Series comparison

-[PULL 00/30] riscv-to-apply queue
+[PULL 00/54] riscv-to-apply queue
-The following changes since commit 9435a8b3dd35f1f926f1b9127e8a906217a5518a:
+The following changes since commit fcb237e64f9d026c03d635579c7b288d0008a6e5:
-  Merge remote-tracking branch 'remotes/kraxel/tags/sirius/ipxe-20200908-pull-request' into staging (2020-09-08 21:21:13 +0100)
+  Merge tag 'pull-vfio-20230710' of https://github.com/legoater/qemu into staging (2023-07-10 09:17:06 +0100)
 are available in the Git repository at:
-  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20200910
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230710-1
-for you to fetch changes up to 7595a65818ea9b49c36650a8c217a1ef9bd6e62a:
+for you to fetch changes up to a47842d16653b4f73b5d56ff0c252dd8a329481b:
-  hw/riscv: Sort the Kconfig options in alphabetical order (2020-09-09 15:54:19 -0700)
+  riscv: Add support for the Zfa extension (2023-07-10 22:29:20 +1000)
 ----------------------------------------------------------------
-This PR includes multiple fixes and features for RISC-V:
+Third RISC-V PR for 8.1
- - Fixes a bug in printing trap causes
- - Allows 16-bit writes to the SiFive test device. This fixes the
+* Use xl instead of mxl for disassemble
-   failure to reboot the RISC-V virt machine
+* Factor out extension tests to cpu_cfg.h
- - Support for the Microchip PolarFire SoC and Icicle Kit
+* disas/riscv: Add vendor extension support
- - A reafactor of RISC-V code out of hw/riscv
+* disas/riscv: Add support for XVentanaCondOps
 * disas/riscv: Add support for XThead* instructions
 * Fix mstatus related problems
 * Fix veyron-v1 CPU properties
 * Fix the xlen for data address when MPRV=1
 * opensbi: Upgrade from v1.2 to v1.3
 * Enable 32-bit Spike OpenSBI boot testing
 * Support the watchdog timer of HiFive 1 rev b
 * Only build qemu-system-riscv$$ on rv$$ host
 * Add RVV registers to log
 * Restrict ACLINT to TCG
 * Add syscall riscv_hwprobe
 * Add support for BF16 extensions
 * KVM_RISCV_SET_TIMER macro is not configured correctly
 * Generate devicetree only after machine initialization is complete
 * virt: Convert fdt_load_addr to uint64_t
 * KVM: fixes and enhancements
 * Add support for the Zfa extension
 ----------------------------------------------------------------
-Bin Meng (28):
+Bin Meng (2):
-      target/riscv: cpu: Add a new 'resetvec' property
+      roms/opensbi: Upgrade from v1.2 to v1.3
-      hw/riscv: hart: Add a new 'resetvec' property
+      tests/avocado: riscv: Enable 32-bit Spike OpenSBI boot testing
       target/riscv: cpu: Set reset vector based on the configured property value
       hw/riscv: Initial support for Microchip PolarFire SoC Icicle Kit board
       hw/char: Add Microchip PolarFire SoC MMUART emulation
       hw/riscv: microchip_pfsoc: Connect 5 MMUARTs
       hw/sd: Add Cadence SDHCI emulation
       hw/riscv: microchip_pfsoc: Connect a Cadence SDHCI controller and an SD card
       hw/dma: Add SiFive platform DMA controller emulation
       hw/riscv: microchip_pfsoc: Connect a DMA controller
       hw/net: cadence_gem: Add a new 'phy-addr' property
       hw/arm: xlnx: Set all boards' GEM 'phy-addr' property value to 23
       hw/riscv: microchip_pfsoc: Connect 2 Cadence GEMs
       hw/riscv: microchip_pfsoc: Hook GPIO controllers
       hw/riscv: clint: Avoid using hard-coded timebase frequency
       hw/riscv: sifive_u: Connect a DMA controller
       hw/riscv: Move sifive_e_prci model to hw/misc
       hw/riscv: Move sifive_u_prci model to hw/misc
       hw/riscv: Move sifive_u_otp model to hw/misc
       hw/riscv: Move sifive_gpio model to hw/gpio
       hw/riscv: Move sifive_clint model to hw/intc
       hw/riscv: Move sifive_plic model to hw/intc
       hw/riscv: Move riscv_htif model to hw/char
       hw/riscv: Move sifive_uart model to hw/char
       hw/riscv: Move sifive_test model to hw/misc
       hw/riscv: Always build riscv_hart.c
       hw/riscv: Drop CONFIG_SIFIVE
       hw/riscv: Sort the Kconfig options in alphabetical order
-Nathan Chancellor (1):
+Christoph Müllner (8):
-      riscv: sifive_test: Allow 16-bit writes to memory region
+      target/riscv: Factor out extension tests to cpu_cfg.h
       disas/riscv: Move types/constants to new header file
       disas/riscv: Make rv_op_illegal a shared enum value
       disas/riscv: Encapsulate opcode_data into decode
       disas/riscv: Provide infrastructure for vendor extensions
       disas/riscv: Add support for XVentanaCondOps
       disas/riscv: Add support for XThead* instructions
       riscv: Add support for the Zfa extension
-Yifei Jiang (1):
+Daniel Henrique Barboza (20):
-      target/riscv: Fix bug in getting trap cause name for trace_riscv_trap
+      target/riscv/cpu.c: fix veyron-v1 CPU properties
       target/riscv: skip features setup for KVM CPUs
       hw/riscv/virt.c: skip 'mmu-type' FDT if satp mode not set
       target/riscv/cpu.c: restrict 'mvendorid' value
       target/riscv/cpu.c: restrict 'mimpid' value
       target/riscv/cpu.c: restrict 'marchid' value
       target/riscv: use KVM scratch CPUs to init KVM properties
       target/riscv: read marchid/mimpid in kvm_riscv_init_machine_ids()
       target/riscv: handle mvendorid/marchid/mimpid for KVM CPUs
       target/riscv/kvm.c: init 'misa_ext_mask' with scratch CPU
       target/riscv/cpu: add misa_ext_info_arr[]
       target/riscv: add KVM specific MISA properties
       target/riscv/kvm.c: update KVM MISA bits
       target/riscv/kvm.c: add multi-letter extension KVM properties
       target/riscv/cpu.c: add satp_mode properties earlier
       target/riscv/cpu.c: remove priv_ver check from riscv_isa_string_ext()
       target/riscv/cpu.c: create KVM mock properties
       target/riscv: update multi-letter extension KVM properties
       target/riscv/kvm.c: add kvmconfig_get_cfg_addr() helper
       target/riscv/kvm.c: read/write (cbom|cboz)_blocksize in KVM
- default-configs/riscv64-softmmu.mak         |   1 +
+Guenter Roeck (1):
- {include/hw/riscv => hw/intc}/sifive_plic.h |   0
+      riscv: Generate devicetree only after machine initialization is complete
  hw/riscv/trace.h                            |   1 -
  include/hw/char/mchp_pfsoc_mmuart.h         |  61 ++++
  include/hw/{riscv => char}/riscv_htif.h     |   0
  include/hw/{riscv => char}/sifive_uart.h    |   0
  include/hw/dma/sifive_pdma.h                |  57 ++++
  include/hw/{riscv => gpio}/sifive_gpio.h    |   0
  include/hw/{riscv => intc}/sifive_clint.h   |   4 +-
  include/hw/{riscv => misc}/sifive_e_prci.h  |   0
  include/hw/{riscv => misc}/sifive_test.h    |   0
  include/hw/{riscv => misc}/sifive_u_otp.h   |   0
  include/hw/{riscv => misc}/sifive_u_prci.h  |   0
  include/hw/net/cadence_gem.h                |   2 +
  include/hw/riscv/microchip_pfsoc.h          | 133 +++++++++
  include/hw/riscv/riscv_hart.h               |   1 +
  include/hw/riscv/sifive_e.h                 |   2 +-
  include/hw/riscv/sifive_u.h                 |  17 +-
  include/hw/sd/cadence_sdhci.h               |  47 +++
  target/riscv/cpu.h                          |   8 +-
  hw/arm/xilinx_zynq.c                        |   1 +
  hw/arm/xlnx-versal.c                        |   1 +
  hw/arm/xlnx-zynqmp.c                        |   2 +
  hw/char/mchp_pfsoc_mmuart.c                 |  86 ++++++
  hw/{riscv => char}/riscv_htif.c             |   2 +-
  hw/{riscv => char}/sifive_uart.c            |   2 +-
  hw/dma/sifive_pdma.c                        | 313 ++++++++++++++++++++
  hw/{riscv => gpio}/sifive_gpio.c            |   2 +-
  hw/{riscv => intc}/sifive_clint.c           |  28 +-
  hw/{riscv => intc}/sifive_plic.c            |   2 +-
  hw/{riscv => misc}/sifive_e_prci.c          |   2 +-
  hw/{riscv => misc}/sifive_test.c            |   4 +-
  hw/{riscv => misc}/sifive_u_otp.c           |   2 +-
  hw/{riscv => misc}/sifive_u_prci.c          |   2 +-
  hw/net/cadence_gem.c                        |   7 +-
  hw/riscv/microchip_pfsoc.c                  | 437 ++++++++++++++++++++++++++++
  hw/riscv/opentitan.c                        |   1 +
  hw/riscv/riscv_hart.c                       |   3 +
  hw/riscv/sifive_e.c                         |  12 +-
  hw/riscv/sifive_u.c                         |  41 ++-
  hw/riscv/spike.c                            |   7 +-
  hw/riscv/virt.c                             |   9 +-
  hw/sd/cadence_sdhci.c                       | 193 ++++++++++++
  target/riscv/cpu.c                          |  19 +-
  target/riscv/cpu_helper.c                   |   8 +-
  target/riscv/csr.c                          |   4 +-
  MAINTAINERS                                 |   9 +
  hw/char/Kconfig                             |   9 +
  hw/char/meson.build                         |   3 +
  hw/dma/Kconfig                              |   3 +
  hw/dma/meson.build                          |   1 +
  hw/gpio/Kconfig                             |   3 +
  hw/gpio/meson.build                         |   1 +
  hw/gpio/trace-events                        |   6 +
  hw/intc/Kconfig                             |   6 +
  hw/intc/meson.build                         |   2 +
  hw/misc/Kconfig                             |  12 +
  hw/misc/meson.build                         |   6 +
  hw/riscv/Kconfig                            |  70 +++--
  hw/riscv/meson.build                        |  12 +-
  hw/riscv/trace-events                       |   7 -
  hw/sd/Kconfig                               |   4 +
  hw/sd/meson.build                           |   1 +
  meson.build                                 |   1 -
 files changed, 1575 insertions(+), 105 deletions(-)
  rename {include/hw/riscv => hw/intc}/sifive_plic.h (100%)
  delete mode 100644 hw/riscv/trace.h
  create mode 100644 include/hw/char/mchp_pfsoc_mmuart.h
  rename include/hw/{riscv => char}/riscv_htif.h (100%)
  rename include/hw/{riscv => char}/sifive_uart.h (100%)
  create mode 100644 include/hw/dma/sifive_pdma.h
  rename include/hw/{riscv => gpio}/sifive_gpio.h (100%)
  rename include/hw/{riscv => intc}/sifive_clint.h (92%)
  rename include/hw/{riscv => misc}/sifive_e_prci.h (100%)
  rename include/hw/{riscv => misc}/sifive_test.h (100%)
  rename include/hw/{riscv => misc}/sifive_u_otp.h (100%)
  rename include/hw/{riscv => misc}/sifive_u_prci.h (100%)
  create mode 100644 include/hw/riscv/microchip_pfsoc.h
  create mode 100644 include/hw/sd/cadence_sdhci.h
  create mode 100644 hw/char/mchp_pfsoc_mmuart.c
  rename hw/{riscv => char}/riscv_htif.c (99%)
  rename hw/{riscv => char}/sifive_uart.c (99%)
  create mode 100644 hw/dma/sifive_pdma.c
  rename hw/{riscv => gpio}/sifive_gpio.c (99%)
  rename hw/{riscv => intc}/sifive_clint.c (90%)
  rename hw/{riscv => intc}/sifive_plic.c (99%)
  rename hw/{riscv => misc}/sifive_e_prci.c (99%)
  rename hw/{riscv => misc}/sifive_test.c (97%)
  rename hw/{riscv => misc}/sifive_u_otp.c (99%)
  rename hw/{riscv => misc}/sifive_u_prci.c (99%)
  create mode 100644 hw/riscv/microchip_pfsoc.c
  create mode 100644 hw/sd/cadence_sdhci.c
  delete mode 100644 hw/riscv/trace-events
+Ivan Klokov (1):
+      target/riscv: Add RVV registers to log
+Jason Chien (1):
+      target/riscv: Set the correct exception for implict G-stage translation fail
+LIU Zhiwei (1):
+      target/riscv: Use xl instead of mxl for disassemble
+Lakshmi Bai Raja Subramanian (1):
+      hw/riscv: virt: Convert fdt_load_addr to uint64_t
+Philippe Mathieu-Daudé (3):
+      target/riscv: Only unify 'riscv32/64' -> 'riscv' for host cpu in meson
+      target/riscv: Only build KVM guest with same wordsize as host
+      hw/riscv/virt: Restrict ACLINT to TCG
+Robbin Ehn (1):
+      linux-user/riscv: Add syscall riscv_hwprobe
+Tommy Wu (3):
+      hw/misc: sifive_e_aon: Support the watchdog timer of HiFive 1 rev b.
+      hw/riscv: sifive_e: Support the watchdog timer of HiFive 1 rev b.
+      tests/qtest: sifive-e-aon-watchdog-test.c: Add QTest of watchdog of sifive_e
+Weiwei Li (11):
+      target/riscv: Make MPV only work when MPP != PRV_M
+      target/riscv: Support MSTATUS.MPV/GVA only when RVH is enabled
+      target/riscv: Remove redundant assignment to SXL
+      target/riscv: Add additional xlen for address when MPRV=1
+      target/riscv: update cur_pmbase/pmmask based on mode affected by MPRV
+      target/riscv: Add properties for BF16 extensions
+      target/riscv: Add support for Zfbfmin extension
+      target/riscv: Add support for Zvfbfmin extension
+      target/riscv: Add support for Zvfbfwma extension
+      target/riscv: Expose properties for BF16 extensions
+      target/riscv: Add disas support for BF16 extensions
+yang.zhang (1):
+      target/riscv KVM_RISCV_SET_TIMER macro is not configured correctly
+ docs/system/riscv/virt.rst                     |   1 +
+ meson.build                                    |  15 +-
+ disas/riscv-xthead.h                           |  28 +
+ disas/riscv-xventana.h                         |  18 +
+ disas/riscv.h                                  | 302 +++++++++++
+ include/hw/misc/sifive_e_aon.h                 |  60 +++
+ include/hw/riscv/sifive_e.h                    |   9 +-
+ linux-user/riscv/syscall32_nr.h                |   1 +
+ linux-user/riscv/syscall64_nr.h                |   1 +
+ target/riscv/cpu.h                             |  56 +-
+ target/riscv/cpu_cfg.h                         |  41 ++
+ target/riscv/helper.h                          |  29 +
+ target/riscv/kvm_riscv.h                       |   1 +
+ target/riscv/insn32.decode                     |  38 ++
+ disas/riscv-xthead.c                           | 707 +++++++++++++++++++++++++
+ disas/riscv-xventana.c                         |  41 ++
+ disas/riscv.c                                  | 559 +++++++++----------
+ hw/misc/sifive_e_aon.c                         | 319 +++++++++++
+ hw/riscv/sifive_e.c                            |  17 +-
+ hw/riscv/virt.c                                |  56 +-
+ linux-user/syscall.c                           | 146 +++++
+ target/riscv/cpu.c                             | 439 +++++++++++++--
+ target/riscv/cpu_helper.c                      |  12 +-
+ target/riscv/csr.c                             |  41 +-
+ target/riscv/fpu_helper.c                      | 166 ++++++
+ target/riscv/kvm.c                             | 501 +++++++++++++++++-
+ target/riscv/op_helper.c                       |   3 +-
+ target/riscv/translate.c                       |  42 +-
+ target/riscv/vector_helper.c                   |  17 +
+ tests/qtest/sifive-e-aon-watchdog-test.c       | 450 ++++++++++++++++
+ tests/tcg/riscv64/test-fcvtmod.c               | 345 ++++++++++++
+ target/riscv/insn_trans/trans_rvbf16.c.inc     | 175 ++++++
+ target/riscv/insn_trans/trans_rvzfa.c.inc      | 521 ++++++++++++++++++
+ target/riscv/insn_trans/trans_rvzfh.c.inc      |  12 +-
+ disas/meson.build                              |   6 +-
+ hw/misc/Kconfig                                |   3 +
+ hw/misc/meson.build                            |   1 +
+ hw/riscv/Kconfig                               |   1 +
+ pc-bios/opensbi-riscv32-generic-fw_dynamic.bin | Bin 123072 -> 135344 bytes
+ pc-bios/opensbi-riscv64-generic-fw_dynamic.bin | Bin 121800 -> 138304 bytes
+ roms/opensbi                                   |   2 +-
+ tests/avocado/riscv_opensbi.py                 |   2 -
+ tests/qtest/meson.build                        |   3 +
+ tests/tcg/riscv64/Makefile.target              |   6 +
+files changed, 4751 insertions(+), 442 deletions(-)
+ create mode 100644 disas/riscv-xthead.h
+ create mode 100644 disas/riscv-xventana.h
+ create mode 100644 disas/riscv.h
+ create mode 100644 include/hw/misc/sifive_e_aon.h
+ create mode 100644 disas/riscv-xthead.c
+ create mode 100644 disas/riscv-xventana.c
+ create mode 100644 hw/misc/sifive_e_aon.c
+ create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c
+ create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
+ create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc
+ create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc

-[PULL 30/30] hw/riscv: Sort the Kconfig options in alphabetical order
+[PULL 01/54] target/riscv: Use xl instead of mxl for disassemble
-From: Bin Meng <bin.meng@windriver.com>
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-At present the Kconfig file is in disorder. Let's sort the options.
+Disassemble function(plugin_disas, target_disas, monitor_disas) will
 always call set_disas_info before disassembling instructions.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+plugin_disas  and target_disas will always be called under a TB, which
 has the same XLEN.
 We can't ensure that monitor_disas will always be called under a TB,
 but current XLEN will still be a better choice, thus we can ensure at
 least the disassemble of the nearest one TB is right.
 Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1599129623-68957-13-git-send-email-bmeng.cn@gmail.com>
+Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-Id: <20230612111034.3955227-2-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/Kconfig | 58 ++++++++++++++++++++++++------------------------
+ target/riscv/cpu.c | 3 ++-
-file changed, 29 insertions(+), 29 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/Kconfig
+--- a/target/riscv/cpu.c
-+++ b/hw/riscv/Kconfig
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
- config IBEX
+ static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
-     bool
+ {
+     RISCVCPU *cpu = RISCV_CPU(s);
--config SIFIVE_E
++    CPURISCVState *env = &cpu->env;
--    bool
+     info->target_info = &cpu->cfg;
--    select MSI_NONBROKEN
--    select SIFIVE_CLINT
+-    switch (riscv_cpu_mxl(&cpu->env)) {
--    select SIFIVE_GPIO
++    switch (env->xl) {
--    select SIFIVE_PLIC
+     case MXL_RV32:
--    select SIFIVE_UART
+         info->print_insn = print_insn_riscv32;
--    select SIFIVE_E_PRCI
+         break;
 -    select UNIMP
 -
 -config SIFIVE_U
 +config MICROCHIP_PFSOC
      bool
 -    select CADENCE
 +    select CADENCE_SDHCI
 +    select MCHP_PFSOC_MMUART
      select MSI_NONBROKEN
      select SIFIVE_CLINT
 -    select SIFIVE_GPIO
      select SIFIVE_PDMA
      select SIFIVE_PLIC
 -    select SIFIVE_UART
 -    select SIFIVE_U_OTP
 -    select SIFIVE_U_PRCI
      select UNIMP
 -config SPIKE
 -    bool
 -    select HTIF
 -    select MSI_NONBROKEN
 -    select SIFIVE_CLINT
 -    select SIFIVE_PLIC
 -
  config OPENTITAN
      bool
      select IBEX
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      bool
      imply PCI_DEVICES
      imply TEST_DEVICES
 +    select GOLDFISH_RTC
      select MSI_NONBROKEN
      select PCI
 -    select SERIAL
 -    select GOLDFISH_RTC
 -    select VIRTIO_MMIO
      select PCI_EXPRESS_GENERIC_BRIDGE
      select PFLASH_CFI01
 +    select SERIAL
      select SIFIVE_CLINT
      select SIFIVE_PLIC
      select SIFIVE_TEST
 +    select VIRTIO_MMIO
 -config MICROCHIP_PFSOC
 +config SIFIVE_E
      bool
      select MSI_NONBROKEN
      select SIFIVE_CLINT
 +    select SIFIVE_GPIO
 +    select SIFIVE_PLIC
 +    select SIFIVE_UART
 +    select SIFIVE_E_PRCI
      select UNIMP
 -    select MCHP_PFSOC_MMUART
 +
 +config SIFIVE_U
 +    bool
 +    select CADENCE
 +    select MSI_NONBROKEN
 +    select SIFIVE_CLINT
 +    select SIFIVE_GPIO
      select SIFIVE_PDMA
      select SIFIVE_PLIC
 -    select CADENCE_SDHCI
 +    select SIFIVE_UART
 +    select SIFIVE_U_OTP
 +    select SIFIVE_U_PRCI
 +    select UNIMP
 +
 +config SPIKE
 +    bool
 +    select HTIF
 +    select MSI_NONBROKEN
 +    select SIFIVE_CLINT
 +    select SIFIVE_PLIC
 --
-.28.0
+.40.1

-[PULL 14/30] hw/arm: xlnx: Set all boards' GEM 'phy-addr' property value to 23
+[PULL 02/54] target/riscv: Factor out extension tests to cpu_cfg.h
-From: Bin Meng <bin.meng@windriver.com>
+From: Christoph Müllner <christoph.muellner@vrull.eu>
-When cadence_gem model was created for Xilinx boards, the PHY address
+This patch moves the extension test functions that are used
-was hard-coded to 23 in the GEM model. Now that we have introduced a
+to gate vendor extension decoders, into cpu_cfg.h.
-property we can use that to tell GEM model what our PHY address is.
+This allows to reuse them in the disassembler.
 Change all boards' GEM 'phy-addr' property value to 23, and set the
 PHY address default value to 0 in the GEM model.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+This patch does not introduce new functionality.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+However, the patch includes a small change:
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+The parameter for the extension test functions has been changed
-Message-Id: <1598924352-89526-13-git-send-email-bmeng.cn@gmail.com>
+from 'DisasContext*' to 'const RISCVCPUConfig*' to keep
 the code in cpu_cfg.h self-contained.
 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Message-Id: <20230612111034.3955227-3-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/arm/xilinx_zynq.c | 1 +
+ target/riscv/cpu_cfg.h   | 26 ++++++++++++++++++++++++++
- hw/arm/xlnx-versal.c | 1 +
+ target/riscv/translate.c | 27 ++-------------------------
- hw/arm/xlnx-zynqmp.c | 2 ++
+files changed, 28 insertions(+), 25 deletions(-)
  hw/net/cadence_gem.c | 6 +++---
 files changed, 7 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xilinx_zynq.c
+--- a/target/riscv/cpu_cfg.h
-+++ b/hw/arm/xilinx_zynq.c
++++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ static void gem_init(NICInfo *nd, uint32_t base, qemu_irq irq)
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-         qemu_check_nic_model(nd, TYPE_CADENCE_GEM);
+ };
-         qdev_set_nic_properties(dev, nd);
-     }
+ typedef struct RISCVCPUConfig RISCVCPUConfig;
-+    object_property_set_int(OBJECT(dev), "phy-addr", 23, &error_abort);
++
-     s = SYS_BUS_DEVICE(dev);
++/* Helper functions to test for extensions.  */
-     sysbus_realize_and_unref(s, &error_fatal);
++
-     sysbus_mmio_map(s, 0, base);
++static inline bool always_true_p(const RISCVCPUConfig *cfg __attribute__((__unused__)))
-diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
++{
 +    return true;
 +}
 +
 +static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
 +{
 +    return cfg->ext_xtheadba || cfg->ext_xtheadbb ||
 +           cfg->ext_xtheadbs || cfg->ext_xtheadcmo ||
 +           cfg->ext_xtheadcondmov ||
 +           cfg->ext_xtheadfmemidx || cfg->ext_xtheadfmv ||
 +           cfg->ext_xtheadmac || cfg->ext_xtheadmemidx ||
 +           cfg->ext_xtheadmempair || cfg->ext_xtheadsync;
 +}
 +
 +#define MATERIALISE_EXT_PREDICATE(ext) \
 +    static inline bool has_ ## ext ## _p(const RISCVCPUConfig *cfg) \
 +    { \
 +        return cfg->ext_ ## ext ; \
 +    }
 +
 +MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
 +
  #endif
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-versal.c
+--- a/target/riscv/translate.c
-+++ b/hw/arm/xlnx-versal.c
++++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static void versal_create_gems(Versal *s, qemu_irq *pic)
+@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
-             qemu_check_nic_model(nd, "cadence_gem");
+     return ctx->misa_ext & ext;
-             qdev_set_nic_properties(dev, nd);
+ }
-         }
-+        object_property_set_int(OBJECT(dev), "phy-addr", 23, &error_abort);
+-static bool always_true_p(DisasContext *ctx  __attribute__((__unused__)))
-         object_property_set_int(OBJECT(dev), "num-priority-queues", 2,
+-{
-                                 &error_abort);
+-    return true;
-         object_property_set_link(OBJECT(dev), "dma", OBJECT(&s->mr_ps),
+-}
-diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
+-
-index XXXXXXX..XXXXXXX 100644
+-static bool has_xthead_p(DisasContext *ctx  __attribute__((__unused__)))
---- a/hw/arm/xlnx-zynqmp.c
+-{
-+++ b/hw/arm/xlnx-zynqmp.c
+-    return ctx->cfg_ptr->ext_xtheadba || ctx->cfg_ptr->ext_xtheadbb ||
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
+-           ctx->cfg_ptr->ext_xtheadbs || ctx->cfg_ptr->ext_xtheadcmo ||
-         }
+-           ctx->cfg_ptr->ext_xtheadcondmov ||
-         object_property_set_int(OBJECT(&s->gem[i]), "revision", GEM_REVISION,
+-           ctx->cfg_ptr->ext_xtheadfmemidx || ctx->cfg_ptr->ext_xtheadfmv ||
-                                 &error_abort);
+-           ctx->cfg_ptr->ext_xtheadmac || ctx->cfg_ptr->ext_xtheadmemidx ||
-+        object_property_set_int(OBJECT(&s->gem[i]), "phy-addr", 23,
+-           ctx->cfg_ptr->ext_xtheadmempair || ctx->cfg_ptr->ext_xtheadsync;
-+                                &error_abort);
+-}
-         object_property_set_int(OBJECT(&s->gem[i]), "num-priority-queues", 2,
+-
-                                 &error_abort);
+-#define MATERIALISE_EXT_PREDICATE(ext)  \
-         if (!sysbus_realize(SYS_BUS_DEVICE(&s->gem[i]), errp)) {
+-    static bool has_ ## ext ## _p(DisasContext *ctx)    \
-diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+-    { \
-index XXXXXXX..XXXXXXX 100644
+-        return ctx->cfg_ptr->ext_ ## ext ; \
---- a/hw/net/cadence_gem.c
+-    }
-+++ b/hw/net/cadence_gem.c
+-
-@@ -XXX,XX +XXX,XX @@
+-MATERIALISE_EXT_PREDICATE(XVentanaCondOps);
- #define GEM_PHYMNTNC_REG_SHIFT 18
+-
+ #ifdef TARGET_RISCV32
- /* Marvell PHY definitions */
+ #define get_xl(ctx)    MXL_RV32
--#define BOARD_PHY_ADDRESS    23 /* PHY address we will emulate a device at */
+ #elif defined(CONFIG_USER_ONLY)
-+#define BOARD_PHY_ADDRESS    0 /* PHY address we will emulate a device at */
+@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
+      * that are tested in-order until a decoder matches onto the opcode.
- #define PHY_REG_CONTROL      0
+      */
- #define PHY_REG_STATUS       1
+     static const struct {
-@@ -XXX,XX +XXX,XX @@ static uint64_t gem_read(void *opaque, hwaddr offset, unsigned size)
+-        bool (*guard_func)(DisasContext *);
-             uint32_t phy_addr, reg_num;
++        bool (*guard_func)(const RISCVCPUConfig *);
+         bool (*decode_func)(DisasContext *, uint32_t);
-             phy_addr = (retval & GEM_PHYMNTNC_ADDR) >> GEM_PHYMNTNC_ADDR_SHFT;
+     } decoders[] = {
--            if (phy_addr == s->phy_addr || phy_addr == 0) {
+         { always_true_p,  decode_insn32 },
-+            if (phy_addr == s->phy_addr) {
+@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
-                 reg_num = (retval & GEM_PHYMNTNC_REG) >> GEM_PHYMNTNC_REG_SHIFT;
+         ctx->opcode = opcode32;
-                 retval &= 0xFFFF0000;
-                 retval |= gem_phy_read(s, reg_num);
+         for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
-@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
+-            if (decoders[i].guard_func(ctx) &&
-             uint32_t phy_addr, reg_num;
++            if (decoders[i].guard_func(ctx->cfg_ptr) &&
+                 decoders[i].decode_func(ctx, opcode32)) {
-             phy_addr = (val & GEM_PHYMNTNC_ADDR) >> GEM_PHYMNTNC_ADDR_SHFT;
+                 return;
 -            if (phy_addr == s->phy_addr || phy_addr == 0) {
 +            if (phy_addr == s->phy_addr) {
                  reg_num = (val & GEM_PHYMNTNC_REG) >> GEM_PHYMNTNC_REG_SHIFT;
                  gem_phy_write(s, reg_num, val);
              }
 --
-.28.0
+.40.1

-[PULL 20/30] hw/riscv: Move sifive_u_prci model to hw/misc
+[PULL 03/54] disas/riscv: Move types/constants to new header file
-From: Bin Meng <bin.meng@windriver.com>
+From: Christoph Müllner <christoph.muellner@vrull.eu>
-This is an effort to clean up the hw/riscv directory. Ideally it
+In order to enable vendor disassembler support, we need to
-should only contain the RISC-V SoC / machine codes plus generic
+move types and constants into a header file so that other
-codes. Let's move sifive_u_prci model to hw/misc directory.
+compilation units can use them as well.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+This patch does not introduce any functional changes.
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1599129623-68957-3-git-send-email-bmeng.cn@gmail.com>
+Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-Id: <20230612111034.3955227-4-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/{riscv => misc}/sifive_u_prci.h | 0
+ disas/riscv.h | 282 ++++++++++++++++++++++++++++++++++++++++++++++++++
- include/hw/riscv/sifive_u.h                | 2 +-
+ disas/riscv.c | 270 +----------------------------------------------
- hw/{riscv => misc}/sifive_u_prci.c         | 2 +-
+files changed, 283 insertions(+), 269 deletions(-)
- hw/misc/Kconfig                            | 3 +++
+ create mode 100644 disas/riscv.h
  hw/misc/meson.build                        | 1 +
  hw/riscv/Kconfig                           | 1 +
  hw/riscv/meson.build                       | 1 -
 files changed, 7 insertions(+), 3 deletions(-)
  rename include/hw/{riscv => misc}/sifive_u_prci.h (100%)
  rename hw/{riscv => misc}/sifive_u_prci.c (99%)
-diff --git a/include/hw/riscv/sifive_u_prci.h b/include/hw/misc/sifive_u_prci.h
+diff --git a/disas/riscv.h b/disas/riscv.h
-similarity index 100%
+new file mode 100644
-rename from include/hw/riscv/sifive_u_prci.h
+index XXXXXXX..XXXXXXX
-rename to include/hw/misc/sifive_u_prci.h
+--- /dev/null
-diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
++++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU disassembler -- RISC-V specific header.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#ifndef DISAS_RISCV_H
 +#define DISAS_RISCV_H
 +
 +#include "qemu/osdep.h"
 +#include "target/riscv/cpu_cfg.h"
 +
 +/* types */
 +
 +typedef uint64_t rv_inst;
 +typedef uint16_t rv_opcode;
 +
 +/* enums */
 +
 +typedef enum {
 +    rv32,
 +    rv64,
 +    rv128
 +} rv_isa;
 +
 +typedef enum {
 +    rv_rm_rne = 0,
 +    rv_rm_rtz = 1,
 +    rv_rm_rdn = 2,
 +    rv_rm_rup = 3,
 +    rv_rm_rmm = 4,
 +    rv_rm_dyn = 7,
 +} rv_rm;
 +
 +typedef enum {
 +    rv_fence_i = 8,
 +    rv_fence_o = 4,
 +    rv_fence_r = 2,
 +    rv_fence_w = 1,
 +} rv_fence;
 +
 +typedef enum {
 +    rv_ireg_zero,
 +    rv_ireg_ra,
 +    rv_ireg_sp,
 +    rv_ireg_gp,
 +    rv_ireg_tp,
 +    rv_ireg_t0,
 +    rv_ireg_t1,
 +    rv_ireg_t2,
 +    rv_ireg_s0,
 +    rv_ireg_s1,
 +    rv_ireg_a0,
 +    rv_ireg_a1,
 +    rv_ireg_a2,
 +    rv_ireg_a3,
 +    rv_ireg_a4,
 +    rv_ireg_a5,
 +    rv_ireg_a6,
 +    rv_ireg_a7,
 +    rv_ireg_s2,
 +    rv_ireg_s3,
 +    rv_ireg_s4,
 +    rv_ireg_s5,
 +    rv_ireg_s6,
 +    rv_ireg_s7,
 +    rv_ireg_s8,
 +    rv_ireg_s9,
 +    rv_ireg_s10,
 +    rv_ireg_s11,
 +    rv_ireg_t3,
 +    rv_ireg_t4,
 +    rv_ireg_t5,
 +    rv_ireg_t6,
 +} rv_ireg;
 +
 +typedef enum {
 +    rvc_end,
 +    rvc_rd_eq_ra,
 +    rvc_rd_eq_x0,
 +    rvc_rs1_eq_x0,
 +    rvc_rs2_eq_x0,
 +    rvc_rs2_eq_rs1,
 +    rvc_rs1_eq_ra,
 +    rvc_imm_eq_zero,
 +    rvc_imm_eq_n1,
 +    rvc_imm_eq_p1,
 +    rvc_csr_eq_0x001,
 +    rvc_csr_eq_0x002,
 +    rvc_csr_eq_0x003,
 +    rvc_csr_eq_0xc00,
 +    rvc_csr_eq_0xc01,
 +    rvc_csr_eq_0xc02,
 +    rvc_csr_eq_0xc80,
 +    rvc_csr_eq_0xc81,
 +    rvc_csr_eq_0xc82,
 +} rvc_constraint;
 +
 +typedef enum {
 +    rv_codec_illegal,
 +    rv_codec_none,
 +    rv_codec_u,
 +    rv_codec_uj,
 +    rv_codec_i,
 +    rv_codec_i_sh5,
 +    rv_codec_i_sh6,
 +    rv_codec_i_sh7,
 +    rv_codec_i_csr,
 +    rv_codec_s,
 +    rv_codec_sb,
 +    rv_codec_r,
 +    rv_codec_r_m,
 +    rv_codec_r4_m,
 +    rv_codec_r_a,
 +    rv_codec_r_l,
 +    rv_codec_r_f,
 +    rv_codec_cb,
 +    rv_codec_cb_imm,
 +    rv_codec_cb_sh5,
 +    rv_codec_cb_sh6,
 +    rv_codec_ci,
 +    rv_codec_ci_sh5,
 +    rv_codec_ci_sh6,
 +    rv_codec_ci_16sp,
 +    rv_codec_ci_lwsp,
 +    rv_codec_ci_ldsp,
 +    rv_codec_ci_lqsp,
 +    rv_codec_ci_li,
 +    rv_codec_ci_lui,
 +    rv_codec_ci_none,
 +    rv_codec_ciw_4spn,
 +    rv_codec_cj,
 +    rv_codec_cj_jal,
 +    rv_codec_cl_lw,
 +    rv_codec_cl_ld,
 +    rv_codec_cl_lq,
 +    rv_codec_cr,
 +    rv_codec_cr_mv,
 +    rv_codec_cr_jalr,
 +    rv_codec_cr_jr,
 +    rv_codec_cs,
 +    rv_codec_cs_sw,
 +    rv_codec_cs_sd,
 +    rv_codec_cs_sq,
 +    rv_codec_css_swsp,
 +    rv_codec_css_sdsp,
 +    rv_codec_css_sqsp,
 +    rv_codec_k_bs,
 +    rv_codec_k_rnum,
 +    rv_codec_v_r,
 +    rv_codec_v_ldst,
 +    rv_codec_v_i,
 +    rv_codec_vsetvli,
 +    rv_codec_vsetivli,
 +    rv_codec_zcb_ext,
 +    rv_codec_zcb_mul,
 +    rv_codec_zcb_lb,
 +    rv_codec_zcb_lh,
 +    rv_codec_zcmp_cm_pushpop,
 +    rv_codec_zcmp_cm_mv,
 +    rv_codec_zcmt_jt,
 +} rv_codec;
 +
 +/* structures */
 +
 +typedef struct {
 +    RISCVCPUConfig *cfg;
 +    uint64_t  pc;
 +    uint64_t  inst;
 +    int32_t   imm;
 +    uint16_t  op;
 +    uint8_t   codec;
 +    uint8_t   rd;
 +    uint8_t   rs1;
 +    uint8_t   rs2;
 +    uint8_t   rs3;
 +    uint8_t   rm;
 +    uint8_t   pred;
 +    uint8_t   succ;
 +    uint8_t   aq;
 +    uint8_t   rl;
 +    uint8_t   bs;
 +    uint8_t   rnum;
 +    uint8_t   vm;
 +    uint32_t  vzimm;
 +    uint8_t   rlist;
 +} rv_decode;
 +
 +typedef struct {
 +    const int op;
 +    const rvc_constraint *constraints;
 +} rv_comp_data;
 +
 +enum {
 +    rvcd_imm_nz = 0x1
 +};
 +
 +typedef struct {
 +    const char * const name;
 +    const rv_codec codec;
 +    const char * const format;
 +    const rv_comp_data *pseudo;
 +    const short decomp_rv32;
 +    const short decomp_rv64;
 +    const short decomp_rv128;
 +    const short decomp_data;
 +} rv_opcode_data;
 +
 +/* instruction formats */
 +
 +#define rv_fmt_none                   "O\t"
 +#define rv_fmt_rs1                    "O\t1"
 +#define rv_fmt_offset                 "O\to"
 +#define rv_fmt_pred_succ              "O\tp,s"
 +#define rv_fmt_rs1_rs2                "O\t1,2"
 +#define rv_fmt_rd_imm                 "O\t0,i"
 +#define rv_fmt_rd_offset              "O\t0,o"
 +#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
 +#define rv_fmt_frd_rs1                "O\t3,1"
 +#define rv_fmt_frd_frs1               "O\t3,4"
 +#define rv_fmt_rd_frs1                "O\t0,4"
 +#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
 +#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
 +#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
 +#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
 +#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
 +#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
 +#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
 +#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
 +#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
 +#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
 +#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
 +#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
 +#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
 +#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
 +#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
 +#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
 +#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
 +#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
 +#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
 +#define rv_fmt_rd                     "O\t0"
 +#define rv_fmt_rd_zimm                "O\t0,7"
 +#define rv_fmt_rd_rs1                 "O\t0,1"
 +#define rv_fmt_rd_rs2                 "O\t0,2"
 +#define rv_fmt_rs1_offset             "O\t1,o"
 +#define rv_fmt_rs2_offset             "O\t2,o"
 +#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
 +#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
 +#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
 +#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
 +#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
 +#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
 +#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
 +#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
 +#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
 +#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
 +#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
 +#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
 +#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
 +#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
 +#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
 +#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
 +#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
 +#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
 +#define rv_fmt_vd_vs1                 "O\tD,E"
 +#define rv_fmt_vd_rs1                 "O\tD,1"
 +#define rv_fmt_vd_fs1                 "O\tD,4"
 +#define rv_fmt_vd_imm                 "O\tD,i"
 +#define rv_fmt_vd_vs2                 "O\tD,F"
 +#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
 +#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
 +#define rv_fmt_rd_vs2                 "O\t0,F"
 +#define rv_fmt_fd_vs2                 "O\t3,F"
 +#define rv_fmt_vd_vm                  "O\tDm"
 +#define rv_fmt_vsetvli                "O\t0,1,v"
 +#define rv_fmt_vsetivli               "O\t0,u,v"
 +#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
 +#define rv_fmt_push_rlist             "O\tx,-i"
 +#define rv_fmt_pop_rlist              "O\tx,i"
 +#define rv_fmt_zcmt_index             "O\ti"
 +
 +#endif /* DISAS_RISCV_H */
 diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/sifive_u.h
+--- a/disas/riscv.c
-+++ b/include/hw/riscv/sifive_u.h
++++ b/disas/riscv.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/riscv/riscv_hart.h"
+ #include "qemu/osdep.h"
- #include "hw/riscv/sifive_cpu.h"
+ #include "disas/dis-asm.h"
- #include "hw/riscv/sifive_gpio.h"
+ #include "target/riscv/cpu_cfg.h"
--#include "hw/riscv/sifive_u_prci.h"
+-
- #include "hw/riscv/sifive_u_otp.h"
+-/* types */
-+#include "hw/misc/sifive_u_prci.h"
+-
+-typedef uint64_t rv_inst;
- #define TYPE_RISCV_U_SOC "riscv.sifive.u.soc"
+-typedef uint16_t rv_opcode;
- #define RISCV_U_SOC(obj) \
+-
-diff --git a/hw/riscv/sifive_u_prci.c b/hw/misc/sifive_u_prci.c
+-/* enums */
-similarity index 99%
+-
-rename from hw/riscv/sifive_u_prci.c
+-typedef enum {
-rename to hw/misc/sifive_u_prci.c
+-    rv32,
-index XXXXXXX..XXXXXXX 100644
+-    rv64,
---- a/hw/riscv/sifive_u_prci.c
+-    rv128
-+++ b/hw/misc/sifive_u_prci.c
+-} rv_isa;
-@@ -XXX,XX +XXX,XX @@
+-
- #include "hw/sysbus.h"
+-typedef enum {
- #include "qemu/log.h"
+-    rv_rm_rne = 0,
- #include "qemu/module.h"
+-    rv_rm_rtz = 1,
--#include "hw/riscv/sifive_u_prci.h"
+-    rv_rm_rdn = 2,
-+#include "hw/misc/sifive_u_prci.h"
+-    rv_rm_rup = 3,
+-    rv_rm_rmm = 4,
- static uint64_t sifive_u_prci_read(void *opaque, hwaddr addr, unsigned int size)
+-    rv_rm_dyn = 7,
- {
+-} rv_rm;
-diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
+-
-index XXXXXXX..XXXXXXX 100644
+-typedef enum {
---- a/hw/misc/Kconfig
+-    rv_fence_i = 8,
-+++ b/hw/misc/Kconfig
+-    rv_fence_o = 4,
-@@ -XXX,XX +XXX,XX @@ config AVR_POWER
+-    rv_fence_r = 2,
- config SIFIVE_E_PRCI
+-    rv_fence_w = 1,
-     bool
+-} rv_fence;
+-
-+config SIFIVE_U_PRCI
+-typedef enum {
-+    bool
+-    rv_ireg_zero,
-+
+-    rv_ireg_ra,
- source macio/Kconfig
+-    rv_ireg_sp,
-diff --git a/hw/misc/meson.build b/hw/misc/meson.build
+-    rv_ireg_gp,
-index XXXXXXX..XXXXXXX 100644
+-    rv_ireg_tp,
---- a/hw/misc/meson.build
+-    rv_ireg_t0,
-+++ b/hw/misc/meson.build
+-    rv_ireg_t1,
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_MOS6522', if_true: files('mos6522.c'))
+-    rv_ireg_t2,
+-    rv_ireg_s0,
- # RISC-V devices
+-    rv_ireg_s1,
- softmmu_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
+-    rv_ireg_a0,
-+softmmu_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
+-    rv_ireg_a1,
+-    rv_ireg_a2,
- # PKUnity SoC devices
+-    rv_ireg_a3,
- softmmu_ss.add(when: 'CONFIG_PUV3', if_true: files('puv3_pm.c'))
+-    rv_ireg_a4,
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
+-    rv_ireg_a5,
-index XXXXXXX..XXXXXXX 100644
+-    rv_ireg_a6,
---- a/hw/riscv/Kconfig
+-    rv_ireg_a7,
-+++ b/hw/riscv/Kconfig
+-    rv_ireg_s2,
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
+-    rv_ireg_s3,
-     select HART
+-    rv_ireg_s4,
-     select SIFIVE
+-    rv_ireg_s5,
-     select SIFIVE_PDMA
+-    rv_ireg_s6,
-+    select SIFIVE_U_PRCI
+-    rv_ireg_s7,
-     select UNIMP
+-    rv_ireg_s8,
+-    rv_ireg_s9,
- config SPIKE
+-    rv_ireg_s10,
-diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
+-    rv_ireg_s11,
-index XXXXXXX..XXXXXXX 100644
+-    rv_ireg_t3,
---- a/hw/riscv/meson.build
+-    rv_ireg_t4,
-+++ b/hw/riscv/meson.build
+-    rv_ireg_t5,
-@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
+-    rv_ireg_t6,
- riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
+-} rv_ireg;
- riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
+-
- riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_otp.c'))
+-typedef enum {
--riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_prci.c'))
+-    rvc_end,
- riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('riscv_htif.c'))
+-    rvc_rd_eq_ra,
- riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
+-    rvc_rd_eq_x0,
- riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
+-    rvc_rs1_eq_x0,
 -    rvc_rs2_eq_x0,
 -    rvc_rs2_eq_rs1,
 -    rvc_rs1_eq_ra,
 -    rvc_imm_eq_zero,
 -    rvc_imm_eq_n1,
 -    rvc_imm_eq_p1,
 -    rvc_csr_eq_0x001,
 -    rvc_csr_eq_0x002,
 -    rvc_csr_eq_0x003,
 -    rvc_csr_eq_0xc00,
 -    rvc_csr_eq_0xc01,
 -    rvc_csr_eq_0xc02,
 -    rvc_csr_eq_0xc80,
 -    rvc_csr_eq_0xc81,
 -    rvc_csr_eq_0xc82,
 -} rvc_constraint;
 -
 -typedef enum {
 -    rv_codec_illegal,
 -    rv_codec_none,
 -    rv_codec_u,
 -    rv_codec_uj,
 -    rv_codec_i,
 -    rv_codec_i_sh5,
 -    rv_codec_i_sh6,
 -    rv_codec_i_sh7,
 -    rv_codec_i_csr,
 -    rv_codec_s,
 -    rv_codec_sb,
 -    rv_codec_r,
 -    rv_codec_r_m,
 -    rv_codec_r4_m,
 -    rv_codec_r_a,
 -    rv_codec_r_l,
 -    rv_codec_r_f,
 -    rv_codec_cb,
 -    rv_codec_cb_imm,
 -    rv_codec_cb_sh5,
 -    rv_codec_cb_sh6,
 -    rv_codec_ci,
 -    rv_codec_ci_sh5,
 -    rv_codec_ci_sh6,
 -    rv_codec_ci_16sp,
 -    rv_codec_ci_lwsp,
 -    rv_codec_ci_ldsp,
 -    rv_codec_ci_lqsp,
 -    rv_codec_ci_li,
 -    rv_codec_ci_lui,
 -    rv_codec_ci_none,
 -    rv_codec_ciw_4spn,
 -    rv_codec_cj,
 -    rv_codec_cj_jal,
 -    rv_codec_cl_lw,
 -    rv_codec_cl_ld,
 -    rv_codec_cl_lq,
 -    rv_codec_cr,
 -    rv_codec_cr_mv,
 -    rv_codec_cr_jalr,
 -    rv_codec_cr_jr,
 -    rv_codec_cs,
 -    rv_codec_cs_sw,
 -    rv_codec_cs_sd,
 -    rv_codec_cs_sq,
 -    rv_codec_css_swsp,
 -    rv_codec_css_sdsp,
 -    rv_codec_css_sqsp,
 -    rv_codec_k_bs,
 -    rv_codec_k_rnum,
 -    rv_codec_v_r,
 -    rv_codec_v_ldst,
 -    rv_codec_v_i,
 -    rv_codec_vsetvli,
 -    rv_codec_vsetivli,
 -    rv_codec_zcb_ext,
 -    rv_codec_zcb_mul,
 -    rv_codec_zcb_lb,
 -    rv_codec_zcb_lh,
 -    rv_codec_zcmp_cm_pushpop,
 -    rv_codec_zcmp_cm_mv,
 -    rv_codec_zcmt_jt,
 -} rv_codec;
 +#include "disas/riscv.h"
  typedef enum {
      rv_op_illegal = 0,
@@ -XXX,XX +XXX,XX @@ typedef enum {
      rv_op_czero_nez = 790,
  } rv_op;
 -/* structures */
 -
 -typedef struct {
 -    RISCVCPUConfig *cfg;
 -    uint64_t  pc;
 -    uint64_t  inst;
 -    int32_t   imm;
 -    uint16_t  op;
 -    uint8_t   codec;
 -    uint8_t   rd;
 -    uint8_t   rs1;
 -    uint8_t   rs2;
 -    uint8_t   rs3;
 -    uint8_t   rm;
 -    uint8_t   pred;
 -    uint8_t   succ;
 -    uint8_t   aq;
 -    uint8_t   rl;
 -    uint8_t   bs;
 -    uint8_t   rnum;
 -    uint8_t   vm;
 -    uint32_t  vzimm;
 -    uint8_t   rlist;
 -} rv_decode;
 -
 -typedef struct {
 -    const int op;
 -    const rvc_constraint *constraints;
 -} rv_comp_data;
 -
 -enum {
 -    rvcd_imm_nz = 0x1
 -};
 -
 -typedef struct {
 -    const char * const name;
 -    const rv_codec codec;
 -    const char * const format;
 -    const rv_comp_data *pseudo;
 -    const short decomp_rv32;
 -    const short decomp_rv64;
 -    const short decomp_rv128;
 -    const short decomp_data;
 -} rv_opcode_data;
 -
  /* register names */
  static const char rv_ireg_name_sym[32][5] = {
@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
      "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
  };
 -/* instruction formats */
 -
 -#define rv_fmt_none                   "O\t"
 -#define rv_fmt_rs1                    "O\t1"
 -#define rv_fmt_offset                 "O\to"
 -#define rv_fmt_pred_succ              "O\tp,s"
 -#define rv_fmt_rs1_rs2                "O\t1,2"
 -#define rv_fmt_rd_imm                 "O\t0,i"
 -#define rv_fmt_rd_offset              "O\t0,o"
 -#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
 -#define rv_fmt_frd_rs1                "O\t3,1"
 -#define rv_fmt_frd_frs1               "O\t3,4"
 -#define rv_fmt_rd_frs1                "O\t0,4"
 -#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
 -#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
 -#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
 -#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
 -#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
 -#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
 -#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
 -#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
 -#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
 -#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
 -#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
 -#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
 -#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
 -#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
 -#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
 -#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
 -#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
 -#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
 -#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
 -#define rv_fmt_rd                     "O\t0"
 -#define rv_fmt_rd_zimm                "O\t0,7"
 -#define rv_fmt_rd_rs1                 "O\t0,1"
 -#define rv_fmt_rd_rs2                 "O\t0,2"
 -#define rv_fmt_rs1_offset             "O\t1,o"
 -#define rv_fmt_rs2_offset             "O\t2,o"
 -#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
 -#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
 -#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
 -#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
 -#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
 -#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
 -#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
 -#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
 -#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
 -#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
 -#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
 -#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
 -#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
 -#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
 -#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
 -#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
 -#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
 -#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
 -#define rv_fmt_vd_vs1                 "O\tD,E"
 -#define rv_fmt_vd_rs1                 "O\tD,1"
 -#define rv_fmt_vd_fs1                 "O\tD,4"
 -#define rv_fmt_vd_imm                 "O\tD,i"
 -#define rv_fmt_vd_vs2                 "O\tD,F"
 -#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
 -#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
 -#define rv_fmt_rd_vs2                 "O\t0,F"
 -#define rv_fmt_fd_vs2                 "O\t3,F"
 -#define rv_fmt_vd_vm                  "O\tDm"
 -#define rv_fmt_vsetvli                "O\t0,1,v"
 -#define rv_fmt_vsetivli               "O\t0,u,v"
 -#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
 -#define rv_fmt_push_rlist             "O\tx,-i"
 -#define rv_fmt_pop_rlist              "O\tx,i"
 -#define rv_fmt_zcmt_index             "O\ti"
 -
  /* pseudo-instruction constraints */
  static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
 --
-.28.0
+.40.1

-[PULL 08/30] hw/riscv: microchip_pfsoc: Connect 5 MMUARTs
+[PULL 04/54] disas/riscv: Make rv_op_illegal a shared enum value
-From: Bin Meng <bin.meng@windriver.com>
+From: Christoph Müllner <christoph.muellner@vrull.eu>
-Microchip PolarFire SoC has 5 MMUARTs, and the Icicle Kit board
+The enum value 'rv_op_illegal' does not represent an
-wires 4 of them out. Let's connect all 5 MMUARTs.
+instruction, but is a catch-all value in case we have
 no match in the decoder. Let's make the value a shared
 one, so that other compile units can reuse it.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1598924352-89526-7-git-send-email-bmeng.cn@gmail.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-Id: <20230612111034.3955227-5-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/microchip_pfsoc.h | 20 ++++++++++++++++++++
+ disas/riscv.h | 4 ++++
- hw/riscv/microchip_pfsoc.c         | 30 ++++++++++++++++++++++++++++++
+ disas/riscv.c | 2 +-
- hw/riscv/Kconfig                   |  1 +
+files changed, 5 insertions(+), 1 deletion(-)
 files changed, 51 insertions(+)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+diff --git a/disas/riscv.h b/disas/riscv.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
+--- a/disas/riscv.h
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/disas/riscv.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct {
- #ifndef HW_MICROCHIP_PFSOC_H
+     const rvc_constraint *constraints;
- #define HW_MICROCHIP_PFSOC_H
+ } rv_comp_data;
 +#include "hw/char/mchp_pfsoc_mmuart.h"
 +
  typedef struct MicrochipPFSoCState {
      /*< private >*/
      DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct MicrochipPFSoCState {
      RISCVHartArrayState e_cpus;
      RISCVHartArrayState u_cpus;
      DeviceState *plic;
 +    MchpPfSoCMMUartState *serial0;
 +    MchpPfSoCMMUartState *serial1;
 +    MchpPfSoCMMUartState *serial2;
 +    MchpPfSoCMMUartState *serial3;
 +    MchpPfSoCMMUartState *serial4;
  } MicrochipPFSoCState;
  #define TYPE_MICROCHIP_PFSOC    "microchip.pfsoc"
@@ -XXX,XX +XXX,XX @@ enum {
      MICROCHIP_PFSOC_L2CC,
      MICROCHIP_PFSOC_L2LIM,
      MICROCHIP_PFSOC_PLIC,
 +    MICROCHIP_PFSOC_MMUART0,
      MICROCHIP_PFSOC_SYSREG,
      MICROCHIP_PFSOC_MPUCFG,
 +    MICROCHIP_PFSOC_MMUART1,
 +    MICROCHIP_PFSOC_MMUART2,
 +    MICROCHIP_PFSOC_MMUART3,
 +    MICROCHIP_PFSOC_MMUART4,
      MICROCHIP_PFSOC_ENVM_CFG,
      MICROCHIP_PFSOC_ENVM_DATA,
      MICROCHIP_PFSOC_IOSCB_CFG,
      MICROCHIP_PFSOC_DRAM,
  };
 +enum {
-+    MICROCHIP_PFSOC_MMUART0_IRQ = 90,
++    rv_op_illegal = 0
 +    MICROCHIP_PFSOC_MMUART1_IRQ = 91,
 +    MICROCHIP_PFSOC_MMUART2_IRQ = 92,
 +    MICROCHIP_PFSOC_MMUART3_IRQ = 93,
 +    MICROCHIP_PFSOC_MMUART4_IRQ = 94,
 +};
 +
- #define MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT    1
+ enum {
- #define MICROCHIP_PFSOC_COMPUTE_CPU_COUNT       4
+     rvcd_imm_nz = 0x1
+ };
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
+diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/microchip_pfsoc.c
+--- a/disas/riscv.c
-+++ b/hw/riscv/microchip_pfsoc.c
++++ b/disas/riscv.c
 @@ -XXX,XX +XXX,XX @@
-  * 0) CLINT (Core Level Interruptor)
+ #include "disas/riscv.h"
-  * 1) PLIC (Platform Level Interrupt Controller)
-  * 2) eNVM (Embedded Non-Volatile Memory)
+ typedef enum {
-+ * 3) MMUARTs (Multi-Mode UART)
+-    rv_op_illegal = 0,
-  *
++    /* 0 is reserved for rv_op_illegal. */
-  * This board currently generates devicetree dynamically that indicates at least
+     rv_op_lui = 1,
-  * two harts and up to five harts.
+     rv_op_auipc = 2,
-@@ -XXX,XX +XXX,XX @@
+     rv_op_jal = 3,
  #include "hw/irq.h"
  #include "hw/loader.h"
  #include "hw/sysbus.h"
 +#include "chardev/char.h"
  #include "hw/cpu/cluster.h"
  #include "target/riscv/cpu.h"
  #include "hw/misc/unimp.h"
@@ -XXX,XX +XXX,XX @@
  #include "hw/riscv/sifive_clint.h"
  #include "hw/riscv/sifive_plic.h"
  #include "hw/riscv/microchip_pfsoc.h"
 +#include "sysemu/sysemu.h"
  /*
   * The BIOS image used by this machine is called Hart Software Services (HSS).
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
      [MICROCHIP_PFSOC_L2CC] =            {  0x2010000,     0x1000 },
      [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,  0x2000000 },
      [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,  0x4000000 },
 +    [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,     0x1000 },
      [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,     0x2000 },
      [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,     0x1000 },
 +    [MICROCHIP_PFSOC_MMUART1] =         { 0x20100000,     0x1000 },
 +    [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,     0x1000 },
 +    [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,     0x1000 },
 +    [MICROCHIP_PFSOC_MMUART4] =         { 0x20106000,     0x1000 },
      [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,     0x1000 },
      [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
      [MICROCHIP_PFSOC_IOSCB_CFG] =       { 0x37080000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
          memmap[MICROCHIP_PFSOC_MPUCFG].base,
          memmap[MICROCHIP_PFSOC_MPUCFG].size);
 +    /* MMUARTs */
 +    s->serial0 = mchp_pfsoc_mmuart_create(system_memory,
 +        memmap[MICROCHIP_PFSOC_MMUART0].base,
 +        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART0_IRQ),
 +        serial_hd(0));
 +    s->serial1 = mchp_pfsoc_mmuart_create(system_memory,
 +        memmap[MICROCHIP_PFSOC_MMUART1].base,
 +        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART1_IRQ),
 +        serial_hd(1));
 +    s->serial2 = mchp_pfsoc_mmuart_create(system_memory,
 +        memmap[MICROCHIP_PFSOC_MMUART2].base,
 +        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART2_IRQ),
 +        serial_hd(2));
 +    s->serial3 = mchp_pfsoc_mmuart_create(system_memory,
 +        memmap[MICROCHIP_PFSOC_MMUART3].base,
 +        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART3_IRQ),
 +        serial_hd(3));
 +    s->serial4 = mchp_pfsoc_mmuart_create(system_memory,
 +        memmap[MICROCHIP_PFSOC_MMUART4].base,
 +        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART4_IRQ),
 +        serial_hd(4));
 +
      /* eNVM */
      memory_region_init_rom(envm_data, OBJECT(dev), "microchip.pfsoc.envm.data",
                             memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
      select HART
      select SIFIVE
      select UNIMP
 +    select MCHP_PFSOC_MMUART
 --
-.28.0
+.40.1

-[PULL 21/30] hw/riscv: Move sifive_u_otp model to hw/misc
+[PULL 05/54] disas/riscv: Encapsulate opcode_data into decode
-From: Bin Meng <bin.meng@windriver.com>
+From: Christoph Müllner <christoph.muellner@vrull.eu>
-This is an effort to clean up the hw/riscv directory. Ideally it
+This patch adds a reference to a struct rv_opcode_data object
-should only contain the RISC-V SoC / machine codes plus generic
+into struct rv_decode. This further allows to remove all references
-codes. Let's move sifive_u_otp model to hw/misc directory.
+to the global variable opcode_data (which is renamed to rvi_opcode_data).
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+This patch does not introduce any functional change, but prepares
 the code for more struct rv_opcode_data objects in the future.
 This patch is based on previous work from Liu Zhiwei:
   https://lists.nongnu.org/archive/html/qemu-devel/2022-08/msg03662.html
 Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1599129623-68957-4-git-send-email-bmeng.cn@gmail.com>
+Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-Id: <20230612111034.3955227-6-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/{riscv => misc}/sifive_u_otp.h | 0
+ disas/riscv.h | 33 +++++++++++++++++----------------
- include/hw/riscv/sifive_u.h               | 2 +-
+ disas/riscv.c |  9 ++++++++-
- hw/{riscv => misc}/sifive_u_otp.c         | 2 +-
+files changed, 25 insertions(+), 17 deletions(-)
  hw/misc/Kconfig                           | 3 +++
  hw/misc/meson.build                       | 1 +
  hw/riscv/Kconfig                          | 1 +
  hw/riscv/meson.build                      | 1 -
 files changed, 7 insertions(+), 3 deletions(-)
  rename include/hw/{riscv => misc}/sifive_u_otp.h (100%)
  rename hw/{riscv => misc}/sifive_u_otp.c (99%)
-diff --git a/include/hw/riscv/sifive_u_otp.h b/include/hw/misc/sifive_u_otp.h
+diff --git a/disas/riscv.h b/disas/riscv.h
 similarity index 100%
 rename from include/hw/riscv/sifive_u_otp.h
 rename to include/hw/misc/sifive_u_otp.h
 diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/sifive_u.h
+--- a/disas/riscv.h
-+++ b/include/hw/riscv/sifive_u.h
++++ b/disas/riscv.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef enum {
- #include "hw/riscv/riscv_hart.h"
- #include "hw/riscv/sifive_cpu.h"
+ /* structures */
- #include "hw/riscv/sifive_gpio.h"
--#include "hw/riscv/sifive_u_otp.h"
++typedef struct {
-+#include "hw/misc/sifive_u_otp.h"
++    const int op;
- #include "hw/misc/sifive_u_prci.h"
++    const rvc_constraint *constraints;
++} rv_comp_data;
- #define TYPE_RISCV_U_SOC "riscv.sifive.u.soc"
++
-diff --git a/hw/riscv/sifive_u_otp.c b/hw/misc/sifive_u_otp.c
++typedef struct {
-similarity index 99%
++    const char * const name;
-rename from hw/riscv/sifive_u_otp.c
++    const rv_codec codec;
-rename to hw/misc/sifive_u_otp.c
++    const char * const format;
 +    const rv_comp_data *pseudo;
 +    const short decomp_rv32;
 +    const short decomp_rv64;
 +    const short decomp_rv128;
 +    const short decomp_data;
 +} rv_opcode_data;
 +
  typedef struct {
      RISCVCPUConfig *cfg;
      uint64_t  pc;
      uint64_t  inst;
 +    const rv_opcode_data *opcode_data;
      int32_t   imm;
      uint16_t  op;
      uint8_t   codec;
@@ -XXX,XX +XXX,XX @@ typedef struct {
      uint8_t   rlist;
  } rv_decode;
 -typedef struct {
 -    const int op;
 -    const rvc_constraint *constraints;
 -} rv_comp_data;
 -
  enum {
      rv_op_illegal = 0
  };
@@ -XXX,XX +XXX,XX @@ enum {
      rvcd_imm_nz = 0x1
  };
 -typedef struct {
 -    const char * const name;
 -    const rv_codec codec;
 -    const char * const format;
 -    const rv_comp_data *pseudo;
 -    const short decomp_rv32;
 -    const short decomp_rv64;
 -    const short decomp_rv128;
 -    const short decomp_data;
 -} rv_opcode_data;
 -
  /* instruction formats */
  #define rv_fmt_none                   "O\t"
 diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_u_otp.c
+--- a/disas/riscv.c
-+++ b/hw/misc/sifive_u_otp.c
++++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const rv_comp_data rvcp_fsgnjx_q[] = {
- #include "hw/sysbus.h"
- #include "qemu/log.h"
+ /* instruction metadata */
- #include "qemu/module.h"
--#include "hw/riscv/sifive_u_otp.h"
+-const rv_opcode_data opcode_data[] = {
-+#include "hw/misc/sifive_u_otp.h"
++const rv_opcode_data rvi_opcode_data[] = {
+     { "illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
- static uint64_t sifive_u_otp_read(void *opaque, hwaddr addr, unsigned int size)
+     { "lui", rv_codec_u, rv_fmt_rd_imm, NULL, 0, 0, 0 },
      { "auipc", rv_codec_u, rv_fmt_rd_offset, NULL, 0, 0, 0 },
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_tbl_index(rv_inst inst)
  static void decode_inst_operands(rv_decode *dec, rv_isa isa)
  {
-diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
++    const rv_opcode_data *opcode_data = dec->opcode_data;
-index XXXXXXX..XXXXXXX 100644
+     rv_inst inst = dec->inst;
---- a/hw/misc/Kconfig
+     dec->codec = opcode_data[dec->op].codec;
-+++ b/hw/misc/Kconfig
+     switch (dec->codec) {
-@@ -XXX,XX +XXX,XX @@ config AVR_POWER
+@@ -XXX,XX +XXX,XX @@ static void append(char *s1, const char *s2, size_t n)
- config SIFIVE_E_PRCI
-     bool
+ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
+ {
-+config SIFIVE_U_OTP
++    const rv_opcode_data *opcode_data = dec->opcode_data;
-+    bool
+     char tmp[64];
-+
+     const char *fmt;
- config SIFIVE_U_PRCI
-     bool
+@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
-diff --git a/hw/misc/meson.build b/hw/misc/meson.build
+ static void decode_inst_lift_pseudo(rv_decode *dec)
-index XXXXXXX..XXXXXXX 100644
+ {
---- a/hw/misc/meson.build
++    const rv_opcode_data *opcode_data = dec->opcode_data;
-+++ b/hw/misc/meson.build
+     const rv_comp_data *comp_data = opcode_data[dec->op].pseudo;
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_MOS6522', if_true: files('mos6522.c'))
+     if (!comp_data) {
+         return;
- # RISC-V devices
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_lift_pseudo(rv_decode *dec)
- softmmu_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
-+softmmu_ss.add(when: 'CONFIG_SIFIVE_U_OTP', if_true: files('sifive_u_otp.c'))
+ static void decode_inst_decompress_rv32(rv_decode *dec)
- softmmu_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
+ {
++    const rv_opcode_data *opcode_data = dec->opcode_data;
- # PKUnity SoC devices
+     int decomp_op = opcode_data[dec->op].decomp_rv32;
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
+     if (decomp_op != rv_op_illegal) {
-index XXXXXXX..XXXXXXX 100644
+         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
---- a/hw/riscv/Kconfig
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv32(rv_decode *dec)
-+++ b/hw/riscv/Kconfig
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
+ static void decode_inst_decompress_rv64(rv_decode *dec)
-     select HART
+ {
-     select SIFIVE
++    const rv_opcode_data *opcode_data = dec->opcode_data;
-     select SIFIVE_PDMA
+     int decomp_op = opcode_data[dec->op].decomp_rv64;
-+    select SIFIVE_U_OTP
+     if (decomp_op != rv_op_illegal) {
-     select SIFIVE_U_PRCI
+         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
-     select UNIMP
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv64(rv_decode *dec)
-diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
+ static void decode_inst_decompress_rv128(rv_decode *dec)
-index XXXXXXX..XXXXXXX 100644
+ {
---- a/hw/riscv/meson.build
++    const rv_opcode_data *opcode_data = dec->opcode_data;
-+++ b/hw/riscv/meson.build
+     int decomp_op = opcode_data[dec->op].decomp_rv128;
-@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
+     if (decomp_op != rv_op_illegal) {
- riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
+         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
- riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
+@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
- riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
+     rv_decode dec = { 0 };
--riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_otp.c'))
+     dec.pc = pc;
- riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('riscv_htif.c'))
+     dec.inst = inst;
- riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
++    dec.opcode_data = rvi_opcode_data;
- riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
+     dec.cfg = cfg;
      decode_inst_opcode(&dec, isa);
      decode_inst_operands(&dec, isa);
 --
-.28.0
+.40.1

-[PULL 29/30] hw/riscv: Drop CONFIG_SIFIVE
+[PULL 06/54] disas/riscv: Provide infrastructure for vendor extensions
-From: Bin Meng <bin.meng@windriver.com>
+From: Christoph Müllner <christoph.muellner@vrull.eu>
-The name SIFIVE is too vague to convey the required component of
+A previous patch provides a pointer to the RISCVCPUConfig data.
-MSI_NONBROKEN. Let's drop the option, and select MSI_NONBROKEN in
+Let's use this to add the necessary code for vendor extensions.
-each machine instead.
+This patch does not change the current behaviour, but clearly
 defines how vendor extension support can be added to the disassembler.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1599129623-68957-12-git-send-email-bmeng.cn@gmail.com>
+Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-Id: <20230612111034.3955227-7-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/Kconfig | 14 +++++---------
+ disas/riscv.c | 28 ++++++++++++++++++++++++++--
-file changed, 5 insertions(+), 9 deletions(-)
+file changed, 26 insertions(+), 2 deletions(-)
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
+diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/Kconfig
+--- a/disas/riscv.c
-+++ b/hw/riscv/Kconfig
++++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
- config IBEX
+     rv_decode dec = { 0 };
-     bool
+     dec.pc = pc;
+     dec.inst = inst;
--config SIFIVE
+-    dec.opcode_data = rvi_opcode_data;
--    bool
+     dec.cfg = cfg;
--    select MSI_NONBROKEN
+-    decode_inst_opcode(&dec, isa);
--
++
- config SIFIVE_E
++    static const struct {
-     bool
++        bool (*guard_func)(const RISCVCPUConfig *);
--    select SIFIVE
++        const rv_opcode_data *opcode_data;
-+    select MSI_NONBROKEN
++        void (*decode_func)(rv_decode *, rv_isa);
-     select SIFIVE_CLINT
++    } decoders[] = {
-     select SIFIVE_GPIO
++        { always_true_p, rvi_opcode_data, decode_inst_opcode },
-     select SIFIVE_PLIC
++    };
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
++
- config SIFIVE_U
++    for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
-     bool
++        bool (*guard_func)(const RISCVCPUConfig *) = decoders[i].guard_func;
-     select CADENCE
++        const rv_opcode_data *opcode_data = decoders[i].opcode_data;
--    select SIFIVE
++        void (*decode_func)(rv_decode *, rv_isa) = decoders[i].decode_func;
-+    select MSI_NONBROKEN
++
-     select SIFIVE_CLINT
++        if (guard_func(cfg)) {
-     select SIFIVE_GPIO
++            dec.opcode_data = opcode_data;
-     select SIFIVE_PDMA
++            decode_func(&dec, isa);
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
++            if (dec.op != rv_op_illegal)
- config SPIKE
++                break;
-     bool
++        }
-     select HTIF
++    }
--    select SIFIVE
++
-+    select MSI_NONBROKEN
++    if (dec.op == rv_op_illegal) {
-     select SIFIVE_CLINT
++        dec.opcode_data = rvi_opcode_data;
-     select SIFIVE_PLIC
++    }
++
-@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
+     decode_inst_operands(&dec, isa);
-     bool
+     decode_inst_decompress(&dec, isa);
-     imply PCI_DEVICES
+     decode_inst_lift_pseudo(&dec);
      imply TEST_DEVICES
 +    select MSI_NONBROKEN
      select PCI
      select SERIAL
      select GOLDFISH_RTC
      select VIRTIO_MMIO
      select PCI_EXPRESS_GENERIC_BRIDGE
      select PFLASH_CFI01
 -    select SIFIVE
      select SIFIVE_CLINT
      select SIFIVE_PLIC
      select SIFIVE_TEST
  config MICROCHIP_PFSOC
      bool
 -    select SIFIVE
 +    select MSI_NONBROKEN
      select SIFIVE_CLINT
      select UNIMP
      select MCHP_PFSOC_MMUART
 --
-.28.0
+.40.1

-[PULL 09/30] hw/sd: Add Cadence SDHCI emulation
+[PULL 07/54] disas/riscv: Add support for XVentanaCondOps
-From: Bin Meng <bin.meng@windriver.com>
+From: Christoph Müllner <christoph.muellner@vrull.eu>
-Cadence SD/SDIO/eMMC Host Controller (SD4HC) is an SDHCI compatible
+This patch adds XVentanaCondOps support to the RISC-V disassembler.
 controller. The SDHCI compatible registers start from offset 0x200,
 which are called Slot Register Set (SRS) in its datasheet.
-This creates a Cadence SDHCI model built on top of the existing
+Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 generic SDHCI model. Cadence specific Host Register Set (HRS) is
 implemented to make guest software happy.
 Signed-off-by: Bin Meng <bin.meng@windriver.com>
 Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1598924352-89526-8-git-send-email-bmeng.cn@gmail.com>
+Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-Id: <20230612111034.3955227-8-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/sd/cadence_sdhci.h |  47 +++++++++
+ disas/riscv-xventana.h | 18 ++++++++++++++++++
- hw/sd/cadence_sdhci.c         | 193 ++++++++++++++++++++++++++++++++++
+ disas/riscv-xventana.c | 41 +++++++++++++++++++++++++++++++++++++++++
- hw/sd/Kconfig                 |   4 +
+ disas/riscv.c          |  4 ++++
- hw/sd/meson.build             |   1 +
+ disas/meson.build      |  5 ++++-
-files changed, 245 insertions(+)
+files changed, 67 insertions(+), 1 deletion(-)
- create mode 100644 include/hw/sd/cadence_sdhci.h
+ create mode 100644 disas/riscv-xventana.h
- create mode 100644 hw/sd/cadence_sdhci.c
+ create mode 100644 disas/riscv-xventana.c
-diff --git a/include/hw/sd/cadence_sdhci.h b/include/hw/sd/cadence_sdhci.h
+diff --git a/disas/riscv-xventana.h b/disas/riscv-xventana.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/sd/cadence_sdhci.h
++++ b/disas/riscv-xventana.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Cadence SDHCI emulation
++ * QEMU disassembler -- RISC-V specific header (xventana*).
 + *
-+ * Copyright (c) 2020 Wind River Systems, Inc.
++ * Copyright (c) 2023 VRULL GmbH
 + *
-+ * Author:
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + *   Bin Meng <bin.meng@windriver.com>
 + *
 + * This program is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU General Public License as
 + * published by the Free Software Foundation; either version 2 or
 + * (at your option) version 3 of the License.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#ifndef CADENCE_SDHCI_H
++#ifndef DISAS_RISCV_XVENTANA_H
-+#define CADENCE_SDHCI_H
++#define DISAS_RISCV_XVENTANA_H
 +
-+#include "hw/sd/sdhci.h"
++#include "disas/riscv.h"
 +
-+#define CADENCE_SDHCI_REG_SIZE  0x100
++extern const rv_opcode_data ventana_opcode_data[];
 +#define CADENCE_SDHCI_NUM_REGS  (CADENCE_SDHCI_REG_SIZE / sizeof(uint32_t))
 +
-+typedef struct CadenceSDHCIState {
++void decode_xventanacondops(rv_decode*, rv_isa);
 +    SysBusDevice parent;
 +
-+    MemoryRegion container;
++#endif /* DISAS_RISCV_XVENTANA_H */
-+    MemoryRegion iomem;
+diff --git a/disas/riscv-xventana.c b/disas/riscv-xventana.c
 +    BusState *bus;
 +
 +    uint32_t regs[CADENCE_SDHCI_NUM_REGS];
 +
 +    SDHCIState sdhci;
 +} CadenceSDHCIState;
 +
 +#define TYPE_CADENCE_SDHCI  "cadence.sdhci"
 +#define CADENCE_SDHCI(obj)  OBJECT_CHECK(CadenceSDHCIState, (obj), \
 +                                         TYPE_CADENCE_SDHCI)
 +
 +#endif /* CADENCE_SDHCI_H */
 diff --git a/hw/sd/cadence_sdhci.c b/hw/sd/cadence_sdhci.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/sd/cadence_sdhci.c
++++ b/disas/riscv-xventana.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Cadence SDHCI emulation
++ * QEMU RISC-V Disassembler for xventana.
 + *
-+ * Copyright (c) 2020 Wind River Systems, Inc.
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + *
 + * Author:
 + *   Bin Meng <bin.meng@windriver.com>
 + *
 + * This program is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU General Public License as
 + * published by the Free Software Foundation; either version 2 or
 + * (at your option) version 3 of the License.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#include "qemu/osdep.h"
++#include "disas/riscv.h"
-+#include "qemu/bitops.h"
++#include "disas/riscv-xventana.h"
 +#include "qemu/error-report.h"
 +#include "qemu/log.h"
 +#include "qapi/error.h"
 +#include "migration/vmstate.h"
 +#include "hw/irq.h"
 +#include "hw/sd/cadence_sdhci.h"
 +#include "sdhci-internal.h"
 +
-+/* HRS - Host Register Set (specific to Cadence) */
++typedef enum {
 +    /* 0 is reserved for rv_op_illegal. */
 +    ventana_op_vt_maskc = 1,
 +    ventana_op_vt_maskcn = 2,
 +} rv_ventana_op;
 +
-+#define CADENCE_SDHCI_HRS00             0x00    /* general information */
++const rv_opcode_data ventana_opcode_data[] = {
-+#define CADENCE_SDHCI_HRS00_SWR             BIT(0)
++    { "vt.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
-+#define CADENCE_SDHCI_HRS00_POR_VAL         0x00010000
++    { "vt.maskc", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "vt.maskcn", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +};
 +
-+#define CADENCE_SDHCI_HRS04             0x10    /* PHY access port */
++void decode_xventanacondops(rv_decode *dec, rv_isa isa)
-+#define CADENCE_SDHCI_HRS04_WR              BIT(24)
++{
-+#define CADENCE_SDHCI_HRS04_RD              BIT(25)
++    rv_inst inst = dec->inst;
-+#define CADENCE_SDHCI_HRS04_ACK             BIT(26)
++    rv_opcode op = rv_op_illegal;
 +
-+#define CADENCE_SDHCI_HRS06             0x18    /* eMMC control */
++    switch (((inst >> 0) & 0b11)) {
-+#define CADENCE_SDHCI_HRS06_TUNE_UP         BIT(15)
++    case 3:
-+
++        switch (((inst >> 2) & 0b11111)) {
-+/* SRS - Slot Register Set (SDHCI-compatible) */
++        case 30:
-+
++            switch (((inst >> 22) & 0b1111111000) | ((inst >> 12) & 0b0000000111)) {
-+#define CADENCE_SDHCI_SRS_BASE          0x200
++            case 6: op = ventana_op_vt_maskc; break;
-+
++            case 7: op = ventana_op_vt_maskcn; break;
-+#define TO_REG(addr)    ((addr) / sizeof(uint32_t))
++            }
-+
++            break;
 +static void cadence_sdhci_instance_init(Object *obj)
 +{
 +    CadenceSDHCIState *s = CADENCE_SDHCI(obj);
 +
 +    object_initialize_child(OBJECT(s), "generic-sdhci",
 +                            &s->sdhci, TYPE_SYSBUS_SDHCI);
 +}
 +
 +static void cadence_sdhci_reset(DeviceState *dev)
 +{
 +    CadenceSDHCIState *s = CADENCE_SDHCI(dev);
 +
 +    memset(s->regs, 0, CADENCE_SDHCI_REG_SIZE);
 +    s->regs[TO_REG(CADENCE_SDHCI_HRS00)] = CADENCE_SDHCI_HRS00_POR_VAL;
 +
 +    device_cold_reset(DEVICE(&s->sdhci));
 +}
 +
 +static uint64_t cadence_sdhci_read(void *opaque, hwaddr addr, unsigned int size)
 +{
 +    CadenceSDHCIState *s = opaque;
 +    uint32_t val;
 +
 +    val = s->regs[TO_REG(addr)];
 +
 +    return (uint64_t)val;
 +}
 +
 +static void cadence_sdhci_write(void *opaque, hwaddr addr, uint64_t val,
 +                                unsigned int size)
 +{
 +    CadenceSDHCIState *s = opaque;
 +    uint32_t val32 = (uint32_t)val;
 +
 +    switch (addr) {
 +    case CADENCE_SDHCI_HRS00:
 +        /*
 +         * The only writable bit is SWR (software reset) and it automatically
 +         * clears to zero, so essentially this register remains unchanged.
 +         */
 +        if (val32 & CADENCE_SDHCI_HRS00_SWR) {
 +            cadence_sdhci_reset(DEVICE(s));
 +        }
-+
-+        break;
-+    case CADENCE_SDHCI_HRS04:
-+        /*
-+         * Only emulate the ACK bit behavior when read or write transaction
-+         * are requested.
-+         */
-+        if (val32 & (CADENCE_SDHCI_HRS04_WR | CADENCE_SDHCI_HRS04_RD)) {
-+            val32 |= CADENCE_SDHCI_HRS04_ACK;
-+        } else {
-+            val32 &= ~CADENCE_SDHCI_HRS04_ACK;
-+        }
-+
-+        s->regs[TO_REG(addr)] = val32;
-+        break;
-+    case CADENCE_SDHCI_HRS06:
-+        if (val32 & CADENCE_SDHCI_HRS06_TUNE_UP) {
-+            val32 &= ~CADENCE_SDHCI_HRS06_TUNE_UP;
-+        }
-+
-+        s->regs[TO_REG(addr)] = val32;
-+        break;
-+    default:
-+        s->regs[TO_REG(addr)] = val32;
 +        break;
 +    }
++
++    dec->op = op;
 +}
+diff --git a/disas/riscv.c b/disas/riscv.c
+index XXXXXXX..XXXXXXX 100644
+--- a/disas/riscv.c
++++ b/disas/riscv.c
+@@ -XXX,XX +XXX,XX @@
+ #include "target/riscv/cpu_cfg.h"
+ #include "disas/riscv.h"
++/* Vendor extensions */
++#include "disas/riscv-xventana.h"
 +
-+static const MemoryRegionOps cadence_sdhci_ops = {
+ typedef enum {
-+    .read = cadence_sdhci_read,
+     /* 0 is reserved for rv_op_illegal. */
-+    .write = cadence_sdhci_write,
+     rv_op_lui = 1,
-+    .endianness = DEVICE_NATIVE_ENDIAN,
+@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
-+    .impl = {
+         void (*decode_func)(rv_decode *, rv_isa);
-+        .min_access_size = 4,
+     } decoders[] = {
-+        .max_access_size = 4,
+         { always_true_p, rvi_opcode_data, decode_inst_opcode },
-+    },
++        { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
-+    .valid = {
+     };
-+        .min_access_size = 4,
-+        .max_access_size = 4,
+     for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
-+    }
+diff --git a/disas/meson.build b/disas/meson.build
 +};
 +
 +static void cadence_sdhci_realize(DeviceState *dev, Error **errp)
 +{
 +    CadenceSDHCIState *s = CADENCE_SDHCI(dev);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 +    SysBusDevice *sbd_sdhci = SYS_BUS_DEVICE(&s->sdhci);
 +
 +    memory_region_init(&s->container, OBJECT(s),
 +                       "cadence.sdhci-container", 0x1000);
 +    sysbus_init_mmio(sbd, &s->container);
 +
 +    memory_region_init_io(&s->iomem, OBJECT(s), &cadence_sdhci_ops,
 +                          s, TYPE_CADENCE_SDHCI, CADENCE_SDHCI_REG_SIZE);
 +    memory_region_add_subregion(&s->container, 0, &s->iomem);
 +
 +    sysbus_realize(sbd_sdhci, errp);
 +    memory_region_add_subregion(&s->container, CADENCE_SDHCI_SRS_BASE,
 +                                sysbus_mmio_get_region(sbd_sdhci, 0));
 +
 +    /* propagate irq and "sd-bus" from generic-sdhci */
 +    sysbus_pass_irq(sbd, sbd_sdhci);
 +    s->bus = qdev_get_child_bus(DEVICE(sbd_sdhci), "sd-bus");
 +}
 +
 +static const VMStateDescription vmstate_cadence_sdhci = {
 +    .name = TYPE_CADENCE_SDHCI,
 +    .version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(regs, CadenceSDHCIState, CADENCE_SDHCI_NUM_REGS),
 +        VMSTATE_END_OF_LIST(),
 +    },
 +};
 +
 +static void cadence_sdhci_class_init(ObjectClass *classp, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(classp);
 +
 +    dc->desc = "Cadence SD/SDIO/eMMC Host Controller (SD4HC)";
 +    dc->realize = cadence_sdhci_realize;
 +    dc->reset = cadence_sdhci_reset;
 +    dc->vmsd = &vmstate_cadence_sdhci;
 +}
 +
 +static TypeInfo cadence_sdhci_info = {
 +    .name          = TYPE_CADENCE_SDHCI,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(CadenceSDHCIState),
 +    .instance_init = cadence_sdhci_instance_init,
 +    .class_init    = cadence_sdhci_class_init,
 +};
 +
 +static void cadence_sdhci_register_types(void)
 +{
 +    type_register_static(&cadence_sdhci_info);
 +}
 +
 +type_init(cadence_sdhci_register_types)
 diff --git a/hw/sd/Kconfig b/hw/sd/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/Kconfig
+--- a/disas/meson.build
-+++ b/hw/sd/Kconfig
++++ b/disas/meson.build
-@@ -XXX,XX +XXX,XX @@ config SDHCI_PCI
+@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_M68K_DIS', if_true: files('m68k.c'))
-     default y if PCI_DEVICES
+ common_ss.add(when: 'CONFIG_MICROBLAZE_DIS', if_true: files('microblaze.c'))
-     depends on PCI
+ common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
-     select SDHCI
+ common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
-+
+-common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files('riscv.c'))
-+config CADENCE_SDHCI
++common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
-+    bool
++    'riscv.c',
-+    select SDHCI
++    'riscv-xventana.c'
-diff --git a/hw/sd/meson.build b/hw/sd/meson.build
++))
-index XXXXXXX..XXXXXXX 100644
+ common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
---- a/hw/sd/meson.build
+ common_ss.add(when: 'CONFIG_SPARC_DIS', if_true: files('sparc.c'))
-+++ b/hw/sd/meson.build
+ common_ss.add(when: 'CONFIG_XTENSA_DIS', if_true: files('xtensa.c'))
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx_mmci.c'))
  softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_sdhost.c'))
  softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_sdhci.c'))
  softmmu_ss.add(when: 'CONFIG_ALLWINNER_H3', if_true: files('allwinner-sdhost.c'))
 +softmmu_ss.add(when: 'CONFIG_CADENCE_SDHCI', if_true: files('cadence_sdhci.c'))
 --
-.28.0
+.40.1

-[PULL 07/30] hw/char: Add Microchip PolarFire SoC MMUART emulation
+[PULL 08/54] disas/riscv: Add support for XThead* instructions
-From: Bin Meng <bin.meng@windriver.com>
+From: Christoph Müllner <christoph.muellner@vrull.eu>
-Microchip PolarFire SoC MMUART is ns16550 compatible, with some
+Support for emulating XThead* instruction has been added recently.
-additional registers. Create a simple MMUART model built on top
+This patch adds support for these instructions to the RISC-V disassembler.
 of the existing ns16550 model.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1598924352-89526-6-git-send-email-bmeng.cn@gmail.com>
+Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-Id: <20230612111034.3955227-9-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/char/mchp_pfsoc_mmuart.h | 61 ++++++++++++++++++++
+ disas/riscv-xthead.h   |  28 ++
- hw/char/mchp_pfsoc_mmuart.c         | 86 +++++++++++++++++++++++++++++
+ disas/riscv.h          |  12 +
- MAINTAINERS                         |  2 +
+ target/riscv/cpu_cfg.h |  11 +
- hw/char/Kconfig                     |  3 +
+ disas/riscv-xthead.c   | 707 +++++++++++++++++++++++++++++++++++++++++
- hw/char/meson.build                 |  1 +
+ disas/riscv.c          |  69 ++++
-files changed, 153 insertions(+)
+ disas/meson.build      |   1 +
- create mode 100644 include/hw/char/mchp_pfsoc_mmuart.h
+files changed, 828 insertions(+)
- create mode 100644 hw/char/mchp_pfsoc_mmuart.c
+ create mode 100644 disas/riscv-xthead.h
  create mode 100644 disas/riscv-xthead.c
-diff --git a/include/hw/char/mchp_pfsoc_mmuart.h b/include/hw/char/mchp_pfsoc_mmuart.h
+diff --git a/disas/riscv-xthead.h b/disas/riscv-xthead.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/char/mchp_pfsoc_mmuart.h
++++ b/disas/riscv-xthead.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Microchip PolarFire SoC MMUART emulation
++ * QEMU disassembler -- RISC-V specific header (xthead*).
 + *
-+ * Copyright (c) 2020 Wind River Systems, Inc.
++ * Copyright (c) 2023 VRULL GmbH
 + *
-+ * Author:
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + *   Bin Meng <bin.meng@windriver.com>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
-+#ifndef HW_MCHP_PFSOC_MMUART_H
++#ifndef DISAS_RISCV_XTHEAD_H
-+#define HW_MCHP_PFSOC_MMUART_H
++#define DISAS_RISCV_XTHEAD_H
 +
-+#include "hw/char/serial.h"
++#include "disas/riscv.h"
 +
-+#define MCHP_PFSOC_MMUART_REG_SIZE  52
++extern const rv_opcode_data xthead_opcode_data[];
 +
-+typedef struct MchpPfSoCMMUartState {
++void decode_xtheadba(rv_decode *, rv_isa);
-+    MemoryRegion iomem;
++void decode_xtheadbb(rv_decode *, rv_isa);
-+    hwaddr base;
++void decode_xtheadbs(rv_decode *, rv_isa);
-+    qemu_irq irq;
++void decode_xtheadcmo(rv_decode *, rv_isa);
-+
++void decode_xtheadcondmov(rv_decode *, rv_isa);
-+    SerialMM *serial;
++void decode_xtheadfmemidx(rv_decode *, rv_isa);
-+
++void decode_xtheadfmv(rv_decode *, rv_isa);
-+    uint32_t reg[MCHP_PFSOC_MMUART_REG_SIZE / sizeof(uint32_t)];
++void decode_xtheadmac(rv_decode *, rv_isa);
-+} MchpPfSoCMMUartState;
++void decode_xtheadmemidx(rv_decode *, rv_isa);
-+
++void decode_xtheadmempair(rv_decode *, rv_isa);
-+/**
++void decode_xtheadsync(rv_decode *, rv_isa);
-+ * mchp_pfsoc_mmuart_create - Create a Microchip PolarFire SoC MMUART
++
-+ *
++#endif /* DISAS_RISCV_XTHEAD_H */
-+ * This is a helper routine for board to create a MMUART device that is
+diff --git a/disas/riscv.h b/disas/riscv.h
-+ * compatible with Microchip PolarFire SoC.
+index XXXXXXX..XXXXXXX 100644
-+ *
+--- a/disas/riscv.h
-+ * @sysmem: system memory region to map
++++ b/disas/riscv.h
-+ * @base: base address of the MMUART registers
+@@ -XXX,XX +XXX,XX @@ typedef enum {
-+ * @irq: IRQ number of the MMUART device
+     rv_codec_zcmp_cm_pushpop,
-+ * @chr: character device to associate to
+     rv_codec_zcmp_cm_mv,
-+ *
+     rv_codec_zcmt_jt,
-+ * @return: a pointer to the device specific control structure
++    rv_codec_r2_imm5,
-+ */
++    rv_codec_r2,
-+MchpPfSoCMMUartState *mchp_pfsoc_mmuart_create(MemoryRegion *sysmem,
++    rv_codec_r2_imm6,
-+    hwaddr base, qemu_irq irq, Chardev *chr);
++    rv_codec_r_imm2,
-+
++    rv_codec_r2_immhl,
-+#endif /* HW_MCHP_PFSOC_MMUART_H */
++    rv_codec_r2_imm2_imm5,
-diff --git a/hw/char/mchp_pfsoc_mmuart.c b/hw/char/mchp_pfsoc_mmuart.c
+ } rv_codec;
  /* structures */
@@ -XXX,XX +XXX,XX @@ typedef struct {
      uint64_t  inst;
      const rv_opcode_data *opcode_data;
      int32_t   imm;
 +    int32_t   imm1;
      uint16_t  op;
      uint8_t   codec;
      uint8_t   rd;
@@ -XXX,XX +XXX,XX @@ enum {
  #define rv_fmt_push_rlist             "O\tx,-i"
  #define rv_fmt_pop_rlist              "O\tx,i"
  #define rv_fmt_zcmt_index             "O\ti"
 +#define rv_fmt_rd_rs1_rs2_imm         "O\t0,1,2,i"
 +#define rv_fmt_frd_rs1_rs2_imm        "O\t3,1,2,i"
 +#define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
 +#define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
 +#define rv_fmt_rd2_imm                "O\t0,2,(1),i"
  #endif /* DISAS_RISCV_H */
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
          return cfg->ext_ ## ext ; \
      }
 +MATERIALISE_EXT_PREDICATE(xtheadba)
 +MATERIALISE_EXT_PREDICATE(xtheadbb)
 +MATERIALISE_EXT_PREDICATE(xtheadbs)
 +MATERIALISE_EXT_PREDICATE(xtheadcmo)
 +MATERIALISE_EXT_PREDICATE(xtheadcondmov)
 +MATERIALISE_EXT_PREDICATE(xtheadfmemidx)
 +MATERIALISE_EXT_PREDICATE(xtheadfmv)
 +MATERIALISE_EXT_PREDICATE(xtheadmac)
 +MATERIALISE_EXT_PREDICATE(xtheadmemidx)
 +MATERIALISE_EXT_PREDICATE(xtheadmempair)
 +MATERIALISE_EXT_PREDICATE(xtheadsync)
  MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
  #endif
 diff --git a/disas/riscv-xthead.c b/disas/riscv-xthead.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/char/mchp_pfsoc_mmuart.c
++++ b/disas/riscv-xthead.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Microchip PolarFire SoC MMUART emulation
++ * QEMU RISC-V Disassembler for xthead.
 + *
-+ * Copyright (c) 2020 Wind River Systems, Inc.
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + *
 + * Author:
 + *   Bin Meng <bin.meng@windriver.com>
 + *
 + * This program is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU General Public License as
 + * published by the Free Software Foundation; either version 2 or
 + * (at your option) version 3 of the License.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#include "qemu/osdep.h"
++#include "disas/riscv.h"
-+#include "qemu/log.h"
++#include "disas/riscv-xthead.h"
-+#include "chardev/char.h"
++
-+#include "exec/address-spaces.h"
++typedef enum {
-+#include "hw/char/mchp_pfsoc_mmuart.h"
++    /* 0 is reserved for rv_op_illegal. */
-+
++    /* XTheadBa */
-+static uint64_t mchp_pfsoc_mmuart_read(void *opaque, hwaddr addr, unsigned size)
++    rv_op_th_addsl = 1,
-+{
++    /* XTheadBb */
-+    MchpPfSoCMMUartState *s = opaque;
++    rv_op_th_srri,
-+
++    rv_op_th_srriw,
-+    if (addr >= MCHP_PFSOC_MMUART_REG_SIZE) {
++    rv_op_th_ext,
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: read: addr=0x%" HWADDR_PRIx "\n",
++    rv_op_th_extu,
-+                      __func__, addr);
++    rv_op_th_ff0,
-+        return 0;
++    rv_op_th_ff1,
-+    }
++    rv_op_th_rev,
-+
++    rv_op_th_revw,
-+    return s->reg[addr / sizeof(uint32_t)];
++    rv_op_th_tstnbz,
-+}
++    /* XTheadBs */
-+
++    rv_op_th_tst,
-+static void mchp_pfsoc_mmuart_write(void *opaque, hwaddr addr,
++    /* XTheadCmo */
-+                                    uint64_t value, unsigned size)
++    rv_op_th_dcache_call,
-+{
++    rv_op_th_dcache_ciall,
-+    MchpPfSoCMMUartState *s = opaque;
++    rv_op_th_dcache_iall,
-+    uint32_t val32 = (uint32_t)value;
++    rv_op_th_dcache_cpa,
-+
++    rv_op_th_dcache_cipa,
-+    if (addr >= MCHP_PFSOC_MMUART_REG_SIZE) {
++    rv_op_th_dcache_ipa,
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%" HWADDR_PRIx
++    rv_op_th_dcache_cva,
-+                      " v=0x%x\n", __func__, addr, val32);
++    rv_op_th_dcache_civa,
-+        return;
++    rv_op_th_dcache_iva,
-+    }
++    rv_op_th_dcache_csw,
-+
++    rv_op_th_dcache_cisw,
-+    s->reg[addr / sizeof(uint32_t)] = val32;
++    rv_op_th_dcache_isw,
-+}
++    rv_op_th_dcache_cpal1,
-+
++    rv_op_th_dcache_cval1,
-+static const MemoryRegionOps mchp_pfsoc_mmuart_ops = {
++    rv_op_th_icache_iall,
-+    .read = mchp_pfsoc_mmuart_read,
++    rv_op_th_icache_ialls,
-+    .write = mchp_pfsoc_mmuart_write,
++    rv_op_th_icache_ipa,
-+    .endianness = DEVICE_LITTLE_ENDIAN,
++    rv_op_th_icache_iva,
-+    .impl = {
++    rv_op_th_l2cache_call,
-+        .min_access_size = 4,
++    rv_op_th_l2cache_ciall,
-+        .max_access_size = 4,
++    rv_op_th_l2cache_iall,
-+    },
++    /* XTheadCondMov */
 +    rv_op_th_mveqz,
 +    rv_op_th_mvnez,
 +    /* XTheadFMemIdx */
 +    rv_op_th_flrd,
 +    rv_op_th_flrw,
 +    rv_op_th_flurd,
 +    rv_op_th_flurw,
 +    rv_op_th_fsrd,
 +    rv_op_th_fsrw,
 +    rv_op_th_fsurd,
 +    rv_op_th_fsurw,
 +    /* XTheadFmv */
 +    rv_op_th_fmv_hw_x,
 +    rv_op_th_fmv_x_hw,
 +    /* XTheadMac */
 +    rv_op_th_mula,
 +    rv_op_th_mulah,
 +    rv_op_th_mulaw,
 +    rv_op_th_muls,
 +    rv_op_th_mulsw,
 +    rv_op_th_mulsh,
 +    /* XTheadMemIdx */
 +    rv_op_th_lbia,
 +    rv_op_th_lbib,
 +    rv_op_th_lbuia,
 +    rv_op_th_lbuib,
 +    rv_op_th_lhia,
 +    rv_op_th_lhib,
 +    rv_op_th_lhuia,
 +    rv_op_th_lhuib,
 +    rv_op_th_lwia,
 +    rv_op_th_lwib,
 +    rv_op_th_lwuia,
 +    rv_op_th_lwuib,
 +    rv_op_th_ldia,
 +    rv_op_th_ldib,
 +    rv_op_th_sbia,
 +    rv_op_th_sbib,
 +    rv_op_th_shia,
 +    rv_op_th_shib,
 +    rv_op_th_swia,
 +    rv_op_th_swib,
 +    rv_op_th_sdia,
 +    rv_op_th_sdib,
 +    rv_op_th_lrb,
 +    rv_op_th_lrbu,
 +    rv_op_th_lrh,
 +    rv_op_th_lrhu,
 +    rv_op_th_lrw,
 +    rv_op_th_lrwu,
 +    rv_op_th_lrd,
 +    rv_op_th_srb,
 +    rv_op_th_srh,
 +    rv_op_th_srw,
 +    rv_op_th_srd,
 +    rv_op_th_lurb,
 +    rv_op_th_lurbu,
 +    rv_op_th_lurh,
 +    rv_op_th_lurhu,
 +    rv_op_th_lurw,
 +    rv_op_th_lurwu,
 +    rv_op_th_lurd,
 +    rv_op_th_surb,
 +    rv_op_th_surh,
 +    rv_op_th_surw,
 +    rv_op_th_surd,
 +    /* XTheadMemPair */
 +    rv_op_th_ldd,
 +    rv_op_th_lwd,
 +    rv_op_th_lwud,
 +    rv_op_th_sdd,
 +    rv_op_th_swd,
 +    /* XTheadSync */
 +    rv_op_th_sfence_vmas,
 +    rv_op_th_sync,
 +    rv_op_th_sync_i,
 +    rv_op_th_sync_is,
 +    rv_op_th_sync_s,
 +} rv_xthead_op;
 +
 +const rv_opcode_data xthead_opcode_data[] = {
 +    { "th.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
 +    /* XTheadBa */
 +    { "th.addsl", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    /* XTheadBb */
 +    { "th.srri", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
 +    { "th.srriw", rv_codec_r2_imm5, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
 +    { "th.ext", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
 +    { "th.extu", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
 +    { "th.ff0", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
 +    { "th.ff1", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
 +    { "th.rev", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
 +    { "th.revw", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
 +    { "th.tstnbz", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
 +    /* XTheadBs */
 +    { "th.tst", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
 +    /* XTheadCmo */
 +    { "th.dcache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.dcache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.dcache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.dcache.cpa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.cipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.cva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.civa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.csw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.cisw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.isw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.cpal1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.dcache.cval1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.icache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.icache.ialls", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.icache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.icache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
 +    { "th.l2cache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.l2cache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.l2cache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    /* XTheadCondMov */
 +    { "th.mveqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.mvnez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    /* XTheadFMemIdx */
 +    { "th.flrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.flrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.flurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.flurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.fsrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.fsrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.fsurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.fsurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    /* XTheadFmv */
 +    { "th.fmv.hw.x", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    { "th.fmv.x.hw", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    /* XTheadMac */
 +    { "th.mula", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.mulaw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.mulah", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.muls", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.mulsw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.mulsh", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
 +    /* XTheadMemIdx */
 +    { "th.lbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
 +    { "th.lbuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lbuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lhia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lhib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lhuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lhuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lwia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lwib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lwuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lwuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.ldia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.ldib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.sbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.sbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.shia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.shib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.swia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.swib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.sdia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.sdib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
 +    { "th.lrb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lrd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.srb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.srh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.srw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.srd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.lurd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.surb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.surh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.surw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    { "th.surd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
 +    /* XTheadMemPair */
 +    { "th.ldd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
 +    { "th.lwd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
 +    { "th.lwud", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
 +    { "th.sdd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
 +    { "th.swd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
 +    /* XTheadSync */
 +    { "th.sfence.vmas", rv_codec_r, rv_fmt_rs1_rs2, NULL, 0, 0, 0 },
 +    { "th.sync", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.sync.i", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.sync.is", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +    { "th.sync.s", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
 +};
 +
-+MchpPfSoCMMUartState *mchp_pfsoc_mmuart_create(MemoryRegion *sysmem,
++void decode_xtheadba(rv_decode *dec, rv_isa isa)
-+    hwaddr base, qemu_irq irq, Chardev *chr)
++{
-+{
++    rv_inst inst = dec->inst;
-+    MchpPfSoCMMUartState *s;
++    rv_opcode op = rv_op_illegal;
 +
-+    s = g_new0(MchpPfSoCMMUartState, 1);
++    switch (((inst >> 0) & 0b11)) {
-+
++    case 3:
-+    memory_region_init_io(&s->iomem, NULL, &mchp_pfsoc_mmuart_ops, s,
++        switch (((inst >> 2) & 0b11111)) {
-+                          "mchp.pfsoc.mmuart", 0x1000);
++        case 2:
-+
++            /* custom-0 */
-+    s->base = base;
++            switch ((inst >> 12) & 0b111) {
-+    s->irq = irq;
++            case 1:
-+
++                switch ((inst >> 25) & 0b1111111) {
-+    s->serial = serial_mm_init(sysmem, base, 2, irq, 399193, chr,
++                case 0b0000000:
-+                               DEVICE_LITTLE_ENDIAN);
++                case 0b0000001:
-+
++                case 0b0000010:
-+    memory_region_add_subregion(sysmem, base + 0x20, &s->iomem);
++                case 0b0000011: op = rv_op_th_addsl; break;
-+
++                }
-+    return s;
++                break;
-+}
++            }
-diff --git a/MAINTAINERS b/MAINTAINERS
++            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadbb(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 1:
 +                switch ((inst >> 25) & 0b1111111) {
 +                case 0b0001010: op = rv_op_th_srriw; break;
 +                case 0b1000000:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_tstnbz;
 +                    }
 +                    break;
 +                case 0b1000001:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_rev;
 +                    }
 +                    break;
 +                case 0b1000010:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_ff0;
 +                    }
 +                    break;
 +                case 0b1000011:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_ff1;
 +                    }
 +                    break;
 +                case 0b1000100:
 +                case 0b1001000:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_revw;
 +                    }
 +                    break;
 +                case 0b0000100:
 +                case 0b0000101: op = rv_op_th_srri; break;
 +                }
 +                break;
 +            case 2: op = rv_op_th_ext; break;
 +            case 3: op = rv_op_th_extu; break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadbs(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 1:
 +                switch ((inst >> 26) & 0b111111) {
 +                case 0b100010: op = rv_op_th_tst; break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadcmo(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 0:
 +                switch ((inst >> 20 & 0b111111111111)) {
 +                case 0b000000000001:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_dcache_call;
 +                    }
 +                    break;
 +                case 0b000000000011:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_dcache_ciall;
 +                    }
 +                    break;
 +                case 0b000000000010:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_dcache_iall;
 +                    }
 +                    break;
 +                case 0b000000101001: op = rv_op_th_dcache_cpa; break;
 +                case 0b000000101011: op = rv_op_th_dcache_cipa; break;
 +                case 0b000000101010: op = rv_op_th_dcache_ipa; break;
 +                case 0b000000100101: op = rv_op_th_dcache_cva; break;
 +                case 0b000000100111: op = rv_op_th_dcache_civa; break;
 +                case 0b000000100110: op = rv_op_th_dcache_iva; break;
 +                case 0b000000100001: op = rv_op_th_dcache_csw; break;
 +                case 0b000000100011: op = rv_op_th_dcache_cisw; break;
 +                case 0b000000100010: op = rv_op_th_dcache_isw; break;
 +                case 0b000000101000: op = rv_op_th_dcache_cpal1; break;
 +                case 0b000000100100: op = rv_op_th_dcache_cval1; break;
 +                case 0b000000010000:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_icache_iall;
 +                    }
 +                    break;
 +                case 0b000000010001:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_icache_ialls;
 +                    }
 +                    break;
 +                case 0b000000111000: op = rv_op_th_icache_ipa; break;
 +                case 0b000000110000: op = rv_op_th_icache_iva; break;
 +                case 0b000000010101:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_l2cache_call;
 +                    }
 +                    break;
 +                case 0b000000010111:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_l2cache_ciall;
 +                    }
 +                    break;
 +                case 0b000000010110:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_l2cache_iall;
 +                    }
 +                    break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadcondmov(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 1:
 +                switch ((inst >> 25) & 0b1111111) {
 +                case 0b0100000: op = rv_op_th_mveqz; break;
 +                case 0b0100001: op = rv_op_th_mvnez; break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadfmemidx(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 6:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 8: op = rv_op_th_flrw; break;
 +                case 10: op = rv_op_th_flurw; break;
 +                case 12: op = rv_op_th_flrd; break;
 +                case 14: op = rv_op_th_flurd; break;
 +                }
 +                break;
 +            case 7:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 8: op = rv_op_th_fsrw; break;
 +                case 10: op = rv_op_th_fsurw; break;
 +                case 12: op = rv_op_th_fsrd; break;
 +                case 14: op = rv_op_th_fsurd; break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadfmv(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 1:
 +                switch ((inst >> 25) & 0b1111111) {
 +                case 0b1010000:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_fmv_hw_x;
 +                    }
 +                    break;
 +                case 0b1100000:
 +                    if (((inst >> 20) & 0b11111) == 0) {
 +                        op = rv_op_th_fmv_x_hw;
 +                    }
 +                    break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadmac(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 1:
 +                switch ((inst >> 25) & 0b1111111) {
 +                case 0b0010000: op = rv_op_th_mula; break;
 +                case 0b0010001: op = rv_op_th_muls; break;
 +                case 0b0010010: op = rv_op_th_mulaw; break;
 +                case 0b0010011: op = rv_op_th_mulsw; break;
 +                case 0b0010100: op = rv_op_th_mulah; break;
 +                case 0b0010101: op = rv_op_th_mulsh; break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadmemidx(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 4:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 0: op = rv_op_th_lrb; break;
 +                case 1: op = rv_op_th_lbib; break;
 +                case 2: op = rv_op_th_lurb; break;
 +                case 3: op = rv_op_th_lbia; break;
 +                case 4: op = rv_op_th_lrh; break;
 +                case 5: op = rv_op_th_lhib; break;
 +                case 6: op = rv_op_th_lurh; break;
 +                case 7: op = rv_op_th_lhia; break;
 +                case 8: op = rv_op_th_lrw; break;
 +                case 9: op = rv_op_th_lwib; break;
 +                case 10: op = rv_op_th_lurw; break;
 +                case 11: op = rv_op_th_lwia; break;
 +                case 12: op = rv_op_th_lrd; break;
 +                case 13: op = rv_op_th_ldib; break;
 +                case 14: op = rv_op_th_lurd; break;
 +                case 15: op = rv_op_th_ldia; break;
 +                case 16: op = rv_op_th_lrbu; break;
 +                case 17: op = rv_op_th_lbuib; break;
 +                case 18: op = rv_op_th_lurbu; break;
 +                case 19: op = rv_op_th_lbuia; break;
 +                case 20: op = rv_op_th_lrhu; break;
 +                case 21: op = rv_op_th_lhuib; break;
 +                case 22: op = rv_op_th_lurhu; break;
 +                case 23: op = rv_op_th_lhuia; break;
 +                case 24: op = rv_op_th_lrwu; break;
 +                case 25: op = rv_op_th_lwuib; break;
 +                case 26: op = rv_op_th_lurwu; break;
 +                case 27: op = rv_op_th_lwuia; break;
 +                }
 +                break;
 +            case 5:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 0: op = rv_op_th_srb; break;
 +                case 1: op = rv_op_th_sbib; break;
 +                case 2: op = rv_op_th_surb; break;
 +                case 3: op = rv_op_th_sbia; break;
 +                case 4: op = rv_op_th_srh; break;
 +                case 5: op = rv_op_th_shib; break;
 +                case 6: op = rv_op_th_surh; break;
 +                case 7: op = rv_op_th_shia; break;
 +                case 8: op = rv_op_th_srw; break;
 +                case 9: op = rv_op_th_swib; break;
 +                case 10: op = rv_op_th_surw; break;
 +                case 11: op = rv_op_th_swia; break;
 +                case 12: op = rv_op_th_srd; break;
 +                case 13: op = rv_op_th_sdib; break;
 +                case 14: op = rv_op_th_surd; break;
 +                case 15: op = rv_op_th_sdia; break;
 +                }
 +                break;
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadmempair(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 4:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 28: op = rv_op_th_lwd; break;
 +                case 30: op = rv_op_th_lwud; break;
 +                case 31: op = rv_op_th_ldd; break;
 +                }
 +                break;
 +            case 5:
 +                switch ((inst >> 27) & 0b11111) {
 +                case 28: op = rv_op_th_swd; break;
 +                case 31: op = rv_op_th_sdd; break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 +
 +void decode_xtheadsync(rv_decode *dec, rv_isa isa)
 +{
 +    rv_inst inst = dec->inst;
 +    rv_opcode op = rv_op_illegal;
 +
 +    switch (((inst >> 0) & 0b11)) {
 +    case 3:
 +        switch (((inst >> 2) & 0b11111)) {
 +        case 2:
 +            /* custom-0 */
 +            switch ((inst >> 12) & 0b111) {
 +            case 0:
 +                switch ((inst >> 25) & 0b1111111) {
 +                case 0b0000010: op = rv_op_th_sfence_vmas; break;
 +                case 0b0000000:
 +                    switch ((inst >> 20) & 0b11111) {
 +                    case 0b11000: op = rv_op_th_sync; break;
 +                    case 0b11010: op = rv_op_th_sync_i; break;
 +                    case 0b11011: op = rv_op_th_sync_is; break;
 +                    case 0b11001: op = rv_op_th_sync_s; break;
 +                    }
 +                    break;
 +                }
 +                break;
 +            }
 +            break;
 +            /* custom-0 */
 +        }
 +        break;
 +    }
 +
 +    dec->op = op;
 +}
 diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/disas/riscv.c
-+++ b/MAINTAINERS
++++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@ M: Bin Meng <bin.meng@windriver.com>
+@@ -XXX,XX +XXX,XX @@
- L: qemu-riscv@nongnu.org
+  */
- S: Supported
- F: hw/riscv/microchip_pfsoc.c
+ #include "qemu/osdep.h"
-+F: hw/char/mchp_pfsoc_mmuart.c
++#include "qemu/bitops.h"
- F: include/hw/riscv/microchip_pfsoc.h
+ #include "disas/dis-asm.h"
-+F: include/hw/char/mchp_pfsoc_mmuart.h
+ #include "target/riscv/cpu_cfg.h"
+ #include "disas/riscv.h"
- RX Machines
- -----------
+ /* Vendor extensions */
-diff --git a/hw/char/Kconfig b/hw/char/Kconfig
++#include "disas/riscv-xthead.h"
  #include "disas/riscv-xventana.h"
  typedef enum {
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_zcmp_rlist(rv_inst inst)
      return ((inst << 56) >> 60);
  }
 +static uint32_t operand_imm6(rv_inst inst)
 +{
 +    return (inst << 38) >> 60;
 +}
 +
 +static uint32_t operand_imm2(rv_inst inst)
 +{
 +    return (inst << 37) >> 62;
 +}
 +
 +static uint32_t operand_immh(rv_inst inst)
 +{
 +    return (inst << 32) >> 58;
 +}
 +
 +static uint32_t operand_imml(rv_inst inst)
 +{
 +    return (inst << 38) >> 58;
 +}
 +
  static uint32_t calculate_stack_adj(rv_isa isa, uint32_t rlist, uint32_t spimm)
  {
      int xlen_bytes_log2 = isa == rv64 ? 3 : 2;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
      case rv_codec_zcmt_jt:
          dec->imm = operand_tbl_index(inst);
          break;
 +    case rv_codec_r2_imm5:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        dec->imm = operand_rs2(inst);
 +        break;
 +    case rv_codec_r2:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        break;
 +    case rv_codec_r2_imm6:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        dec->imm = operand_imm6(inst);
 +        break;
 +    case rv_codec_r_imm2:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        dec->rs2 = operand_rs2(inst);
 +        dec->imm = operand_imm2(inst);
 +        break;
 +    case rv_codec_r2_immhl:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        dec->imm = operand_immh(inst);
 +        dec->imm1 = operand_imml(inst);
 +        break;
 +    case rv_codec_r2_imm2_imm5:
 +        dec->rd = operand_rd(inst);
 +        dec->rs1 = operand_rs1(inst);
 +        dec->imm = sextract32(operand_rs2(inst), 0, 5);
 +        dec->imm1 = operand_imm2(inst);
 +        break;
      };
  }
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
              snprintf(tmp, sizeof(tmp), "%u", ((uint32_t)dec->imm & 0b11111));
              append(buf, tmp, buflen);
              break;
 +        case 'j':
 +            snprintf(tmp, sizeof(tmp), "%d", dec->imm1);
 +            append(buf, tmp, buflen);
 +            break;
          case 'o':
              snprintf(tmp, sizeof(tmp), "%d", dec->imm);
              append(buf, tmp, buflen);
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
          void (*decode_func)(rv_decode *, rv_isa);
      } decoders[] = {
          { always_true_p, rvi_opcode_data, decode_inst_opcode },
 +        { has_xtheadba_p, xthead_opcode_data, decode_xtheadba },
 +        { has_xtheadbb_p, xthead_opcode_data, decode_xtheadbb },
 +        { has_xtheadbs_p, xthead_opcode_data, decode_xtheadbs },
 +        { has_xtheadcmo_p, xthead_opcode_data, decode_xtheadcmo },
 +        { has_xtheadcondmov_p, xthead_opcode_data, decode_xtheadcondmov },
 +        { has_xtheadfmemidx_p, xthead_opcode_data, decode_xtheadfmemidx },
 +        { has_xtheadfmv_p, xthead_opcode_data, decode_xtheadfmv },
 +        { has_xtheadmac_p, xthead_opcode_data, decode_xtheadmac },
 +        { has_xtheadmemidx_p, xthead_opcode_data, decode_xtheadmemidx },
 +        { has_xtheadmempair_p, xthead_opcode_data, decode_xtheadmempair },
 +        { has_xtheadsync_p, xthead_opcode_data, decode_xtheadsync },
          { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
      };
 diff --git a/disas/meson.build b/disas/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/Kconfig
+--- a/disas/meson.build
-+++ b/hw/char/Kconfig
++++ b/disas/meson.build
-@@ -XXX,XX +XXX,XX @@ config RENESAS_SCI
+@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
+ common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
- config AVR_USART
+ common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
-     bool
+     'riscv.c',
-+
++    'riscv-xthead.c',
-+config MCHP_PFSOC_MMUART
+     'riscv-xventana.c'
-+    bool
+ ))
-diff --git a/hw/char/meson.build b/hw/char/meson.build
+ common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/meson.build
 +++ b/hw/char/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_aux.c'))
  softmmu_ss.add(when: 'CONFIG_RENESAS_SCI', if_true: files('renesas_sci.c'))
  softmmu_ss.add(when: 'CONFIG_SH4', if_true: files('sh_serial.c'))
  softmmu_ss.add(when: 'CONFIG_STM32F2XX_USART', if_true: files('stm32f2xx_usart.c'))
 +softmmu_ss.add(when: 'CONFIG_MCHP_PFSOC_MMUART', if_true: files('mchp_pfsoc_mmuart.c'))
  specific_ss.add(when: 'CONFIG_TERMINAL3270', if_true: files('terminal3270.c'))
  specific_ss.add(when: 'CONFIG_VIRTIO', if_true: files('virtio-serial-bus.c'))
 --
-.28.0
+.40.1

-New patch
+[PULL 09/54] target/riscv: Make MPV only work when MPP != PRV_M
+From: Weiwei Li <liweiwei@iscas.ac.cn>
+Upon MRET or explicit memory access with MPRV=1, MPV should be ignored
+when MPP=PRV_M.
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230603134236.15719-2-liweiwei@iscas.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_helper.c | 3 ++-
+ target/riscv/op_helper.c  | 3 ++-
+files changed, 4 insertions(+), 2 deletions(-)
+diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_helper.c
++++ b/target/riscv/cpu_helper.c
+@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
+         if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
+             mode = get_field(env->mstatus, MSTATUS_MPP);
+-            virt = get_field(env->mstatus, MSTATUS_MPV);
++            virt = get_field(env->mstatus, MSTATUS_MPV) &&
++                   (mode != PRV_M);
+             if (virt) {
+                 status = env->vsstatus;
+             }
+diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/op_helper.c
++++ b/target/riscv/op_helper.c
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
+         riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
+     }
+-    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV);
++    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) &&
++                             (prev_priv != PRV_M);
+     mstatus = set_field(mstatus, MSTATUS_MIE,
+                         get_field(mstatus, MSTATUS_MPIE));
+     mstatus = set_field(mstatus, MSTATUS_MPIE, 1);
+--
+.40.1

-New patch
+[PULL 10/54] target/riscv: Support MSTATUS.MPV/GVA only when RVH is enabled
+From: Weiwei Li <liweiwei@iscas.ac.cn>
+MPV and GVA bits are added by hypervisor extension to mstatus
+and mstatush (if MXLEN=32).
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230603134236.15719-3-liweiwei@iscas.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/csr.c | 10 ++++------
+file changed, 4 insertions(+), 6 deletions(-)
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/csr.c
++++ b/target/riscv/csr.c
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
+     }
+     if (xl != MXL_RV32 || env->debugger) {
+-        /*
+-         * RV32: MPV and GVA are not in mstatus. The current plan is to
+-         * add them to mstatush. For now, we just don't support it.
+-         */
+-        mask |= MSTATUS_MPV | MSTATUS_GVA;
++        if (riscv_has_ext(env, RVH)) {
++            mask |= MSTATUS_MPV | MSTATUS_GVA;
++        }
+         if ((val & MSTATUS64_UXL) != 0) {
+             mask |= MSTATUS64_UXL;
+         }
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
+                                      target_ulong val)
+ {
+     uint64_t valh = (uint64_t)val << 32;
+-    uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
++    uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
+     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
+--
+.40.1

-New patch
+[PULL 11/54] target/riscv: Remove redundant assignment to SXL
+From: Weiwei Li <liweiwei@iscas.ac.cn>
+SXL is initialized as env->misa_mxl which is also the mxl value.
+So we can just remain it unchanged to keep it read-only.
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230603134236.15719-4-liweiwei@iscas.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/csr.c | 4 ----
+file changed, 4 deletions(-)
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/csr.c
++++ b/target/riscv/csr.c
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
+     mstatus = (mstatus & ~mask) | (val & mask);
+-    if (xl > MXL_RV32) {
+-        /* SXL field is for now read only */
+-        mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
+-    }
+     env->mstatus = mstatus;
+     /*
+--
+.40.1

-New patch
+[PULL 12/54] target/riscv/cpu.c: fix veyron-v1 CPU properties
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Commit 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from
+riscv_cpu_init()") removed code that was enabling mmu, pmp, ext_ifencei
+and ext_icsr from riscv_cpu_init(), the init() function of
+TYPE_RISCV_CPU, parent type of all RISC-V CPUss. This was done to force
+CPUs to explictly enable all extensions and features it requires,
+without any 'magic values' that were inherited by the parent type.
+This commit failed to make appropriate changes in the 'veyron-v1' CPU,
+added earlier by commit e1d084a8524a. The result is that the veyron-v1
+CPU has ext_ifencei, ext_icsr and pmp set to 'false', which is not the
+case.
+The reason why it took this long to notice (thanks LIU Zhiwei for
+reporting it) is because Linux doesn't mind 'ifencei' and 'icsr' being
+absent in the 'riscv,isa' DT, implying that they're both present if the
+'i' extension is enabled. OpenSBI also doesn't error out or warns about
+the lack of 'pmp', it'll just not protect memory pages.
+Fix it by setting them to 'true' in rv64_veyron_v1_cpu_init() like
+f0bdfb5bfc2 already did with other CPUs.
+Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Fixes: 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from riscv_cpu_init()")
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Message-Id: <20230620152443.137079-1-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.c | 3 +++
+file changed, 3 insertions(+)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void rv64_veyron_v1_cpu_init(Object *obj)
+     /* Enable ISA extensions */
+     cpu->cfg.mmu = true;
++    cpu->cfg.ext_ifencei = true;
++    cpu->cfg.ext_icsr = true;
++    cpu->cfg.pmp = true;
+     cpu->cfg.ext_icbom = true;
+     cpu->cfg.cbom_blocksize = 64;
+     cpu->cfg.cboz_blocksize = 64;
+--
+.40.1

-[PULL 01/30] target/riscv: Fix bug in getting trap cause name for trace_riscv_trap
+[PULL 13/54] target/riscv: Add additional xlen for address when MPRV=1
-From: Yifei Jiang <jiangyifei@huawei.com>
+From: Weiwei Li <liweiwei@iscas.ac.cn>
-When the cause number is equal to or greater than 23, print "(unknown)" in
+As specified in privilege spec:"When MPRV=1, load and store memory
-trace_riscv_trap. The max valid number of riscv_excp_names is 23, so the last
+addresses are treated as though the current XLEN were set to MPP’s
-excpetion "guest_store_page_fault" can not be printed.
+XLEN". So the xlen for address may be different from current xlen.
-In addition, the current check of cause is invalid for riscv_intr_names. So
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-introduce riscv_cpu_get_trap_name to get the trap cause name.
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
+Message-Id: <20230614032547.35895-2-liweiwei@iscas.ac.cn>
 Signed-off-by: Yipeng Yin <yinyipeng1@huawei.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20200814035819.1214-1-jiangyifei@huawei.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        |  1 +
+ target/riscv/cpu.h        | 49 +++++++++++++++++++++++++++++++++------
- target/riscv/cpu.c        | 11 +++++++++++
+ target/riscv/cpu_helper.c |  1 +
- target/riscv/cpu_helper.c |  4 ++--
+ target/riscv/translate.c  | 13 ++++++++++-
-files changed, 14 insertions(+), 2 deletions(-)
+files changed, 55 insertions(+), 8 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ extern const char * const riscv_fpr_regnames[];
+@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, ITRIGGER, 22, 1)
- extern const char * const riscv_excp_names[];
+ /* Virtual mode enabled */
- extern const char * const riscv_intr_names[];
+ FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
+ FIELD(TB_FLAGS, PRIV, 24, 2)
-+const char *riscv_cpu_get_trap_name(target_ulong cause, bool async);
++FIELD(TB_FLAGS, AXL, 26, 2)
- void riscv_cpu_do_interrupt(CPUState *cpu);
- int riscv_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
+ #ifdef TARGET_RISCV32
- int riscv_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+ #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static inline const RISCVCPUConfig *riscv_cpu_cfg(CPURISCVState *env)
-index XXXXXXX..XXXXXXX 100644
+     return &env_archcpu(env)->cfg;
---- a/target/riscv/cpu.c
+ }
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ const char * const riscv_intr_names[] = {
+-#if defined(TARGET_RISCV32)
-     "reserved"
+-#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
- };
+-#else
+-static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
-+const char *riscv_cpu_get_trap_name(target_ulong cause, bool async)
++#if !defined(CONFIG_USER_ONLY)
 +static inline int cpu_address_mode(CPURISCVState *env)
 +{
-+    if (async) {
++    int mode = env->priv;
-+        return (cause < ARRAY_SIZE(riscv_intr_names)) ?
++
-+               riscv_intr_names[cause] : "(unknown)";
++    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
-+    } else {
++        mode = get_field(env->mstatus, MSTATUS_MPP);
 +        return (cause < ARRAY_SIZE(riscv_excp_names)) ?
 +               riscv_excp_names[cause] : "(unknown)";
 +    }
++    return mode;
 +}
 +
- static void set_misa(CPURISCVState *env, target_ulong misa)
++static inline RISCVMXL cpu_get_xl(CPURISCVState *env, target_ulong mode)
  {
-     env->misa_mask = env->misa = misa;
+     RISCVMXL xl = env->misa_mxl;
 -#if !defined(CONFIG_USER_ONLY)
      /*
       * When emulating a 32-bit-only cpu, use RV32.
       * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
       * back to RV64 for lower privs.
       */
      if (xl != MXL_RV32) {
 -        switch (env->priv) {
 +        switch (mode) {
          case PRV_M:
              break;
          case PRV_U:
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
              break;
          }
      }
 -#endif
      return xl;
  }
  #endif
 +#if defined(TARGET_RISCV32)
 +#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
 +#else
 +static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
 +{
 +#if !defined(CONFIG_USER_ONLY)
 +    return cpu_get_xl(env, env->priv);
 +#else
 +    return env->misa_mxl;
 +#endif
 +}
 +#endif
 +
 +#if defined(TARGET_RISCV32)
 +#define cpu_address_xl(env)  ((void)(env), MXL_RV32)
 +#else
 +static inline RISCVMXL cpu_address_xl(CPURISCVState *env)
 +{
 +#ifdef CONFIG_USER_ONLY
 +    return env->xl;
 +#else
 +    int mode = cpu_address_mode(env);
 +
 +    return cpu_get_xl(env, mode);
 +#endif
 +}
 +#endif
 +
  static inline int riscv_cpu_xlen(CPURISCVState *env)
  {
      return 16 << env->xl;
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
-         }
+     flags = FIELD_DP32(flags, TB_FLAGS, FS, fs);
      flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
      flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
 +    flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
      if (env->cur_pmmask != 0) {
          flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
      }
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
--    trace_riscv_trap(env->mhartid, async, cause, env->pc, tval, cause < 23 ?
+index XXXXXXX..XXXXXXX 100644
--        (async ? riscv_intr_names : riscv_excp_names)[cause] : "(unknown)");
+--- a/target/riscv/translate.c
-+    trace_riscv_trap(env->mhartid, async, cause, env->pc, tval,
++++ b/target/riscv/translate.c
-+        riscv_cpu_get_trap_name(cause, async));
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+     target_ulong priv_ver;
-     if (env->priv <= PRV_S &&
+     RISCVMXL misa_mxl_max;
-             cause < TARGET_LONG_BITS && ((deleg >> cause) & 1)) {
+     RISCVMXL xl;
 +    RISCVMXL address_xl;
      uint32_t misa_ext;
      uint32_t opcode;
      RISCVExtStatus mstatus_fs;
@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
  #define get_xl(ctx)    ((ctx)->xl)
  #endif
 +#ifdef TARGET_RISCV32
 +#define get_address_xl(ctx)    MXL_RV32
 +#elif defined(CONFIG_USER_ONLY)
 +#define get_address_xl(ctx)    MXL_RV64
 +#else
 +#define get_address_xl(ctx)    ((ctx)->address_xl)
 +#endif
 +
  /* The word size for this machine mode. */
  static inline int __attribute__((unused)) get_xlen(DisasContext *ctx)
  {
@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
      tcg_gen_addi_tl(addr, src1, imm);
      if (ctx->pm_mask_enabled) {
          tcg_gen_andc_tl(addr, addr, pm_mask);
 -    } else if (get_xl(ctx) == MXL_RV32) {
 +    } else if (get_address_xl(ctx) == MXL_RV32) {
          tcg_gen_ext32u_tl(addr, addr);
      }
      if (ctx->pm_base_enabled) {
          tcg_gen_or_tl(addr, addr, pm_base);
      }
 +
      return addr;
  }
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
      ctx->misa_mxl_max = env->misa_mxl_max;
      ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
 +    ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
      ctx->cs = cs;
      ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
      ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
 --
-.28.0
+.40.1

-[PULL 17/30] hw/riscv: clint: Avoid using hard-coded timebase frequency
+[PULL 14/54] target/riscv: update cur_pmbase/pmmask based on mode affected by MPRV
-From: Bin Meng <bin.meng@windriver.com>
+From: Weiwei Li <liweiwei@iscas.ac.cn>
-At present the CLINT timestamp is using a hard-coded timebase
+Pointer mask is also affected by MPRV which means cur_pmbase/pmmask
-frequency value SIFIVE_CLINT_TIMEBASE_FREQ. This might not be
+should also take MPRV into consideration. As pointer mask for instruction
-true for all boards.
+is not supported currently, so we can directly update cur_pmbase/pmmask
 based on address related mode and xlen affected by MPRV now.
-Add a new 'timebase-freq' property to the CLINT device, and
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-update various functions to accept this as a parameter.
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Message-Id: <20230614032547.35895-3-liweiwei@iscas.ac.cn>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <1598924352-89526-16-git-send-email-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/sifive_clint.h |  4 +++-
+ target/riscv/cpu_helper.c |  7 +++++--
- target/riscv/cpu.h              |  6 ++++--
+ target/riscv/csr.c        | 27 ++++++++++++++++++++-------
- hw/riscv/microchip_pfsoc.c      |  6 +++++-
+files changed, 25 insertions(+), 9 deletions(-)
  hw/riscv/sifive_clint.c         | 26 +++++++++++++++-----------
  hw/riscv/sifive_e.c             |  3 ++-
  hw/riscv/sifive_u.c             |  3 ++-
  hw/riscv/spike.c                |  3 ++-
  hw/riscv/virt.c                 |  3 ++-
  target/riscv/cpu_helper.c       |  4 +++-
  target/riscv/csr.c              |  4 ++--
 files changed, 40 insertions(+), 22 deletions(-)
-diff --git a/include/hw/riscv/sifive_clint.h b/include/hw/riscv/sifive_clint.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/sifive_clint.h
-+++ b/include/hw/riscv/sifive_clint.h
-@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveCLINTState {
-     uint32_t timecmp_base;
-     uint32_t time_base;
-     uint32_t aperture_size;
-+    uint32_t timebase_freq;
- } SiFiveCLINTState;
- DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
-     uint32_t hartid_base, uint32_t num_harts, uint32_t sip_base,
--    uint32_t timecmp_base, uint32_t time_base, bool provide_rdtime);
-+    uint32_t timecmp_base, uint32_t time_base, uint32_t timebase_freq,
-+    bool provide_rdtime);
- enum {
-     SIFIVE_SIP_BASE     = 0x0,
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
-     pmp_table_t pmp_state;
-     /* machine specific rdtime callback */
--    uint64_t (*rdtime_fn)(void);
-+    uint64_t (*rdtime_fn)(uint32_t);
-+    uint32_t rdtime_fn_arg;
-     /* True if in debugger mode.  */
-     bool debugger;
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env);
- int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint32_t interrupts);
- uint32_t riscv_cpu_update_mip(RISCVCPU *cpu, uint32_t mask, uint32_t value);
- #define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
--void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(void));
-+void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(uint32_t),
-+                             uint32_t arg);
- #endif
- void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv);
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/microchip_pfsoc.c
-+++ b/hw/riscv/microchip_pfsoc.c
-@@ -XXX,XX +XXX,XX @@
- #define BIOS_FILENAME   "hss.bin"
- #define RESET_VECTOR    0x20220000
-+/* CLINT timebase frequency */
-+#define CLINT_TIMEBASE_FREQ 1000000
-+
- /* GEM version */
- #define GEM_REVISION    0x0107010c
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
-     /* CLINT */
-     sifive_clint_create(memmap[MICROCHIP_PFSOC_CLINT].base,
-         memmap[MICROCHIP_PFSOC_CLINT].size, 0, ms->smp.cpus,
--        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
-+        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
-+        CLINT_TIMEBASE_FREQ, false);
-     /* L2 cache controller */
-     create_unimplemented_device("microchip.pfsoc.l2cc",
-diff --git a/hw/riscv/sifive_clint.c b/hw/riscv/sifive_clint.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_clint.c
-+++ b/hw/riscv/sifive_clint.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/riscv/sifive_clint.h"
- #include "qemu/timer.h"
--static uint64_t cpu_riscv_read_rtc(void)
-+static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
- {
-     return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
--        SIFIVE_CLINT_TIMEBASE_FREQ, NANOSECONDS_PER_SECOND);
-+        timebase_freq, NANOSECONDS_PER_SECOND);
- }
- /*
-  * Called when timecmp is written to update the QEMU timer or immediately
-  * trigger timer interrupt if mtimecmp <= current timer value.
-  */
--static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value)
-+static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
-+                                       uint32_t timebase_freq)
- {
-     uint64_t next;
-     uint64_t diff;
--    uint64_t rtc_r = cpu_riscv_read_rtc();
-+    uint64_t rtc_r = cpu_riscv_read_rtc(timebase_freq);
-     cpu->env.timecmp = value;
-     if (cpu->env.timecmp <= rtc_r) {
-@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value)
-     diff = cpu->env.timecmp - rtc_r;
-     /* back to ns (note args switched in muldiv64) */
-     next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
--        muldiv64(diff, NANOSECONDS_PER_SECOND, SIFIVE_CLINT_TIMEBASE_FREQ);
-+        muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
-     timer_mod(cpu->env.timer, next);
- }
-@@ -XXX,XX +XXX,XX @@ static uint64_t sifive_clint_read(void *opaque, hwaddr addr, unsigned size)
-         }
-     } else if (addr == clint->time_base) {
-         /* time_lo */
--        return cpu_riscv_read_rtc() & 0xFFFFFFFF;
-+        return cpu_riscv_read_rtc(clint->timebase_freq) & 0xFFFFFFFF;
-     } else if (addr == clint->time_base + 4) {
-         /* time_hi */
--        return (cpu_riscv_read_rtc() >> 32) & 0xFFFFFFFF;
-+        return (cpu_riscv_read_rtc(clint->timebase_freq) >> 32) & 0xFFFFFFFF;
-     }
-     error_report("clint: invalid read: %08x", (uint32_t)addr);
-@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write(void *opaque, hwaddr addr, uint64_t value,
-             /* timecmp_lo */
-             uint64_t timecmp_hi = env->timecmp >> 32;
-             sifive_clint_write_timecmp(RISCV_CPU(cpu),
--                timecmp_hi << 32 | (value & 0xFFFFFFFF));
-+                timecmp_hi << 32 | (value & 0xFFFFFFFF), clint->timebase_freq);
-             return;
-         } else if ((addr & 0x7) == 4) {
-             /* timecmp_hi */
-             uint64_t timecmp_lo = env->timecmp;
-             sifive_clint_write_timecmp(RISCV_CPU(cpu),
--                value << 32 | (timecmp_lo & 0xFFFFFFFF));
-+                value << 32 | (timecmp_lo & 0xFFFFFFFF), clint->timebase_freq);
-         } else {
-             error_report("clint: invalid timecmp write: %08x", (uint32_t)addr);
-         }
-@@ -XXX,XX +XXX,XX @@ static Property sifive_clint_properties[] = {
-     DEFINE_PROP_UINT32("timecmp-base", SiFiveCLINTState, timecmp_base, 0),
-     DEFINE_PROP_UINT32("time-base", SiFiveCLINTState, time_base, 0),
-     DEFINE_PROP_UINT32("aperture-size", SiFiveCLINTState, aperture_size, 0),
-+    DEFINE_PROP_UINT32("timebase-freq", SiFiveCLINTState, timebase_freq, 0),
-     DEFINE_PROP_END_OF_LIST(),
- };
-@@ -XXX,XX +XXX,XX @@ type_init(sifive_clint_register_types)
-  */
- DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
-     uint32_t hartid_base, uint32_t num_harts, uint32_t sip_base,
--    uint32_t timecmp_base, uint32_t time_base, bool provide_rdtime)
-+    uint32_t timecmp_base, uint32_t time_base, uint32_t timebase_freq,
-+    bool provide_rdtime)
- {
-     int i;
-     for (i = 0; i < num_harts; i++) {
-@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
-             continue;
-         }
-         if (provide_rdtime) {
--            riscv_cpu_set_rdtime_fn(env, cpu_riscv_read_rtc);
-+            riscv_cpu_set_rdtime_fn(env, cpu_riscv_read_rtc, timebase_freq);
-         }
-         env->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                   &sifive_clint_timer_cb, cpu);
-@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
-     qdev_prop_set_uint32(dev, "timecmp-base", timecmp_base);
-     qdev_prop_set_uint32(dev, "time-base", time_base);
-     qdev_prop_set_uint32(dev, "aperture-size", size);
-+    qdev_prop_set_uint32(dev, "timebase-freq", timebase_freq);
-     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
-     return dev;
-diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_e.c
-+++ b/hw/riscv/sifive_e.c
-@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
-         memmap[SIFIVE_E_PLIC].size);
-     sifive_clint_create(memmap[SIFIVE_E_CLINT].base,
-         memmap[SIFIVE_E_CLINT].size, 0, ms->smp.cpus,
--        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
-+        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
-+        SIFIVE_CLINT_TIMEBASE_FREQ, false);
-     create_unimplemented_device("riscv.sifive.e.aon",
-         memmap[SIFIVE_E_AON].base, memmap[SIFIVE_E_AON].size);
-     sifive_e_prci_create(memmap[SIFIVE_E_PRCI].base);
-diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_u.c
-+++ b/hw/riscv/sifive_u.c
-@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
-         serial_hd(1), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_U_UART1_IRQ));
-     sifive_clint_create(memmap[SIFIVE_U_CLINT].base,
-         memmap[SIFIVE_U_CLINT].size, 0, ms->smp.cpus,
--        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
-+        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
-+        SIFIVE_CLINT_TIMEBASE_FREQ, false);
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->prci), errp)) {
-         return;
-diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/spike.c
-+++ b/hw/riscv/spike.c
-@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
-         sifive_clint_create(
-             memmap[SPIKE_CLINT].base + i * memmap[SPIKE_CLINT].size,
-             memmap[SPIKE_CLINT].size, base_hartid, hart_count,
--            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
-+            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
-+            SIFIVE_CLINT_TIMEBASE_FREQ, false);
-     }
-     /* register system main memory (actual RAM) */
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
-+++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
-         sifive_clint_create(
-             memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
-             memmap[VIRT_CLINT].size, base_hartid, hart_count,
--            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, true);
-+            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
-+            SIFIVE_CLINT_TIMEBASE_FREQ, true);
-         /* Per-socket PLIC hart topology configuration string */
-         plic_hart_config_len =
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ uint32_t riscv_cpu_update_mip(RISCVCPU *cpu, uint32_t mask, uint32_t value)
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
-     return old;
+ void riscv_cpu_update_mask(CPURISCVState *env)
  }
 -void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(void))
 +void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(uint32_t),
 +                             uint32_t arg)
  {
-     env->rdtime_fn = fn;
+     target_ulong mask = 0, base = 0;
-+    env->rdtime_fn_arg = arg;
++    RISCVMXL xl = env->xl;
- }
+     /*
+      * TODO: Current RVJ spec does not specify
- void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
+      * how the extension interacts with XLEN.
       */
  #ifndef CONFIG_USER_ONLY
 +    int mode = cpu_address_mode(env);
 +    xl = cpu_get_xl(env, mode);
      if (riscv_has_ext(env, RVJ)) {
 -        switch (env->priv) {
 +        switch (mode) {
          case PRV_M:
              if (env->mmte & M_PM_ENABLE) {
                  mask = env->mpmmask;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_update_mask(CPURISCVState *env)
          }
      }
  #endif
 -    if (env->xl == MXL_RV32) {
 +    if (xl == MXL_RV32) {
          env->cur_pmmask = mask & UINT32_MAX;
          env->cur_pmbase = base & UINT32_MAX;
      } else {
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static int read_time(CPURISCVState *env, int csrno, target_ulong *val)
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
-         return -RISCV_EXCP_ILLEGAL_INST;
+      */
      if (env->debugger) {
          env->xl = cpu_recompute_xl(env);
 -        riscv_cpu_update_mask(env);
      }
++
--    *val = env->rdtime_fn() + delta;
++    riscv_cpu_update_mask(env);
-+    *val = env->rdtime_fn(env->rdtime_fn_arg) + delta;
+     return RISCV_EXCP_NONE;
      return 0;
  }
-@@ -XXX,XX +XXX,XX @@ static int read_timeh(CPURISCVState *env, int csrno, target_ulong *val)
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
-         return -RISCV_EXCP_ILLEGAL_INST;
+     uint64_t mstatus;
      env->mpmmask = val;
 -    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
          env->cur_pmmask = val;
      }
+     env->mmte |= EXT_STATUS_DIRTY;
--    *val = (env->rdtime_fn() + delta) >> 32;
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmmask(CPURISCVState *env, int csrno,
-+    *val = (env->rdtime_fn(env->rdtime_fn_arg) + delta) >> 32;
+         return RISCV_EXCP_NONE;
-     return 0;
+     }
- }
+     env->spmmask = val;
- #endif
+-    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
          env->cur_pmmask = val;
 +        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
 +            env->cur_pmmask &= UINT32_MAX;
 +        }
      }
      env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmmask(CPURISCVState *env, int csrno,
          return RISCV_EXCP_NONE;
      }
      env->upmmask = val;
 -    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
          env->cur_pmmask = val;
 +        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
 +            env->cur_pmmask &= UINT32_MAX;
 +        }
      }
      env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
      uint64_t mstatus;
      env->mpmbase = val;
 -    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
          env->cur_pmbase = val;
      }
      env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmbase(CPURISCVState *env, int csrno,
          return RISCV_EXCP_NONE;
      }
      env->spmbase = val;
 -    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
          env->cur_pmbase = val;
 +        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
 +            env->cur_pmbase &= UINT32_MAX;
 +        }
      }
      env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
          return RISCV_EXCP_NONE;
      }
      env->upmbase = val;
 -    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
 +    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
          env->cur_pmbase = val;
 +        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
 +            env->cur_pmbase &= UINT32_MAX;
 +        }
      }
      env->mmte |= EXT_STATUS_DIRTY;
 --
-.28.0
+.40.1

-New patch
+[PULL 15/54] roms/opensbi: Upgrade from v1.2 to v1.3
+From: Bin Meng <bmeng@tinylab.org>
+Upgrade OpenSBI from v1.2 to v1.3 and the pre-built bios images.
+The v1.3 release includes the following commits:
+fa81 treewide: Replace TRUE/FALSE with true/false
+6509127 Makefile: Remove -N ldflag to prevent linker RWX warning
+f8 lib: utils/sys: Allow custom HTIF base address for RV32
+f14595a lib: sbi: Allow platform to influence cold boot HART selection
+ae0 platform: generic: Allow platform_override to select cold boot HART
+cb7e7c3 platform: generic: Allow platform_override to perform firmware init
+df8 generic/starfive: Add Starfive JH7110 platform implementation
+6997552 lib: sbi_hsm: Rename 'priv' argument to 'arg1'
+e397e3 docs: domain_support: Use capital letter for privilege modes
+e0ba09 include: sbi: Fine grain the permissions for M and SU modes
+aace1e1 lib: sbi: Use finer permission semantics for address validation
+dbdb3 lib: sbi: Add permissions for the firmware start till end
+ac14f1 lib: sbi: Use finer permission sematics to decide on PMP bits
+f736c lib: sbi: Modify the boot time region flag prints
+e0 lib: utils: Use SU-{R/W/X} flags for region permissions during parsing
+e2f573 lib: utils: Disallow non-root domains from adding M-mode regions
+a08cd lib: utils: Add M-mode {R/W} flags to the MMIO regions
+d docs: Update domain's region permissions and requirements
+da5594b platform: generic: allwinner: Fix PLIC array bounds
+ce2a834 docs: generic.md: fix typo of andes-ae350
+ecbe6d lib: sbi_hsm: handle failure when hart_stop returns SBI_ENOTSUPP
+b1818ee include: types: add always inline compiler attribute
+c4eb35 lib: utils: atcsmu: Add Andes System Management Unit support
+a platform: andes/ae350: Implement hart hotplug using HSM extension
+aaeeab lib: reset/fdt_reset_atcwdt200: Use defined macros and function in atcsmu.h
+a990309 lib: utils: Fix reserved memory node for firmware memory
+fefa548 firmware: Split RO/RX and RW sections
+f40a99 firmware: Move dynsym and reladyn sections to RX section
+c10e3fe firmware: Add RW section offset in scratch
+b666760 lib: sbi: Print the RW section offset
+d lib: sbi: Add separate entries for firmware RX and RW regions
+dea0922 platform: renesas/rzfive: Configure Local memory regions as part of root domain
+bf917 lib: utils: Add fdt_add_cpu_idle_states() helper function
+c45992c platform: generic: allwinner: Advertise nonretentive suspend
+c8ea836 firmware: Fix fw_rw_offset computation in fw_base.S
+8050081 firmware: Not to clear all the MIP
+d15f4 lib: sbi_hsm: Use csr_set to restore the MIP
+b lib: utils: Mark only the largest region as reserved in FDT
+b0e23 lib: sbi: Ensure domidx_to_domain_table is null-terminated
+f3de Makefile: Add missing .dep files for fw_*.elf.ld
+b34d8 include: Add support for byteorder/endianness conversion
+bea0 lib: utils/fdt: Use byteorder conversion functions in libfdt_env.h
+b224ddb include: types: Add typedefs for endianness
+aa5dafc include: sbi: Fix BSWAPx() macros for big-endian host
+e3bf1af include: Add defines for SBI debug console extension
+ee3a86 lib: sbi: Add sbi_nputs() function
+e0572f lib: sbi: Add sbi_ngets() function
+eab48c3 lib: sbi: Add sbi_domain_check_addr_range() function
+a41a38 lib: sbi: Implement SBI debug console extension
+c43903c lib: sbi: Add console_puts() callback in the console device
+ae lib: utils/serial: Implement console_puts() for semihosting
+c2190 lib: sbi: Speed-up sbi_printf() and friends using nputs()
+c lib: utils/fdt: Fix fdt_pmu.c header dependency
+aafcc90 platform: generic/allwinner: Fix sun20i-d1.c header dependency
+aaec platform: generic/andes: Fix ae350.c header dependency
+d09b6 include: fdt/fdt_helper: Change fdt_get_address() to return root.next_arg1
+ee9 lib: utils: fdt_fixup: Fix compile error
+f2be40 docs: fix typo in fw.md
+ea806 lib: sbi_hart: Enable hcontext and scontext
+adc62 lib: sbi: Align SBI vendor extension id with mvendorid CSR
+b82e0 include: sbi: Remove extid parameter from vendor_ext_provider() callback
+c100951 platform: generic: renesas: rzfive: Add support to configure the PMA
+2491242 platform: generic: renesas: rzfive: Configure the PMA region
+b2a40 lib: sbi: sbi_ecall: Check the range of SBI error
+a75f53 lib: sbi/sbi_domain: cosmetic style fixes
+bc06ff6 lib: utils/fdt/fdt_domain: Simplify region access permission check
+b3776 docs: domain_support: Update the DT example
+d5a lib: sbi_hsm: Factor out invalid state detection
+f16a8 lib: sbi_hsm: Don't try to restore state on failed change
+c88e039 lib: sbi_hsm: Ensure errors are consistent with spec
+b1ae6ef lib: sbi_hsm: Move misplaced comment
+fc lib: sbi_hsm: Remove unnecessary include
+a40306 lib: sbi_hsm: Export some functions
+a0 lib: sbi: Add system suspend skeleton
+c9917b6 lib: sbi: Add system_suspend_allowed domain property
+c964e2 lib: sbi: Implement system suspend
+dc docs: Correct opensbi-domain property name
+ccebf0 platform: generic: Add system suspend test
+be1b gpio/starfive: add gpio driver and support gpio reset
+b28afc make: Add a command line option for debugging OpenSBI
+e9d08bd lib: utils/i2c: Add minimal StarFive jh7110 I2C driver
+ea49 platform: starfive: add PMIC power ops in JH7110 visionfive2 board
+f lib: serial: Cadence: Enable compatibility for cdns,uart-r1p8
+fe8dc9 lib: sbi_pmu: add callback for counter width
+d9 lib: sbi_pmu: Implement sbi_pmu_counter_fw_read_hi
+c358e lib: sbi_pmu: Reserve space for implementation specific firmware events
+e4b4 lib: sbi_pmu: Rename fw_counter_value
+b51ddff lib: sbi_pmu: Update sbi_pmu dev ops
+d2e9 lib: sbi_pmu: Use dedicated event code for platform firmware events
+d3aa3 lib: sbi_pmu: Introduce fw_counter_write_value API
+c631a7d lib: sbi_pmu: Add hartid parameter PMU device ops
+d56049e lib: sbi: Refactor the calls to sbi_hart_switch_mode()
+e8e9ed3 lib: sbi: Set the state of a hart to START_PENDING after the hart is ready
+c6a092c lib: sbi: Clear IPIs before init_warm_startup in non-boot harts
+ed88a63 lib: sbi_scratch: Optimize the alignment code for alloc size
+ab11d lib: sbi: Fix how to check whether the domain contains fw_region
+f64dfcd lib: sbi: Introduce sbi_entry_count() function
+b9e7e lib: sbi_hsm: Fix sbi_hsm_hart_start() for platform with hart hotplug
+e90259 lib: sbi_hart: clear mip csr during hart init
+ba2b2 include: Add defines for SBI CPPC extension
+caae8 lib: sbi: Implement SBI CPPC extension
+d0 lib: sbi: Print the CPPC device name
+edc9914 lib: sbi_pmu: Align the event type offset as per SBI specification
+ee016a7 docs: Correct FW_JUMP_FDT_ADDR calculation example
+f26 lib: utils: fdt_fixup: avoid buffer overrun
+fa925 lib: sbi: Optimize sbi_tlb
+dde46 lib: sbi: Optimize sbi_ipi
+ab sbi: tlb: Simplify to tlb_process_count/tlb_process function
+bf40e07 lib: sbi: Optimize sbi_tlb queue waiting
+eeab500 platform: generic: andes/renesas: Add SBI EXT to check for enabling IOCP errata
+f692289 firmware: Optimize loading relocation type
+e41dbb5 firmware: Change to use positive offset to access relocation entries
+bdb3c42 lib: sbi: Do not clear active_events for cycle/instret when stopping
+e019 lib: sbi: Fix counter index calculation for SBI_PMU_CFG_FLAG_SKIP_MATCH
+f5dfd99 lib: sbi: Don't check SBI error range for legacy console getchar
+7919530 lib: sbi: Add debug print when sbi_pmu_init fails
+e33530 lib: sbi: Remove unnecessary semicolon
+bc02de lib: sbi: Simplify sbi_ipi_process remove goto
+dc1c7db lib: sbi: Simplify BITS_PER_LONG definition
+f58c140 lib: sbi: Introduce register_extensions extension callback
+e307ba7 lib: sbi: Narrow vendor extension range
+f0c3 lib: sbi: pmu: Remove unnecessary probe function
+b952d4 lib: sbi: Only register available extensions
+b5fc lib: sbi: Optimize probe of srst/susp
+c3e31cb lib: sbi: Remove 0/1 probe implementations
+f1722 lib: sbi: Document sbi_ecall_extension members
+d4c46e0 Makefile: Dereference symlinks on install
+b99a7f lib: sbi: Fix return of sbi_console_init
+d0be lib: utils: Improve fdt_serial_init
+a0bdd0 lib: utils: Improve fdt_ipi
+f226 lib: utils: Improve fdt_timer
+df75e09 lib: utils/ipi: buffer overrun aclint_mswi_cold_init
+bdde2ec lib: sbi: Align system suspend errors with spec
+aad7a37 include: sbi_scratch: Add helper macros to access data type
+cf9a54 platform: Allow platforms to specify heap size
+d36a6 lib: sbi: Introduce simple heap allocator
+a04f70 lib: sbi: Print scratch size and usage at boot time
+bbff53f lib: sbi_pmu: Use heap for per-HART PMU state
+ef4542d lib: sbi: Use heap for root domain creation
+daafe lib: sbi: Use scratch space to save per-HART domain pointer
+fa5ad2e lib: utils/gpio: Use heap in SiFive and StartFive GPIO drivers
+e88c lib: utils/i2c: Use heap in DesignWare and SiFive I2C drivers
+a8cfcd lib: utils/ipi: Use heap in ACLINT MSWI driver
+3013716 lib: utils/irqchip: Use heap in PLIC, APLIC and IMSIC drivers
+e5636a lib: utils/timer: Use heap in ACLINT MTIMER driver
+c1c972 lib: utils/fdt: Use heap in FDT domain parsing
+acbd8fc lib: utils/ipi: Use scratch space to save per-HART MSWI pointer
+f0516be lib: utils/timer: Use scratch space to save per-HART MTIMER pointer
+b3594ac lib: utils/irqchip: Use scratch space to save per-HART PLIC pointer
+df52fa lib: utils/irqchip: Don't check hartid in imsic_update_hartid_table()
+c lib: utils/irqchip: Use scratch space to save per-HART IMSIC pointer
+feec docs: Add OpenSBI logo and use it in the top-level README.md
+be2c README.md: Improve project copyright information
+b26 platform/lib: Set no-map attribute on all PMP regions
+d64942f firmware: Fix find hart index
+c957a lib: reset: Move fdt_reset_init into generic_early_init
+bd666a lib: sbi: check A2 register in ecall_dbcn_handler.
+2552799 include: Bump-up version to 1.3
+Signed-off-by: Bin Meng <bmeng@tinylab.org>
+Message-Id: <20230630160717.843044-1-bmeng@tinylab.org>
+Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 123072 -> 135344 bytes
+ .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 121800 -> 138304 bytes
+ roms/opensbi                                  |   2 +-
+files changed, 1 insertion(+), 1 deletion(-)
+diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
+index XXXXXXX..XXXXXXX 100644
+Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
+diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
+index XXXXXXX..XXXXXXX 100644
+Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
+diff --git a/roms/opensbi b/roms/opensbi
+index XXXXXXX..XXXXXXX 160000
+--- a/roms/opensbi
++++ b/roms/opensbi
+@@ -1 +1 @@
+-Subproject commit 6b5188ca14e59ce7bf71afe4e7d3d557c3d31bf8
++Subproject commit 2552799a1df30a3dcd2321a8b75d61d06f5fb9fc
+--
+.40.1

-New patch
+[PULL 16/54] tests/avocado: riscv: Enable 32-bit Spike OpenSBI boot testing
+From: Bin Meng <bmeng@tinylab.org>
+The 32-bit Spike boot issue has been fixed in the OpenSBI v1.3.
+Let's enable the 32-bit Spike OpenSBI boot testing.
+Signed-off-by: Bin Meng <bmeng@tinylab.org>
+Message-Id: <20230630160717.843044-2-bmeng@tinylab.org>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ tests/avocado/riscv_opensbi.py | 2 --
+file changed, 2 deletions(-)
+diff --git a/tests/avocado/riscv_opensbi.py b/tests/avocado/riscv_opensbi.py
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/avocado/riscv_opensbi.py
++++ b/tests/avocado/riscv_opensbi.py
+@@ -XXX,XX +XXX,XX @@
+ # later.  See the COPYING file in the top-level directory.
+ from avocado_qemu import QemuSystemTest
+-from avocado import skip
+ from avocado_qemu import wait_for_console_pattern
+ class RiscvOpenSBI(QemuSystemTest):
+@@ -XXX,XX +XXX,XX @@ def boot_opensbi(self):
+         wait_for_console_pattern(self, 'Platform Name')
+         wait_for_console_pattern(self, 'Boot HART MEDELEG')
+-    @skip("requires OpenSBI fix to work")
+     def test_riscv32_spike(self):
+         """
+         :avocado: tags=arch:riscv32
+--
+.40.1

-[PULL 06/30] hw/riscv: Initial support for Microchip PolarFire SoC Icicle Kit board
+[PULL 17/54] hw/misc: sifive_e_aon: Support the watchdog timer of HiFive 1 rev b.
-From: Bin Meng <bin.meng@windriver.com>
+From: Tommy Wu <tommy.wu@sifive.com>
-This is an initial support for Microchip PolarFire SoC Icicle Kit.
+The watchdog timer is in the always-on domain device of HiFive 1 rev b,
-The Icicle Kit board integrates a PolarFire SoC, with one SiFive's
+so this patch added the AON device to the sifive_e machine. This patch
-E51 plus four U54 cores and many on-chip peripherals and an FPGA.
+only implemented the functionality of the watchdog timer.
-For more details about Microchip PolarFire Soc, please see:
+Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
-https://www.microsemi.com/product-directory/soc-fpgas/5498-polarfire-soc-fpga
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Unlike SiFive FU540, the RISC-V core resect vector is at 0x20220000.
+Message-Id: <20230627141216.3962299-2-tommy.wu@sifive.com>
 The following perepherals are created as an unimplemented device:
 - Bus Error Uint 0/1/2/3/4
 - L2 cache controller
 - SYSREG
 - MPUCFG
 - IOSCBCFG
 More devices will be added later.
 The BIOS image used by this machine is hss.bin, aka Hart Software
 Services, which can be built from:
 https://github.com/polarfire-soc/hart-software-services
 To launch this machine:
 $ qemu-system-riscv64 -nographic -M microchip-icicle-kit
 The memory is set to 1 GiB by default to match the hardware.
 A sanity check on ram size is performed in the machine init routine
 to prompt user to increase the RAM size to > 1 GiB when less than
 GiB ram is detected.
 Signed-off-by: Bin Meng <bin.meng@windriver.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <1598924352-89526-5-git-send-email-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- default-configs/riscv64-softmmu.mak |   1 +
+ include/hw/misc/sifive_e_aon.h |  60 +++++++
- include/hw/riscv/microchip_pfsoc.h  |  88 ++++++++
+ hw/misc/sifive_e_aon.c         | 319 +++++++++++++++++++++++++++++++++
- hw/riscv/microchip_pfsoc.c          | 312 ++++++++++++++++++++++++++++
+ hw/misc/Kconfig                |   3 +
- MAINTAINERS                         |   7 +
+ hw/misc/meson.build            |   1 +
- hw/riscv/Kconfig                    |   6 +
+files changed, 383 insertions(+)
- hw/riscv/meson.build                |   1 +
+ create mode 100644 include/hw/misc/sifive_e_aon.h
-files changed, 415 insertions(+)
+ create mode 100644 hw/misc/sifive_e_aon.c
  create mode 100644 include/hw/riscv/microchip_pfsoc.h
  create mode 100644 hw/riscv/microchip_pfsoc.c
-diff --git a/default-configs/riscv64-softmmu.mak b/default-configs/riscv64-softmmu.mak
+diff --git a/include/hw/misc/sifive_e_aon.h b/include/hw/misc/sifive_e_aon.h
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/riscv64-softmmu.mak
 +++ b/default-configs/riscv64-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_SPIKE=y
  CONFIG_SIFIVE_E=y
  CONFIG_SIFIVE_U=y
  CONFIG_RISCV_VIRT=y
 +CONFIG_MICROCHIP_PFSOC=y
 diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/include/hw/misc/sifive_e_aon.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Microchip PolarFire SoC machine interface
++ * SiFive HiFive1 AON (Always On Domain) interface.
 + *
-+ * Copyright (c) 2020 Wind River Systems, Inc.
++ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
 + *
 + * Author:
 + *   Bin Meng <bin.meng@windriver.com>
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#ifndef HW_MICROCHIP_PFSOC_H
++#ifndef HW_SIFIVE_AON_H
-+#define HW_MICROCHIP_PFSOC_H
++#define HW_SIFIVE_AON_H
 +
-+typedef struct MicrochipPFSoCState {
++#include "hw/sysbus.h"
 +#include "qom/object.h"
 +
 +#define TYPE_SIFIVE_E_AON "riscv.sifive.e.aon"
 +OBJECT_DECLARE_SIMPLE_TYPE(SiFiveEAONState, SIFIVE_E_AON)
 +
 +#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
 +#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
 +#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
 +
 +enum {
 +    SIFIVE_E_AON_WDT    = 0x0,
 +    SIFIVE_E_AON_RTC    = 0x40,
 +    SIFIVE_E_AON_LFROSC = 0x70,
 +    SIFIVE_E_AON_BACKUP = 0x80,
 +    SIFIVE_E_AON_PMU    = 0x100,
 +    SIFIVE_E_AON_MAX    = 0x150
 +};
 +
 +struct SiFiveEAONState {
 +    /*< private >*/
-+    DeviceState parent_obj;
++    SysBusDevice parent_obj;
 +
 +    /*< public >*/
-+    CPUClusterState e_cluster;
++    MemoryRegion mmio;
-+    CPUClusterState u_cluster;
++
-+    RISCVHartArrayState e_cpus;
++    /*< watchdog timer >*/
-+    RISCVHartArrayState u_cpus;
++    QEMUTimer *wdog_timer;
-+    DeviceState *plic;
++    qemu_irq wdog_irq;
-+} MicrochipPFSoCState;
++    uint64_t wdog_restart_time;
-+
++    uint64_t wdogclk_freq;
-+#define TYPE_MICROCHIP_PFSOC    "microchip.pfsoc"
++
-+#define MICROCHIP_PFSOC(obj) \
++    uint32_t wdogcfg;
-+    OBJECT_CHECK(MicrochipPFSoCState, (obj), TYPE_MICROCHIP_PFSOC)
++    uint16_t wdogcmp0;
-+
++    uint32_t wdogcount;
-+typedef struct MicrochipIcicleKitState {
++    uint8_t wdogunlock;
 +    /*< private >*/
 +    MachineState parent_obj;
 +
 +    /*< public >*/
 +    MicrochipPFSoCState soc;
 +} MicrochipIcicleKitState;
 +
 +#define TYPE_MICROCHIP_ICICLE_KIT_MACHINE \
 +    MACHINE_TYPE_NAME("microchip-icicle-kit")
 +#define MICROCHIP_ICICLE_KIT_MACHINE(obj) \
 +    OBJECT_CHECK(MicrochipIcicleKitState, (obj), \
 +                 TYPE_MICROCHIP_ICICLE_KIT_MACHINE)
 +
 +enum {
 +    MICROCHIP_PFSOC_DEBUG,
 +    MICROCHIP_PFSOC_E51_DTIM,
 +    MICROCHIP_PFSOC_BUSERR_UNIT0,
 +    MICROCHIP_PFSOC_BUSERR_UNIT1,
 +    MICROCHIP_PFSOC_BUSERR_UNIT2,
 +    MICROCHIP_PFSOC_BUSERR_UNIT3,
 +    MICROCHIP_PFSOC_BUSERR_UNIT4,
 +    MICROCHIP_PFSOC_CLINT,
 +    MICROCHIP_PFSOC_L2CC,
 +    MICROCHIP_PFSOC_L2LIM,
 +    MICROCHIP_PFSOC_PLIC,
 +    MICROCHIP_PFSOC_SYSREG,
 +    MICROCHIP_PFSOC_MPUCFG,
 +    MICROCHIP_PFSOC_ENVM_CFG,
 +    MICROCHIP_PFSOC_ENVM_DATA,
 +    MICROCHIP_PFSOC_IOSCB_CFG,
 +    MICROCHIP_PFSOC_DRAM,
 +};
 +
-+#define MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT    1
++#endif
-+#define MICROCHIP_PFSOC_COMPUTE_CPU_COUNT       4
+diff --git a/hw/misc/sifive_e_aon.c b/hw/misc/sifive_e_aon.c
 +
 +#define MICROCHIP_PFSOC_PLIC_HART_CONFIG        "MS"
 +#define MICROCHIP_PFSOC_PLIC_NUM_SOURCES        185
 +#define MICROCHIP_PFSOC_PLIC_NUM_PRIORITIES     7
 +#define MICROCHIP_PFSOC_PLIC_PRIORITY_BASE      0x04
 +#define MICROCHIP_PFSOC_PLIC_PENDING_BASE       0x1000
 +#define MICROCHIP_PFSOC_PLIC_ENABLE_BASE        0x2000
 +#define MICROCHIP_PFSOC_PLIC_ENABLE_STRIDE      0x80
 +#define MICROCHIP_PFSOC_PLIC_CONTEXT_BASE       0x200000
 +#define MICROCHIP_PFSOC_PLIC_CONTEXT_STRIDE     0x1000
 +
 +#endif /* HW_MICROCHIP_PFSOC_H */
 diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/riscv/microchip_pfsoc.c
++++ b/hw/misc/sifive_e_aon.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * QEMU RISC-V Board Compatible with Microchip PolarFire SoC Icicle Kit
++ * SiFive HiFive1 AON (Always On Domain) for QEMU.
 + *
-+ * Copyright (c) 2020 Wind River Systems, Inc.
++ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
 + *
 + * Author:
 + *   Bin Meng <bin.meng@windriver.com>
 + *
 + * Provides a board compatible with the Microchip PolarFire SoC Icicle Kit
 + *
 + * 0) CLINT (Core Level Interruptor)
 + * 1) PLIC (Platform Level Interrupt Controller)
 + * 2) eNVM (Embedded Non-Volatile Memory)
 + *
 + * This board currently generates devicetree dynamically that indicates at least
 + * two harts and up to five harts.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
-+#include "qemu/error-report.h"
++#include "qemu/timer.h"
 +#include "qemu/log.h"
-+#include "qemu/units.h"
++#include "hw/irq.h"
-+#include "qemu/cutils.h"
++#include "hw/registerfields.h"
 +#include "hw/misc/sifive_e_aon.h"
 +#include "qapi/visitor.h"
 +#include "qapi/error.h"
-+#include "hw/boards.h"
++#include "sysemu/watchdog.h"
-+#include "hw/irq.h"
++#include "hw/qdev-properties.h"
-+#include "hw/loader.h"
++
-+#include "hw/sysbus.h"
++REG32(AON_WDT_WDOGCFG, 0x0)
-+#include "hw/cpu/cluster.h"
++    FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
-+#include "target/riscv/cpu.h"
++    FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
-+#include "hw/misc/unimp.h"
++    FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
-+#include "hw/riscv/boot.h"
++    FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
-+#include "hw/riscv/riscv_hart.h"
++    FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
-+#include "hw/riscv/sifive_clint.h"
++    FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
-+#include "hw/riscv/sifive_plic.h"
++    FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
-+#include "hw/riscv/microchip_pfsoc.h"
++    FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
 +    FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
 +    FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
 +REG32(AON_WDT_WDOGCOUNT, 0x8)
 +    FIELD(AON_WDT_WDOGCOUNT, VALUE, 0, 31)
 +REG32(AON_WDT_WDOGS, 0x10)
 +REG32(AON_WDT_WDOGFEED, 0x18)
 +REG32(AON_WDT_WDOGKEY, 0x1c)
 +REG32(AON_WDT_WDOGCMP0, 0x20)
 +
 +static void sifive_e_aon_wdt_update_wdogcount(SiFiveEAONState *r)
 +{
 +    int64_t now;
 +    if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 0 &&
 +        FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 0) {
 +        return;
 +    }
 +
 +    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +    r->wdogcount += muldiv64(now - r->wdog_restart_time,
 +                             r->wdogclk_freq, NANOSECONDS_PER_SECOND);
 +
 +    /* Clean the most significant bit. */
 +    r->wdogcount &= R_AON_WDT_WDOGCOUNT_VALUE_MASK;
 +    r->wdog_restart_time = now;
 +}
 +
 +static void sifive_e_aon_wdt_update_state(SiFiveEAONState *r)
 +{
 +    uint16_t wdogs;
 +    bool cmp_signal = false;
 +    sifive_e_aon_wdt_update_wdogcount(r);
 +    wdogs = (uint16_t)(r->wdogcount >>
 +                           FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE));
 +
 +    if (wdogs >= r->wdogcmp0) {
 +        cmp_signal = true;
 +        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, ZEROCMP) == 1) {
 +            r->wdogcount = 0;
 +            wdogs = 0;
 +        }
 +    }
 +
 +    if (cmp_signal) {
 +        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN) == 1) {
 +            watchdog_perform_action();
 +        }
 +        r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, IP0, 1);
 +    }
 +
 +    qemu_set_irq(r->wdog_irq, FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, IP0));
 +
 +    if (wdogs < r->wdogcmp0 &&
 +        (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 1 ||
 +         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 1)) {
 +        int64_t next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        next += muldiv64((r->wdogcmp0 - wdogs) <<
 +                         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE),
 +                         NANOSECONDS_PER_SECOND, r->wdogclk_freq);
 +        timer_mod(r->wdog_timer, next);
 +    } else {
 +        timer_mod(r->wdog_timer, INT64_MAX);
 +    }
 +}
 +
 +/*
-+ * The BIOS image used by this machine is called Hart Software Services (HSS).
++ * Callback used when the timer set using timer_mod expires.
 + * See https://github.com/polarfire-soc/hart-software-services
 + */
-+#define BIOS_FILENAME   "hss.bin"
++static void sifive_e_aon_wdt_expired_cb(void *opaque)
-+#define RESET_VECTOR    0x20220000
++{
-+
++    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
-+static const struct MemmapEntry {
++    sifive_e_aon_wdt_update_state(r);
-+    hwaddr base;
++}
-+    hwaddr size;
++
-+} microchip_pfsoc_memmap[] = {
++static uint64_t
-+    [MICROCHIP_PFSOC_DEBUG] =           {        0x0,     0x1000 },
++sifive_e_aon_wdt_read(void *opaque, hwaddr addr, unsigned int size)
-+    [MICROCHIP_PFSOC_E51_DTIM] =        {  0x1000000,     0x2000 },
++{
-+    [MICROCHIP_PFSOC_BUSERR_UNIT0] =    {  0x1700000,     0x1000 },
++    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
-+    [MICROCHIP_PFSOC_BUSERR_UNIT1] =    {  0x1701000,     0x1000 },
++
-+    [MICROCHIP_PFSOC_BUSERR_UNIT2] =    {  0x1702000,     0x1000 },
++    switch (addr) {
-+    [MICROCHIP_PFSOC_BUSERR_UNIT3] =    {  0x1703000,     0x1000 },
++    case A_AON_WDT_WDOGCFG:
-+    [MICROCHIP_PFSOC_BUSERR_UNIT4] =    {  0x1704000,     0x1000 },
++        return r->wdogcfg;
-+    [MICROCHIP_PFSOC_CLINT] =           {  0x2000000,    0x10000 },
++    case A_AON_WDT_WDOGCOUNT:
-+    [MICROCHIP_PFSOC_L2CC] =            {  0x2010000,     0x1000 },
++        sifive_e_aon_wdt_update_wdogcount(r);
-+    [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,  0x2000000 },
++        return r->wdogcount;
-+    [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,  0x4000000 },
++    case A_AON_WDT_WDOGS:
-+    [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,     0x2000 },
++        sifive_e_aon_wdt_update_wdogcount(r);
-+    [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,     0x1000 },
++        return r->wdogcount >>
-+    [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,     0x1000 },
++               FIELD_EX32(r->wdogcfg,
-+    [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
++                          AON_WDT_WDOGCFG,
-+    [MICROCHIP_PFSOC_IOSCB_CFG] =       { 0x37080000,     0x1000 },
++                          SCALE);
-+    [MICROCHIP_PFSOC_DRAM] =            { 0x80000000,        0x0 },
++    case A_AON_WDT_WDOGFEED:
 +        return 0;
 +    case A_AON_WDT_WDOGKEY:
 +        return r->wdogunlock;
 +    case A_AON_WDT_WDOGCMP0:
 +        return r->wdogcmp0;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    }
 +
 +    return 0;
 +}
 +
 +static void
 +sifive_e_aon_wdt_write(void *opaque, hwaddr addr,
 +                       uint64_t val64, unsigned int size)
 +{
 +    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
 +    uint32_t value = val64;
 +
 +    switch (addr) {
 +    case A_AON_WDT_WDOGCFG: {
 +        uint8_t new_en_always;
 +        uint8_t new_en_core_awake;
 +        uint8_t old_en_always;
 +        uint8_t old_en_core_awake;
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +
 +        new_en_always = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_ALWAYS);
 +        new_en_core_awake = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_CORE_AWAKE);
 +        old_en_always = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS);
 +        old_en_core_awake = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG,
 +                                       EN_CORE_AWAKE);
 +
 +        if ((old_en_always ||
 +             old_en_core_awake) == 1 &&
 +            (new_en_always ||
 +             new_en_core_awake) == 0) {
 +            sifive_e_aon_wdt_update_wdogcount(r);
 +        } else if ((old_en_always ||
 +                    old_en_core_awake) == 0 &&
 +                   (new_en_always ||
 +                    new_en_core_awake) == 1) {
 +            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        }
 +        r->wdogcfg = value;
 +        r->wdogunlock = 0;
 +        break;
 +    }
 +    case A_AON_WDT_WDOGCOUNT:
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +        r->wdogcount = value & R_AON_WDT_WDOGCOUNT_VALUE_MASK;
 +        r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        r->wdogunlock = 0;
 +        break;
 +    case A_AON_WDT_WDOGS:
 +        return;
 +    case A_AON_WDT_WDOGFEED:
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +        if (value == SIFIVE_E_AON_WDOGFEED) {
 +            r->wdogcount = 0;
 +            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        }
 +        r->wdogunlock = 0;
 +        break;
 +    case A_AON_WDT_WDOGKEY:
 +        if (value == SIFIVE_E_AON_WDOGKEY) {
 +            r->wdogunlock = 1;
 +        }
 +        break;
 +    case A_AON_WDT_WDOGCMP0:
 +        if (r->wdogunlock == 0) {
 +            return;
 +        }
 +        r->wdogcmp0 = (uint16_t) value;
 +        r->wdogunlock = 0;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x v=0x%x\n",
 +                      __func__, (int)addr, (int)value);
 +    }
 +    sifive_e_aon_wdt_update_state(r);
 +}
 +
 +static uint64_t
 +sifive_e_aon_read(void *opaque, hwaddr addr, unsigned int size)
 +{
 +    if (addr < SIFIVE_E_AON_RTC) {
 +        return sifive_e_aon_wdt_read(opaque, addr, size);
 +    } else if (addr < SIFIVE_E_AON_MAX) {
 +        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented read: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    } else {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    }
 +    return 0;
 +}
 +
 +static void
 +sifive_e_aon_write(void *opaque, hwaddr addr,
 +                   uint64_t val64, unsigned int size)
 +{
 +    if (addr < SIFIVE_E_AON_RTC) {
 +        sifive_e_aon_wdt_write(opaque, addr, val64, size);
 +    } else if (addr < SIFIVE_E_AON_MAX) {
 +        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented write: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    } else {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x\n",
 +                      __func__, (int)addr);
 +    }
 +}
 +
 +static const MemoryRegionOps sifive_e_aon_ops = {
 +    .read = sifive_e_aon_read,
 +    .write = sifive_e_aon_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .impl = {
 +        .min_access_size = 4,
 +        .max_access_size = 4
 +    },
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4
 +    }
 +};
 +
-+static void microchip_pfsoc_soc_instance_init(Object *obj)
++static void sifive_e_aon_reset(DeviceState *dev)
 +{
-+    MachineState *ms = MACHINE(qdev_get_machine());
++    SiFiveEAONState *r = SIFIVE_E_AON(dev);
-+    MicrochipPFSoCState *s = MICROCHIP_PFSOC(obj);
++
-+
++    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN, 0);
-+    object_initialize_child(obj, "e-cluster", &s->e_cluster, TYPE_CPU_CLUSTER);
++    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
-+    qdev_prop_set_uint32(DEVICE(&s->e_cluster), "cluster-id", 0);
++    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE, 0);
-+
++    r->wdogcmp0 = 0xbeef;
-+    object_initialize_child(OBJECT(&s->e_cluster), "e-cpus", &s->e_cpus,
++
-+                            TYPE_RISCV_HART_ARRAY);
++    sifive_e_aon_wdt_update_state(r);
-+    qdev_prop_set_uint32(DEVICE(&s->e_cpus), "num-harts", 1);
++}
-+    qdev_prop_set_uint32(DEVICE(&s->e_cpus), "hartid-base", 0);
++
-+    qdev_prop_set_string(DEVICE(&s->e_cpus), "cpu-type",
++static void sifive_e_aon_init(Object *obj)
-+                         TYPE_RISCV_CPU_SIFIVE_E51);
++{
-+    qdev_prop_set_uint64(DEVICE(&s->e_cpus), "resetvec", RESET_VECTOR);
++    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-+
++    SiFiveEAONState *r = SIFIVE_E_AON(obj);
-+    object_initialize_child(obj, "u-cluster", &s->u_cluster, TYPE_CPU_CLUSTER);
++
-+    qdev_prop_set_uint32(DEVICE(&s->u_cluster), "cluster-id", 1);
++    memory_region_init_io(&r->mmio, OBJECT(r), &sifive_e_aon_ops, r,
-+
++                          TYPE_SIFIVE_E_AON, SIFIVE_E_AON_MAX);
-+    object_initialize_child(OBJECT(&s->u_cluster), "u-cpus", &s->u_cpus,
++    sysbus_init_mmio(sbd, &r->mmio);
-+                            TYPE_RISCV_HART_ARRAY);
++
-+    qdev_prop_set_uint32(DEVICE(&s->u_cpus), "num-harts", ms->smp.cpus - 1);
++    /* watchdog timer */
-+    qdev_prop_set_uint32(DEVICE(&s->u_cpus), "hartid-base", 1);
++    r->wdog_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-+    qdev_prop_set_string(DEVICE(&s->u_cpus), "cpu-type",
++                                 sifive_e_aon_wdt_expired_cb, r);
-+                         TYPE_RISCV_CPU_SIFIVE_U54);
++    r->wdogclk_freq = SIFIVE_E_LFCLK_DEFAULT_FREQ;
-+    qdev_prop_set_uint64(DEVICE(&s->u_cpus), "resetvec", RESET_VECTOR);
++    sysbus_init_irq(sbd, &r->wdog_irq);
 +}
 +
-+static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
++static Property sifive_e_aon_properties[] = {
-+{
++    DEFINE_PROP_UINT64("wdogclk-frequency", SiFiveEAONState, wdogclk_freq,
-+    MachineState *ms = MACHINE(qdev_get_machine());
++                       SIFIVE_E_LFCLK_DEFAULT_FREQ),
-+    MicrochipPFSoCState *s = MICROCHIP_PFSOC(dev);
++    DEFINE_PROP_END_OF_LIST(),
-+    const struct MemmapEntry *memmap = microchip_pfsoc_memmap;
++};
-+    MemoryRegion *system_memory = get_system_memory();
++
-+    MemoryRegion *e51_dtim_mem = g_new(MemoryRegion, 1);
++static void sifive_e_aon_class_init(ObjectClass *oc, void *data)
 +    MemoryRegion *l2lim_mem = g_new(MemoryRegion, 1);
 +    MemoryRegion *envm_data = g_new(MemoryRegion, 1);
 +    char *plic_hart_config;
 +    size_t plic_hart_config_len;
 +    int i;
 +
 +    sysbus_realize(SYS_BUS_DEVICE(&s->e_cpus), &error_abort);
 +    sysbus_realize(SYS_BUS_DEVICE(&s->u_cpus), &error_abort);
 +    /*
 +     * The cluster must be realized after the RISC-V hart array container,
 +     * as the container's CPU object is only created on realize, and the
 +     * CPU must exist and have been parented into the cluster before the
 +     * cluster is realized.
 +     */
 +    qdev_realize(DEVICE(&s->e_cluster), NULL, &error_abort);
 +    qdev_realize(DEVICE(&s->u_cluster), NULL, &error_abort);
 +
 +    /* E51 DTIM */
 +    memory_region_init_ram(e51_dtim_mem, NULL, "microchip.pfsoc.e51_dtim_mem",
 +                           memmap[MICROCHIP_PFSOC_E51_DTIM].size, &error_fatal);
 +    memory_region_add_subregion(system_memory,
 +                                memmap[MICROCHIP_PFSOC_E51_DTIM].base,
 +                                e51_dtim_mem);
 +
 +    /* Bus Error Units */
 +    create_unimplemented_device("microchip.pfsoc.buserr_unit0_mem",
 +        memmap[MICROCHIP_PFSOC_BUSERR_UNIT0].base,
 +        memmap[MICROCHIP_PFSOC_BUSERR_UNIT0].size);
 +    create_unimplemented_device("microchip.pfsoc.buserr_unit1_mem",
 +        memmap[MICROCHIP_PFSOC_BUSERR_UNIT1].base,
 +        memmap[MICROCHIP_PFSOC_BUSERR_UNIT1].size);
 +    create_unimplemented_device("microchip.pfsoc.buserr_unit2_mem",
 +        memmap[MICROCHIP_PFSOC_BUSERR_UNIT2].base,
 +        memmap[MICROCHIP_PFSOC_BUSERR_UNIT2].size);
 +    create_unimplemented_device("microchip.pfsoc.buserr_unit3_mem",
 +        memmap[MICROCHIP_PFSOC_BUSERR_UNIT3].base,
 +        memmap[MICROCHIP_PFSOC_BUSERR_UNIT3].size);
 +    create_unimplemented_device("microchip.pfsoc.buserr_unit4_mem",
 +        memmap[MICROCHIP_PFSOC_BUSERR_UNIT4].base,
 +        memmap[MICROCHIP_PFSOC_BUSERR_UNIT4].size);
 +
 +    /* CLINT */
 +    sifive_clint_create(memmap[MICROCHIP_PFSOC_CLINT].base,
 +        memmap[MICROCHIP_PFSOC_CLINT].size, 0, ms->smp.cpus,
 +        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
 +
 +    /* L2 cache controller */
 +    create_unimplemented_device("microchip.pfsoc.l2cc",
 +        memmap[MICROCHIP_PFSOC_L2CC].base, memmap[MICROCHIP_PFSOC_L2CC].size);
 +
 +    /*
 +     * Add L2-LIM at reset size.
 +     * This should be reduced in size as the L2 Cache Controller WayEnable
 +     * register is incremented. Unfortunately I don't see a nice (or any) way
 +     * to handle reducing or blocking out the L2 LIM while still allowing it
 +     * be re returned to all enabled after a reset. For the time being, just
 +     * leave it enabled all the time. This won't break anything, but will be
 +     * too generous to misbehaving guests.
 +     */
 +    memory_region_init_ram(l2lim_mem, NULL, "microchip.pfsoc.l2lim",
 +                           memmap[MICROCHIP_PFSOC_L2LIM].size, &error_fatal);
 +    memory_region_add_subregion(system_memory,
 +                                memmap[MICROCHIP_PFSOC_L2LIM].base,
 +                                l2lim_mem);
 +
 +    /* create PLIC hart topology configuration string */
 +    plic_hart_config_len = (strlen(MICROCHIP_PFSOC_PLIC_HART_CONFIG) + 1) *
 +                           ms->smp.cpus;
 +    plic_hart_config = g_malloc0(plic_hart_config_len);
 +    for (i = 0; i < ms->smp.cpus; i++) {
 +        if (i != 0) {
 +            strncat(plic_hart_config, "," MICROCHIP_PFSOC_PLIC_HART_CONFIG,
 +                    plic_hart_config_len);
 +        } else {
 +            strncat(plic_hart_config, "M", plic_hart_config_len);
 +        }
 +        plic_hart_config_len -= (strlen(MICROCHIP_PFSOC_PLIC_HART_CONFIG) + 1);
 +    }
 +
 +    /* PLIC */
 +    s->plic = sifive_plic_create(memmap[MICROCHIP_PFSOC_PLIC].base,
 +        plic_hart_config, 0,
 +        MICROCHIP_PFSOC_PLIC_NUM_SOURCES,
 +        MICROCHIP_PFSOC_PLIC_NUM_PRIORITIES,
 +        MICROCHIP_PFSOC_PLIC_PRIORITY_BASE,
 +        MICROCHIP_PFSOC_PLIC_PENDING_BASE,
 +        MICROCHIP_PFSOC_PLIC_ENABLE_BASE,
 +        MICROCHIP_PFSOC_PLIC_ENABLE_STRIDE,
 +        MICROCHIP_PFSOC_PLIC_CONTEXT_BASE,
 +        MICROCHIP_PFSOC_PLIC_CONTEXT_STRIDE,
 +        memmap[MICROCHIP_PFSOC_PLIC].size);
 +    g_free(plic_hart_config);
 +
 +    /* SYSREG */
 +    create_unimplemented_device("microchip.pfsoc.sysreg",
 +        memmap[MICROCHIP_PFSOC_SYSREG].base,
 +        memmap[MICROCHIP_PFSOC_SYSREG].size);
 +
 +    /* MPUCFG */
 +    create_unimplemented_device("microchip.pfsoc.mpucfg",
 +        memmap[MICROCHIP_PFSOC_MPUCFG].base,
 +        memmap[MICROCHIP_PFSOC_MPUCFG].size);
 +
 +    /* eNVM */
 +    memory_region_init_rom(envm_data, OBJECT(dev), "microchip.pfsoc.envm.data",
 +                           memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
 +                           &error_fatal);
 +    memory_region_add_subregion(system_memory,
 +                                memmap[MICROCHIP_PFSOC_ENVM_DATA].base,
 +                                envm_data);
 +
 +    /* IOSCBCFG */
 +    create_unimplemented_device("microchip.pfsoc.ioscb.cfg",
 +        memmap[MICROCHIP_PFSOC_IOSCB_CFG].base,
 +        memmap[MICROCHIP_PFSOC_IOSCB_CFG].size);
 +}
 +
 +static void microchip_pfsoc_soc_class_init(ObjectClass *oc, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(oc);
 +
-+    dc->realize = microchip_pfsoc_soc_realize;
++    dc->reset = sifive_e_aon_reset;
-+    /* Reason: Uses serial_hds in realize function, thus can't be used twice */
++    device_class_set_props(dc, sifive_e_aon_properties);
-+    dc->user_creatable = false;
++}
-+}
++
-+
++static const TypeInfo sifive_e_aon_info = {
-+static const TypeInfo microchip_pfsoc_soc_type_info = {
++    .name          = TYPE_SIFIVE_E_AON,
-+    .name = TYPE_MICROCHIP_PFSOC,
++    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .parent = TYPE_DEVICE,
++    .instance_size = sizeof(SiFiveEAONState),
-+    .instance_size = sizeof(MicrochipPFSoCState),
++    .instance_init = sifive_e_aon_init,
-+    .instance_init = microchip_pfsoc_soc_instance_init,
++    .class_init    = sifive_e_aon_class_init,
 +    .class_init = microchip_pfsoc_soc_class_init,
 +};
 +
-+static void microchip_pfsoc_soc_register_types(void)
++static void sifive_e_aon_register_types(void)
 +{
-+    type_register_static(&microchip_pfsoc_soc_type_info);
++    type_register_static(&sifive_e_aon_info);
 +}
 +
-+type_init(microchip_pfsoc_soc_register_types)
++type_init(sifive_e_aon_register_types)
-+
+diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
 +static void microchip_icicle_kit_machine_init(MachineState *machine)
 +{
 +    MachineClass *mc = MACHINE_GET_CLASS(machine);
 +    const struct MemmapEntry *memmap = microchip_pfsoc_memmap;
 +    MicrochipIcicleKitState *s = MICROCHIP_ICICLE_KIT_MACHINE(machine);
 +    MemoryRegion *system_memory = get_system_memory();
 +    MemoryRegion *main_mem = g_new(MemoryRegion, 1);
 +
 +    /* Sanity check on RAM size */
 +    if (machine->ram_size < mc->default_ram_size) {
 +        char *sz = size_to_str(mc->default_ram_size);
 +        error_report("Invalid RAM size, should be bigger than %s", sz);
 +        g_free(sz);
 +        exit(EXIT_FAILURE);
 +    }
 +
 +    /* Initialize SoC */
 +    object_initialize_child(OBJECT(machine), "soc", &s->soc,
 +                            TYPE_MICROCHIP_PFSOC);
 +    qdev_realize(DEVICE(&s->soc), NULL, &error_abort);
 +
 +    /* Register RAM */
 +    memory_region_init_ram(main_mem, NULL, "microchip.icicle.kit.ram",
 +                           machine->ram_size, &error_fatal);
 +    memory_region_add_subregion(system_memory,
 +                                memmap[MICROCHIP_PFSOC_DRAM].base, main_mem);
 +
 +    /* Load the firmware */
 +    riscv_find_and_load_firmware(machine, BIOS_FILENAME, RESET_VECTOR, NULL);
 +}
 +
 +static void microchip_icicle_kit_machine_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +
 +    mc->desc = "Microchip PolarFire SoC Icicle Kit";
 +    mc->init = microchip_icicle_kit_machine_init;
 +    mc->max_cpus = MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT +
 +                   MICROCHIP_PFSOC_COMPUTE_CPU_COUNT;
 +    mc->min_cpus = MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT + 1;
 +    mc->default_cpus = mc->min_cpus;
 +    mc->default_ram_size = 1 * GiB;
 +}
 +
 +static const TypeInfo microchip_icicle_kit_machine_typeinfo = {
 +    .name       = MACHINE_TYPE_NAME("microchip-icicle-kit"),
 +    .parent     = TYPE_MACHINE,
 +    .class_init = microchip_icicle_kit_machine_class_init,
 +    .instance_size = sizeof(MicrochipIcicleKitState),
 +};
 +
 +static void microchip_icicle_kit_machine_init_register_types(void)
 +{
 +    type_register_static(&microchip_icicle_kit_machine_typeinfo);
 +}
 +
 +type_init(microchip_icicle_kit_machine_init_register_types)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/misc/Kconfig
-+++ b/MAINTAINERS
++++ b/hw/misc/Kconfig
-@@ -XXX,XX +XXX,XX @@ F: include/hw/riscv/opentitan.h
+@@ -XXX,XX +XXX,XX @@ config SIFIVE_TEST
- F: include/hw/char/ibex_uart.h
+ config SIFIVE_E_PRCI
- F: include/hw/intc/ibex_plic.h
+     bool
-+Microchip PolarFire SoC Icicle Kit
++config SIFIVE_E_AON
-+M: Bin Meng <bin.meng@windriver.com>
++    bool
-+L: qemu-riscv@nongnu.org
++
-+S: Supported
+ config SIFIVE_U_OTP
-+F: hw/riscv/microchip_pfsoc.c
+     bool
-+F: include/hw/riscv/microchip_pfsoc.h
-+
+diff --git a/hw/misc/meson.build b/hw/misc/meson.build
  RX Machines
  -----------
  rx-gdbsim
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/Kconfig
+--- a/hw/misc/meson.build
-+++ b/hw/riscv/Kconfig
++++ b/hw/misc/meson.build
-@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
+@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_MCHP_PFSOC_IOSCB', if_true: files('mchp_pfsoc_ioscb.
-     select PCI_EXPRESS_GENERIC_BRIDGE
+ system_ss.add(when: 'CONFIG_MCHP_PFSOC_SYSREG', if_true: files('mchp_pfsoc_sysreg.c'))
-     select PFLASH_CFI01
+ system_ss.add(when: 'CONFIG_SIFIVE_TEST', if_true: files('sifive_test.c'))
-     select SIFIVE
+ system_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
-+
++system_ss.add(when: 'CONFIG_SIFIVE_E_AON', if_true: files('sifive_e_aon.c'))
-+config MICROCHIP_PFSOC
+ system_ss.add(when: 'CONFIG_SIFIVE_U_OTP', if_true: files('sifive_u_otp.c'))
-+    bool
+ system_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
-+    select HART
 +    select SIFIVE
 +    select UNIMP
 diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/meson.build
 +++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_otp.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_prci.c'))
  riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('riscv_htif.c'))
  riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
 +riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
  hw_arch += {'riscv': riscv_ss}
 --
-.28.0
+.40.1

-[PULL 26/30] hw/riscv: Move sifive_uart model to hw/char
+[PULL 18/54] hw/riscv: sifive_e: Support the watchdog timer of HiFive 1 rev b.
-From: Bin Meng <bin.meng@windriver.com>
+From: Tommy Wu <tommy.wu@sifive.com>
-This is an effort to clean up the hw/riscv directory. Ideally it
+Create the AON device when we realize the sifive_e machine.
-should only contain the RISC-V SoC / machine codes plus generic
+This patch only implemented the functionality of the watchdog timer,
-codes. Let's move sifive_uart model to hw/char directory.
+not all the functionality of the AON device.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1599129623-68957-9-git-send-email-bmeng.cn@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-Id: <20230627141216.3962299-3-tommy.wu@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/{riscv => char}/sifive_uart.h | 0
+ include/hw/riscv/sifive_e.h |  9 ++++++---
- hw/{riscv => char}/sifive_uart.c         | 2 +-
+ hw/riscv/sifive_e.c         | 17 +++++++++++++++--
- hw/riscv/sifive_e.c                      | 2 +-
+ hw/riscv/Kconfig            |  1 +
- hw/riscv/sifive_u.c                      | 2 +-
+files changed, 22 insertions(+), 5 deletions(-)
  hw/char/Kconfig                          | 3 +++
  hw/char/meson.build                      | 1 +
  hw/riscv/Kconfig                         | 2 ++
  hw/riscv/meson.build                     | 1 -
 files changed, 9 insertions(+), 4 deletions(-)
  rename include/hw/{riscv => char}/sifive_uart.h (100%)
  rename hw/{riscv => char}/sifive_uart.c (99%)
-diff --git a/include/hw/riscv/sifive_uart.h b/include/hw/char/sifive_uart.h
+diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
 similarity index 100%
 rename from include/hw/riscv/sifive_uart.h
 rename to include/hw/char/sifive_uart.h
 diff --git a/hw/riscv/sifive_uart.c b/hw/char/sifive_uart.c
 similarity index 99%
 rename from hw/riscv/sifive_uart.c
 rename to hw/char/sifive_uart.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_uart.c
+--- a/include/hw/riscv/sifive_e.h
-+++ b/hw/char/sifive_uart.c
++++ b/include/hw/riscv/sifive_e.h
 @@ -XXX,XX +XXX,XX @@
- #include "chardev/char-fe.h"
+ #include "hw/riscv/riscv_hart.h"
- #include "hw/hw.h"
+ #include "hw/riscv/sifive_cpu.h"
- #include "hw/irq.h"
+ #include "hw/gpio/sifive_gpio.h"
--#include "hw/riscv/sifive_uart.h"
++#include "hw/misc/sifive_e_aon.h"
-+#include "hw/char/sifive_uart.h"
+ #include "hw/boards.h"
- /*
+ #define TYPE_RISCV_E_SOC "riscv.sifive.e.soc"
-  * Not yet implemented:
+@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveESoCState {
      /*< public >*/
      RISCVHartArrayState cpus;
      DeviceState *plic;
 +    SiFiveEAONState aon;
      SIFIVEGPIOState gpio;
      MemoryRegion xip_mem;
      MemoryRegion mask_rom;
@@ -XXX,XX +XXX,XX @@ enum {
  };
  enum {
 -    SIFIVE_E_UART0_IRQ  = 3,
 -    SIFIVE_E_UART1_IRQ  = 4,
 -    SIFIVE_E_GPIO0_IRQ0 = 8
 +    SIFIVE_E_AON_WDT_IRQ  = 1,
 +    SIFIVE_E_UART0_IRQ    = 3,
 +    SIFIVE_E_UART1_IRQ    = 4,
 +    SIFIVE_E_GPIO0_IRQ0   = 8
  };
  #define SIFIVE_E_PLIC_HART_CONFIG "M"
 diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_e.c
 +++ b/hw/riscv/sifive_e.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/misc/unimp.h"
+ #include "hw/intc/riscv_aclint.h"
  #include "target/riscv/cpu.h"
  #include "hw/riscv/riscv_hart.h"
 -#include "hw/riscv/sifive_uart.h"
  #include "hw/riscv/sifive_e.h"
  #include "hw/riscv/boot.h"
 +#include "hw/char/sifive_uart.h"
  #include "hw/intc/sifive_clint.h"
  #include "hw/intc/sifive_plic.h"
  #include "hw/misc/sifive_e_prci.h"
-diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
++#include "hw/misc/sifive_e_aon.h"
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_u.c
 +++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/misc/unimp.h"
  #include "target/riscv/cpu.h"
  #include "hw/riscv/riscv_hart.h"
 -#include "hw/riscv/sifive_uart.h"
  #include "hw/riscv/sifive_u.h"
  #include "hw/riscv/boot.h"
 +#include "hw/char/sifive_uart.h"
  #include "hw/intc/sifive_clint.h"
  #include "hw/intc/sifive_plic.h"
  #include "chardev/char.h"
-diff --git a/hw/char/Kconfig b/hw/char/Kconfig
+ #include "sysemu/sysemu.h"
-index XXXXXXX..XXXXXXX 100644
---- a/hw/char/Kconfig
+@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_init(Object *obj)
-+++ b/hw/char/Kconfig
+     object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x1004, &error_abort);
-@@ -XXX,XX +XXX,XX @@ config AVR_USART
+     object_initialize_child(obj, "riscv.sifive.e.gpio0", &s->gpio,
+                             TYPE_SIFIVE_GPIO);
- config MCHP_PFSOC_MMUART
++    object_initialize_child(obj, "riscv.sifive.e.aon", &s->aon,
-     bool
++                            TYPE_SIFIVE_E_AON);
  }
  static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
          RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
          RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
          RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
 -    create_unimplemented_device("riscv.sifive.e.aon",
 -        memmap[SIFIVE_E_DEV_AON].base, memmap[SIFIVE_E_DEV_AON].size);
      sifive_e_prci_create(memmap[SIFIVE_E_DEV_PRCI].base);
 +    /* AON */
 +
-+config SIFIVE_UART
++    if (!sysbus_realize(SYS_BUS_DEVICE(&s->aon), errp)) {
-+    bool
++        return;
-diff --git a/hw/char/meson.build b/hw/char/meson.build
++    }
-index XXXXXXX..XXXXXXX 100644
++
---- a/hw/char/meson.build
++    /* Map AON registers */
-+++ b/hw/char/meson.build
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->aon), 0, memmap[SIFIVE_E_DEV_AON].base);
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4210_uart.c'))
++
- softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_uart.c'))
+     /* GPIO */
- softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_aux.c'))
- softmmu_ss.add(when: 'CONFIG_RENESAS_SCI', if_true: files('renesas_sci.c'))
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
-+softmmu_ss.add(when: 'CONFIG_SIFIVE_UART', if_true: files('sifive_uart.c'))
+@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
- softmmu_ss.add(when: 'CONFIG_SH4', if_true: files('sh_serial.c'))
+                            qdev_get_gpio_in(DEVICE(s->plic),
- softmmu_ss.add(when: 'CONFIG_STM32F2XX_USART', if_true: files('stm32f2xx_usart.c'))
+                                             SIFIVE_E_GPIO0_IRQ0 + i));
- softmmu_ss.add(when: 'CONFIG_MCHP_PFSOC_MMUART', if_true: files('mchp_pfsoc_mmuart.c'))
+     }
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->aon), 0,
 +                       qdev_get_gpio_in(DEVICE(s->plic),
 +                                        SIFIVE_E_AON_WDT_IRQ));
      sifive_uart_create(sys_mem, memmap[SIFIVE_E_DEV_UART0].base,
          serial_hd(0), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_E_UART0_IRQ));
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
 @@ -XXX,XX +XXX,XX @@ config SIFIVE_E
-     select SIFIVE_CLINT
-     select SIFIVE_GPIO
      select SIFIVE_PLIC
-+    select SIFIVE_UART
+     select SIFIVE_UART
      select SIFIVE_E_PRCI
++    select SIFIVE_E_AON
      select UNIMP
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
+ config SIFIVE_U
      select SIFIVE_GPIO
      select SIFIVE_PDMA
      select SIFIVE_PLIC
 +    select SIFIVE_UART
      select SIFIVE_U_OTP
      select SIFIVE_U_PRCI
      select UNIMP
 diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/meson.build
 +++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
  riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
  riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
 -riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
  riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
 --
-.28.0
+.40.1

-New patch
+[PULL 19/54] tests/qtest: sifive-e-aon-watchdog-test.c: Add QTest of watchdog of sifive_e
+From: Tommy Wu <tommy.wu@sifive.com>
+Add some simple tests of the watchdog timer in the always-on domain device
+of HiFive 1 rev b.
+Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Acked-by: Thomas Huth <thuth@redhat.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230627141216.3962299-4-tommy.wu@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ tests/qtest/sifive-e-aon-watchdog-test.c | 450 +++++++++++++++++++++++
+ tests/qtest/meson.build                  |   3 +
+files changed, 453 insertions(+)
+ create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c
+diff --git a/tests/qtest/sifive-e-aon-watchdog-test.c b/tests/qtest/sifive-e-aon-watchdog-test.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/tests/qtest/sifive-e-aon-watchdog-test.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QTest testcase for the watchdog timer of HiFive 1 rev b.
++ *
++ * Copyright (c) 2023 SiFive, Inc.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2 or later, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License along with
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include "qemu/osdep.h"
++#include "qemu/timer.h"
++#include "qemu/bitops.h"
++#include "libqtest.h"
++#include "hw/registerfields.h"
++#include "hw/misc/sifive_e_aon.h"
++
++FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
++FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
++FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
++FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
++FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
++FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
++FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
++FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
++FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
++FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
++
++#define WDOG_BASE (0x10000000)
++#define WDOGCFG (0x0)
++#define WDOGCOUNT (0x8)
++#define WDOGS (0x10)
++#define WDOGFEED (0x18)
++#define WDOGKEY (0x1c)
++#define WDOGCMP0 (0x20)
++
++#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
++#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
++#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
++
++static void test_init(QTestState *qts)
++{
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
++}
++
++static void test_wdogcount(void)
++{
++    uint64_t tmp;
++    QTestState *qts = qtest_init("-machine sifive_e");
++
++    test_init(qts);
++
++    tmp = qtest_readl(qts, WDOG_BASE + WDOGCOUNT);
++    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
++    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == tmp);
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
++    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xAAAAAAAA);
++    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
++    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGFEED, SIFIVE_E_AON_WDOGFEED);
++    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
++
++    qtest_quit(qts);
++}
++
++static void test_wdogcfg(void)
++{
++    uint32_t tmp_cfg;
++    QTestState *qts = qtest_init("-machine sifive_e");
++
++    test_init(qts);
++
++    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
++    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCFG) == tmp_cfg);
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
++    g_assert(0xFFFFFFFF == qtest_readl(qts, WDOG_BASE + WDOGCFG));
++
++    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(15 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
++    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
++    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
++    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
++    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
++    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
++    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
++    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
++    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
++    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
++    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
++    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
++    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCFG));
++
++    qtest_quit(qts);
++}
++
++static void test_wdogcmp0(void)
++{
++    uint32_t tmp;
++    QTestState *qts = qtest_init("-machine sifive_e");
++
++    test_init(qts);
++
++    tmp = qtest_readl(qts, WDOG_BASE + WDOGCMP0);
++    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
++    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCMP0) == tmp);
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
++    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCMP0));
++
++    qtest_quit(qts);
++}
++
++static void test_wdogkey(void)
++{
++    QTestState *qts = qtest_init("-machine sifive_e");
++
++    test_init(qts);
++
++    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, 0xFFFF);
++    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    g_assert(1 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
++
++    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
++    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
++
++    qtest_quit(qts);
++}
++
++static void test_wdogfeed(void)
++{
++    QTestState *qts = qtest_init("-machine sifive_e");
++
++    test_init(qts);
++
++    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
++
++    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xFFFF);
++    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
++
++    qtest_quit(qts);
++}
++
++static void test_scaled_wdogs(void)
++{
++    uint32_t cfg;
++    uint32_t fake_count = 0x12345678;
++    QTestState *qts = qtest_init("-machine sifive_e");
++
++    test_init(qts);
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, fake_count);
++    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == fake_count);
++    g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
++             (uint16_t)fake_count);
++
++    for (int i = 0; i < 16; i++) {
++        cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++        cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, i);
++        qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++        qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++        g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
++                 (uint16_t)(fake_count >>
++                            FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE)));
++    }
++
++    qtest_quit(qts);
++}
++
++static void test_watchdog(void)
++{
++    uint32_t cfg;
++    QTestState *qts = qtest_init("-machine sifive_e");
++
++    test_init(qts);
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
++
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++
++    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
++
++    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
++             SIFIVE_E_LFCLK_DEFAULT_FREQ);
++    g_assert(qtest_readl(qts, WDOG_BASE + WDOGS) ==
++             SIFIVE_E_LFCLK_DEFAULT_FREQ);
++
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    qtest_quit(qts);
++}
++
++static void test_scaled_watchdog(void)
++{
++    uint32_t cfg;
++    QTestState *qts = qtest_init("-machine sifive_e");
++
++    test_init(qts);
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
++
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++
++    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 10);
++
++    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
++             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
++
++    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
++
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    qtest_quit(qts);
++}
++
++static void test_periodic_int(void)
++{
++    uint32_t cfg;
++    QTestState *qts = qtest_init("-machine sifive_e");
++
++    test_init(qts);
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
++
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, ZEROCMP, 1);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++
++    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
++
++    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
++    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
++
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
++
++    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
++    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
++
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    qtest_quit(qts);
++}
++
++static void test_enable_disable(void)
++{
++    uint32_t cfg;
++    QTestState *qts = qtest_init("-machine sifive_e");
++
++    test_init(qts);
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
++
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++
++    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 2);
++
++    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
++             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
++    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
++
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++
++    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
++
++    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
++             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
++    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
++
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++
++    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
++
++    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
++             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
++    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
++
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
++    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
++    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
++    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
++    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
++    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
++    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
++
++    qtest_quit(qts);
++}
++
++int main(int argc, char *argv[])
++{
++    g_test_init(&argc, &argv, NULL);
++    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcount",
++                   test_wdogcount);
++    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcfg",
++                   test_wdogcfg);
++    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcmp0",
++                   test_wdogcmp0);
++    qtest_add_func("/sifive-e-aon-watchdog-test/wdogkey",
++                   test_wdogkey);
++    qtest_add_func("/sifive-e-aon-watchdog-test/wdogfeed",
++                   test_wdogfeed);
++    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_wdogs",
++                   test_scaled_wdogs);
++    qtest_add_func("/sifive-e-aon-watchdog-test/watchdog",
++                   test_watchdog);
++    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_watchdog",
++                   test_scaled_watchdog);
++    qtest_add_func("/sifive-e-aon-watchdog-test/periodic_int",
++                   test_periodic_int);
++    qtest_add_func("/sifive-e-aon-watchdog-test/enable_disable",
++                   test_enable_disable);
++    return g_test_run();
++}
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/meson.build
++++ b/tests/qtest/meson.build
+@@ -XXX,XX +XXX,XX @@ qtests_s390x = \
+    'cpu-plug-test',
+    'migration-test']
++qtests_riscv32 = \
++  (config_all_devices.has_key('CONFIG_SIFIVE_E_AON') ? ['sifive-e-aon-watchdog-test'] : [])
++
+ qos_test_ss = ss.source_set()
+ qos_test_ss.add(
+   'ac97-test.c',
+--
+.40.1

-[PULL 28/30] hw/riscv: Always build riscv_hart.c
+[PULL 20/54] target/riscv: Only unify 'riscv32/64' -> 'riscv' for host cpu in meson
-From: Bin Meng <bin.meng@windriver.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Every RISC-V machine needs riscv_hart hence there is no need to
+We want to keep the ability to distinct between 32/64-bit host.
 have a dedicated Kconfig option for it. Drop the Kconfig option
 and always build riscv_hart.c.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1599129623-68957-11-git-send-email-bmeng.cn@gmail.com>
+Message-Id: <20230627143235.29947-2-philmd@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/Kconfig     | 9 ---------
+ meson.build | 11 ++++-------
- hw/riscv/meson.build | 2 +-
+file changed, 4 insertions(+), 7 deletions(-)
 files changed, 1 insertion(+), 10 deletions(-)
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
+diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/Kconfig
+--- a/meson.build
-+++ b/hw/riscv/Kconfig
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ qapi_trace_events = []
--config HART
--    bool
+ bsd_oses = ['gnu/kfreebsd', 'freebsd', 'netbsd', 'openbsd', 'dragonfly', 'darwin']
  supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux']
 -supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv', 'x86', 'x86_64',
 +supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv32', 'riscv64', 'x86', 'x86_64',
    'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64']
  cpu = host_machine.cpu_family()
 -# Unify riscv* to a single family.
 -if cpu in ['riscv32', 'riscv64']
 -  cpu = 'riscv'
 -endif
 -
- config IBEX
+ target_dirs = config_host['TARGET_DIRS'].split()
-     bool
+ have_linux_user = false
+ have_bsd_user = false
-@@ -XXX,XX +XXX,XX @@ config SIFIVE
+@@ -XXX,XX +XXX,XX @@ elif cpu == 'x86'
+   host_arch = 'i386'
- config SIFIVE_E
+ elif cpu == 'mips64'
-     bool
+   host_arch = 'mips'
--    select HART
++elif cpu in ['riscv32', 'riscv64']
-     select SIFIVE
++  host_arch = 'riscv'
-     select SIFIVE_CLINT
+ else
-     select SIFIVE_GPIO
+   host_arch = cpu
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
+ endif
- config SIFIVE_U
+@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
-     bool
+   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
-     select CADENCE
+ elif cpu in ['mips', 'mips64']
--    select HART
+   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
-     select SIFIVE
+-elif cpu in ['riscv']
-     select SIFIVE_CLINT
++elif cpu in ['riscv32', 'riscv64']
-     select SIFIVE_GPIO
+   kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
+ else
+   kvm_targets = []
  config SPIKE
      bool
 -    select HART
      select HTIF
      select SIFIVE
      select SIFIVE_CLINT
@@ -XXX,XX +XXX,XX @@ config SPIKE
  config OPENTITAN
      bool
      select IBEX
 -    select HART
      select UNIMP
  config RISCV_VIRT
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      imply PCI_DEVICES
      imply TEST_DEVICES
      select PCI
 -    select HART
      select SERIAL
      select GOLDFISH_RTC
      select VIRTIO_MMIO
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
  config MICROCHIP_PFSOC
      bool
 -    select HART
      select SIFIVE
      select SIFIVE_CLINT
      select UNIMP
 diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/meson.build
 +++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@
  riscv_ss = ss.source_set()
  riscv_ss.add(files('boot.c'), fdt)
  riscv_ss.add(files('numa.c'))
 -riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
 +riscv_ss.add(files('riscv_hart.c'))
  riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
  riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
 --
-.28.0
+.40.1

-[PULL 22/30] hw/riscv: Move sifive_gpio model to hw/gpio
+[PULL 21/54] target/riscv: Only build KVM guest with same wordsize as host
-From: Bin Meng <bin.meng@windriver.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-This is an effort to clean up the hw/riscv directory. Ideally it
+Per Anup Patel in [*]:
 should only contain the RISC-V SoC / machine codes plus generic
 codes. Let's move sifive_gpio model to hw/gpio directory.
-Note this also removes the trace-events in the hw/riscv directory,
+ > Currently, we only support running rv64 guest on rv64 host
-since gpio is the only supported trace target in that directory.
+ > and rv32 guest on rv32 host.
  >
  > In the future, we might support running rv32 guest on rv64
  > host but as of now we don't see a strong push for it.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Therefore, when only using the KVM accelerator it is pointless
 to build qemu-system-riscv32 on a rv64 host (or qemu-system-riscv64
 on a rv32 host). Restrict meson to only build the correct binary,
 avoiding to waste ressources building unusable code.
 [*] https://lore.kernel.org/qemu-devel/CAAhSdy2JeRHeeoEc1XKQhPO3aDz4YKeyQsPT4S8yKJcYTA+AiQ@mail.gmail.com/
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1599129623-68957-5-git-send-email-bmeng.cn@gmail.com>
+Message-Id: <20230627143235.29947-3-philmd@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/trace.h                         | 1 -
+ meson.build | 6 ++++--
- include/hw/{riscv => gpio}/sifive_gpio.h | 0
+file changed, 4 insertions(+), 2 deletions(-)
  include/hw/riscv/sifive_e.h              | 2 +-
  include/hw/riscv/sifive_u.h              | 2 +-
  hw/{riscv => gpio}/sifive_gpio.c         | 2 +-
  hw/gpio/Kconfig                          | 3 +++
  hw/gpio/meson.build                      | 1 +
  hw/gpio/trace-events                     | 6 ++++++
  hw/riscv/Kconfig                         | 2 ++
  hw/riscv/meson.build                     | 1 -
  hw/riscv/trace-events                    | 7 -------
  meson.build                              | 1 -
 files changed, 15 insertions(+), 13 deletions(-)
  delete mode 100644 hw/riscv/trace.h
  rename include/hw/{riscv => gpio}/sifive_gpio.h (100%)
  rename hw/{riscv => gpio}/sifive_gpio.c (99%)
  delete mode 100644 hw/riscv/trace-events
-diff --git a/hw/riscv/trace.h b/hw/riscv/trace.h
-deleted file mode 100644
-index XXXXXXX..XXXXXXX
---- a/hw/riscv/trace.h
-+++ /dev/null
-@@ -1 +0,0 @@
--#include "trace/trace-hw_riscv.h"
-diff --git a/include/hw/riscv/sifive_gpio.h b/include/hw/gpio/sifive_gpio.h
-similarity index 100%
-rename from include/hw/riscv/sifive_gpio.h
-rename to include/hw/gpio/sifive_gpio.h
-diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/sifive_e.h
-+++ b/include/hw/riscv/sifive_e.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/riscv/riscv_hart.h"
- #include "hw/riscv/sifive_cpu.h"
--#include "hw/riscv/sifive_gpio.h"
-+#include "hw/gpio/sifive_gpio.h"
- #define TYPE_RISCV_E_SOC "riscv.sifive.e.soc"
- #define RISCV_E_SOC(obj) \
-diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/sifive_u.h
-+++ b/include/hw/riscv/sifive_u.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/net/cadence_gem.h"
- #include "hw/riscv/riscv_hart.h"
- #include "hw/riscv/sifive_cpu.h"
--#include "hw/riscv/sifive_gpio.h"
-+#include "hw/gpio/sifive_gpio.h"
- #include "hw/misc/sifive_u_otp.h"
- #include "hw/misc/sifive_u_prci.h"
-diff --git a/hw/riscv/sifive_gpio.c b/hw/gpio/sifive_gpio.c
-similarity index 99%
-rename from hw/riscv/sifive_gpio.c
-rename to hw/gpio/sifive_gpio.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_gpio.c
-+++ b/hw/gpio/sifive_gpio.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/log.h"
- #include "hw/irq.h"
- #include "hw/qdev-properties.h"
--#include "hw/riscv/sifive_gpio.h"
-+#include "hw/gpio/sifive_gpio.h"
- #include "migration/vmstate.h"
- #include "trace.h"
-diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/gpio/Kconfig
-+++ b/hw/gpio/Kconfig
-@@ -XXX,XX +XXX,XX @@ config PL061
- config GPIO_KEY
-     bool
-+
-+config SIFIVE_GPIO
-+    bool
-diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/hw/gpio/meson.build
-+++ b/hw/gpio/meson.build
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_gpio.c'))
- softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_gpio.c'))
- softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_gpio.c'))
- softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
-+softmmu_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
-diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/gpio/trace-events
-+++ b/hw/gpio/trace-events
-@@ -XXX,XX +XXX,XX @@ nrf51_gpio_read(uint64_t offset, uint64_t r) "offset 0x%" PRIx64 " value 0x%" PR
- nrf51_gpio_write(uint64_t offset, uint64_t value) "offset 0x%" PRIx64 " value 0x%" PRIx64
- nrf51_gpio_set(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
- nrf51_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
-+
-+# sifive_gpio.c
-+sifive_gpio_read(uint64_t offset, uint64_t r) "offset 0x%" PRIx64 " value 0x%" PRIx64
-+sifive_gpio_write(uint64_t offset, uint64_t value) "offset 0x%" PRIx64 " value 0x%" PRIx64
-+sifive_gpio_set(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
-+sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/Kconfig
-+++ b/hw/riscv/Kconfig
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
-     bool
-     select HART
-     select SIFIVE
-+    select SIFIVE_GPIO
-     select SIFIVE_E_PRCI
-     select UNIMP
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
-     select CADENCE
-     select HART
-     select SIFIVE
-+    select SIFIVE_GPIO
-     select SIFIVE_PDMA
-     select SIFIVE_U_OTP
-     select SIFIVE_U_PRCI
-diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/meson.build
-+++ b/hw/riscv/meson.build
-@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
- riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
- riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
- riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_clint.c'))
--riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_gpio.c'))
- riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_plic.c'))
- riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
- riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
-diff --git a/hw/riscv/trace-events b/hw/riscv/trace-events
-deleted file mode 100644
-index XXXXXXX..XXXXXXX
---- a/hw/riscv/trace-events
-+++ /dev/null
-@@ -XXX,XX +XXX,XX @@
--# See docs/devel/tracing.txt for syntax documentation.
--
--# hw/gpio/sifive_gpio.c
--sifive_gpio_read(uint64_t offset, uint64_t r) "offset 0x%" PRIx64 " value 0x%" PRIx64
--sifive_gpio_write(uint64_t offset, uint64_t value) "offset 0x%" PRIx64 " value 0x%" PRIx64
--sifive_gpio_set(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
--sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ if have_system
+@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
-     'hw/watchdog',
+   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
-     'hw/xen',
+ elif cpu in ['mips', 'mips64']
-     'hw/gpio',
+   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
--    'hw/riscv',
+-elif cpu in ['riscv32', 'riscv64']
-     'migration',
+-  kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
-     'net',
++elif cpu in ['riscv32']
-     'ui',
++  kvm_targets = ['riscv32-softmmu']
 +elif cpu in ['riscv64']
 +  kvm_targets = ['riscv64-softmmu']
  else
    kvm_targets = []
  endif
 --
-.28.0
+.40.1

-New patch
+[PULL 22/54] target/riscv: Add RVV registers to log
+From: Ivan Klokov <ivan.klokov@syntacore.com>
+Print RvV extension register to log if VPU option is enabled.
+Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230629083730.386604-1-ivan.klokov@syntacore.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.c | 57 +++++++++++++++++++++++++++++++++++++++++++++-
+file changed, 56 insertions(+), 1 deletion(-)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
+ #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
+     {#_name, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
++/*
++ * From vector_helper.c
++ * Note that vector data is stored in host-endian 64-bit chunks,
++ * so addressing bytes needs a host-endian fixup.
++ */
++#if HOST_BIG_ENDIAN
++#define BYTE(x)   ((x) ^ 7)
++#else
++#define BYTE(x)   (x)
++#endif
++
+ /*
+  * Here are the ordering rules of extension naming defined by RISC-V
+  * specification :
+@@ -XXX,XX +XXX,XX @@ const char * const riscv_fpr_regnames[] = {
+     "f30/ft10", "f31/ft11"
+ };
++const char * const riscv_rvv_regnames[] = {
++  "v0",  "v1",  "v2",  "v3",  "v4",  "v5",  "v6",
++  "v7",  "v8",  "v9",  "v10", "v11", "v12", "v13",
++  "v14", "v15", "v16", "v17", "v18", "v19", "v20",
++  "v21", "v22", "v23", "v24", "v25", "v26", "v27",
++  "v28", "v29", "v30", "v31"
++};
++
+ static const char * const riscv_excp_names[] = {
+     "misaligned_fetch",
+     "fault_fetch",
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
+ {
+     RISCVCPU *cpu = RISCV_CPU(cs);
+     CPURISCVState *env = &cpu->env;
+-    int i;
++    int i, j;
++    uint8_t *p;
+ #if !defined(CONFIG_USER_ONLY)
+     if (riscv_has_ext(env, RVH)) {
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
+             }
+         }
+     }
++    if (riscv_has_ext(env, RVV) && (flags & CPU_DUMP_VPU)) {
++        static const int dump_rvv_csrs[] = {
++                    CSR_VSTART,
++                    CSR_VXSAT,
++                    CSR_VXRM,
++                    CSR_VCSR,
++                    CSR_VL,
++                    CSR_VTYPE,
++                    CSR_VLENB,
++                };
++        for (int i = 0; i < ARRAY_SIZE(dump_rvv_csrs); ++i) {
++            int csrno = dump_rvv_csrs[i];
++            target_ulong val = 0;
++            RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
++
++            /*
++             * Rely on the smode, hmode, etc, predicates within csr.c
++             * to do the filtering of the registers that are present.
++             */
++            if (res == RISCV_EXCP_NONE) {
++                qemu_fprintf(f, " %-8s " TARGET_FMT_lx "\n",
++                             csr_ops[csrno].name, val);
++            }
++        }
++        uint16_t vlenb = cpu->cfg.vlen >> 3;
++
++        for (i = 0; i < 32; i++) {
++            qemu_fprintf(f, " %-8s ", riscv_rvv_regnames[i]);
++            p = (uint8_t *)env->vreg;
++            for (j = vlenb - 1 ; j >= 0; j--) {
++                qemu_fprintf(f, "%02x", *(p + i * vlenb + BYTE(j)));
++            }
++            qemu_fprintf(f, "\n");
++        }
++    }
+ }
+ static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
+--
+.40.1

-[PULL 27/30] hw/riscv: Move sifive_test model to hw/misc
+[PULL 23/54] hw/riscv/virt: Restrict ACLINT to TCG
-From: Bin Meng <bin.meng@windriver.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-This is an effort to clean up the hw/riscv directory. Ideally it
+The Advanced Core Local Interruptor (ACLINT) device can
-should only contain the RISC-V SoC / machine codes plus generic
+only be used with TCG. Check for TCG enabled instead of
-codes. Let's move sifive_test model to hw/misc directory.
+KVM being not. Only add the property when TCG is used.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1599129623-68957-10-git-send-email-bmeng.cn@gmail.com>
+Message-Id: <20230629121103.87733-3-philmd@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/{riscv => misc}/sifive_test.h | 0
+ docs/system/riscv/virt.rst |  1 +
- hw/{riscv => misc}/sifive_test.c         | 2 +-
+ hw/riscv/virt.c            | 18 ++++++++++--------
- hw/riscv/virt.c                          | 2 +-
+files changed, 11 insertions(+), 8 deletions(-)
  hw/misc/Kconfig                          | 3 +++
  hw/misc/meson.build                      | 1 +
  hw/riscv/Kconfig                         | 1 +
  hw/riscv/meson.build                     | 1 -
 files changed, 7 insertions(+), 3 deletions(-)
  rename include/hw/{riscv => misc}/sifive_test.h (100%)
  rename hw/{riscv => misc}/sifive_test.c (98%)
-diff --git a/include/hw/riscv/sifive_test.h b/include/hw/misc/sifive_test.h
+diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
 similarity index 100%
 rename from include/hw/riscv/sifive_test.h
 rename to include/hw/misc/sifive_test.h
 diff --git a/hw/riscv/sifive_test.c b/hw/misc/sifive_test.c
 similarity index 98%
 rename from hw/riscv/sifive_test.c
 rename to hw/misc/sifive_test.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_test.c
+--- a/docs/system/riscv/virt.rst
-+++ b/hw/misc/sifive_test.c
++++ b/docs/system/riscv/virt.rst
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
- #include "qemu/module.h"
- #include "sysemu/runstate.h"
+   When this option is "on", ACLINT devices will be emulated instead of
- #include "hw/hw.h"
+   SiFive CLINT. When not specified, this option is assumed to be "off".
--#include "hw/riscv/sifive_test.h"
++  This option is restricted to the TCG accelerator.
-+#include "hw/misc/sifive_test.h"
+ - aia=[none|aplic|aplic-imsic]
- static uint64_t sifive_test_read(void *opaque, hwaddr addr, unsigned int size)
  {
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/char/serial.h"
- #include "target/riscv/cpu.h"
- #include "hw/riscv/riscv_hart.h"
--#include "hw/riscv/sifive_test.h"
- #include "hw/riscv/virt.h"
- #include "hw/riscv/boot.h"
- #include "hw/riscv/numa.h"
- #include "hw/intc/sifive_clint.h"
- #include "hw/intc/sifive_plic.h"
-+#include "hw/misc/sifive_test.h"
  #include "chardev/char.h"
- #include "sysemu/arch_init.h"
  #include "sysemu/device_tree.h"
-diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
+ #include "sysemu/sysemu.h"
-index XXXXXXX..XXXXXXX 100644
++#include "sysemu/tcg.h"
---- a/hw/misc/Kconfig
+ #include "sysemu/kvm.h"
-+++ b/hw/misc/Kconfig
+ #include "sysemu/tpm.h"
-@@ -XXX,XX +XXX,XX @@ config MAC_VIA
+ #include "hw/pci/pci.h"
- config AVR_POWER
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-     bool
+         g_free(clust_name);
-+config SIFIVE_TEST
-+    bool
+-        if (!kvm_enabled()) {
-+
++        if (tcg_enabled()) {
- config SIFIVE_E_PRCI
+             if (s->have_aclint) {
-     bool
+                 create_fdt_socket_aclint(s, memmap, socket,
+                     &intc_phandles[phandle_pos]);
-diff --git a/hw/misc/meson.build b/hw/misc/meson.build
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
-index XXXXXXX..XXXXXXX 100644
+                                 hart_count, &error_abort);
---- a/hw/misc/meson.build
+         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_fatal);
-+++ b/hw/misc/meson.build
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM11SCU', if_true: files('arm11scu.c'))
+-        if (!kvm_enabled()) {
- softmmu_ss.add(when: 'CONFIG_MOS6522', if_true: files('mos6522.c'))
++        if (tcg_enabled()) {
+             if (s->have_aclint) {
- # RISC-V devices
+                 if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
-+softmmu_ss.add(when: 'CONFIG_SIFIVE_TEST', if_true: files('sifive_test.c'))
+                     /* Per-socket ACLINT MTIMER */
- softmmu_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
- softmmu_ss.add(when: 'CONFIG_SIFIVE_U_OTP', if_true: files('sifive_u_otp.c'))
+     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
- softmmu_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
+ #endif
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
-index XXXXXXX..XXXXXXX 100644
+-    object_class_property_add_bool(oc, "aclint", virt_get_aclint,
---- a/hw/riscv/Kconfig
+-                                   virt_set_aclint);
-+++ b/hw/riscv/Kconfig
+-    object_class_property_set_description(oc, "aclint",
-@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
+-                                          "Set on/off to enable/disable "
-     select SIFIVE
+-                                          "emulating ACLINT devices");
-     select SIFIVE_CLINT
+-
-     select SIFIVE_PLIC
++    if (tcg_enabled()) {
-+    select SIFIVE_TEST
++        object_class_property_add_bool(oc, "aclint", virt_get_aclint,
++                                       virt_set_aclint);
- config MICROCHIP_PFSOC
++        object_class_property_set_description(oc, "aclint",
-     bool
++                                              "Set on/off to enable/disable "
-diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
++                                              "emulating ACLINT devices");
-index XXXXXXX..XXXXXXX 100644
++    }
---- a/hw/riscv/meson.build
+     object_class_property_add_str(oc, "aia", virt_get_aia,
-+++ b/hw/riscv/meson.build
+                                   virt_set_aia);
-@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files('numa.c'))
+     object_class_property_set_description(oc, "aia",
  riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
  riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
  riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
 -riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
  riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
 --
-.28.0
+.40.1

-New patch
+[PULL 24/54] linux-user/riscv: Add syscall riscv_hwprobe
+From: Robbin Ehn <rehn@rivosinc.com>
+This patch adds the new syscall for the
+"RISC-V Hardware Probing Interface"
+(https://docs.kernel.org/riscv/hwprobe.html).
+Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
+Message-Id: <06a4543df2aa6101ca9a48f21a3198064b4f1f87.camel@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ linux-user/riscv/syscall32_nr.h |   1 +
+ linux-user/riscv/syscall64_nr.h |   1 +
+ linux-user/syscall.c            | 146 ++++++++++++++++++++++++++++++++
+files changed, 148 insertions(+)
+diff --git a/linux-user/riscv/syscall32_nr.h b/linux-user/riscv/syscall32_nr.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/riscv/syscall32_nr.h
++++ b/linux-user/riscv/syscall32_nr.h
+@@ -XXX,XX +XXX,XX @@
+ #define TARGET_NR_accept4 242
+ #define TARGET_NR_arch_specific_syscall 244
+ #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
++#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
+ #define TARGET_NR_prlimit64 261
+ #define TARGET_NR_fanotify_init 262
+ #define TARGET_NR_fanotify_mark 263
+diff --git a/linux-user/riscv/syscall64_nr.h b/linux-user/riscv/syscall64_nr.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/riscv/syscall64_nr.h
++++ b/linux-user/riscv/syscall64_nr.h
+@@ -XXX,XX +XXX,XX @@
+ #define TARGET_NR_recvmmsg 243
+ #define TARGET_NR_arch_specific_syscall 244
+ #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
++#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
+ #define TARGET_NR_wait4 260
+ #define TARGET_NR_prlimit64 261
+ #define TARGET_NR_fanotify_init 262
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/syscall.c
++++ b/linux-user/syscall.c
+@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
+ }
+ #endif /* TARGET_NR_getdents64 */
++#if defined(TARGET_NR_riscv_hwprobe)
++
++#define RISCV_HWPROBE_KEY_MVENDORID     0
++#define RISCV_HWPROBE_KEY_MARCHID       1
++#define RISCV_HWPROBE_KEY_MIMPID        2
++
++#define RISCV_HWPROBE_KEY_BASE_BEHAVIOR 3
++#define     RISCV_HWPROBE_BASE_BEHAVIOR_IMA (1 << 0)
++
++#define RISCV_HWPROBE_KEY_IMA_EXT_0     4
++#define     RISCV_HWPROBE_IMA_FD       (1 << 0)
++#define     RISCV_HWPROBE_IMA_C        (1 << 1)
++
++#define RISCV_HWPROBE_KEY_CPUPERF_0     5
++#define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
++#define     RISCV_HWPROBE_MISALIGNED_EMULATED    (1 << 0)
++#define     RISCV_HWPROBE_MISALIGNED_SLOW        (2 << 0)
++#define     RISCV_HWPROBE_MISALIGNED_FAST        (3 << 0)
++#define     RISCV_HWPROBE_MISALIGNED_UNSUPPORTED (4 << 0)
++#define     RISCV_HWPROBE_MISALIGNED_MASK        (7 << 0)
++
++struct riscv_hwprobe {
++    abi_llong  key;
++    abi_ullong value;
++};
++
++static void risc_hwprobe_fill_pairs(CPURISCVState *env,
++                                    struct riscv_hwprobe *pair,
++                                    size_t pair_count)
++{
++    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
++
++    for (; pair_count > 0; pair_count--, pair++) {
++        abi_llong key;
++        abi_ullong value;
++        __put_user(0, &pair->value);
++        __get_user(key, &pair->key);
++        switch (key) {
++        case RISCV_HWPROBE_KEY_MVENDORID:
++            __put_user(cfg->mvendorid, &pair->value);
++            break;
++        case RISCV_HWPROBE_KEY_MARCHID:
++            __put_user(cfg->marchid, &pair->value);
++            break;
++        case RISCV_HWPROBE_KEY_MIMPID:
++            __put_user(cfg->mimpid, &pair->value);
++            break;
++        case RISCV_HWPROBE_KEY_BASE_BEHAVIOR:
++            value = riscv_has_ext(env, RVI) &&
++                    riscv_has_ext(env, RVM) &&
++                    riscv_has_ext(env, RVA) ?
++                    RISCV_HWPROBE_BASE_BEHAVIOR_IMA : 0;
++            __put_user(value, &pair->value);
++            break;
++        case RISCV_HWPROBE_KEY_IMA_EXT_0:
++            value = riscv_has_ext(env, RVF) &&
++                    riscv_has_ext(env, RVD) ?
++                    RISCV_HWPROBE_IMA_FD : 0;
++            value |= riscv_has_ext(env, RVC) ?
++                     RISCV_HWPROBE_IMA_C : pair->value;
++            __put_user(value, &pair->value);
++            break;
++        case RISCV_HWPROBE_KEY_CPUPERF_0:
++            __put_user(RISCV_HWPROBE_MISALIGNED_FAST, &pair->value);
++            break;
++        default:
++            __put_user(-1, &pair->key);
++            break;
++        }
++    }
++}
++
++static int cpu_set_valid(abi_long arg3, abi_long arg4)
++{
++    int ret, i, tmp;
++    size_t host_mask_size, target_mask_size;
++    unsigned long *host_mask;
++
++    /*
++     * cpu_set_t represent CPU masks as bit masks of type unsigned long *.
++     * arg3 contains the cpu count.
++     */
++    tmp = (8 * sizeof(abi_ulong));
++    target_mask_size = ((arg3 + tmp - 1) / tmp) * sizeof(abi_ulong);
++    host_mask_size = (target_mask_size + (sizeof(*host_mask) - 1)) &
++                     ~(sizeof(*host_mask) - 1);
++
++    host_mask = alloca(host_mask_size);
++
++    ret = target_to_host_cpu_mask(host_mask, host_mask_size,
++                                  arg4, target_mask_size);
++    if (ret != 0) {
++        return ret;
++    }
++
++    for (i = 0 ; i < host_mask_size / sizeof(*host_mask); i++) {
++        if (host_mask[i] != 0) {
++            return 0;
++        }
++    }
++    return -TARGET_EINVAL;
++}
++
++static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
++                                 abi_long arg2, abi_long arg3,
++                                 abi_long arg4, abi_long arg5)
++{
++    int ret;
++    struct riscv_hwprobe *host_pairs;
++
++    /* flags must be 0 */
++    if (arg5 != 0) {
++        return -TARGET_EINVAL;
++    }
++
++    /* check cpu_set */
++    if (arg3 != 0) {
++        ret = cpu_set_valid(arg3, arg4);
++        if (ret != 0) {
++            return ret;
++        }
++    } else if (arg4 != 0) {
++        return -TARGET_EINVAL;
++    }
++
++    /* no pairs */
++    if (arg2 == 0) {
++        return 0;
++    }
++
++    host_pairs = lock_user(VERIFY_WRITE, arg1,
++                           sizeof(*host_pairs) * (size_t)arg2, 0);
++    if (host_pairs == NULL) {
++        return -TARGET_EFAULT;
++    }
++    risc_hwprobe_fill_pairs(cpu_env, host_pairs, arg2);
++    unlock_user(host_pairs, arg1, sizeof(*host_pairs) * (size_t)arg2);
++    return 0;
++}
++#endif /* TARGET_NR_riscv_hwprobe */
++
+ #if defined(TARGET_NR_pivot_root) && defined(__NR_pivot_root)
+ _syscall2(int, pivot_root, const char *, new_root, const char *, put_old)
+ #endif
+@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
+         return ret;
+ #endif
++#if defined(TARGET_NR_riscv_hwprobe)
++    case TARGET_NR_riscv_hwprobe:
++        return do_riscv_hwprobe(cpu_env, arg1, arg2, arg3, arg4, arg5);
++#endif
++
+     default:
+         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
+         return -TARGET_ENOSYS;
+--
+.40.1

-New patch
+[PULL 25/54] target/riscv: Add properties for BF16 extensions
+From: Weiwei Li <liweiwei@iscas.ac.cn>
+Add ext_zfbfmin/zvfbfmin/zvfbfwma properties.
+Add require check for BF16 extensions.
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-Id: <20230615063302.102409-2-liweiwei@iscas.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_cfg.h |  3 +++
+ target/riscv/cpu.c     | 20 ++++++++++++++++++++
+files changed, 23 insertions(+)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_svpbmt;
+     bool ext_zdinx;
+     bool ext_zawrs;
++    bool ext_zfbfmin;
+     bool ext_zfh;
+     bool ext_zfhmin;
+     bool ext_zfinx;
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_zve64f;
+     bool ext_zve64d;
+     bool ext_zmmul;
++    bool ext_zvfbfmin;
++    bool ext_zvfbfwma;
+     bool ext_zvfh;
+     bool ext_zvfhmin;
+     bool ext_smaia;
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+         return;
+     }
++    if (cpu->cfg.ext_zfbfmin && !riscv_has_ext(env, RVF)) {
++        error_setg(errp, "Zfbfmin extension depends on F extension");
++        return;
++    }
++
+     if (riscv_has_ext(env, RVD) && !riscv_has_ext(env, RVF)) {
+         error_setg(errp, "D extension requires F extension");
+         return;
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+         return;
+     }
++    if (cpu->cfg.ext_zvfbfmin && !cpu->cfg.ext_zfbfmin) {
++        error_setg(errp, "Zvfbfmin extension depends on Zfbfmin extension");
++        return;
++    }
++
++    if (cpu->cfg.ext_zvfbfmin && !cpu->cfg.ext_zve32f) {
++        error_setg(errp, "Zvfbfmin extension depends on Zve32f extension");
++        return;
++    }
++
++    if (cpu->cfg.ext_zvfbfwma && !cpu->cfg.ext_zvfbfmin) {
++        error_setg(errp, "Zvfbfwma extension depends on Zvfbfmin extension");
++        return;
++    }
++
+     /* Set the ISA extensions, checks should have happened above */
+     if (cpu->cfg.ext_zhinx) {
+         cpu->cfg.ext_zhinxmin = true;
+--
+.40.1

-New patch
+[PULL 26/54] target/riscv: Add support for Zfbfmin extension
+From: Weiwei Li <liweiwei@iscas.ac.cn>
+Add trans_* and helper function for Zfbfmin instructions.
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20230615063302.102409-3-liweiwei@iscas.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/helper.h                      |  4 ++
+ target/riscv/insn32.decode                 |  4 ++
+ target/riscv/fpu_helper.c                  | 12 +++++
+ target/riscv/translate.c                   |  1 +
+ target/riscv/insn_trans/trans_rvbf16.c.inc | 53 ++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvzfh.c.inc  | 12 ++---
+files changed, 80 insertions(+), 6 deletions(-)
+ create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/helper.h
++++ b/target/riscv/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sm4ks, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+ /* Zce helper */
+ DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
++
++/* BF16 functions */
++DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
++DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@ sm4ks       .. 11010 ..... ..... 000 ..... 0110011 @k_aes
+ # *** RV32 Zicond Standard Extension ***
+ czero_eqz   0000111  ..... ..... 101 ..... 0110011 @r
+ czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
++
++# *** Zfbfmin Standard Extension ***
++fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
++fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
+diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/fpu_helper.c
++++ b/target/riscv/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ uint64_t helper_fcvt_d_h(CPURISCVState *env, uint64_t rs1)
+     float16 frs1 = check_nanbox_h(env, rs1);
+     return float16_to_float64(frs1, true, &env->fp_status);
+ }
++
++uint64_t helper_fcvt_bf16_s(CPURISCVState *env, uint64_t rs1)
++{
++    float32 frs1 = check_nanbox_s(env, rs1);
++    return nanbox_h(env, float32_to_bfloat16(frs1, &env->fp_status));
++}
++
++uint64_t helper_fcvt_s_bf16(CPURISCVState *env, uint64_t rs1)
++{
++    float16 frs1 = check_nanbox_h(env, rs1);
++    return nanbox_s(env, bfloat16_to_float32(frs1, &env->fp_status));
++}
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/translate.c
++++ b/target/riscv/translate.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
+ #include "insn_trans/trans_rvk.c.inc"
+ #include "insn_trans/trans_privileged.c.inc"
+ #include "insn_trans/trans_svinval.c.inc"
++#include "insn_trans/trans_rvbf16.c.inc"
+ #include "decode-xthead.c.inc"
+ #include "insn_trans/trans_xthead.c.inc"
+ #include "insn_trans/trans_xventanacondops.c.inc"
+diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
+@@ -XXX,XX +XXX,XX @@
++/*
++ * RISC-V translation routines for the BF16 Standard Extensions.
++ *
++ * Copyright (c) 2020-2023 PLCT Lab
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2 or later, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License along with
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#define REQUIRE_ZFBFMIN(ctx) do { \
++    if (!ctx->cfg_ptr->ext_zfbfmin) { \
++        return false; \
++    } \
++} while (0)
++
++static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
++{
++    REQUIRE_FPU;
++    REQUIRE_ZFBFMIN(ctx);
++
++    TCGv_i64 dest = dest_fpr(ctx, a->rd);
++    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
++
++    gen_set_rm(ctx, a->rm);
++    gen_helper_fcvt_bf16_s(dest, cpu_env, src1);
++    gen_set_fpr_hs(ctx, a->rd, dest);
++    mark_fs_dirty(ctx);
++    return true;
++}
++
++static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
++{
++    REQUIRE_FPU;
++    REQUIRE_ZFBFMIN(ctx);
++
++    TCGv_i64 dest = dest_fpr(ctx, a->rd);
++    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
++
++    gen_set_rm(ctx, a->rm);
++    gen_helper_fcvt_s_bf16(dest, cpu_env, src1);
++    gen_set_fpr_hs(ctx, a->rd, dest);
++    mark_fs_dirty(ctx);
++    return true;
++}
+diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvzfh.c.inc
++++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
+@@ -XXX,XX +XXX,XX @@
+     }                                  \
+ } while (0)
+-#define REQUIRE_ZFHMIN(ctx) do {              \
+-    if (!ctx->cfg_ptr->ext_zfhmin) {          \
++#define REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx) do {   \
++    if (!ctx->cfg_ptr->ext_zfhmin && !ctx->cfg_ptr->ext_zfbfmin) { \
+         return false;                         \
+     }                                         \
+ } while (0)
+@@ -XXX,XX +XXX,XX @@ static bool trans_flh(DisasContext *ctx, arg_flh *a)
+     TCGv t0;
+     REQUIRE_FPU;
+-    REQUIRE_ZFHMIN(ctx);
++    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
+     decode_save_opc(ctx);
+     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
+@@ -XXX,XX +XXX,XX @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
+     TCGv t0;
+     REQUIRE_FPU;
+-    REQUIRE_ZFHMIN(ctx);
++    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
+     decode_save_opc(ctx);
+     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
+@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_wu(DisasContext *ctx, arg_fcvt_h_wu *a)
+ static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
+ {
+     REQUIRE_FPU;
+-    REQUIRE_ZFHMIN(ctx);
++    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
+     TCGv dest = dest_gpr(ctx, a->rd);
+@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
+ static bool trans_fmv_h_x(DisasContext *ctx, arg_fmv_h_x *a)
+ {
+     REQUIRE_FPU;
+-    REQUIRE_ZFHMIN(ctx);
++    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
+     TCGv t0 = get_gpr(ctx, a->rs1, EXT_ZERO);
+--
+.40.1

-New patch
+[PULL 27/54] target/riscv: Add support for Zvfbfmin extension
+From: Weiwei Li <liweiwei@iscas.ac.cn>
+Add trans_* and helper function for Zvfbfmin instructions.
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20230615063302.102409-4-liweiwei@iscas.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/helper.h                      |  3 +
+ target/riscv/insn32.decode                 |  4 ++
+ target/riscv/vector_helper.c               |  6 ++
+ target/riscv/insn_trans/trans_rvbf16.c.inc | 64 ++++++++++++++++++++++
+files changed, 77 insertions(+)
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/helper.h
++++ b/target/riscv/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
+ /* BF16 functions */
+ DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
+ DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
++
++DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
++DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@ czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
+ # *** Zfbfmin Standard Extension ***
+ fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
+ fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
++
++# *** Zvfbfmin Standard Extension ***
++vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
++vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vector_helper.c
++++ b/target/riscv/vector_helper.c
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfwcvt_f_f_v_w, WOP_UU_W, H8, H4, float32_to_float64)
+ GEN_VEXT_V_ENV(vfwcvt_f_f_v_h, 4)
+ GEN_VEXT_V_ENV(vfwcvt_f_f_v_w, 8)
++RVVCALL(OPFVV1, vfwcvtbf16_f_f_v, WOP_UU_H, H4, H2, bfloat16_to_float32)
++GEN_VEXT_V_ENV(vfwcvtbf16_f_f_v, 4)
++
+ /* Narrowing Floating-Point/Integer Type-Convert Instructions */
+ /* (TD, T2, TX2) */
+ #define NOP_UU_B uint8_t,  uint16_t, uint32_t
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfncvt_f_f_w_w, NOP_UU_W, H4, H8, float64_to_float32)
+ GEN_VEXT_V_ENV(vfncvt_f_f_w_h, 2)
+ GEN_VEXT_V_ENV(vfncvt_f_f_w_w, 4)
++RVVCALL(OPFVV1, vfncvtbf16_f_f_w, NOP_UU_H, H2, H4, float32_to_bfloat16)
++GEN_VEXT_V_ENV(vfncvtbf16_f_f_w, 2)
++
+ /*
+  * Vector Reduction Operations
+  */
+diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvbf16.c.inc
++++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
+@@ -XXX,XX +XXX,XX @@
+     } \
+ } while (0)
++#define REQUIRE_ZVFBFMIN(ctx) do { \
++    if (!ctx->cfg_ptr->ext_zvfbfmin) { \
++        return false; \
++    } \
++} while (0)
++
+ static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
+ {
+     REQUIRE_FPU;
+@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
+     mark_fs_dirty(ctx);
+     return true;
+ }
++
++static bool trans_vfncvtbf16_f_f_w(DisasContext *ctx, arg_vfncvtbf16_f_f_w *a)
++{
++    REQUIRE_FPU;
++    REQUIRE_ZVFBFMIN(ctx);
++
++    if (opfv_narrow_check(ctx, a) && (ctx->sew == MO_16)) {
++        uint32_t data = 0;
++        TCGLabel *over = gen_new_label();
++
++        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
++        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
++        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
++
++        data = FIELD_DP32(data, VDATA, VM, a->vm);
++        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
++        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
++        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
++        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
++                           vreg_ofs(ctx, a->rs2), cpu_env,
++                           ctx->cfg_ptr->vlen / 8,
++                           ctx->cfg_ptr->vlen / 8, data,
++                           gen_helper_vfncvtbf16_f_f_w);
++        mark_vs_dirty(ctx);
++        gen_set_label(over);
++        return true;
++    }
++    return false;
++}
++
++static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
++{
++    REQUIRE_FPU;
++    REQUIRE_ZVFBFMIN(ctx);
++
++    if (opfv_widen_check(ctx, a) && (ctx->sew == MO_16)) {
++        uint32_t data = 0;
++        TCGLabel *over = gen_new_label();
++
++        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
++        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
++        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
++
++        data = FIELD_DP32(data, VDATA, VM, a->vm);
++        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
++        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
++        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
++        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
++                           vreg_ofs(ctx, a->rs2), cpu_env,
++                           ctx->cfg_ptr->vlen / 8,
++                           ctx->cfg_ptr->vlen / 8, data,
++                           gen_helper_vfwcvtbf16_f_f_v);
++        mark_vs_dirty(ctx);
++        gen_set_label(over);
++        return true;
++    }
++    return false;
++}
+--
+.40.1

-New patch
+[PULL 28/54] target/riscv: Add support for Zvfbfwma extension
+From: Weiwei Li <liweiwei@iscas.ac.cn>
+Add trans_* and helper function for Zvfbfwma instructions.
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-Id: <20230615063302.102409-5-liweiwei@iscas.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/helper.h                      |  3 ++
+ target/riscv/insn32.decode                 |  4 ++
+ target/riscv/vector_helper.c               | 11 ++++
+ target/riscv/insn_trans/trans_rvbf16.c.inc | 58 ++++++++++++++++++++++
+files changed, 76 insertions(+)
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/helper.h
++++ b/target/riscv/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
+ DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
+ DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
++
++DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
++DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@ fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
+ # *** Zvfbfmin Standard Extension ***
+ vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
+ vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
++
++# *** Zvfbfwma Standard Extension ***
++vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
++vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vector_helper.c
++++ b/target/riscv/vector_helper.c
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVF3, vfwmacc_vf_w, WOP_UUU_W, H8, H4, fwmacc32)
+ GEN_VEXT_VF(vfwmacc_vf_h, 4)
+ GEN_VEXT_VF(vfwmacc_vf_w, 8)
++static uint32_t fwmaccbf16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
++{
++    return float32_muladd(bfloat16_to_float32(a, s),
++                          bfloat16_to_float32(b, s), d, 0, s);
++}
++
++RVVCALL(OPFVV3, vfwmaccbf16_vv, WOP_UUU_H, H4, H2, H2, fwmaccbf16)
++GEN_VEXT_VV_ENV(vfwmaccbf16_vv, 4)
++RVVCALL(OPFVF3, vfwmaccbf16_vf, WOP_UUU_H, H4, H2, fwmacc16)
++GEN_VEXT_VF(vfwmaccbf16_vf, 4)
++
+ static uint32_t fwnmacc16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
+ {
+     return float32_muladd(float16_to_float32(a, true, s),
+diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvbf16.c.inc
++++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
+@@ -XXX,XX +XXX,XX @@
+     } \
+ } while (0)
++#define REQUIRE_ZVFBFWMA(ctx) do { \
++    if (!ctx->cfg_ptr->ext_zvfbfwma) { \
++        return false; \
++    } \
++} while (0)
++
+ static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
+ {
+     REQUIRE_FPU;
+@@ -XXX,XX +XXX,XX @@ static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
+     }
+     return false;
+ }
++
++static bool trans_vfwmaccbf16_vv(DisasContext *ctx, arg_vfwmaccbf16_vv *a)
++{
++    REQUIRE_FPU;
++    REQUIRE_ZVFBFWMA(ctx);
++
++    if (require_rvv(ctx) && vext_check_isa_ill(ctx) && (ctx->sew == MO_16) &&
++        vext_check_dss(ctx, a->rd, a->rs1, a->rs2, a->vm)) {
++        uint32_t data = 0;
++        TCGLabel *over = gen_new_label();
++
++        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
++        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
++        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
++
++        data = FIELD_DP32(data, VDATA, VM, a->vm);
++        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
++        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
++        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
++        tcg_gen_gvec_4_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
++                           vreg_ofs(ctx, a->rs1),
++                           vreg_ofs(ctx, a->rs2), cpu_env,
++                           ctx->cfg_ptr->vlen / 8,
++                           ctx->cfg_ptr->vlen / 8, data,
++                           gen_helper_vfwmaccbf16_vv);
++        mark_vs_dirty(ctx);
++        gen_set_label(over);
++        return true;
++    }
++    return false;
++}
++
++static bool trans_vfwmaccbf16_vf(DisasContext *ctx, arg_vfwmaccbf16_vf *a)
++{
++    REQUIRE_FPU;
++    REQUIRE_ZVFBFWMA(ctx);
++
++    if (require_rvv(ctx) && (ctx->sew == MO_16) && vext_check_isa_ill(ctx) &&
++        vext_check_ds(ctx, a->rd, a->rs2, a->vm)) {
++        uint32_t data = 0;
++
++        gen_set_rm(ctx, RISCV_FRM_DYN);
++        data = FIELD_DP32(data, VDATA, VM, a->vm);
++        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
++        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
++        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
++        return opfvf_trans(a->rd, a->rs1, a->rs2, data,
++                           gen_helper_vfwmaccbf16_vf, ctx);
++    }
++
++    return false;
++}
+--
+.40.1

-[PULL 04/30] hw/riscv: hart: Add a new 'resetvec' property
+[PULL 29/54] target/riscv: Expose properties for BF16 extensions
-From: Bin Meng <bin.meng@windriver.com>
+From: Weiwei Li <liweiwei@iscas.ac.cn>
-RISC-V machines do not instantiate RISC-V CPUs directly, instead
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-they do that via the hart array. Add a new property for the reset
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-vector address to allow the value to be passed to the CPU, before
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-CPU is realized.
+Message-Id: <20230615063302.102409-6-liweiwei@iscas.ac.cn>
 Signed-off-by: Bin Meng <bin.meng@windriver.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-Id: <1598924352-89526-3-git-send-email-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/riscv_hart.h | 1 +
+ target/riscv/cpu.c | 7 +++++++
- hw/riscv/riscv_hart.c         | 3 +++
+file changed, 7 insertions(+)
 files changed, 4 insertions(+)
-diff --git a/include/hw/riscv/riscv_hart.h b/include/hw/riscv/riscv_hart.h
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/riscv_hart.h
+--- a/target/riscv/cpu.c
-+++ b/include/hw/riscv/riscv_hart.h
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ typedef struct RISCVHartArrayState {
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     uint32_t num_harts;
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
-     uint32_t hartid_base;
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
-     char *cpu_type;
+     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
-+    uint64_t resetvec;
++    ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
-     RISCVCPU *harts;
+     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
- } RISCVHartArrayState;
+     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
+     ISA_EXT_DATA_ENTRY(zfinx, PRIV_VERSION_1_12_0, ext_zfinx),
-diff --git a/hw/riscv/riscv_hart.c b/hw/riscv/riscv_hart.c
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-index XXXXXXX..XXXXXXX 100644
+     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
---- a/hw/riscv/riscv_hart.c
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
-+++ b/hw/riscv/riscv_hart.c
+     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
-@@ -XXX,XX +XXX,XX @@ static Property riscv_harts_props[] = {
++    ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
-     DEFINE_PROP_UINT32("num-harts", RISCVHartArrayState, num_harts, 1),
++    ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
-     DEFINE_PROP_UINT32("hartid-base", RISCVHartArrayState, hartid_base, 0),
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
-     DEFINE_PROP_STRING("cpu-type", RISCVHartArrayState, cpu_type),
+     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
-+    DEFINE_PROP_UINT64("resetvec", RISCVHartArrayState, resetvec,
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-+                       DEFAULT_RSTVEC),
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvfh", RISCVCPU, cfg.ext_zvfh, false),
      DEFINE_PROP_BOOL("x-zvfhmin", RISCVCPU, cfg.ext_zvfhmin, false),
 +    DEFINE_PROP_BOOL("x-zfbfmin", RISCVCPU, cfg.ext_zfbfmin, false),
 +    DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
 +    DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
 +
      DEFINE_PROP_END_OF_LIST(),
  };
-@@ -XXX,XX +XXX,XX @@ static bool riscv_hart_realize(RISCVHartArrayState *s, int idx,
-                                char *cpu_type, Error **errp)
- {
-     object_initialize_child(OBJECT(s), "harts[*]", &s->harts[idx], cpu_type);
-+    qdev_prop_set_uint64(DEVICE(&s->harts[idx]), "resetvec", s->resetvec);
-     s->harts[idx].env.mhartid = s->hartid_base + idx;
-     qemu_register_reset(riscv_harts_cpu_reset, &s->harts[idx]);
-     return qdev_realize(DEVICE(&s->harts[idx]), NULL, errp);
 --
-.28.0
+.40.1

-New patch
+[PULL 30/54] target/riscv: Set the correct exception for implict G-stage translation fail
+From: Jason Chien <jason.chien@sifive.com>
+The privileged spec states:
+For a memory access made to support VS-stage address translation (such as
+to read/write a VS-level page table), permissions are checked as though
+for a load or store, not for the original access type. However, any
+exception is always reported for the original access type (instruction,
+load, or store/AMO).
+The current implementation converts the access type to LOAD if implicit
+G-stage translation fails which results in only reporting "Load guest-page
+fault". This commit removes the convertion of access type, so the reported
+exception conforms to the spec.
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230627074915.7686-1-jason.chien@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_helper.c | 1 -
+file changed, 1 deletion(-)
+diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_helper.c
++++ b/target/riscv/cpu_helper.c
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+         if (ret == TRANSLATE_G_STAGE_FAIL) {
+             first_stage_error = false;
+             two_stage_indirect_error = true;
+-            access_type = MMU_DATA_LOAD;
+         }
+         qemu_log_mask(CPU_LOG_MMU,
+--
+.40.1

-New patch
+[PULL 31/54] target/riscv: Add disas support for BF16 extensions
+From: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230703071759.86775-2-liweiwei@iscas.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ disas/riscv.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
+file changed, 44 insertions(+)
+diff --git a/disas/riscv.c b/disas/riscv.c
+index XXXXXXX..XXXXXXX 100644
+--- a/disas/riscv.c
++++ b/disas/riscv.c
+@@ -XXX,XX +XXX,XX @@ typedef enum {
+     rv_op_cm_jalt = 788,
+     rv_op_czero_eqz = 789,
+     rv_op_czero_nez = 790,
++    rv_op_fcvt_bf16_s = 791,
++    rv_op_fcvt_s_bf16 = 792,
++    rv_op_vfncvtbf16_f_f_w = 793,
++    rv_op_vfwcvtbf16_f_f_v = 794,
++    rv_op_vfwmaccbf16_vv = 795,
++    rv_op_vfwmaccbf16_vf = 796,
++    rv_op_flh = 797,
++    rv_op_fsh = 798,
++    rv_op_fmv_h_x = 799,
++    rv_op_fmv_x_h = 800,
+ } rv_op;
+ /* register names */
+@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
+     { "cm.jalt", rv_codec_zcmt_jt, rv_fmt_zcmt_index, NULL, 0 },
+     { "czero.eqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+     { "czero.nez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
++    { "fcvt.bf16.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
++    { "fcvt.s.bf16", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
++    { "vfncvtbf16.f.f.w", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
++    { "vfwcvtbf16.f.f.v", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
++    { "vfwmaccbf16.vv", rv_codec_v_r, rv_fmt_vd_vs1_vs2_vm, NULL, 0, 0, 0 },
++    { "vfwmaccbf16.vf", rv_codec_v_r, rv_fmt_vd_fs1_vs2_vm, NULL, 0, 0, 0 },
++    { "flh", rv_codec_i, rv_fmt_frd_offset_rs1, NULL, 0, 0, 0 },
++    { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
++    { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
++    { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+ };
+ /* CSR names */
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
+                 case 3: op = rv_op_vloxei8_v; break;
+                 }
+                 break;
++            case 1: op = rv_op_flh; break;
+             case 2: op = rv_op_flw; break;
+             case 3: op = rv_op_fld; break;
+             case 4: op = rv_op_flq; break;
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
+                 case 3: op = rv_op_vsoxei8_v; break;
+                 }
+                 break;
++            case 1: op = rv_op_fsh; break;
+             case 2: op = rv_op_fsw; break;
+             case 3: op = rv_op_fsd; break;
+             case 4: op = rv_op_fsq; break;
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
+                 switch ((inst >> 20) & 0b11111) {
+                 case 1: op = rv_op_fcvt_s_d; break;
+                 case 3: op = rv_op_fcvt_s_q; break;
++                case 6: op = rv_op_fcvt_s_bf16; break;
+                 }
+                 break;
+             case 33:
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
+                 case 3: op = rv_op_fcvt_d_q; break;
+                 }
+                 break;
++            case 34:
++                switch (((inst >> 20) & 0b11111)) {
++                case 8: op = rv_op_fcvt_bf16_s; break;
++                }
++                break;
+             case 35:
+                 switch ((inst >> 20) & 0b11111) {
+                 case 0: op = rv_op_fcvt_q_s; break;
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
+                 case 1: op = rv_op_fclass_d; break;
+                 }
+                 break;
++            case 114:
++                switch (((inst >> 17) & 0b11111000) |
++                        ((inst >> 12) & 0b00000111)) {
++                case 0: op = rv_op_fmv_x_h; break;
++                }
++                break;
+             case 115:
+                 switch (((inst >> 17) & 0b11111000) |
+                         ((inst >> 12) & 0b00000111)) {
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
+                 case 0: op = rv_op_fmv_d_x; break;
+                 }
+                 break;
++            case 122:
++                switch (((inst >> 17) & 0b11111000) |
++                        ((inst >> 12) & 0b00000111)) {
++                case 0: op = rv_op_fmv_h_x; break;
++                }
++                break;
+             case 123:
+                 switch (((inst >> 17) & 0b11111000) |
+                         ((inst >> 12) & 0b00000111)) {
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
+                     case 10: op = rv_op_vfwcvt_f_xu_v; break;
+                     case 11: op = rv_op_vfwcvt_f_x_v; break;
+                     case 12: op = rv_op_vfwcvt_f_f_v; break;
++                    case 13: op = rv_op_vfwcvtbf16_f_f_v; break;
+                     case 14: op = rv_op_vfwcvt_rtz_xu_f_v; break;
+                     case 15: op = rv_op_vfwcvt_rtz_x_f_v; break;
+                     case 16: op = rv_op_vfncvt_xu_f_w; break;
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
+                     case 21: op = rv_op_vfncvt_rod_f_f_w; break;
+                     case 22: op = rv_op_vfncvt_rtz_xu_f_w; break;
+                     case 23: op = rv_op_vfncvt_rtz_x_f_w; break;
++                    case 29: op = rv_op_vfncvtbf16_f_f_w; break;
+                     }
+                     break;
+                 case 19:
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
+                 case 52: op = rv_op_vfwadd_wv; break;
+                 case 54: op = rv_op_vfwsub_wv; break;
+                 case 56: op = rv_op_vfwmul_vv; break;
++                case 59: op = rv_op_vfwmaccbf16_vv; break;
+                 case 60: op = rv_op_vfwmacc_vv; break;
+                 case 61: op = rv_op_vfwnmacc_vv; break;
+                 case 62: op = rv_op_vfwmsac_vv; break;
+@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
+                 case 52: op = rv_op_vfwadd_wf; break;
+                 case 54: op = rv_op_vfwsub_wf; break;
+                 case 56: op = rv_op_vfwmul_vf; break;
++                case 59: op = rv_op_vfwmaccbf16_vf; break;
+                 case 60: op = rv_op_vfwmacc_vf; break;
+                 case 61: op = rv_op_vfwnmacc_vf; break;
+                 case 62: op = rv_op_vfwmsac_vf; break;
+--
+.40.1

-[PULL 02/30] riscv: sifive_test: Allow 16-bit writes to memory region
+[PULL 32/54] target/riscv KVM_RISCV_SET_TIMER macro is not configured correctly
-From: Nathan Chancellor <natechancellor@gmail.com>
+From: "yang.zhang" <yang.zhang@hexintek.com>
-When shutting down the machine running a mainline Linux kernel, the
+Should set/get riscv all reg timer,i.e, time/compare/frequency/state.
 following error happens:
-$ build/riscv64-softmmu/qemu-system-riscv64 -bios default -M virt \
+Signed-off-by: Yang Zhang <yang.zhang@hexintek.com>
-    -display none -initrd rootfs.cpio -kernel Image -m 512m \
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1688
     -nodefaults -serial mon:stdio
 ...
 Requesting system poweroff
 [    4.999630] reboot: Power down
 sbi_trap_error: hart0: trap handler failed (error -2)
 sbi_trap_error: hart0: mcause=0x0000000000000007 mtval=0x0000000000100000
 sbi_trap_error: hart0: mepc=0x000000008000d4cc mstatus=0x0000000000001822
 sbi_trap_error: hart0: ra=0x000000008000999e sp=0x0000000080015c78
 sbi_trap_error: hart0: gp=0xffffffe000e76610 tp=0xffffffe0081b89c0
 sbi_trap_error: hart0: s0=0x0000000080015c88 s1=0x0000000000000040
 sbi_trap_error: hart0: a0=0x0000000000000000 a1=0x0000000080004024
 sbi_trap_error: hart0: a2=0x0000000080004024 a3=0x0000000080004024
 sbi_trap_error: hart0: a4=0x0000000000100000 a5=0x0000000000005555
 sbi_trap_error: hart0: a6=0x0000000000004024 a7=0x0000000080011158
 sbi_trap_error: hart0: s2=0x0000000000000000 s3=0x0000000080016000
 sbi_trap_error: hart0: s4=0x0000000000000000 s5=0x0000000000000000
 sbi_trap_error: hart0: s6=0x0000000000000001 s7=0x0000000000000000
 sbi_trap_error: hart0: s8=0x0000000000000000 s9=0x0000000000000000
 sbi_trap_error: hart0: s10=0x0000000000000000 s11=0x0000000000000008
 sbi_trap_error: hart0: t0=0x0000000000000000 t1=0x0000000000000000
 sbi_trap_error: hart0: t2=0x0000000000000000 t3=0x0000000000000000
 sbi_trap_error: hart0: t4=0x0000000000000000 t5=0x0000000000000000
 sbi_trap_error: hart0: t6=0x0000000000000000
 The kernel does a 16-bit write when powering off the machine, which
 was allowed before commit 5d971f9e67 ("memory: Revert "memory: accept
 mismatching sizes in memory_region_access_valid""). Make min_access_size
 match reality so that the machine can shut down properly now.
 Cc: qemu-stable@nongnu.org
 Fixes: 88a07990fa ("SiFive RISC-V Test Finisher")
 Fixes: 5d971f9e67 ("memory: Revert "memory: accept mismatching sizes in memory_region_access_valid"")
 Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20200901055822.2721209-1-natechancellor@gmail.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-Id: <20230707032306.4606-1-gaoshanliukou@163.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/sifive_test.c | 2 +-
+ target/riscv/kvm.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/riscv/sifive_test.c b/hw/riscv/sifive_test.c
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_test.c
+--- a/target/riscv/kvm.c
-+++ b/hw/riscv/sifive_test.c
++++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps sifive_test_ops = {
+@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
-     .write = sifive_test_write,
-     .endianness = DEVICE_NATIVE_ENDIAN,
+ #define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
-     .valid = {
+     do { \
--        .min_access_size = 4,
+-        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, time), &reg); \
-+        .min_access_size = 2,
++        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
-         .max_access_size = 4
+         if (ret) { \
-     }
+             abort(); \
- };
+         } \
 --
-.28.0
+.40.1

-[PULL 24/30] hw/riscv: Move sifive_plic model to hw/intc
+[PULL 34/54] hw/riscv: virt: Convert fdt_load_addr to uint64_t
-From: Bin Meng <bin.meng@windriver.com>
+From: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>
-This is an effort to clean up the hw/riscv directory. Ideally it
+fdt_load_addr was previously declared as uint32_t which doe not match
-should only contain the RISC-V SoC / machine codes plus generic
+with the return type of riscv_compute_fdt_addr().
 codes. Let's move sifive_plic model to hw/intc directory.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+This patch modifies the fdt_load_addr type from a uint32_t to a uint64_t
 to match the riscv_compute_fdt_addr() return type.
 This fixes calculating the fdt address when DRAM is mapped to higher
 -bit address.
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Signed-off-by: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>
 [ Change by AF:
  - Cleanup commit title and message
 ]
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1599129623-68957-7-git-send-email-bmeng.cn@gmail.com>
+Message-Id: <168872495192.6334.3845988291412774261-1@git.sr.ht>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- {include/hw/riscv => hw/intc}/sifive_plic.h | 0
+ hw/riscv/virt.c | 2 +-
- hw/{riscv => intc}/sifive_plic.c            | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
  hw/riscv/microchip_pfsoc.c                  | 2 +-
  hw/riscv/sifive_e.c                         | 2 +-
  hw/riscv/sifive_u.c                         | 2 +-
  hw/riscv/virt.c                             | 2 +-
  hw/intc/Kconfig                             | 3 +++
  hw/intc/meson.build                         | 1 +
  hw/riscv/Kconfig                            | 5 +++++
  hw/riscv/meson.build                        | 1 -
 files changed, 14 insertions(+), 6 deletions(-)
  rename {include/hw/riscv => hw/intc}/sifive_plic.h (100%)
  rename hw/{riscv => intc}/sifive_plic.c (99%)
-diff --git a/include/hw/riscv/sifive_plic.h b/hw/intc/sifive_plic.h
-similarity index 100%
-rename from include/hw/riscv/sifive_plic.h
-rename to hw/intc/sifive_plic.h
-diff --git a/hw/riscv/sifive_plic.c b/hw/intc/sifive_plic.c
-similarity index 99%
-rename from hw/riscv/sifive_plic.c
-rename to hw/intc/sifive_plic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_plic.c
-+++ b/hw/intc/sifive_plic.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/pci/msi.h"
- #include "hw/boards.h"
- #include "hw/qdev-properties.h"
-+#include "hw/intc/sifive_plic.h"
- #include "target/riscv/cpu.h"
- #include "sysemu/sysemu.h"
--#include "hw/riscv/sifive_plic.h"
- #define RISCV_DEBUG_PLIC 0
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/microchip_pfsoc.c
-+++ b/hw/riscv/microchip_pfsoc.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/misc/unimp.h"
- #include "hw/riscv/boot.h"
- #include "hw/riscv/riscv_hart.h"
--#include "hw/riscv/sifive_plic.h"
- #include "hw/riscv/microchip_pfsoc.h"
- #include "hw/intc/sifive_clint.h"
-+#include "hw/intc/sifive_plic.h"
- #include "sysemu/sysemu.h"
- /*
-diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_e.c
-+++ b/hw/riscv/sifive_e.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/misc/unimp.h"
- #include "target/riscv/cpu.h"
- #include "hw/riscv/riscv_hart.h"
--#include "hw/riscv/sifive_plic.h"
- #include "hw/riscv/sifive_uart.h"
- #include "hw/riscv/sifive_e.h"
- #include "hw/riscv/boot.h"
- #include "hw/intc/sifive_clint.h"
-+#include "hw/intc/sifive_plic.h"
- #include "hw/misc/sifive_e_prci.h"
- #include "chardev/char.h"
- #include "sysemu/arch_init.h"
-diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_u.c
-+++ b/hw/riscv/sifive_u.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/misc/unimp.h"
- #include "target/riscv/cpu.h"
- #include "hw/riscv/riscv_hart.h"
--#include "hw/riscv/sifive_plic.h"
- #include "hw/riscv/sifive_uart.h"
- #include "hw/riscv/sifive_u.h"
- #include "hw/riscv/boot.h"
- #include "hw/intc/sifive_clint.h"
-+#include "hw/intc/sifive_plic.h"
- #include "chardev/char.h"
- #include "net/eth.h"
- #include "sysemu/arch_init.h"
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
- #include "hw/char/serial.h"
+     target_ulong start_addr = memmap[VIRT_DRAM].base;
- #include "target/riscv/cpu.h"
+     target_ulong firmware_end_addr, kernel_start_addr;
- #include "hw/riscv/riscv_hart.h"
+     const char *firmware_name = riscv_default_firmware_name(&s->soc[0]);
--#include "hw/riscv/sifive_plic.h"
+-    uint32_t fdt_load_addr;
- #include "hw/riscv/sifive_test.h"
++    uint64_t fdt_load_addr;
- #include "hw/riscv/virt.h"
+     uint64_t kernel_entry = 0;
- #include "hw/riscv/boot.h"
+     BlockBackend *pflash_blk0;
- #include "hw/riscv/numa.h"
  #include "hw/intc/sifive_clint.h"
 +#include "hw/intc/sifive_plic.h"
  #include "chardev/char.h"
  #include "sysemu/arch_init.h"
  #include "sysemu/device_tree.h"
 diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/Kconfig
 +++ b/hw/intc/Kconfig
@@ -XXX,XX +XXX,XX @@ config LOONGSON_LIOINTC
  config SIFIVE_CLINT
      bool
 +
 +config SIFIVE_PLIC
 +    bool
 diff --git a/hw/intc/meson.build b/hw/intc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/meson.build
 +++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: 'CONFIG_S390_FLIC', if_true: files('s390_flic.c'))
  specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: files('s390_flic_kvm.c'))
  specific_ss.add(when: 'CONFIG_SH4', if_true: files('sh_intc.c'))
  specific_ss.add(when: 'CONFIG_SIFIVE_CLINT', if_true: files('sifive_clint.c'))
 +specific_ss.add(when: 'CONFIG_SIFIVE_PLIC', if_true: files('sifive_plic.c'))
  specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c'))
  specific_ss.add(when: 'CONFIG_XICS_KVM', if_true: files('xics_kvm.c'))
  specific_ss.add(when: 'CONFIG_XICS_SPAPR', if_true: files('xics_spapr.c'))
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
      select SIFIVE
      select SIFIVE_CLINT
      select SIFIVE_GPIO
 +    select SIFIVE_PLIC
      select SIFIVE_E_PRCI
      select UNIMP
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
      select SIFIVE_CLINT
      select SIFIVE_GPIO
      select SIFIVE_PDMA
 +    select SIFIVE_PLIC
      select SIFIVE_U_OTP
      select SIFIVE_U_PRCI
      select UNIMP
@@ -XXX,XX +XXX,XX @@ config SPIKE
      select HTIF
      select SIFIVE
      select SIFIVE_CLINT
 +    select SIFIVE_PLIC
  config OPENTITAN
      bool
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      select PFLASH_CFI01
      select SIFIVE
      select SIFIVE_CLINT
 +    select SIFIVE_PLIC
  config MICROCHIP_PFSOC
      bool
@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
      select UNIMP
      select MCHP_PFSOC_MMUART
      select SIFIVE_PDMA
 +    select SIFIVE_PLIC
      select CADENCE_SDHCI
 diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/meson.build
 +++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files('numa.c'))
  riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
  riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
  riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
 -riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_plic.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
 --
-.28.0
+.40.1

-New patch
+[PULL 35/54] target/riscv: skip features setup for KVM CPUs
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+As it is today it's not possible to use '-cpu host' if the RISC-V host
+has RVH enabled. This is the resulting error:
+$ ./qemu/build/qemu-system-riscv64 \
+    -machine virt,accel=kvm -m 2G -smp 1 \
+    -nographic -snapshot -kernel ./guest_imgs/Image  \
+    -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
+    -append "earlycon=sbi root=/dev/ram rw" \
+    -cpu host
+qemu-system-riscv64: H extension requires priv spec 1.12.0
+This happens because we're checking for priv spec for all CPUs, and
+since we're not setting  env->priv_ver for the 'host' CPU, it's being
+default to zero (i.e. PRIV_SPEC_1_10_0).
+In reality env->priv_ver does not make sense when running with the KVM
+'host' CPU. It's used to gate certain CSRs/extensions during translation
+to make them unavailable if the hart declares an older spec version. It
+doesn't have any other use. E.g. OpenSBI version 1.2 retrieves the spec
+checking if the CSR_MCOUNTEREN, CSR_MCOUNTINHIBIT and CSR_MENVCFG CSRs
+are available [1].
+'priv_ver' is just one example. We're doing a lot of feature validation
+and setup during riscv_cpu_realize() that it doesn't apply to KVM CPUs.
+Validating the feature set for those CPUs is a KVM problem that should
+be handled in KVM specific code.
+The new riscv_cpu_realize_tcg() helper contains all validation logic that
+are applicable to TCG CPUs only. riscv_cpu_realize() verifies if we're
+running TCG and, if it's the case, proceed with the usual TCG realize()
+logic.
+[1] lib/sbi/sbi_hart.c, hart_detect_features()
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230706101738.460804-2-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.c | 35 +++++++++++++++++++++++++----------
+file changed, 25 insertions(+), 10 deletions(-)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@
+ #include "migration/vmstate.h"
+ #include "fpu/softfloat-helpers.h"
+ #include "sysemu/kvm.h"
++#include "sysemu/tcg.h"
+ #include "kvm_riscv.h"
+ #include "tcg/tcg.h"
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
+     }
+ }
+-static void riscv_cpu_realize(DeviceState *dev, Error **errp)
++static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
+ {
+-    CPUState *cs = CPU(dev);
+     RISCVCPU *cpu = RISCV_CPU(dev);
+     CPURISCVState *env = &cpu->env;
+-    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
+     Error *local_err = NULL;
+-    cpu_exec_realizefn(cs, &local_err);
+-    if (local_err != NULL) {
+-        error_propagate(errp, local_err);
+-        return;
+-    }
+-
+     riscv_cpu_validate_misa_mxl(cpu, &local_err);
+     if (local_err != NULL) {
+         error_propagate(errp, local_err);
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+     }
+ #ifndef CONFIG_USER_ONLY
+-    cs->tcg_cflags |= CF_PCREL;
++    CPU(dev)->tcg_cflags |= CF_PCREL;
+     if (cpu->cfg.ext_sstc) {
+         riscv_timer_init(cpu);
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+         }
+      }
+ #endif
++}
++
++static void riscv_cpu_realize(DeviceState *dev, Error **errp)
++{
++    CPUState *cs = CPU(dev);
++    RISCVCPU *cpu = RISCV_CPU(dev);
++    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
++    Error *local_err = NULL;
++
++    cpu_exec_realizefn(cs, &local_err);
++    if (local_err != NULL) {
++        error_propagate(errp, local_err);
++        return;
++    }
++
++    if (tcg_enabled()) {
++        riscv_cpu_realize_tcg(dev, &local_err);
++        if (local_err != NULL) {
++            error_propagate(errp, local_err);
++            return;
++        }
++    }
+     riscv_cpu_finalize_features(cpu, &local_err);
+     if (local_err != NULL) {
+--
+.40.1

-[PULL 23/30] hw/riscv: Move sifive_clint model to hw/intc
+[PULL 36/54] hw/riscv/virt.c: skip 'mmu-type' FDT if satp mode not set
-From: Bin Meng <bin.meng@windriver.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-This is an effort to clean up the hw/riscv directory. Ideally it
+The absence of a satp mode in riscv_host_cpu_init() is causing the
-should only contain the RISC-V SoC / machine codes plus generic
+following error:
 codes. Let's move sifive_clint model to hw/intc directory.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+$ ./qemu/build/qemu-system-riscv64  -machine virt,accel=kvm \
     -m 2G -smp 1  -nographic -snapshot \
     -kernel ./guest_imgs/Image \
     -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
     -append "earlycon=sbi root=/dev/ram rw" \
     -cpu host
 **
 ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should not be
 reached
 Bail out! ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should
 not be reached
 Aborted
 The error is triggered from create_fdt_socket_cpus() in hw/riscv/virt.c.
 It's trying to get satp_mode_str for a NULL cpu->cfg.satp_mode.map.
 For this KVM cpu we would need to inherit the satp supported modes
 from the RISC-V host. At this moment this is not possible because the
 KVM driver does not support it. And even when it does we can't just let
 this broken for every other older kernel.
 Since mmu-type is not a required node, according to [1], skip the
 'mmu-type' FDT node if there's no satp_mode set. We'll revisit this
 logic when we can get satp information from KVM.
 [1] https://github.com/torvalds/linux/blob/master/Documentation/devicetree/bindings/riscv/cpus.yaml
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1599129623-68957-6-git-send-email-bmeng.cn@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-Id: <20230706101738.460804-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/{riscv => intc}/sifive_clint.h | 0
+ hw/riscv/virt.c | 14 +++++++-------
- hw/{riscv => intc}/sifive_clint.c         | 2 +-
+file changed, 7 insertions(+), 7 deletions(-)
  hw/riscv/microchip_pfsoc.c                | 2 +-
  hw/riscv/sifive_e.c                       | 2 +-
  hw/riscv/sifive_u.c                       | 2 +-
  hw/riscv/spike.c                          | 2 +-
  hw/riscv/virt.c                           | 2 +-
  hw/intc/Kconfig                           | 3 +++
  hw/intc/meson.build                       | 1 +
  hw/riscv/Kconfig                          | 5 +++++
  hw/riscv/meson.build                      | 1 -
 files changed, 15 insertions(+), 7 deletions(-)
  rename include/hw/{riscv => intc}/sifive_clint.h (100%)
  rename hw/{riscv => intc}/sifive_clint.c (99%)
-diff --git a/include/hw/riscv/sifive_clint.h b/include/hw/intc/sifive_clint.h
-similarity index 100%
-rename from include/hw/riscv/sifive_clint.h
-rename to include/hw/intc/sifive_clint.h
-diff --git a/hw/riscv/sifive_clint.c b/hw/intc/sifive_clint.c
-similarity index 99%
-rename from hw/riscv/sifive_clint.c
-rename to hw/intc/sifive_clint.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_clint.c
-+++ b/hw/intc/sifive_clint.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "target/riscv/cpu.h"
- #include "hw/qdev-properties.h"
--#include "hw/riscv/sifive_clint.h"
-+#include "hw/intc/sifive_clint.h"
- #include "qemu/timer.h"
- static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/microchip_pfsoc.c
-+++ b/hw/riscv/microchip_pfsoc.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/misc/unimp.h"
- #include "hw/riscv/boot.h"
- #include "hw/riscv/riscv_hart.h"
--#include "hw/riscv/sifive_clint.h"
- #include "hw/riscv/sifive_plic.h"
- #include "hw/riscv/microchip_pfsoc.h"
-+#include "hw/intc/sifive_clint.h"
- #include "sysemu/sysemu.h"
- /*
-diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_e.c
-+++ b/hw/riscv/sifive_e.c
-@@ -XXX,XX +XXX,XX @@
- #include "target/riscv/cpu.h"
- #include "hw/riscv/riscv_hart.h"
- #include "hw/riscv/sifive_plic.h"
--#include "hw/riscv/sifive_clint.h"
- #include "hw/riscv/sifive_uart.h"
- #include "hw/riscv/sifive_e.h"
- #include "hw/riscv/boot.h"
-+#include "hw/intc/sifive_clint.h"
- #include "hw/misc/sifive_e_prci.h"
- #include "chardev/char.h"
- #include "sysemu/arch_init.h"
-diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_u.c
-+++ b/hw/riscv/sifive_u.c
-@@ -XXX,XX +XXX,XX @@
- #include "target/riscv/cpu.h"
- #include "hw/riscv/riscv_hart.h"
- #include "hw/riscv/sifive_plic.h"
--#include "hw/riscv/sifive_clint.h"
- #include "hw/riscv/sifive_uart.h"
- #include "hw/riscv/sifive_u.h"
- #include "hw/riscv/boot.h"
-+#include "hw/intc/sifive_clint.h"
- #include "chardev/char.h"
- #include "net/eth.h"
- #include "sysemu/arch_init.h"
-diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/spike.c
-+++ b/hw/riscv/spike.c
-@@ -XXX,XX +XXX,XX @@
- #include "target/riscv/cpu.h"
- #include "hw/riscv/riscv_htif.h"
- #include "hw/riscv/riscv_hart.h"
--#include "hw/riscv/sifive_clint.h"
- #include "hw/riscv/spike.h"
- #include "hw/riscv/boot.h"
- #include "hw/riscv/numa.h"
-+#include "hw/intc/sifive_clint.h"
- #include "chardev/char.h"
- #include "sysemu/arch_init.h"
- #include "sysemu/device_tree.h"
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
- #include "target/riscv/cpu.h"
+             s->soc[socket].hartid_base + cpu);
- #include "hw/riscv/riscv_hart.h"
+         qemu_fdt_add_subnode(ms->fdt, cpu_name);
- #include "hw/riscv/sifive_plic.h"
--#include "hw/riscv/sifive_clint.h"
+-        satp_mode_max = satp_mode_max_from_map(
- #include "hw/riscv/sifive_test.h"
+-            s->soc[socket].harts[cpu].cfg.satp_mode.map);
- #include "hw/riscv/virt.h"
+-        sv_name = g_strdup_printf("riscv,%s",
- #include "hw/riscv/boot.h"
+-                                  satp_mode_str(satp_mode_max, is_32_bit));
- #include "hw/riscv/numa.h"
+-        qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
-+#include "hw/intc/sifive_clint.h"
+-        g_free(sv_name);
- #include "chardev/char.h"
+-
- #include "sysemu/arch_init.h"
++        if (cpu_ptr->cfg.satp_mode.supported != 0) {
- #include "sysemu/device_tree.h"
++            satp_mode_max = satp_mode_max_from_map(cpu_ptr->cfg.satp_mode.map);
-diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
++            sv_name = g_strdup_printf("riscv,%s",
-index XXXXXXX..XXXXXXX 100644
++                                      satp_mode_str(satp_mode_max, is_32_bit));
---- a/hw/intc/Kconfig
++            qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
-+++ b/hw/intc/Kconfig
++            g_free(sv_name);
-@@ -XXX,XX +XXX,XX @@ config RX_ICU
++        }
- config LOONGSON_LIOINTC
+         name = riscv_isa_string(cpu_ptr);
-     bool
+         qemu_fdt_setprop_string(ms->fdt, cpu_name, "riscv,isa", name);
 +
 +config SIFIVE_CLINT
 +    bool
 diff --git a/hw/intc/meson.build b/hw/intc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/meson.build
 +++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: 'CONFIG_RX_ICU', if_true: files('rx_icu.c'))
  specific_ss.add(when: 'CONFIG_S390_FLIC', if_true: files('s390_flic.c'))
  specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: files('s390_flic_kvm.c'))
  specific_ss.add(when: 'CONFIG_SH4', if_true: files('sh_intc.c'))
 +specific_ss.add(when: 'CONFIG_SIFIVE_CLINT', if_true: files('sifive_clint.c'))
  specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c'))
  specific_ss.add(when: 'CONFIG_XICS_KVM', if_true: files('xics_kvm.c'))
  specific_ss.add(when: 'CONFIG_XICS_SPAPR', if_true: files('xics_spapr.c'))
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
      bool
      select HART
      select SIFIVE
 +    select SIFIVE_CLINT
      select SIFIVE_GPIO
      select SIFIVE_E_PRCI
      select UNIMP
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
      select CADENCE
      select HART
      select SIFIVE
 +    select SIFIVE_CLINT
      select SIFIVE_GPIO
      select SIFIVE_PDMA
      select SIFIVE_U_OTP
@@ -XXX,XX +XXX,XX @@ config SPIKE
      select HART
      select HTIF
      select SIFIVE
 +    select SIFIVE_CLINT
  config OPENTITAN
      bool
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      select PCI_EXPRESS_GENERIC_BRIDGE
      select PFLASH_CFI01
      select SIFIVE
 +    select SIFIVE_CLINT
  config MICROCHIP_PFSOC
      bool
      select HART
      select SIFIVE
 +    select SIFIVE_CLINT
      select UNIMP
      select MCHP_PFSOC_MMUART
      select SIFIVE_PDMA
 diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/meson.build
 +++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files('numa.c'))
  riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
  riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
  riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
 -riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_clint.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_plic.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
 --
-.28.0
+.40.1

-[PULL 18/30] hw/riscv: sifive_u: Connect a DMA controller
+[PULL 37/54] target/riscv/cpu.c: restrict 'mvendorid' value
-From: Bin Meng <bin.meng@windriver.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-SiFive FU540 SoC integrates a platform DMA controller with 4 DMA
+We're going to change the handling of mvendorid/marchid/mimpid by the
-channels. This connects the exsiting SiFive PDMA model to the SoC,
+KVM driver. Since these are always present in all CPUs let's put the
-and adds its device tree data as well.
+same validation for everyone.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+It doesn't make sense to allow 'mvendorid' to be different than it
 is already set in named (vendor) CPUs. Generic (dynamic) CPUs can have
 any 'mvendorid' they want.
 Change 'mvendorid' to be a class property created via
 'object_class_property_add', instead of using the DEFINE_PROP_UINT32()
 macro. This allow us to define a custom setter for it that will verify,
 for named CPUs, if mvendorid is different than it is already set by the
 CPU. This is the error thrown for the 'veyron-v1' CPU if 'mvendorid' is
 set to an invalid value:
 $ qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mvendorid=2
 qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mvendorid=2:
     Unable to change veyron-v1-riscv-cpu mvendorid (0x61f)
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1598924352-89526-17-git-send-email-bmeng.cn@gmail.com>
+Message-Id: <20230706101738.460804-4-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/sifive_u.h | 11 +++++++++++
+ target/riscv/cpu.c | 38 +++++++++++++++++++++++++++++++++++++-
- hw/riscv/sifive_u.c         | 30 ++++++++++++++++++++++++++++++
+file changed, 37 insertions(+), 1 deletion(-)
  hw/riscv/Kconfig            |  1 +
 files changed, 42 insertions(+)
-diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/sifive_u.h
+--- a/target/riscv/cpu.c
-+++ b/include/hw/riscv/sifive_u.h
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
- #ifndef HW_SIFIVE_U_H
+ static Property riscv_cpu_properties[] = {
- #define HW_SIFIVE_U_H
+     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
-+#include "hw/dma/sifive_pdma.h"
+-    DEFINE_PROP_UINT32("mvendorid", RISCVCPU, cfg.mvendorid, 0),
- #include "hw/net/cadence_gem.h"
+     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
- #include "hw/riscv/riscv_hart.h"
+     DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
- #include "hw/riscv/sifive_cpu.h"
-@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveUSoCState {
+@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps riscv_tcg_ops = {
-     SiFiveUPRCIState prci;
+ #endif /* !CONFIG_USER_ONLY */
      SIFIVEGPIOState gpio;
      SiFiveUOTPState otp;
 +    SiFivePDMAState dma;
      CadenceGEMState gem;
      uint32_t serial;
@@ -XXX,XX +XXX,XX @@ enum {
      SIFIVE_U_MROM,
      SIFIVE_U_CLINT,
      SIFIVE_U_L2CC,
 +    SIFIVE_U_PDMA,
      SIFIVE_U_L2LIM,
      SIFIVE_U_PLIC,
      SIFIVE_U_PRCI,
@@ -XXX,XX +XXX,XX @@ enum {
      SIFIVE_U_GPIO_IRQ13 = 20,
      SIFIVE_U_GPIO_IRQ14 = 21,
      SIFIVE_U_GPIO_IRQ15 = 22,
 +    SIFIVE_U_PDMA_IRQ0 = 23,
 +    SIFIVE_U_PDMA_IRQ1 = 24,
 +    SIFIVE_U_PDMA_IRQ2 = 25,
 +    SIFIVE_U_PDMA_IRQ3 = 26,
 +    SIFIVE_U_PDMA_IRQ4 = 27,
 +    SIFIVE_U_PDMA_IRQ5 = 28,
 +    SIFIVE_U_PDMA_IRQ6 = 29,
 +    SIFIVE_U_PDMA_IRQ7 = 30,
      SIFIVE_U_GEM_IRQ = 0x35
  };
-diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
++static bool riscv_cpu_is_dynamic(Object *cpu_obj)
-index XXXXXXX..XXXXXXX 100644
++{
---- a/hw/riscv/sifive_u.c
++    return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
-+++ b/hw/riscv/sifive_u.c
++}
@@ -XXX,XX +XXX,XX @@
   * 4) GPIO (General Purpose Input/Output Controller)
   * 5) OTP (One-Time Programmable) memory with stored serial number
   * 6) GEM (Gigabit Ethernet Controller) and management block
 + * 7) DMA (Direct Memory Access Controller)
   *
   * This board currently generates devicetree dynamically that indicates at least
   * two harts and up to five harts.
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
      [SIFIVE_U_MROM] =     {     0x1000,     0xf000 },
      [SIFIVE_U_CLINT] =    {  0x2000000,    0x10000 },
      [SIFIVE_U_L2CC] =     {  0x2010000,     0x1000 },
 +    [SIFIVE_U_PDMA] =     {  0x3000000,   0x100000 },
      [SIFIVE_U_L2LIM] =    {  0x8000000,  0x2000000 },
      [SIFIVE_U_PLIC] =     {  0xc000000,  0x4000000 },
      [SIFIVE_U_PRCI] =     { 0x10000000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const struct MemmapEntry *memmap,
      qemu_fdt_setprop_string(fdt, nodename, "compatible", "gpio-restart");
      g_free(nodename);
 +    nodename = g_strdup_printf("/soc/dma@%lx",
 +        (long)memmap[SIFIVE_U_PDMA].base);
 +    qemu_fdt_add_subnode(fdt, nodename);
 +    qemu_fdt_setprop_cell(fdt, nodename, "#dma-cells", 1);
 +    qemu_fdt_setprop_cells(fdt, nodename, "interrupts",
 +        SIFIVE_U_PDMA_IRQ0, SIFIVE_U_PDMA_IRQ1, SIFIVE_U_PDMA_IRQ2,
 +        SIFIVE_U_PDMA_IRQ3, SIFIVE_U_PDMA_IRQ4, SIFIVE_U_PDMA_IRQ5,
 +        SIFIVE_U_PDMA_IRQ6, SIFIVE_U_PDMA_IRQ7);
 +    qemu_fdt_setprop_cell(fdt, nodename, "interrupt-parent", plic_phandle);
 +    qemu_fdt_setprop_cells(fdt, nodename, "reg",
 +        0x0, memmap[SIFIVE_U_PDMA].base,
 +        0x0, memmap[SIFIVE_U_PDMA].size);
 +    qemu_fdt_setprop_string(fdt, nodename, "compatible",
 +                            "sifive,fu540-c000-pdma");
 +    g_free(nodename);
 +
-     nodename = g_strdup_printf("/soc/cache-controller@%lx",
++static void cpu_set_mvendorid(Object *obj, Visitor *v, const char *name,
-         (long)memmap[SIFIVE_U_L2CC].base);
++                              void *opaque, Error **errp)
-     qemu_fdt_add_subnode(fdt, nodename);
++{
-@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_instance_init(Object *obj)
++    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
-     object_initialize_child(obj, "otp", &s->otp, TYPE_SIFIVE_U_OTP);
++    RISCVCPU *cpu = RISCV_CPU(obj);
-     object_initialize_child(obj, "gem", &s->gem, TYPE_CADENCE_GEM);
++    uint32_t prev_val = cpu->cfg.mvendorid;
-     object_initialize_child(obj, "gpio", &s->gpio, TYPE_SIFIVE_GPIO);
++    uint32_t value;
 +    object_initialize_child(obj, "pdma", &s->dma, TYPE_SIFIVE_PDMA);
  }
  static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
                                              SIFIVE_U_GPIO_IRQ0 + i));
      }
 +    /* PDMA */
 +    sysbus_realize(SYS_BUS_DEVICE(&s->dma), errp);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->dma), 0, memmap[SIFIVE_U_PDMA].base);
 +
-+    /* Connect PDMA interrupts to the PLIC */
++    if (!visit_type_uint32(v, name, &value, errp)) {
-+    for (i = 0; i < SIFIVE_PDMA_IRQS; i++) {
++        return;
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->dma), i,
 +                           qdev_get_gpio_in(DEVICE(s->plic),
 +                                            SIFIVE_U_PDMA_IRQ0 + i));
 +    }
 +
-     qdev_prop_set_uint32(DEVICE(&s->otp), "serial", s->serial);
++    if (!dynamic_cpu && prev_val != value) {
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->otp), errp)) {
++        error_setg(errp, "Unable to change %s mvendorid (0x%x)",
-         return;
++                   object_get_typename(obj), prev_val);
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
++        return;
-index XXXXXXX..XXXXXXX 100644
++    }
---- a/hw/riscv/Kconfig
++
-+++ b/hw/riscv/Kconfig
++    cpu->cfg.mvendorid = value;
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
++}
-     select CADENCE
++
-     select HART
++static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
-     select SIFIVE
++                              void *opaque, Error **errp)
-+    select SIFIVE_PDMA
++{
-     select UNIMP
++    bool value = RISCV_CPU(obj)->cfg.mvendorid;
++
- config SPIKE
++    visit_type_bool(v, name, &value, errp);
 +}
 +
  static void riscv_cpu_class_init(ObjectClass *c, void *data)
  {
      RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
      cc->tcg_ops = &riscv_tcg_ops;
 +    object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
 +                              cpu_set_mvendorid, NULL, NULL);
 +
      device_class_set_props(dc, riscv_cpu_properties);
  }
 --
-.28.0
+.40.1

-New patch
+[PULL 38/54] target/riscv/cpu.c: restrict 'mimpid' value
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Following the same logic used with 'mvendorid' let's also restrict
+'mimpid' for named CPUs. Generic CPUs keep setting the value freely.
+Note that we're getting rid of the default RISCV_CPU_MARCHID value. The
+reason is that this is not a good default since it's dynamic, changing
+with with every QEMU version, regardless of whether the actual
+implementation of the CPU changed from one QEMU version to the other.
+Named CPU should set it to a meaningful value instead and generic CPUs
+can set whatever they want.
+This is the error thrown for an invalid 'mimpid' value for the veyron-v1
+CPU:
+$ ./qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mimpid=2
+qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mimpid=2:
+    Unable to change veyron-v1-riscv-cpu mimpid (0x111)
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230706101738.460804-5-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.c | 34 ++++++++++++++++++++++++++++++++--
+file changed, 32 insertions(+), 2 deletions(-)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@
+ #define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
+                              (QEMU_VERSION_MINOR << 8)  | \
+                              (QEMU_VERSION_MICRO))
+-#define RISCV_CPU_MIMPID    RISCV_CPU_MARCHID
+ static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
+     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
+     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
+-    DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
+ #ifndef CONFIG_USER_ONLY
+     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
+@@ -XXX,XX +XXX,XX @@ static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
+     visit_type_bool(v, name, &value, errp);
+ }
++static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
++                           void *opaque, Error **errp)
++{
++    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
++    RISCVCPU *cpu = RISCV_CPU(obj);
++    uint64_t prev_val = cpu->cfg.mimpid;
++    uint64_t value;
++
++    if (!visit_type_uint64(v, name, &value, errp)) {
++        return;
++    }
++
++    if (!dynamic_cpu && prev_val != value) {
++        error_setg(errp, "Unable to change %s mimpid (0x%" PRIu64 ")",
++                   object_get_typename(obj), prev_val);
++        return;
++    }
++
++    cpu->cfg.mimpid = value;
++}
++
++static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
++                           void *opaque, Error **errp)
++{
++    bool value = RISCV_CPU(obj)->cfg.mimpid;
++
++    visit_type_bool(v, name, &value, errp);
++}
++
+ static void riscv_cpu_class_init(ObjectClass *c, void *data)
+ {
+     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
+     object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
+                               cpu_set_mvendorid, NULL, NULL);
++    object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
++                              cpu_set_mimpid, NULL, NULL);
++
+     device_class_set_props(dc, riscv_cpu_properties);
+ }
+--
+.40.1

-New patch
+[PULL 39/54] target/riscv/cpu.c: restrict 'marchid' value
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+'marchid' shouldn't be set to a different value as previously set for
+named CPUs.
+For all other CPUs it shouldn't be freely set either - the spec requires
+that 'marchid' can't have the MSB (most significant bit) set and every
+other bit set to zero, i.e. 0x80000000 is an invalid 'marchid' value for
+bit CPUs.
+As with 'mimpid', setting a default value based on the current QEMU
+version is not a good idea because it implies that the CPU
+implementation changes from one QEMU version to the other. Named CPUs
+should set 'marchid' to a meaningful value instead, and generic CPUs can
+set to any valid value.
+For the 'veyron-v1' CPU this is the error thrown if 'marchid' is set to
+a different val:
+$ ./build/qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,marchid=0x80000000
+qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.marchid=0x80000000:
+    Unable to change veyron-v1-riscv-cpu marchid (0x8000000000010000)
+And, for generics CPUs, this is the error when trying to set to an
+invalid val:
+$ ./build/qemu-system-riscv64 -M virt -nographic -cpu rv64,marchid=0x8000000000000000
+qemu-system-riscv64: can't apply global rv64-riscv-cpu.marchid=0x8000000000000000:
+    Unable to set marchid with MSB (64) bit set and the remaining bits zero
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230706101738.460804-6-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.c | 60 ++++++++++++++++++++++++++++++++++++++++------
+file changed, 53 insertions(+), 7 deletions(-)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@
+ #include "tcg/tcg.h"
+ /* RISC-V CPU definitions */
+-
+-#define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
+-                             (QEMU_VERSION_MINOR << 8)  | \
+-                             (QEMU_VERSION_MICRO))
+-
+ static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
+ struct isa_ext_data {
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
+ static Property riscv_cpu_properties[] = {
+     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
+-    DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
+-
+ #ifndef CONFIG_USER_ONLY
+     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
+ #endif
+@@ -XXX,XX +XXX,XX @@ static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
+     visit_type_bool(v, name, &value, errp);
+ }
++static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
++                            void *opaque, Error **errp)
++{
++    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
++    RISCVCPU *cpu = RISCV_CPU(obj);
++    uint64_t prev_val = cpu->cfg.marchid;
++    uint64_t value, invalid_val;
++    uint32_t mxlen = 0;
++
++    if (!visit_type_uint64(v, name, &value, errp)) {
++        return;
++    }
++
++    if (!dynamic_cpu && prev_val != value) {
++        error_setg(errp, "Unable to change %s marchid (0x%" PRIu64 ")",
++                   object_get_typename(obj), prev_val);
++        return;
++    }
++
++    switch (riscv_cpu_mxl(&cpu->env)) {
++    case MXL_RV32:
++        mxlen = 32;
++        break;
++    case MXL_RV64:
++    case MXL_RV128:
++        mxlen = 64;
++        break;
++    default:
++        g_assert_not_reached();
++    }
++
++    invalid_val = 1LL << (mxlen - 1);
++
++    if (value == invalid_val) {
++        error_setg(errp, "Unable to set marchid with MSB (%u) bit set "
++                         "and the remaining bits zero", mxlen);
++        return;
++    }
++
++    cpu->cfg.marchid = value;
++}
++
++static void cpu_get_marchid(Object *obj, Visitor *v, const char *name,
++                           void *opaque, Error **errp)
++{
++    bool value = RISCV_CPU(obj)->cfg.marchid;
++
++    visit_type_bool(v, name, &value, errp);
++}
++
+ static void riscv_cpu_class_init(ObjectClass *c, void *data)
+ {
+     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
+     object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
+                               cpu_set_mimpid, NULL, NULL);
++    object_class_property_add(c, "marchid", "uint64", cpu_get_marchid,
++                              cpu_set_marchid, NULL, NULL);
++
+     device_class_set_props(dc, riscv_cpu_properties);
+ }
+--
+.40.1

-[PULL 11/30] hw/dma: Add SiFive platform DMA controller emulation
+[PULL 40/54] target/riscv: use KVM scratch CPUs to init KVM properties
-From: Bin Meng <bin.meng@windriver.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Microchip PolarFire SoC integrates a DMA engine that supports:
+Certain validations, such as the validations done for the machine IDs
-* Independent concurrent DMA transfers using 4 DMA channels
+(mvendorid/marchid/mimpid), are done before starting the CPU.
-* Generation of interrupts on various conditions during execution
+Non-dynamic (named) CPUs tries to match user input with a preset
-which is actually an IP reused from the SiFive FU540 chip.
+default. As it is today we can't prefetch a KVM default for these cases
 because we're only able to read/write KVM regs after the vcpu is
 spinning.
-This creates a model to support both polling and interrupt modes.
+Our target/arm friends use a concept called "scratch CPU", which
 consists of creating a vcpu for doing queries and validations and so on,
 which is discarded shortly after use [1]. This is a suitable solution
 for what we need so let's implement it in target/riscv as well.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+kvm_riscv_init_machine_ids() will be used to do any pre-launch setup for
 KVM CPUs, via riscv_cpu_add_user_properties(). The function will create
 a KVM scratch CPU, fetch KVM regs that work as default values for user
 properties, and then discard the scratch CPU afterwards.
 We're starting by initializing 'mvendorid'. This concept will be used to
 init other KVM specific properties in the next patches as well.
 [1] target/arm/kvm.c, kvm_arm_create_scratch_host_vcpu()
 Suggested-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1598924352-89526-10-git-send-email-bmeng.cn@gmail.com>
+Message-Id: <20230706101738.460804-7-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/dma/sifive_pdma.h |  57 +++++++
+ target/riscv/kvm_riscv.h |  1 +
- hw/dma/sifive_pdma.c         | 313 +++++++++++++++++++++++++++++++++++
+ target/riscv/cpu.c       |  6 +++
- hw/dma/Kconfig               |   3 +
+ target/riscv/kvm.c       | 85 ++++++++++++++++++++++++++++++++++++++++
- hw/dma/meson.build           |   1 +
+files changed, 92 insertions(+)
 files changed, 374 insertions(+)
  create mode 100644 include/hw/dma/sifive_pdma.h
  create mode 100644 hw/dma/sifive_pdma.c
-diff --git a/include/hw/dma/sifive_pdma.h b/include/hw/dma/sifive_pdma.h
+diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/target/riscv/kvm_riscv.h
---- /dev/null
++++ b/target/riscv/kvm_riscv.h
 +++ b/include/hw/dma/sifive_pdma.h
 @@ -XXX,XX +XXX,XX @@
+ #ifndef QEMU_KVM_RISCV_H
+ #define QEMU_KVM_RISCV_H
++void kvm_riscv_init_user_properties(Object *cpu_obj);
+ void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
+ void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
+     Property *prop;
+     DeviceState *dev = DEVICE(obj);
++#ifndef CONFIG_USER_ONLY
++    if (kvm_enabled()) {
++        kvm_riscv_init_user_properties(obj);
++    }
++#endif
++
+     riscv_cpu_add_misa_properties(obj);
+     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm.c
++++ b/target/riscv/kvm.c
+@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
+     env->kvm_timer_dirty = false;
+ }
++typedef struct KVMScratchCPU {
++    int kvmfd;
++    int vmfd;
++    int cpufd;
++} KVMScratchCPU;
++
 +/*
-+ * SiFive Platform DMA emulation
++ * Heavily inspired by kvm_arm_create_scratch_host_vcpu()
-+ *
++ * from target/arm/kvm.c.
 + * Copyright (c) 2020 Wind River Systems, Inc.
 + *
 + * Author:
 + *   Bin Meng <bin.meng@windriver.com>
 + *
 + * This program is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU General Public License as
 + * published by the Free Software Foundation; either version 2 or
 + * (at your option) version 3 of the License.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
++static bool kvm_riscv_create_scratch_vcpu(KVMScratchCPU *scratch)
++{
++    int kvmfd = -1, vmfd = -1, cpufd = -1;
 +
-+#ifndef SIFIVE_PDMA_H
++    kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
-+#define SIFIVE_PDMA_H
++    if (kvmfd < 0) {
-+
++        goto err;
-+struct sifive_pdma_chan {
++    }
-+    uint32_t control;
++    do {
-+    uint32_t next_config;
++        vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
-+    uint64_t next_bytes;
++    } while (vmfd == -1 && errno == EINTR);
-+    uint64_t next_dst;
++    if (vmfd < 0) {
-+    uint64_t next_src;
++        goto err;
-+    uint32_t exec_config;
++    }
-+    uint64_t exec_bytes;
++    cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
-+    uint64_t exec_dst;
++    if (cpufd < 0) {
-+    uint64_t exec_src;
++        goto err;
 +    int state;
 +};
 +
 +#define SIFIVE_PDMA_CHANS           4
 +#define SIFIVE_PDMA_IRQS            (SIFIVE_PDMA_CHANS * 2)
 +#define SIFIVE_PDMA_REG_SIZE        0x100000
 +#define SIFIVE_PDMA_CHAN_NO(reg)    ((reg & (SIFIVE_PDMA_REG_SIZE - 1)) >> 12)
 +
 +typedef struct SiFivePDMAState {
 +    SysBusDevice parent;
 +    MemoryRegion iomem;
 +    qemu_irq irq[SIFIVE_PDMA_IRQS];
 +
 +    struct sifive_pdma_chan chan[SIFIVE_PDMA_CHANS];
 +} SiFivePDMAState;
 +
 +#define TYPE_SIFIVE_PDMA    "sifive.pdma"
 +
 +#define SIFIVE_PDMA(obj)    \
 +    OBJECT_CHECK(SiFivePDMAState, (obj), TYPE_SIFIVE_PDMA)
 +
 +#endif /* SIFIVE_PDMA_H */
 diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/dma/sifive_pdma.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * SiFive Platform DMA emulation
 + *
 + * Copyright (c) 2020 Wind River Systems, Inc.
 + *
 + * Author:
 + *   Bin Meng <bin.meng@windriver.com>
 + *
 + * This program is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU General Public License as
 + * published by the Free Software Foundation; either version 2 or
 + * (at your option) version 3 of the License.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/bitops.h"
 +#include "qemu/log.h"
 +#include "qapi/error.h"
 +#include "hw/hw.h"
 +#include "hw/irq.h"
 +#include "hw/qdev-properties.h"
 +#include "hw/sysbus.h"
 +#include "migration/vmstate.h"
 +#include "sysemu/dma.h"
 +#include "hw/dma/sifive_pdma.h"
 +
 +#define DMA_CONTROL         0x000
 +#define   CONTROL_CLAIM     BIT(0)
 +#define   CONTROL_RUN       BIT(1)
 +#define   CONTROL_DONE_IE   BIT(14)
 +#define   CONTROL_ERR_IE    BIT(15)
 +#define   CONTROL_DONE      BIT(30)
 +#define   CONTROL_ERR       BIT(31)
 +
 +#define DMA_NEXT_CONFIG     0x004
 +#define   CONFIG_REPEAT     BIT(2)
 +#define   CONFIG_ORDER      BIT(3)
 +#define   CONFIG_WRSZ_SHIFT 24
 +#define   CONFIG_RDSZ_SHIFT 28
 +#define   CONFIG_SZ_MASK    0xf
 +
 +#define DMA_NEXT_BYTES      0x008
 +#define DMA_NEXT_DST        0x010
 +#define DMA_NEXT_SRC        0x018
 +#define DMA_EXEC_CONFIG     0x104
 +#define DMA_EXEC_BYTES      0x108
 +#define DMA_EXEC_DST        0x110
 +#define DMA_EXEC_SRC        0x118
 +
 +enum dma_chan_state {
 +    DMA_CHAN_STATE_IDLE,
 +    DMA_CHAN_STATE_STARTED,
 +    DMA_CHAN_STATE_ERROR,
 +    DMA_CHAN_STATE_DONE
 +};
 +
 +static void sifive_pdma_run(SiFivePDMAState *s, int ch)
 +{
 +    uint64_t bytes = s->chan[ch].next_bytes;
 +    uint64_t dst = s->chan[ch].next_dst;
 +    uint64_t src = s->chan[ch].next_src;
 +    uint32_t config = s->chan[ch].next_config;
 +    int wsize, rsize, size;
 +    uint8_t buf[64];
 +    int n;
 +
 +    /* do nothing if bytes to transfer is zero */
 +    if (!bytes) {
 +        goto error;
 +    }
 +
-+    /*
++    scratch->kvmfd =  kvmfd;
-+     * The manual does not describe how the hardware behaviors when
++    scratch->vmfd = vmfd;
-+     * config.wsize and config.rsize are given different values.
++    scratch->cpufd = cpufd;
-+     * A common case is memory to memory DMA, and in this case they
++
-+     * are normally the same. Abort if this expectation fails.
++    return true;
-+     */
++
-+    wsize = (config >> CONFIG_WRSZ_SHIFT) & CONFIG_SZ_MASK;
++ err:
-+    rsize = (config >> CONFIG_RDSZ_SHIFT) & CONFIG_SZ_MASK;
++    if (cpufd >= 0) {
-+    if (wsize != rsize) {
++        close(cpufd);
-+        goto error;
++    }
 +    if (vmfd >= 0) {
 +        close(vmfd);
 +    }
 +    if (kvmfd >= 0) {
 +        close(kvmfd);
 +    }
 +
-+    /*
++    return false;
 +     * Calculate the transaction size
 +     *
 +     * size field is base 2 logarithm of DMA transaction size,
 +     * but there is an upper limit of 64 bytes per transaction.
 +     */
 +    size = wsize;
 +    if (size > 6) {
 +        size = 6;
 +    }
 +    size = 1 << size;
 +
 +    /* the bytes to transfer should be multiple of transaction size */
 +    if (bytes % size) {
 +        goto error;
 +    }
 +
 +    /* indicate a DMA transfer is started */
 +    s->chan[ch].state = DMA_CHAN_STATE_STARTED;
 +    s->chan[ch].control &= ~CONTROL_DONE;
 +    s->chan[ch].control &= ~CONTROL_ERR;
 +
 +    /* load the next_ registers into their exec_ counterparts */
 +    s->chan[ch].exec_config = config;
 +    s->chan[ch].exec_bytes = bytes;
 +    s->chan[ch].exec_dst = dst;
 +    s->chan[ch].exec_src = src;
 +
 +    for (n = 0; n < bytes / size; n++) {
 +        cpu_physical_memory_read(s->chan[ch].exec_src, buf, size);
 +        cpu_physical_memory_write(s->chan[ch].exec_dst, buf, size);
 +        s->chan[ch].exec_src += size;
 +        s->chan[ch].exec_dst += size;
 +        s->chan[ch].exec_bytes -= size;
 +    }
 +
 +    /* indicate a DMA transfer is done */
 +    s->chan[ch].state = DMA_CHAN_STATE_DONE;
 +    s->chan[ch].control &= ~CONTROL_RUN;
 +    s->chan[ch].control |= CONTROL_DONE;
 +
 +    /* reload exec_ registers if repeat is required */
 +    if (s->chan[ch].next_config & CONFIG_REPEAT) {
 +        s->chan[ch].exec_bytes = bytes;
 +        s->chan[ch].exec_dst = dst;
 +        s->chan[ch].exec_src = src;
 +    }
 +
 +    return;
 +
 +error:
 +    s->chan[ch].state = DMA_CHAN_STATE_ERROR;
 +    s->chan[ch].control |= CONTROL_ERR;
 +    return;
 +}
 +
-+static inline void sifive_pdma_update_irq(SiFivePDMAState *s, int ch)
++static void kvm_riscv_destroy_scratch_vcpu(KVMScratchCPU *scratch)
 +{
-+    bool done_ie, err_ie;
++    close(scratch->cpufd);
-+
++    close(scratch->vmfd);
-+    done_ie = !!(s->chan[ch].control & CONTROL_DONE_IE);
++    close(scratch->kvmfd);
 +    err_ie = !!(s->chan[ch].control & CONTROL_ERR_IE);
 +
 +    if (done_ie && (s->chan[ch].control & CONTROL_DONE)) {
 +        qemu_irq_raise(s->irq[ch * 2]);
 +    } else {
 +        qemu_irq_lower(s->irq[ch * 2]);
 +    }
 +
 +    if (err_ie && (s->chan[ch].control & CONTROL_ERR)) {
 +        qemu_irq_raise(s->irq[ch * 2 + 1]);
 +    } else {
 +        qemu_irq_lower(s->irq[ch * 2 + 1]);
 +    }
 +
 +    s->chan[ch].state = DMA_CHAN_STATE_IDLE;
 +}
 +
-+static uint64_t sifive_pdma_read(void *opaque, hwaddr offset, unsigned size)
++static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 +{
-+    SiFivePDMAState *s = opaque;
++    CPURISCVState *env = &cpu->env;
-+    int ch = SIFIVE_PDMA_CHAN_NO(offset);
++    struct kvm_one_reg reg;
-+    uint64_t val = 0;
++    int ret;
 +
-+    if (ch >= SIFIVE_PDMA_CHANS) {
++    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Invalid channel no %d\n",
++                              KVM_REG_RISCV_CONFIG_REG(mvendorid));
-+                      __func__, ch);
++    reg.addr = (uint64_t)&cpu->cfg.mvendorid;
-+        return 0;
++    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 +    if (ret != 0) {
 +        error_report("Unable to retrieve mvendorid from host, error %d", ret);
 +    }
-+
-+    offset &= 0xfff;
-+    switch (offset) {
-+    case DMA_CONTROL:
-+        val = s->chan[ch].control;
-+        break;
-+    case DMA_NEXT_CONFIG:
-+        val = s->chan[ch].next_config;
-+        break;
-+    case DMA_NEXT_BYTES:
-+        val = s->chan[ch].next_bytes;
-+        break;
-+    case DMA_NEXT_DST:
-+        val = s->chan[ch].next_dst;
-+        break;
-+    case DMA_NEXT_SRC:
-+        val = s->chan[ch].next_src;
-+        break;
-+    case DMA_EXEC_CONFIG:
-+        val = s->chan[ch].exec_config;
-+        break;
-+    case DMA_EXEC_BYTES:
-+        val = s->chan[ch].exec_bytes;
-+        break;
-+    case DMA_EXEC_DST:
-+        val = s->chan[ch].exec_dst;
-+        break;
-+    case DMA_EXEC_SRC:
-+        val = s->chan[ch].exec_src;
-+        break;
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIX "\n",
-+                      __func__, offset);
-+        break;
-+    }
-+
-+    return val;
 +}
 +
-+static void sifive_pdma_write(void *opaque, hwaddr offset,
++void kvm_riscv_init_user_properties(Object *cpu_obj)
 +                              uint64_t value, unsigned size)
 +{
-+    SiFivePDMAState *s = opaque;
++    RISCVCPU *cpu = RISCV_CPU(cpu_obj);
-+    int ch = SIFIVE_PDMA_CHAN_NO(offset);
++    KVMScratchCPU kvmcpu;
 +
-+    if (ch >= SIFIVE_PDMA_CHANS) {
++    if (!kvm_riscv_create_scratch_vcpu(&kvmcpu)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Invalid channel no %d\n",
 +                      __func__, ch);
 +        return;
 +    }
 +
-+    offset &= 0xfff;
++    kvm_riscv_init_machine_ids(cpu, &kvmcpu);
 +    switch (offset) {
 +    case DMA_CONTROL:
 +        s->chan[ch].control = value;
 +
-+        if (value & CONTROL_RUN) {
++    kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 +            sifive_pdma_run(s, ch);
 +        }
 +
 +        sifive_pdma_update_irq(s, ch);
 +        break;
 +    case DMA_NEXT_CONFIG:
 +        s->chan[ch].next_config = value;
 +        break;
 +    case DMA_NEXT_BYTES:
 +        s->chan[ch].next_bytes = value;
 +        break;
 +    case DMA_NEXT_DST:
 +        s->chan[ch].next_dst = value;
 +        break;
 +    case DMA_NEXT_SRC:
 +        s->chan[ch].next_src = value;
 +        break;
 +    case DMA_EXEC_CONFIG:
 +    case DMA_EXEC_BYTES:
 +    case DMA_EXEC_DST:
 +    case DMA_EXEC_SRC:
 +        /* these are read-only registers */
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIX "\n",
 +                      __func__, offset);
 +        break;
 +    }
 +}
 +
-+static const MemoryRegionOps sifive_pdma_ops = {
+ const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
-+    .read = sifive_pdma_read,
+     KVM_CAP_LAST_INFO
-+    .write = sifive_pdma_write,
+ };
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    /* there are 32-bit and 64-bit wide registers */
 +    .impl = {
 +        .min_access_size = 4,
 +        .max_access_size = 8,
 +    }
 +};
 +
 +static void sifive_pdma_realize(DeviceState *dev, Error **errp)
 +{
 +    SiFivePDMAState *s = SIFIVE_PDMA(dev);
 +    int i;
 +
 +    memory_region_init_io(&s->iomem, OBJECT(dev), &sifive_pdma_ops, s,
 +                          TYPE_SIFIVE_PDMA, SIFIVE_PDMA_REG_SIZE);
 +    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
 +
 +    for (i = 0; i < SIFIVE_PDMA_IRQS; i++) {
 +        sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq[i]);
 +    }
 +}
 +
 +static void sifive_pdma_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->desc = "SiFive Platform DMA controller";
 +    dc->realize = sifive_pdma_realize;
 +}
 +
 +static const TypeInfo sifive_pdma_info = {
 +    .name          = TYPE_SIFIVE_PDMA,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(SiFivePDMAState),
 +    .class_init    = sifive_pdma_class_init,
 +};
 +
 +static void sifive_pdma_register_types(void)
 +{
 +    type_register_static(&sifive_pdma_info);
 +}
 +
 +type_init(sifive_pdma_register_types)
 diff --git a/hw/dma/Kconfig b/hw/dma/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/dma/Kconfig
 +++ b/hw/dma/Kconfig
@@ -XXX,XX +XXX,XX @@ config ZYNQ_DEVCFG
  config STP2000
      bool
 +
 +config SIFIVE_PDMA
 +    bool
 diff --git a/hw/dma/meson.build b/hw/dma/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/dma/meson.build
 +++ b/hw/dma/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zdma.c'))
  softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_dma.c', 'soc_dma.c'))
  softmmu_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx_dma.c'))
  softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_dma.c'))
 +softmmu_ss.add(when: 'CONFIG_SIFIVE_PDMA', if_true: files('sifive_pdma.c'))
 --
-.28.0
+.40.1

-New patch
+[PULL 41/54] target/riscv: read marchid/mimpid in kvm_riscv_init_machine_ids()
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Allow 'marchid' and 'mimpid' to also be initialized in
+kvm_riscv_init_machine_ids().
+After this change, the handling of mvendorid/marchid/mimpid for the
+'host' CPU type will be equal to what we already have for TCG named
+CPUs, i.e. the user is not able to set these values to a different val
+than the one that is already preset.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230706101738.460804-8-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/kvm.c | 16 ++++++++++++++++
+file changed, 16 insertions(+)
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm.c
++++ b/target/riscv/kvm.c
+@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+     if (ret != 0) {
+         error_report("Unable to retrieve mvendorid from host, error %d", ret);
+     }
++
++    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++                              KVM_REG_RISCV_CONFIG_REG(marchid));
++    reg.addr = (uint64_t)&cpu->cfg.marchid;
++    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
++    if (ret != 0) {
++        error_report("Unable to retrieve marchid from host, error %d", ret);
++    }
++
++    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++                              KVM_REG_RISCV_CONFIG_REG(mimpid));
++    reg.addr = (uint64_t)&cpu->cfg.mimpid;
++    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
++    if (ret != 0) {
++        error_report("Unable to retrieve mimpid from host, error %d", ret);
++    }
+ }
+ void kvm_riscv_init_user_properties(Object *cpu_obj)
+--
+.40.1

-New patch
+[PULL 42/54] target/riscv: handle mvendorid/marchid/mimpid for KVM CPUs
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+After changing user validation for mvendorid/marchid/mimpid to guarantee
+that the value is validated on user input time, coupled with the work in
+fetching KVM default values for them by using a scratch CPU, we're
+certain that the values in cpu->cfg.(mvendorid|marchid|mimpid) are
+already good to be written back to KVM.
+There's no need to write the values back for 'host' type CPUs since the
+values can't be changed, so let's do that just for generic CPUs.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230706101738.460804-9-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/kvm.c | 31 +++++++++++++++++++++++++++++++
+file changed, 31 insertions(+)
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm.c
++++ b/target/riscv/kvm.c
+@@ -XXX,XX +XXX,XX @@ void kvm_arch_init_irq_routing(KVMState *s)
+ {
+ }
++static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
++{
++    CPURISCVState *env = &cpu->env;
++    uint64_t id;
++    int ret;
++
++    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++                          KVM_REG_RISCV_CONFIG_REG(mvendorid));
++    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mvendorid);
++    if (ret != 0) {
++        return ret;
++    }
++
++    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++                          KVM_REG_RISCV_CONFIG_REG(marchid));
++    ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
++    if (ret != 0) {
++        return ret;
++    }
++
++    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++                          KVM_REG_RISCV_CONFIG_REG(mimpid));
++    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
++
++    return ret;
++}
++
+ int kvm_arch_init_vcpu(CPUState *cs)
+ {
+     int ret = 0;
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
+     }
+     env->misa_ext = isa;
++    if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
++        ret = kvm_vcpu_set_machine_ids(cpu, cs);
++    }
++
+     return ret;
+ }
+--
+.40.1

-New patch
+[PULL 43/54] target/riscv/kvm.c: init 'misa_ext_mask' with scratch CPU
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+At this moment we're retrieving env->misa_ext during
+kvm_arch_init_cpu(), leaving env->misa_ext_mask behind.
+We want to set env->misa_ext_mask, and we want to set it as early as
+possible. The reason is that we're going to use it in the validation
+process of the KVM MISA properties we're going to add next. Setting it
+during arch_init_cpu() is too late for user validation.
+Move the code to a new helper that is going to be called during init()
+time, via kvm_riscv_init_user_properties(), like we're already doing for
+the machine ID properties. Set both misa_ext and misa_ext_mask to the
+same value retrieved by the 'isa' config reg.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230706101738.460804-11-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/kvm.c | 34 +++++++++++++++++++++++-----------
+file changed, 23 insertions(+), 11 deletions(-)
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm.c
++++ b/target/riscv/kvm.c
+@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+     }
+ }
++static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
++                                         KVMScratchCPU *kvmcpu)
++{
++    CPURISCVState *env = &cpu->env;
++    struct kvm_one_reg reg;
++    int ret;
++
++    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++                              KVM_REG_RISCV_CONFIG_REG(isa));
++    reg.addr = (uint64_t)&env->misa_ext_mask;
++    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
++
++    if (ret) {
++        error_report("Unable to fetch ISA register from KVM, "
++                     "error %d", ret);
++        kvm_riscv_destroy_scratch_vcpu(kvmcpu);
++        exit(EXIT_FAILURE);
++    }
++
++    env->misa_ext = env->misa_ext_mask;
++}
++
+ void kvm_riscv_init_user_properties(Object *cpu_obj)
+ {
+     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
+     }
+     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
++    kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
+     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
+ }
+@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
+ int kvm_arch_init_vcpu(CPUState *cs)
+ {
+     int ret = 0;
+-    target_ulong isa;
+     RISCVCPU *cpu = RISCV_CPU(cs);
+-    CPURISCVState *env = &cpu->env;
+-    uint64_t id;
+     qemu_add_vm_change_state_handler(kvm_riscv_vm_state_change, cs);
+-    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+-                          KVM_REG_RISCV_CONFIG_REG(isa));
+-    ret = kvm_get_one_reg(cs, id, &isa);
+-    if (ret) {
+-        return ret;
+-    }
+-    env->misa_ext = isa;
+-
+     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
+         ret = kvm_vcpu_set_machine_ids(cpu, cs);
+     }
+--
+.40.1

-[PULL 03/30] target/riscv: cpu: Add a new 'resetvec' property
+[PULL 44/54] target/riscv/cpu: add misa_ext_info_arr[]
-From: Bin Meng <bin.meng@windriver.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Currently the reset vector address is hard-coded in a RISC-V CPU's
+Next patch will add KVM specific user properties for both MISA and
-instance_init() routine. In a real world we can have 2 exact same
+multi-letter extensions. For MISA extensions we want to make use of what
-CPUs except for the reset vector address, which is pretty common in
+is already available in misa_ext_cfgs[] to avoid code repetition.
-the RISC-V core IP licensing business.
+misa_ext_info_arr[] array will hold name and description for each MISA
-Normally reset vector address is a configurable parameter. Let's
+extension that misa_ext_cfgs[] is declaring. We'll then use this new
-create a 64-bit property to store the reset vector address which
+array in KVM code to avoid duplicating strings. Two getters were added
-covers both 32-bit and 64-bit CPUs.
+to allow KVM to retrieve the 'name' and 'description' for each MISA
+property.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
 There's nothing holding us back from doing the same with multi-letter
 extensions. For now doing just with MISA extensions is enough.
 It is worth documenting that even using the __bultin_ctz() directive to
 populate the misa_ext_info_arr[] we are forced to assign 'name' and
 'description' during runtime in riscv_cpu_add_misa_properties(). The
 reason is that some Gitlab runners ('clang-user' and 'tsan-build') will
 throw errors like this if we fetch 'name' and 'description' from the
 array in the MISA_CFG() macro:
 ../target/riscv/cpu.c:1624:5: error: initializer element is not a
                               compile-time constant
     MISA_CFG(RVA, true),
     ^~~~~~~~~~~~~~~~~~~
 ../target/riscv/cpu.c:1619:53: note: expanded from macro 'MISA_CFG'
     {.name = misa_ext_info_arr[MISA_INFO_IDX(_bit)].name, \
              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~
 gcc and others compilers/builders were fine with that change. We can't
 ignore failures in the Gitlab pipeline though, so code was changed to
 make every runner happy.
 As a side effect, misa_ext_cfg[] is no longer a 'const' array because
 it must be set during runtime.
 Suggested-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-Id: <20230706101738.460804-12-dbarboza@ventanamicro.com>
 Message-Id: <1598924352-89526-2-git-send-email-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h | 1 +
+ target/riscv/cpu.h |   7 ++-
- target/riscv/cpu.c | 1 +
+ target/riscv/cpu.c | 110 +++++++++++++++++++++++++++++++++------------
-files changed, 2 insertions(+)
+files changed, 88 insertions(+), 29 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct RISCVCPU {
+@@ -XXX,XX +XXX,XX @@
-         uint16_t elen;
-         bool mmu;
+ #define RV(x) ((target_ulong)1 << (x - 'A'))
-         bool pmp;
-+        uint64_t resetvec;
+-/* Consider updating misa_ext_cfgs[] when adding new MISA bits here */
-     } cfg;
++/*
- } RISCVCPU;
++ * Consider updating misa_ext_info_arr[] and misa_ext_cfgs[]
++ * when adding new MISA bits here.
 + */
  #define RVI RV('I')
  #define RVE RV('E') /* E and I are mutually exclusive */
  #define RVM RV('M')
@@ -XXX,XX +XXX,XX @@
  #define RVJ RV('J')
  #define RVG RV('G')
 +const char *riscv_get_misa_ext_name(uint32_t bit);
 +const char *riscv_get_misa_ext_description(uint32_t bit);
  /* Privileged specification version */
  enum {
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
-     DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
+     visit_type_bool(v, name, &value, errp);
-     DEFINE_PROP_BOOL("mmu", RISCVCPU, cfg.mmu, true),
+ }
-     DEFINE_PROP_BOOL("pmp", RISCVCPU, cfg.pmp, true),
-+    DEFINE_PROP_UINT64("resetvec", RISCVCPU, cfg.resetvec, DEFAULT_RSTVEC),
+-static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-     DEFINE_PROP_END_OF_LIST(),
+-    {.name = "a", .description = "Atomic instructions",
 -     .misa_bit = RVA, .enabled = true},
 -    {.name = "c", .description = "Compressed instructions",
 -     .misa_bit = RVC, .enabled = true},
 -    {.name = "d", .description = "Double-precision float point",
 -     .misa_bit = RVD, .enabled = true},
 -    {.name = "f", .description = "Single-precision float point",
 -     .misa_bit = RVF, .enabled = true},
 -    {.name = "i", .description = "Base integer instruction set",
 -     .misa_bit = RVI, .enabled = true},
 -    {.name = "e", .description = "Base integer instruction set (embedded)",
 -     .misa_bit = RVE, .enabled = false},
 -    {.name = "m", .description = "Integer multiplication and division",
 -     .misa_bit = RVM, .enabled = true},
 -    {.name = "s", .description = "Supervisor-level instructions",
 -     .misa_bit = RVS, .enabled = true},
 -    {.name = "u", .description = "User-level instructions",
 -     .misa_bit = RVU, .enabled = true},
 -    {.name = "h", .description = "Hypervisor",
 -     .misa_bit = RVH, .enabled = true},
 -    {.name = "x-j", .description = "Dynamic translated languages",
 -     .misa_bit = RVJ, .enabled = false},
 -    {.name = "v", .description = "Vector operations",
 -     .misa_bit = RVV, .enabled = false},
 -    {.name = "g", .description = "General purpose (IMAFD_Zicsr_Zifencei)",
 -     .misa_bit = RVG, .enabled = false},
 +typedef struct misa_ext_info {
 +    const char *name;
 +    const char *description;
 +} MISAExtInfo;
 +
 +#define MISA_INFO_IDX(_bit) \
 +    __builtin_ctz(_bit)
 +
 +#define MISA_EXT_INFO(_bit, _propname, _descr) \
 +    [MISA_INFO_IDX(_bit)] = {.name = _propname, .description = _descr}
 +
 +static const MISAExtInfo misa_ext_info_arr[] = {
 +    MISA_EXT_INFO(RVA, "a", "Atomic instructions"),
 +    MISA_EXT_INFO(RVC, "c", "Compressed instructions"),
 +    MISA_EXT_INFO(RVD, "d", "Double-precision float point"),
 +    MISA_EXT_INFO(RVF, "f", "Single-precision float point"),
 +    MISA_EXT_INFO(RVI, "i", "Base integer instruction set"),
 +    MISA_EXT_INFO(RVE, "e", "Base integer instruction set (embedded)"),
 +    MISA_EXT_INFO(RVM, "m", "Integer multiplication and division"),
 +    MISA_EXT_INFO(RVS, "s", "Supervisor-level instructions"),
 +    MISA_EXT_INFO(RVU, "u", "User-level instructions"),
 +    MISA_EXT_INFO(RVH, "h", "Hypervisor"),
 +    MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
 +    MISA_EXT_INFO(RVV, "v", "Vector operations"),
 +    MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
 +};
 +
 +static int riscv_validate_misa_info_idx(uint32_t bit)
 +{
 +    int idx;
 +
 +    /*
 +     * Our lowest valid input (RVA) is 1 and
 +     * __builtin_ctz() is UB with zero.
 +     */
 +    g_assert(bit != 0);
 +    idx = MISA_INFO_IDX(bit);
 +
 +    g_assert(idx < ARRAY_SIZE(misa_ext_info_arr));
 +    return idx;
 +}
 +
 +const char *riscv_get_misa_ext_name(uint32_t bit)
 +{
 +    int idx = riscv_validate_misa_info_idx(bit);
 +    const char *val = misa_ext_info_arr[idx].name;
 +
 +    g_assert(val != NULL);
 +    return val;
 +}
 +
 +const char *riscv_get_misa_ext_description(uint32_t bit)
 +{
 +    int idx = riscv_validate_misa_info_idx(bit);
 +    const char *val = misa_ext_info_arr[idx].description;
 +
 +    g_assert(val != NULL);
 +    return val;
 +}
 +
 +#define MISA_CFG(_bit, _enabled) \
 +    {.misa_bit = _bit, .enabled = _enabled}
 +
 +static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
 +    MISA_CFG(RVA, true),
 +    MISA_CFG(RVC, true),
 +    MISA_CFG(RVD, true),
 +    MISA_CFG(RVF, true),
 +    MISA_CFG(RVI, true),
 +    MISA_CFG(RVE, false),
 +    MISA_CFG(RVM, true),
 +    MISA_CFG(RVS, true),
 +    MISA_CFG(RVU, true),
 +    MISA_CFG(RVH, true),
 +    MISA_CFG(RVJ, false),
 +    MISA_CFG(RVV, false),
 +    MISA_CFG(RVG, false),
  };
+ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
+     int i;
+     for (i = 0; i < ARRAY_SIZE(misa_ext_cfgs); i++) {
+-        const RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
++        RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
++        int bit = misa_cfg->misa_bit;
++
++        misa_cfg->name = riscv_get_misa_ext_name(bit);
++        misa_cfg->description = riscv_get_misa_ext_description(bit);
+         object_property_add(cpu_obj, misa_cfg->name, "bool",
+                             cpu_get_misa_ext_cfg,
 --
-.28.0
+.40.1

-New patch
+[PULL 45/54] target/riscv: add KVM specific MISA properties
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Using all TCG user properties in KVM is tricky. First because KVM
+supports only a small subset of what TCG provides, so most of the
+cpu->cfg flags do nothing for KVM.
+Second, and more important, we don't have a way of telling if any given
+value is an user input or not. For TCG this has a small impact since we
+just validating everything and error out if needed. But for KVM it would
+be good to know if a given value was set by the user or if it's a value
+already provided by KVM. Otherwise we don't know how to handle failed
+kvm_set_one_regs() when writing the configurations back.
+These characteristics make it overly complicated to use the same user
+facing flags for both KVM and TCG. A simpler approach is to create KVM
+specific properties that have specialized logic, forking KVM and TCG use
+cases for those cases only. Fully separating KVM/TCG properties is
+unneeded at this point - in fact we want the user experience to be as
+equal as possible, regardless of the acceleration chosen.
+We'll start this fork with the MISA properties, adding the MISA bits
+that the KVM driver currently supports. A new KVMCPUConfig type is
+introduced. It'll hold general information about an extension. For MISA
+extensions we're going to use the newly created getters of
+misa_ext_infos[] to populate their name and description. 'offset' holds
+the MISA bit (RVA, RVC, ...). We're calling it 'offset' instead of
+'misa_bit' because this same KVMCPUConfig struct will be used to
+multi-letter extensions later on.
+This new type also holds a 'user_set' flag. This flag will be set when
+the user set an option that's different than what is already configured
+in the host, requiring KVM intervention to write the regs back during
+kvm_arch_init_vcpu(). Similar mechanics will be implemented for
+multi-letter extensions as well.
+There is no need to duplicate more code than necessary, so we're going
+to use the existing kvm_riscv_init_user_properties() to add the KVM
+specific properties. Any code that is adding a TCG user prop is then
+changed slightly to verify first if there's a KVM prop with the same
+name already added.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230706101738.460804-13-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.c |  5 +++
+ target/riscv/kvm.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++
+files changed, 83 insertions(+)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
+         misa_cfg->name = riscv_get_misa_ext_name(bit);
+         misa_cfg->description = riscv_get_misa_ext_description(bit);
++        /* Check if KVM already created the property */
++        if (object_property_find(cpu_obj, misa_cfg->name)) {
++            continue;
++        }
++
+         object_property_add(cpu_obj, misa_cfg->name, "bool",
+                             cpu_get_misa_ext_cfg,
+                             cpu_set_misa_ext_cfg,
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm.c
++++ b/target/riscv/kvm.c
+@@ -XXX,XX +XXX,XX @@
+ #include <linux/kvm.h>
+ #include "qemu/timer.h"
++#include "qapi/error.h"
+ #include "qemu/error-report.h"
+ #include "qemu/main-loop.h"
++#include "qapi/visitor.h"
+ #include "sysemu/sysemu.h"
+ #include "sysemu/kvm.h"
+ #include "sysemu/kvm_int.h"
+@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
+         } \
+     } while (0)
++typedef struct KVMCPUConfig {
++    const char *name;
++    const char *description;
++    target_ulong offset;
++    int kvm_reg_id;
++    bool user_set;
++} KVMCPUConfig;
++
++#define KVM_MISA_CFG(_bit, _reg_id) \
++    {.offset = _bit, .kvm_reg_id = _reg_id}
++
++/* KVM ISA extensions */
++static KVMCPUConfig kvm_misa_ext_cfgs[] = {
++    KVM_MISA_CFG(RVA, KVM_RISCV_ISA_EXT_A),
++    KVM_MISA_CFG(RVC, KVM_RISCV_ISA_EXT_C),
++    KVM_MISA_CFG(RVD, KVM_RISCV_ISA_EXT_D),
++    KVM_MISA_CFG(RVF, KVM_RISCV_ISA_EXT_F),
++    KVM_MISA_CFG(RVH, KVM_RISCV_ISA_EXT_H),
++    KVM_MISA_CFG(RVI, KVM_RISCV_ISA_EXT_I),
++    KVM_MISA_CFG(RVM, KVM_RISCV_ISA_EXT_M),
++};
++
++static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
++                                     const char *name,
++                                     void *opaque, Error **errp)
++{
++    KVMCPUConfig *misa_ext_cfg = opaque;
++    target_ulong misa_bit = misa_ext_cfg->offset;
++    RISCVCPU *cpu = RISCV_CPU(obj);
++    CPURISCVState *env = &cpu->env;
++    bool value, host_bit;
++
++    if (!visit_type_bool(v, name, &value, errp)) {
++        return;
++    }
++
++    host_bit = env->misa_ext_mask & misa_bit;
++
++    if (value == host_bit) {
++        return;
++    }
++
++    if (!value) {
++        misa_ext_cfg->user_set = true;
++        return;
++    }
++
++    /*
++     * Forbid users to enable extensions that aren't
++     * available in the hart.
++     */
++    error_setg(errp, "Enabling MISA bit '%s' is not allowed: it's not "
++               "enabled in the host", misa_ext_cfg->name);
++}
++
++static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
++{
++    int i;
++
++    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
++        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
++        int bit = misa_cfg->offset;
++
++        misa_cfg->name = riscv_get_misa_ext_name(bit);
++        misa_cfg->description = riscv_get_misa_ext_description(bit);
++
++        object_property_add(cpu_obj, misa_cfg->name, "bool",
++                            NULL,
++                            kvm_cpu_set_misa_ext_cfg,
++                            NULL, misa_cfg);
++        object_property_set_description(cpu_obj, misa_cfg->name,
++                                        misa_cfg->description);
++    }
++}
++
+ static int kvm_riscv_get_regs_core(CPUState *cs)
+ {
+     int ret = 0;
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
+         return;
+     }
++    kvm_riscv_add_cpu_user_properties(cpu_obj);
+     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
+     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
+--
+.40.1

-[PULL 25/30] hw/riscv: Move riscv_htif model to hw/char
+[PULL 46/54] target/riscv/kvm.c: update KVM MISA bits
-From: Bin Meng <bin.meng@windriver.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-This is an effort to clean up the hw/riscv directory. Ideally it
+Our design philosophy with KVM properties can be resumed in two main
-should only contain the RISC-V SoC / machine codes plus generic
+decisions based on KVM interface availability and what the user wants to
-codes. Let's move riscv_htif model to hw/char directory.
+do:
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+- if the user disables an extension that the host KVM module doesn't
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+know about (i.e. it doesn't implement the kvm_get_one_reg() interface),
-Message-Id: <1599129623-68957-8-git-send-email-bmeng.cn@gmail.com>
+keep booting the CPU. This will avoid users having to deal with issues
 with older KVM versions while disabling features they don't care;
 - for any other case we're going to error out immediately. If the user
 wants to enable a feature that KVM doesn't know about this a problem that
 is worth aborting - the user must know that the feature wasn't enabled
 in the hart. Likewise, if KVM knows about the extension, the user wants
 to enable/disable it, and we fail to do it so, that's also a problem we
 can't shrug it off.
 In the case of MISA bits we won't even try enabling bits that aren't
 already available in the host. The ioctl() is so likely to fail that
 it's not worth trying. This check is already done in the previous patch,
 in kvm_cpu_set_misa_ext_cfg(), thus we don't need to worry about it now.
 In kvm_riscv_update_cpu_misa_ext() we'll go through every potential user
 option and do as follows:
 - if the user didn't set the property or set to the same value of the
 host, do nothing;
 - Disable the given extension in KVM. Error out if anything goes wrong.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20230706101738.460804-14-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/{riscv => char}/riscv_htif.h | 0
+ target/riscv/kvm.c | 40 ++++++++++++++++++++++++++++++++++++++++
- hw/{riscv => char}/riscv_htif.c         | 2 +-
+file changed, 40 insertions(+)
  hw/riscv/spike.c                        | 2 +-
  hw/char/Kconfig                         | 3 +++
  hw/char/meson.build                     | 1 +
  hw/riscv/Kconfig                        | 3 ---
  hw/riscv/meson.build                    | 1 -
 files changed, 6 insertions(+), 6 deletions(-)
  rename include/hw/{riscv => char}/riscv_htif.h (100%)
  rename hw/{riscv => char}/riscv_htif.c (99%)
-diff --git a/include/hw/riscv/riscv_htif.h b/include/hw/char/riscv_htif.h
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 similarity index 100%
 rename from include/hw/riscv/riscv_htif.h
 rename to include/hw/char/riscv_htif.h
 diff --git a/hw/riscv/riscv_htif.c b/hw/char/riscv_htif.c
 similarity index 99%
 rename from hw/riscv/riscv_htif.c
 rename to hw/char/riscv_htif.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/riscv_htif.c
+--- a/target/riscv/kvm.c
-+++ b/hw/char/riscv_htif.c
++++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
- #include "qapi/error.h"
+                "enabled in the host", misa_ext_cfg->name);
- #include "qemu/log.h"
+ }
- #include "hw/sysbus.h"
-+#include "hw/char/riscv_htif.h"
++static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
- #include "hw/char/serial.h"
++{
- #include "chardev/char.h"
++    CPURISCVState *env = &cpu->env;
- #include "chardev/char-fe.h"
++    uint64_t id, reg;
--#include "hw/riscv/riscv_htif.h"
++    int i, ret;
  #include "qemu/timer.h"
  #include "qemu/error-report.h"
 diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/spike.c
 +++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/loader.h"
  #include "hw/sysbus.h"
  #include "target/riscv/cpu.h"
 -#include "hw/riscv/riscv_htif.h"
  #include "hw/riscv/riscv_hart.h"
  #include "hw/riscv/spike.h"
  #include "hw/riscv/boot.h"
  #include "hw/riscv/numa.h"
 +#include "hw/char/riscv_htif.h"
  #include "hw/intc/sifive_clint.h"
  #include "chardev/char.h"
  #include "sysemu/arch_init.h"
 diff --git a/hw/char/Kconfig b/hw/char/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/Kconfig
 +++ b/hw/char/Kconfig
@@ -XXX,XX +XXX,XX @@
  config ESCC
      bool
 +config HTIF
 +    bool
 +
- config PARALLEL
++    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
-     bool
++        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
-     default y
++        target_ulong misa_bit = misa_cfg->offset;
-diff --git a/hw/char/meson.build b/hw/char/meson.build
++
-index XXXXXXX..XXXXXXX 100644
++        if (!misa_cfg->user_set) {
---- a/hw/char/meson.build
++            continue;
-+++ b/hw/char/meson.build
++        }
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_SH4', if_true: files('sh_serial.c'))
++
- softmmu_ss.add(when: 'CONFIG_STM32F2XX_USART', if_true: files('stm32f2xx_usart.c'))
++        /* If we're here we're going to disable the MISA bit */
- softmmu_ss.add(when: 'CONFIG_MCHP_PFSOC_MMUART', if_true: files('mchp_pfsoc_mmuart.c'))
++        reg = 0;
++        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
-+specific_ss.add(when: 'CONFIG_HTIF', if_true: files('riscv_htif.c'))
++                              misa_cfg->kvm_reg_id);
- specific_ss.add(when: 'CONFIG_TERMINAL3270', if_true: files('terminal3270.c'))
++        ret = kvm_set_one_reg(cs, id, &reg);
- specific_ss.add(when: 'CONFIG_VIRTIO', if_true: files('virtio-serial-bus.c'))
++        if (ret != 0) {
- specific_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr_vty.c'))
++            /*
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
++             * We're not checking for -EINVAL because if the bit is about
-index XXXXXXX..XXXXXXX 100644
++             * to be disabled, it means that it was already enabled by
---- a/hw/riscv/Kconfig
++             * KVM. We determined that by fetching the 'isa' register
-+++ b/hw/riscv/Kconfig
++             * during init() time. Any error at this point is worth
-@@ -XXX,XX +XXX,XX @@
++             * aborting.
--config HTIF
++             */
--    bool
++            error_report("Unable to set KVM reg %s, error %d",
--
++                         misa_cfg->name, ret);
- config HART
++            exit(EXIT_FAILURE);
-     bool
++        }
++        env->misa_ext &= ~misa_bit;
-diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
++    }
-index XXXXXXX..XXXXXXX 100644
++}
---- a/hw/riscv/meson.build
++
-+++ b/hw/riscv/meson.build
+ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
-@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
+ {
- riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
+     int i;
- riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
- riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
--riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('riscv_htif.c'))
+     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
- riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
+         ret = kvm_vcpu_set_machine_ids(cpu, cs);
- riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
++        if (ret != 0) {
 +            return ret;
 +        }
      }
 +    kvm_riscv_update_cpu_misa_ext(cpu, cs);
 +
      return ret;
  }
 --
-.28.0
+.40.1

-New patch
+[PULL 47/54] target/riscv/kvm.c: add multi-letter extension KVM properties
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Let's add KVM user properties for the multi-letter extensions that KVM
 currently supports: zicbom, zicboz, zihintpause, zbb, ssaia, sstc,
 svinval and svpbmt.
 As with MISA extensions, we're using the KVMCPUConfig type to hold
 information about the state of each extension. However, multi-letter
 extensions have more cases to cover than MISA extensions, so we're
 adding an extra 'supported' flag as well. This flag will reflect if a
 given extension is supported by KVM, i.e. KVM knows how to handle it.
 This is determined during KVM extension discovery in
 kvm_riscv_init_multiext_cfg(), where we test for EINVAL errors. Any
 other error will cause an abort.
 The use of the 'user_set' is similar to what we already do with MISA
 extensions: the flag set only if the user is changing the extension
 state.
 The 'supported' flag will be used later on to make an exception for
 users that are disabling multi-letter extensions that are unknown to
 KVM.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-Id: <20230706101738.460804-15-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu.c |   8 +++
  target/riscv/kvm.c | 119 +++++++++++++++++++++++++++++++++++++++++++++
 files changed, 127 insertions(+)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
      riscv_cpu_add_misa_properties(obj);
      for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
 +#ifndef CONFIG_USER_ONLY
 +        if (kvm_enabled()) {
 +            /* Check if KVM created the property already */
 +            if (object_property_find(obj, prop->name)) {
 +                continue;
 +            }
 +        }
 +#endif
          qdev_property_add_static(dev, prop);
      }
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ typedef struct KVMCPUConfig {
      target_ulong offset;
      int kvm_reg_id;
      bool user_set;
 +    bool supported;
  } KVMCPUConfig;
  #define KVM_MISA_CFG(_bit, _reg_id) \
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
      }
  }
 +#define CPUCFG(_prop) offsetof(struct RISCVCPUConfig, _prop)
 +
 +#define KVM_EXT_CFG(_name, _prop, _reg_id) \
 +    {.name = _name, .offset = CPUCFG(_prop), \
 +     .kvm_reg_id = _reg_id}
 +
 +static KVMCPUConfig kvm_multi_ext_cfgs[] = {
 +    KVM_EXT_CFG("zicbom", ext_icbom, KVM_RISCV_ISA_EXT_ZICBOM),
 +    KVM_EXT_CFG("zicboz", ext_icboz, KVM_RISCV_ISA_EXT_ZICBOZ),
 +    KVM_EXT_CFG("zihintpause", ext_zihintpause, KVM_RISCV_ISA_EXT_ZIHINTPAUSE),
 +    KVM_EXT_CFG("zbb", ext_zbb, KVM_RISCV_ISA_EXT_ZBB),
 +    KVM_EXT_CFG("ssaia", ext_ssaia, KVM_RISCV_ISA_EXT_SSAIA),
 +    KVM_EXT_CFG("sstc", ext_sstc, KVM_RISCV_ISA_EXT_SSTC),
 +    KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
 +    KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
 +};
 +
 +static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
 +                            uint32_t val)
 +{
 +    int cpu_cfg_offset = multi_ext->offset;
 +    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
 +
 +    *ext_enabled = val;
 +}
 +
 +static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
 +                                KVMCPUConfig *multi_ext)
 +{
 +    int cpu_cfg_offset = multi_ext->offset;
 +    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
 +
 +    return *ext_enabled;
 +}
 +
 +static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
 +                                      const char *name,
 +                                      void *opaque, Error **errp)
 +{
 +    KVMCPUConfig *multi_ext_cfg = opaque;
 +    RISCVCPU *cpu = RISCV_CPU(obj);
 +    bool value, host_val;
 +
 +    if (!visit_type_bool(v, name, &value, errp)) {
 +        return;
 +    }
 +
 +    host_val = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
 +
 +    /*
 +     * Ignore if the user is setting the same value
 +     * as the host.
 +     */
 +    if (value == host_val) {
 +        return;
 +    }
 +
 +    if (!multi_ext_cfg->supported) {
 +        /*
 +         * Error out if the user is trying to enable an
 +         * extension that KVM doesn't support. Ignore
 +         * option otherwise.
 +         */
 +        if (value) {
 +            error_setg(errp, "KVM does not support disabling extension %s",
 +                       multi_ext_cfg->name);
 +        }
 +
 +        return;
 +    }
 +
 +    multi_ext_cfg->user_set = true;
 +    kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
 +}
 +
  static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
  {
      int i;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
          object_property_set_description(cpu_obj, misa_cfg->name,
                                          misa_cfg->description);
      }
 +
 +    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
 +        KVMCPUConfig *multi_cfg = &kvm_multi_ext_cfgs[i];
 +
 +        object_property_add(cpu_obj, multi_cfg->name, "bool",
 +                            NULL,
 +                            kvm_cpu_set_multi_ext_cfg,
 +                            NULL, multi_cfg);
 +    }
  }
  static int kvm_riscv_get_regs_core(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
      env->misa_ext = env->misa_ext_mask;
  }
 +static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 +{
 +    CPURISCVState *env = &cpu->env;
 +    uint64_t val;
 +    int i, ret;
 +
 +    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
 +        KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
 +        struct kvm_one_reg reg;
 +
 +        reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
 +                                  multi_ext_cfg->kvm_reg_id);
 +        reg.addr = (uint64_t)&val;
 +        ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
 +        if (ret != 0) {
 +            if (errno == EINVAL) {
 +                /* Silently default to 'false' if KVM does not support it. */
 +                multi_ext_cfg->supported = false;
 +                val = false;
 +            } else {
 +                error_report("Unable to read ISA_EXT KVM register %s, "
 +                             "error %d", multi_ext_cfg->name, ret);
 +                kvm_riscv_destroy_scratch_vcpu(kvmcpu);
 +                exit(EXIT_FAILURE);
 +            }
 +        } else {
 +            multi_ext_cfg->supported = true;
 +        }
 +
 +        kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
 +    }
 +}
 +
  void kvm_riscv_init_user_properties(Object *cpu_obj)
  {
      RISCVCPU *cpu = RISCV_CPU(cpu_obj);
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
      kvm_riscv_add_cpu_user_properties(cpu_obj);
      kvm_riscv_init_machine_ids(cpu, &kvmcpu);
      kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
 +    kvm_riscv_init_multiext_cfg(cpu, &kvmcpu);
      kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
  }
 --
 .40.1

-[PULL 19/30] hw/riscv: Move sifive_e_prci model to hw/misc
+[PULL 48/54] target/riscv/cpu.c: add satp_mode properties earlier
-From: Bin Meng <bin.meng@windriver.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-This is an effort to clean up the hw/riscv directory. Ideally it
+riscv_cpu_add_user_properties() ended up with an excess of "#ifndef
-should only contain the RISC-V SoC / machine codes plus generic
+CONFIG_USER_ONLY" blocks after changes that added KVM properties
-codes. Let's move sifive_e_prci model to hw/misc directory.
+handling.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+KVM specific properties are required to be created earlier than their
 TCG counterparts, but the remaining props can be created at any order.
 Move riscv_add_satp_mode_properties() to the start of the function,
 inside the !CONFIG_USER_ONLY block already present there, to remove the
 last ifndef block.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1599129623-68957-2-git-send-email-bmeng.cn@gmail.com>
+Message-Id: <20230706101738.460804-16-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/{riscv => misc}/sifive_e_prci.h | 0
+ target/riscv/cpu.c | 6 ++----
- hw/{riscv => misc}/sifive_e_prci.c         | 2 +-
+file changed, 2 insertions(+), 4 deletions(-)
  hw/riscv/sifive_e.c                        | 2 +-
  hw/misc/Kconfig                            | 3 +++
  hw/misc/meson.build                        | 3 +++
  hw/riscv/Kconfig                           | 1 +
  hw/riscv/meson.build                       | 1 -
 files changed, 9 insertions(+), 3 deletions(-)
  rename include/hw/{riscv => misc}/sifive_e_prci.h (100%)
  rename hw/{riscv => misc}/sifive_e_prci.c (99%)
-diff --git a/include/hw/riscv/sifive_e_prci.h b/include/hw/misc/sifive_e_prci.h
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 similarity index 100%
 rename from include/hw/riscv/sifive_e_prci.h
 rename to include/hw/misc/sifive_e_prci.h
 diff --git a/hw/riscv/sifive_e_prci.c b/hw/misc/sifive_e_prci.c
 similarity index 99%
 rename from hw/riscv/sifive_e_prci.c
 rename to hw/misc/sifive_e_prci.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_e_prci.c
+--- a/target/riscv/cpu.c
-+++ b/hw/misc/sifive_e_prci.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
- #include "qemu/log.h"
+     DeviceState *dev = DEVICE(obj);
- #include "qemu/module.h"
- #include "hw/hw.h"
+ #ifndef CONFIG_USER_ONLY
--#include "hw/riscv/sifive_e_prci.h"
++    riscv_add_satp_mode_properties(obj);
 +#include "hw/misc/sifive_e_prci.h"
  static uint64_t sifive_e_prci_read(void *opaque, hwaddr addr, unsigned int size)
  {
 diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_e.c
 +++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/riscv/sifive_clint.h"
  #include "hw/riscv/sifive_uart.h"
  #include "hw/riscv/sifive_e.h"
 -#include "hw/riscv/sifive_e_prci.h"
  #include "hw/riscv/boot.h"
 +#include "hw/misc/sifive_e_prci.h"
  #include "chardev/char.h"
  #include "sysemu/arch_init.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/Kconfig
 +++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config MAC_VIA
  config AVR_POWER
      bool
 +config SIFIVE_E_PRCI
 +    bool
 +
- source macio/Kconfig
+     if (kvm_enabled()) {
-diff --git a/hw/misc/meson.build b/hw/misc/meson.build
+         kvm_riscv_init_user_properties(obj);
-index XXXXXXX..XXXXXXX 100644
+     }
---- a/hw/misc/meson.build
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
-+++ b/hw/misc/meson.build
+ #endif
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM11SCU', if_true: files('arm11scu.c'))
+         qdev_property_add_static(dev, prop);
- # Mac devices
+     }
- softmmu_ss.add(when: 'CONFIG_MOS6522', if_true: files('mos6522.c'))
+-
+-#ifndef CONFIG_USER_ONLY
-+# RISC-V devices
+-    riscv_add_satp_mode_properties(obj);
-+softmmu_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
+-#endif
-+
+ }
- # PKUnity SoC devices
- softmmu_ss.add(when: 'CONFIG_PUV3', if_true: files('puv3_pm.c'))
+ static Property riscv_cpu_properties[] = {
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
      bool
      select HART
      select SIFIVE
 +    select SIFIVE_E_PRCI
      select UNIMP
  config SIFIVE_U
 diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/meson.build
 +++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_plic.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
 -riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e_prci.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_otp.c'))
  riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_prci.c'))
 --
-.28.0
+.40.1

-[PULL 15/30] hw/riscv: microchip_pfsoc: Connect 2 Cadence GEMs
+[PULL 49/54] target/riscv/cpu.c: remove priv_ver check from riscv_isa_string_ext()
-From: Bin Meng <bin.meng@windriver.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Microchip PolarFire SoC integrates 2 Candence GEMs to provide
+riscv_isa_string_ext() is being used by riscv_isa_string(), which is
-IEEE 802.3 standard-compliant 10/100/1000 Mbps ethernet interface.
+then used by boards to retrieve the 'riscv,isa' string to be written in
 the FDT. All this happens after riscv_cpu_realize(), meaning that we're
 already past riscv_cpu_validate_set_extensions() and, more important,
 riscv_cpu_disable_priv_spec_isa_exts().
-On the Icicle Kit board, GEM0 connects to a PHY at address 8 while
+This means that all extensions that needed to be disabled due to
-GEM1 connects to a PHY at address 9.
+priv_spec mismatch are already disabled. Checking this again during
 riscv_isa_string_ext() is unneeded. Remove it.
-The 2nd stage bootloader (U-Boot) is using GEM1 by default, so we
+As a bonus, riscv_isa_string_ext() can now be used with the 'host'
-must specify 2 '-nic' options from the command line in order to get
+KVM-only CPU type since it doesn't have a env->priv_ver assigned and it
-a working ethernet.
+would fail this check for no good reason.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-Id: <20230706101738.460804-17-dbarboza@ventanamicro.com>
 Message-Id: <1598924352-89526-14-git-send-email-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/microchip_pfsoc.h |  7 ++++++
+ target/riscv/cpu.c | 3 +--
- hw/riscv/microchip_pfsoc.c         | 39 ++++++++++++++++++++++++++++++
+file changed, 1 insertion(+), 2 deletions(-)
 files changed, 46 insertions(+)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
+--- a/target/riscv/cpu.c
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
  #include "hw/char/mchp_pfsoc_mmuart.h"
  #include "hw/dma/sifive_pdma.h"
 +#include "hw/net/cadence_gem.h"
  #include "hw/sd/cadence_sdhci.h"
  typedef struct MicrochipPFSoCState {
@@ -XXX,XX +XXX,XX @@ typedef struct MicrochipPFSoCState {
      MchpPfSoCMMUartState *serial3;
      MchpPfSoCMMUartState *serial4;
      SiFivePDMAState dma;
 +    CadenceGEMState gem0;
 +    CadenceGEMState gem1;
      CadenceSDHCIState sdhci;
  } MicrochipPFSoCState;
@@ -XXX,XX +XXX,XX @@ enum {
      MICROCHIP_PFSOC_MMUART2,
      MICROCHIP_PFSOC_MMUART3,
      MICROCHIP_PFSOC_MMUART4,
 +    MICROCHIP_PFSOC_GEM0,
 +    MICROCHIP_PFSOC_GEM1,
      MICROCHIP_PFSOC_ENVM_CFG,
      MICROCHIP_PFSOC_ENVM_DATA,
      MICROCHIP_PFSOC_IOSCB_CFG,
@@ -XXX,XX +XXX,XX @@ enum {
      MICROCHIP_PFSOC_DMA_IRQ5 = 10,
      MICROCHIP_PFSOC_DMA_IRQ6 = 11,
      MICROCHIP_PFSOC_DMA_IRQ7 = 12,
 +    MICROCHIP_PFSOC_GEM0_IRQ = 64,
 +    MICROCHIP_PFSOC_GEM1_IRQ = 70,
      MICROCHIP_PFSOC_EMMC_SD_IRQ = 88,
      MICROCHIP_PFSOC_MMUART0_IRQ = 90,
      MICROCHIP_PFSOC_MMUART1_IRQ = 91,
 diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/microchip_pfsoc.c
 +++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
   * 3) MMUARTs (Multi-Mode UART)
   * 4) Cadence eMMC/SDHC controller and an SD card connected to it
   * 5) SiFive Platform DMA (Direct Memory Access Controller)
 + * 6) GEM (Gigabit Ethernet MAC Controller)
   *
   * This board currently generates devicetree dynamically that indicates at least
   * two harts and up to five harts.
@@ -XXX,XX +XXX,XX @@
  #define BIOS_FILENAME   "hss.bin"
  #define RESET_VECTOR    0x20220000
 +/* GEM version */
 +#define GEM_REVISION    0x0107010c
 +
  static const struct MemmapEntry {
      hwaddr base;
      hwaddr size;
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
      [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,     0x1000 },
      [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,     0x1000 },
      [MICROCHIP_PFSOC_MMUART4] =         { 0x20106000,     0x1000 },
 +    [MICROCHIP_PFSOC_GEM0] =            { 0x20110000,     0x2000 },
 +    [MICROCHIP_PFSOC_GEM1] =            { 0x20112000,     0x2000 },
      [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,     0x1000 },
      [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
      [MICROCHIP_PFSOC_IOSCB_CFG] =       { 0x37080000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
      object_initialize_child(obj, "dma-controller", &s->dma,
                              TYPE_SIFIVE_PDMA);
 +    object_initialize_child(obj, "gem0", &s->gem0, TYPE_CADENCE_GEM);
 +    object_initialize_child(obj, "gem1", &s->gem1, TYPE_CADENCE_GEM);
 +
      object_initialize_child(obj, "sd-controller", &s->sdhci,
                              TYPE_CADENCE_SDHCI);
  }
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
      MemoryRegion *envm_data = g_new(MemoryRegion, 1);
      char *plic_hart_config;
      size_t plic_hart_config_len;
 +    NICInfo *nd;
      int i;
-     sysbus_realize(SYS_BUS_DEVICE(&s->e_cpus), &error_abort);
+     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
+-        if (cpu->env.priv_ver >= isa_edata_arr[i].min_version &&
-         qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART4_IRQ),
+-            isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
-         serial_hd(4));
++        if (isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
+             new = g_strconcat(old, "_", isa_edata_arr[i].name, NULL);
-+    /* GEMs */
+             g_free(old);
-+
+             old = new;
 +    nd = &nd_table[0];
 +    if (nd->used) {
 +        qemu_check_nic_model(nd, TYPE_CADENCE_GEM);
 +        qdev_set_nic_properties(DEVICE(&s->gem0), nd);
 +    }
 +    nd = &nd_table[1];
 +    if (nd->used) {
 +        qemu_check_nic_model(nd, TYPE_CADENCE_GEM);
 +        qdev_set_nic_properties(DEVICE(&s->gem1), nd);
 +    }
 +
 +    object_property_set_int(OBJECT(&s->gem0), "revision", GEM_REVISION, errp);
 +    object_property_set_int(OBJECT(&s->gem0), "phy-addr", 8, errp);
 +    sysbus_realize(SYS_BUS_DEVICE(&s->gem0), errp);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gem0), 0,
 +                    memmap[MICROCHIP_PFSOC_GEM0].base);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gem0), 0,
 +        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_GEM0_IRQ));
 +
 +    object_property_set_int(OBJECT(&s->gem1), "revision", GEM_REVISION, errp);
 +    object_property_set_int(OBJECT(&s->gem1), "phy-addr", 9, errp);
 +    sysbus_realize(SYS_BUS_DEVICE(&s->gem1), errp);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gem1), 0,
 +                    memmap[MICROCHIP_PFSOC_GEM1].base);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gem1), 0,
 +        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_GEM1_IRQ));
 +
      /* eNVM */
      memory_region_init_rom(envm_data, OBJECT(dev), "microchip.pfsoc.envm.data",
                             memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
 --
-.28.0
+.40.1

-[PULL 12/30] hw/riscv: microchip_pfsoc: Connect a DMA controller
+[PULL 50/54] target/riscv/cpu.c: create KVM mock properties
-From: Bin Meng <bin.meng@windriver.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-On the Icicle Kit board, the HSS firmware utilizes the on-chip DMA
+KVM-specific properties are being created inside target/riscv/kvm.c. But
-controller to move the 2nd stage bootloader in the system memory.
+at this moment we're gathering all the remaining properties from TCG and
-Let's connect a DMA controller to Microchip PolarFire SoC.
+adding them as is when running KVM. This creates a situation where
 non-KVM properties are setting flags to 'true' due to its default
 settings (e.g.  Zawrs). Users can also freely enable them via command
 line.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+This doesn't impact runtime per se because KVM doesn't care about these
 flags, but code such as riscv_isa_string_ext() take those flags into
 account. The result is that, for a KVM guest, setting non-KVM properties
 will make them appear in the riscv,isa DT.
 We want to keep the same API for both TCG and KVM and at the same time,
 when running KVM, forbid non-KVM extensions to be enabled internally. We
 accomplish both by changing riscv_cpu_add_user_properties() to add a
 mock boolean property for every non-KVM extension in
 riscv_cpu_extensions[]. Then, when running KVM, users are still free to
 set extensions at will, but we'll error out if a non-KVM extension is
 enabled. Setting such extension to 'false' will be ignored.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1598924352-89526-11-git-send-email-bmeng.cn@gmail.com>
+Message-Id: <20230706101738.460804-18-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/microchip_pfsoc.h | 11 +++++++++++
+ target/riscv/cpu.c | 36 ++++++++++++++++++++++++++++++++++++
- hw/riscv/microchip_pfsoc.c         | 15 +++++++++++++++
+file changed, 36 insertions(+)
  hw/riscv/Kconfig                   |  1 +
 files changed, 27 insertions(+)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
+--- a/target/riscv/cpu.c
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
- #define HW_MICROCHIP_PFSOC_H
+     DEFINE_PROP_END_OF_LIST(),
  #include "hw/char/mchp_pfsoc_mmuart.h"
 +#include "hw/dma/sifive_pdma.h"
  #include "hw/sd/cadence_sdhci.h"
  typedef struct MicrochipPFSoCState {
@@ -XXX,XX +XXX,XX @@ typedef struct MicrochipPFSoCState {
      MchpPfSoCMMUartState *serial2;
      MchpPfSoCMMUartState *serial3;
      MchpPfSoCMMUartState *serial4;
 +    SiFivePDMAState dma;
      CadenceSDHCIState sdhci;
  } MicrochipPFSoCState;
@@ -XXX,XX +XXX,XX @@ enum {
      MICROCHIP_PFSOC_BUSERR_UNIT4,
      MICROCHIP_PFSOC_CLINT,
      MICROCHIP_PFSOC_L2CC,
 +    MICROCHIP_PFSOC_DMA,
      MICROCHIP_PFSOC_L2LIM,
      MICROCHIP_PFSOC_PLIC,
      MICROCHIP_PFSOC_MMUART0,
@@ -XXX,XX +XXX,XX @@ enum {
  };
- enum {
-+    MICROCHIP_PFSOC_DMA_IRQ0 = 5,
-+    MICROCHIP_PFSOC_DMA_IRQ1 = 6,
-+    MICROCHIP_PFSOC_DMA_IRQ2 = 7,
-+    MICROCHIP_PFSOC_DMA_IRQ3 = 8,
-+    MICROCHIP_PFSOC_DMA_IRQ4 = 9,
-+    MICROCHIP_PFSOC_DMA_IRQ5 = 10,
-+    MICROCHIP_PFSOC_DMA_IRQ6 = 11,
-+    MICROCHIP_PFSOC_DMA_IRQ7 = 12,
-     MICROCHIP_PFSOC_EMMC_SD_IRQ = 88,
-     MICROCHIP_PFSOC_MMUART0_IRQ = 90,
-     MICROCHIP_PFSOC_MMUART1_IRQ = 91,
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/microchip_pfsoc.c
-+++ b/hw/riscv/microchip_pfsoc.c
-@@ -XXX,XX +XXX,XX @@
-  * 2) eNVM (Embedded Non-Volatile Memory)
-  * 3) MMUARTs (Multi-Mode UART)
-  * 4) Cadence eMMC/SDHC controller and an SD card connected to it
-+ * 5) SiFive Platform DMA (Direct Memory Access Controller)
-  *
-  * This board currently generates devicetree dynamically that indicates at least
-  * two harts and up to five harts.
-@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
-     [MICROCHIP_PFSOC_BUSERR_UNIT4] =    {  0x1704000,     0x1000 },
-     [MICROCHIP_PFSOC_CLINT] =           {  0x2000000,    0x10000 },
-     [MICROCHIP_PFSOC_L2CC] =            {  0x2010000,     0x1000 },
-+    [MICROCHIP_PFSOC_DMA] =             {  0x3000000,   0x100000 },
-     [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,  0x2000000 },
-     [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,  0x4000000 },
-     [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,     0x1000 },
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
-                          TYPE_RISCV_CPU_SIFIVE_U54);
-     qdev_prop_set_uint64(DEVICE(&s->u_cpus), "resetvec", RESET_VECTOR);
-+    object_initialize_child(obj, "dma-controller", &s->dma,
-+                            TYPE_SIFIVE_PDMA);
 +
-     object_initialize_child(obj, "sd-controller", &s->sdhci,
++#ifndef CONFIG_USER_ONLY
-                             TYPE_CADENCE_SDHCI);
++static void cpu_set_cfg_unavailable(Object *obj, Visitor *v,
- }
++                                    const char *name,
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
++                                    void *opaque, Error **errp)
-         memmap[MICROCHIP_PFSOC_PLIC].size);
++{
-     g_free(plic_hart_config);
++    const char *propname = opaque;
++    bool value;
-+    /* DMA */
++
-+    sysbus_realize(SYS_BUS_DEVICE(&s->dma), errp);
++    if (!visit_type_bool(v, name, &value, errp)) {
-+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->dma), 0,
++        return;
 +                    memmap[MICROCHIP_PFSOC_DMA].base);
 +    for (i = 0; i < SIFIVE_PDMA_IRQS; i++) {
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->dma), i,
 +                           qdev_get_gpio_in(DEVICE(s->plic),
 +                                            MICROCHIP_PFSOC_DMA_IRQ0 + i));
 +    }
 +
-     /* SYSREG */
++    if (value) {
-     create_unimplemented_device("microchip.pfsoc.sysreg",
++        error_setg(errp, "extension %s is not available with KVM",
-         memmap[MICROCHIP_PFSOC_SYSREG].base,
++                   propname);
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
++    }
-index XXXXXXX..XXXXXXX 100644
++}
---- a/hw/riscv/Kconfig
++#endif
-+++ b/hw/riscv/Kconfig
++
-@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
+ /*
-     select SIFIVE
+  * Add CPU properties with user-facing flags.
-     select UNIMP
+  *
-     select MCHP_PFSOC_MMUART
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
-+    select SIFIVE_PDMA
+             if (object_property_find(obj, prop->name)) {
-     select CADENCE_SDHCI
+                 continue;
              }
 +
 +            /*
 +             * Set the default to disabled for every extension
 +             * unknown to KVM and error out if the user attempts
 +             * to enable any of them.
 +             *
 +             * We're giving a pass for non-bool properties since they're
 +             * not related to the availability of extensions and can be
 +             * safely ignored as is.
 +             */
 +            if (prop->info == &qdev_prop_bool) {
 +                object_property_add(obj, prop->name, "bool",
 +                                    NULL, cpu_set_cfg_unavailable,
 +                                    NULL, (void *)prop->name);
 +                continue;
 +            }
          }
  #endif
          qdev_property_add_static(dev, prop);
 --
-.28.0
+.40.1

-[PULL 16/30] hw/riscv: microchip_pfsoc: Hook GPIO controllers
+[PULL 51/54] target/riscv: update multi-letter extension KVM properties
-From: Bin Meng <bin.meng@windriver.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Microchip PolarFire SoC integrates 3 GPIOs controllers. It seems
+We're now ready to update the multi-letter extensions status for KVM.
 enough to create unimplemented devices to cover their register
 spaces at this point.
-With this commit, QEMU can boot to U-Boot (2nd stage bootloader)
+kvm_riscv_update_cpu_cfg_isa_ext() is called called during vcpu creation
-all the way to the Linux shell login prompt, with a modified HSS
+time to verify which user options changes host defaults (via the 'user_set'
-(1st stage bootloader).
+flag) and tries to write them back to KVM.
-For detailed instructions on how to create images for the Icicle
+Failure to commit a change to KVM is only ignored in case KVM doesn't
-Kit board, please check QEMU RISC-V WiKi page at:
+know about the extension (-EINVAL error code) and the user wanted to
-https://wiki.qemu.org/Documentation/Platforms/RISCV
+disable the given extension. Otherwise we're going to abort the boot
 process.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-Id: <20230706101738.460804-19-dbarboza@ventanamicro.com>
 Message-Id: <1598924352-89526-15-git-send-email-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/microchip_pfsoc.h |  3 +++
+ target/riscv/kvm.c | 27 +++++++++++++++++++++++++++
- hw/riscv/microchip_pfsoc.c         | 14 ++++++++++++++
+file changed, 27 insertions(+)
 files changed, 17 insertions(+)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
+--- a/target/riscv/kvm.c
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
-     MICROCHIP_PFSOC_MMUART4,
+     kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
-     MICROCHIP_PFSOC_GEM0,
+ }
-     MICROCHIP_PFSOC_GEM1,
-+    MICROCHIP_PFSOC_GPIO0,
++static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
-+    MICROCHIP_PFSOC_GPIO1,
++{
-+    MICROCHIP_PFSOC_GPIO2,
++    CPURISCVState *env = &cpu->env;
-     MICROCHIP_PFSOC_ENVM_CFG,
++    uint64_t id, reg;
-     MICROCHIP_PFSOC_ENVM_DATA,
++    int i, ret;
      MICROCHIP_PFSOC_IOSCB_CFG,
 diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/microchip_pfsoc.c
 +++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
      [MICROCHIP_PFSOC_MMUART4] =         { 0x20106000,     0x1000 },
      [MICROCHIP_PFSOC_GEM0] =            { 0x20110000,     0x2000 },
      [MICROCHIP_PFSOC_GEM1] =            { 0x20112000,     0x2000 },
 +    [MICROCHIP_PFSOC_GPIO0] =           { 0x20120000,     0x1000 },
 +    [MICROCHIP_PFSOC_GPIO1] =           { 0x20121000,     0x1000 },
 +    [MICROCHIP_PFSOC_GPIO2] =           { 0x20122000,     0x1000 },
      [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,     0x1000 },
      [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
      [MICROCHIP_PFSOC_IOSCB_CFG] =       { 0x37080000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->gem1), 0,
          qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_GEM1_IRQ));
 +    /* GPIOs */
 +    create_unimplemented_device("microchip.pfsoc.gpio0",
 +        memmap[MICROCHIP_PFSOC_GPIO0].base,
 +        memmap[MICROCHIP_PFSOC_GPIO0].size);
 +    create_unimplemented_device("microchip.pfsoc.gpio1",
 +        memmap[MICROCHIP_PFSOC_GPIO1].base,
 +        memmap[MICROCHIP_PFSOC_GPIO1].size);
 +    create_unimplemented_device("microchip.pfsoc.gpio2",
 +        memmap[MICROCHIP_PFSOC_GPIO2].base,
 +        memmap[MICROCHIP_PFSOC_GPIO2].size);
 +
-     /* eNVM */
++    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
-     memory_region_init_rom(envm_data, OBJECT(dev), "microchip.pfsoc.envm.data",
++        KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
-                            memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
++
 +        if (!multi_ext_cfg->user_set) {
 +            continue;
 +        }
 +
 +        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
 +                              multi_ext_cfg->kvm_reg_id);
 +        reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
 +        ret = kvm_set_one_reg(cs, id, &reg);
 +        if (ret != 0) {
 +            error_report("Unable to %s extension %s in KVM, error %d",
 +                         reg ? "enable" : "disable",
 +                         multi_ext_cfg->name, ret);
 +            exit(EXIT_FAILURE);
 +        }
 +    }
 +}
 +
  static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
  {
      int i;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
      }
      kvm_riscv_update_cpu_misa_ext(cpu, cs);
 +    kvm_riscv_update_cpu_cfg_isa_ext(cpu, cs);
      return ret;
  }
 --
-.28.0
+.40.1

-[PULL 13/30] hw/net: cadence_gem: Add a new 'phy-addr' property
+[PULL 52/54] target/riscv/kvm.c: add kvmconfig_get_cfg_addr() helper
-From: Bin Meng <bin.meng@windriver.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-At present the PHY address of the PHY connected to GEM is hard-coded
+There are 2 places in which we need to get a pointer to a certain
-to either 23 (BOARD_PHY_ADDRESS) or 0. This might not be the case for
+property of the cpu->cfg struct based on property offset. Next patch
-all boards. Add a new 'phy-addr' property so that board can specify
+will add a couple more.
 the PHY address for each GEM instance.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Create a helper to avoid repeating this code over and over.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <1598924352-89526-12-git-send-email-bmeng.cn@gmail.com>
+Message-Id: <20230706101738.460804-20-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/net/cadence_gem.h | 2 ++
+ target/riscv/kvm.c | 11 +++++++----
- hw/net/cadence_gem.c         | 5 +++--
+file changed, 7 insertions(+), 4 deletions(-)
 files changed, 5 insertions(+), 2 deletions(-)
-diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/net/cadence_gem.h
+--- a/target/riscv/kvm.c
-+++ b/include/hw/net/cadence_gem.h
++++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
+@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
-     /* Mask of register bits which are write 1 to clear */
+     KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
-     uint32_t regs_w1c[CADENCE_GEM_MAXREG];
+ };
-+    /* PHY address */
++static void *kvmconfig_get_cfg_addr(RISCVCPU *cpu, KVMCPUConfig *kvmcfg)
-+    uint8_t phy_addr;
++{
-     /* PHY registers backing store */
++    return (void *)&cpu->cfg + kvmcfg->offset;
-     uint16_t phy_regs[32];
++}
++
-diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+ static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
-index XXXXXXX..XXXXXXX 100644
+                             uint32_t val)
---- a/hw/net/cadence_gem.c
+ {
-+++ b/hw/net/cadence_gem.c
+-    int cpu_cfg_offset = multi_ext->offset;
-@@ -XXX,XX +XXX,XX @@ static uint64_t gem_read(void *opaque, hwaddr offset, unsigned size)
+-    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
-             uint32_t phy_addr, reg_num;
++    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
-             phy_addr = (retval & GEM_PHYMNTNC_ADDR) >> GEM_PHYMNTNC_ADDR_SHFT;
+     *ext_enabled = val;
--            if (phy_addr == BOARD_PHY_ADDRESS || phy_addr == 0) {
+ }
-+            if (phy_addr == s->phy_addr || phy_addr == 0) {
+@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
-                 reg_num = (retval & GEM_PHYMNTNC_REG) >> GEM_PHYMNTNC_REG_SHIFT;
+ static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
-                 retval &= 0xFFFF0000;
+                                 KVMCPUConfig *multi_ext)
-                 retval |= gem_phy_read(s, reg_num);
+ {
-@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
+-    int cpu_cfg_offset = multi_ext->offset;
-             uint32_t phy_addr, reg_num;
+-    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
++    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
-             phy_addr = (val & GEM_PHYMNTNC_ADDR) >> GEM_PHYMNTNC_ADDR_SHFT;
--            if (phy_addr == BOARD_PHY_ADDRESS || phy_addr == 0) {
+     return *ext_enabled;
-+            if (phy_addr == s->phy_addr || phy_addr == 0) {
+ }
                  reg_num = (val & GEM_PHYMNTNC_REG) >> GEM_PHYMNTNC_REG_SHIFT;
                  gem_phy_write(s, reg_num, val);
              }
@@ -XXX,XX +XXX,XX @@ static Property gem_properties[] = {
      DEFINE_NIC_PROPERTIES(CadenceGEMState, conf),
      DEFINE_PROP_UINT32("revision", CadenceGEMState, revision,
                         GEM_MODID_VALUE),
 +    DEFINE_PROP_UINT8("phy-addr", CadenceGEMState, phy_addr, BOARD_PHY_ADDRESS),
      DEFINE_PROP_UINT8("num-priority-queues", CadenceGEMState,
                        num_priority_queues, 1),
      DEFINE_PROP_UINT8("num-type1-screeners", CadenceGEMState,
 --
-.28.0
+.40.1

-[PULL 10/30] hw/riscv: microchip_pfsoc: Connect a Cadence SDHCI controller and an SD card
+[PULL 53/54] target/riscv/kvm.c: read/write (cbom|cboz)_blocksize in KVM
-From: Bin Meng <bin.meng@windriver.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Microchip PolarFire SoC integrates one Cadence SDHCI controller.
+If we don't set a proper cbom_blocksize|cboz_blocksize in the FDT the
-On the Icicle Kit board, one eMMC chip and an external SD card
+Linux Kernel will fail to detect the availability of the CBOM/CBOZ
-connect to this controller depending on different configuration.
+extensions, regardless of the contents of the 'riscv,isa' DT prop.
-As QEMU does not support eMMC yet, we just emulate the SD card
+The FDT is being written using the cpu->cfg.cbom|z_blocksize attributes,
-configuration. To test this, the Hart Software Services (HSS)
+so let's expose them as user properties like it is already done with
-should choose the SD card configuration:
+TCG.
-$ cp boards/icicle-kit-es/def_config.sdcard .config
+This will also require us to determine proper blocksize values during
-$ make BOARD=icicle-kit-es
+init() time since the FDT is already created during realize(). We'll
 take a ride in kvm_riscv_init_multiext_cfg() to do it. Note that we
 don't need to fetch both cbom and cboz blocksizes every time: check for
 their parent extensions (icbom and icboz) and only read the blocksizes
 if needed.
-The SD card image can be built from the Yocto BSP at:
+In contrast with cbom|z_blocksize properties from TCG, the user is not
-https://github.com/polarfire-soc/meta-polarfire-soc-yocto-bsp
+able to set any value that is different from the 'host' value when
 running KVM. KVM can be particularly harsh dealing with it: a ENOTSUPP
 can be thrown for the mere attempt of executing kvm_set_one_reg() for
 these 2 regs.
-Note the generated SD card image should be resized before use:
+Hopefully we don't need to call kvm_set_one_reg() for these regs.
-$ qemu-img resize /path/to/sdcard.img 4G
+We'll check if the user input matches the host value in
 kvm_cpu_set_cbomz_blksize(), the set() accessor for both blocksize
 properties. We'll fail fast since it's already known to not be
 supported.
-Launch QEMU with the following command:
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-$ qemu-system-riscv64 -nographic -M microchip-icicle-kit -sd sdcard.img
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Message-Id: <20230706101738.460804-21-dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <1598924352-89526-9-git-send-email-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/microchip_pfsoc.h |  4 ++++
+ target/riscv/kvm.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++
- hw/riscv/microchip_pfsoc.c         | 23 +++++++++++++++++++++++
+file changed, 70 insertions(+)
  hw/riscv/Kconfig                   |  1 +
 files changed, 28 insertions(+)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
+--- a/target/riscv/kvm.c
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
- #define HW_MICROCHIP_PFSOC_H
+     kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
+ }
- #include "hw/char/mchp_pfsoc_mmuart.h"
-+#include "hw/sd/cadence_sdhci.h"
++static KVMCPUConfig kvm_cbom_blocksize = {
++    .name = "cbom_blocksize",
- typedef struct MicrochipPFSoCState {
++    .offset = CPUCFG(cbom_blocksize),
-     /*< private >*/
++    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicbom_block_size)
-@@ -XXX,XX +XXX,XX @@ typedef struct MicrochipPFSoCState {
++};
      MchpPfSoCMMUartState *serial2;
      MchpPfSoCMMUartState *serial3;
      MchpPfSoCMMUartState *serial4;
 +    CadenceSDHCIState sdhci;
  } MicrochipPFSoCState;
  #define TYPE_MICROCHIP_PFSOC    "microchip.pfsoc"
@@ -XXX,XX +XXX,XX @@ enum {
      MICROCHIP_PFSOC_MMUART0,
      MICROCHIP_PFSOC_SYSREG,
      MICROCHIP_PFSOC_MPUCFG,
 +    MICROCHIP_PFSOC_EMMC_SD,
      MICROCHIP_PFSOC_MMUART1,
      MICROCHIP_PFSOC_MMUART2,
      MICROCHIP_PFSOC_MMUART3,
@@ -XXX,XX +XXX,XX @@ enum {
  };
  enum {
 +    MICROCHIP_PFSOC_EMMC_SD_IRQ = 88,
      MICROCHIP_PFSOC_MMUART0_IRQ = 90,
      MICROCHIP_PFSOC_MMUART1_IRQ = 91,
      MICROCHIP_PFSOC_MMUART2_IRQ = 92,
 diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/microchip_pfsoc.c
 +++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
   * 1) PLIC (Platform Level Interrupt Controller)
   * 2) eNVM (Embedded Non-Volatile Memory)
   * 3) MMUARTs (Multi-Mode UART)
 + * 4) Cadence eMMC/SDHC controller and an SD card connected to it
   *
   * This board currently generates devicetree dynamically that indicates at least
   * two harts and up to five harts.
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
      [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,     0x1000 },
      [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,     0x2000 },
      [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,     0x1000 },
 +    [MICROCHIP_PFSOC_EMMC_SD] =         { 0x20008000,     0x1000 },
      [MICROCHIP_PFSOC_MMUART1] =         { 0x20100000,     0x1000 },
      [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,     0x1000 },
      [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
      qdev_prop_set_string(DEVICE(&s->u_cpus), "cpu-type",
                           TYPE_RISCV_CPU_SIFIVE_U54);
      qdev_prop_set_uint64(DEVICE(&s->u_cpus), "resetvec", RESET_VECTOR);
 +
-+    object_initialize_child(obj, "sd-controller", &s->sdhci,
++static KVMCPUConfig kvm_cboz_blocksize = {
-+                            TYPE_CADENCE_SDHCI);
++    .name = "cboz_blocksize",
 +    .offset = CPUCFG(cboz_blocksize),
 +    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicboz_block_size)
 +};
 +
 +static void kvm_cpu_set_cbomz_blksize(Object *obj, Visitor *v,
 +                                      const char *name,
 +                                      void *opaque, Error **errp)
 +{
 +    KVMCPUConfig *cbomz_cfg = opaque;
 +    RISCVCPU *cpu = RISCV_CPU(obj);
 +    uint16_t value, *host_val;
 +
 +    if (!visit_type_uint16(v, name, &value, errp)) {
 +        return;
 +    }
 +
 +    host_val = kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
 +
 +    if (value != *host_val) {
 +        error_report("Unable to set %s to a different value than "
 +                     "the host (%u)",
 +                     cbomz_cfg->name, *host_val);
 +        exit(EXIT_FAILURE);
 +    }
 +
 +    cbomz_cfg->user_set = true;
 +}
 +
  static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
  {
      CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
                              kvm_cpu_set_multi_ext_cfg,
                              NULL, multi_cfg);
      }
 +
 +    object_property_add(cpu_obj, "cbom_blocksize", "uint16",
 +                        NULL, kvm_cpu_set_cbomz_blksize,
 +                        NULL, &kvm_cbom_blocksize);
 +
 +    object_property_add(cpu_obj, "cboz_blocksize", "uint16",
 +                        NULL, kvm_cpu_set_cbomz_blksize,
 +                        NULL, &kvm_cboz_blocksize);
  }
- static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
+ static int kvm_riscv_get_regs_core(CPUState *cs)
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
-         memmap[MICROCHIP_PFSOC_MPUCFG].base,
+     env->misa_ext = env->misa_ext_mask;
-         memmap[MICROCHIP_PFSOC_MPUCFG].size);
+ }
-+    /* SDHCI */
++static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
-+    sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp);
++                                         KVMCPUConfig *cbomz_cfg)
-+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
++{
-+                    memmap[MICROCHIP_PFSOC_EMMC_SD].base);
++    CPURISCVState *env = &cpu->env;
-+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
++    struct kvm_one_reg reg;
-+        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_EMMC_SD_IRQ));
++    int ret;
 +
-     /* MMUARTs */
++    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-     s->serial0 = mchp_pfsoc_mmuart_create(system_memory,
++                              cbomz_cfg->kvm_reg_id);
-         memmap[MICROCHIP_PFSOC_MMUART0].base,
++    reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
-@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
++    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
-     MicrochipIcicleKitState *s = MICROCHIP_ICICLE_KIT_MACHINE(machine);
++    if (ret != 0) {
-     MemoryRegion *system_memory = get_system_memory();
++        error_report("Unable to read KVM reg %s, error %d",
-     MemoryRegion *main_mem = g_new(MemoryRegion, 1);
++                     cbomz_cfg->name, ret);
-+    DriveInfo *dinfo = drive_get_next(IF_SD);
++        exit(EXIT_FAILURE);
++    }
-     /* Sanity check on RAM size */
++}
      if (machine->ram_size < mc->default_ram_size) {
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
      /* Load the firmware */
      riscv_find_and_load_firmware(machine, BIOS_FILENAME, RESET_VECTOR, NULL);
 +
-+    /* Attach an SD card */
+ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
-+    if (dinfo) {
+ {
-+        CadenceSDHCIState *sdhci = &(s->soc.sdhci);
+     CPURISCVState *env = &cpu->env;
-+        DeviceState *card = qdev_new(TYPE_SD_CARD);
+@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
          kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
      }
 +
-+        qdev_prop_set_drive_err(card, "drive", blk_by_legacy_dinfo(dinfo),
++    if (cpu->cfg.ext_icbom) {
-+                                &error_fatal);
++        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cbom_blocksize);
-+        qdev_realize_and_unref(card, sdhci->bus, &error_fatal);
++    }
 +
 +    if (cpu->cfg.ext_icboz) {
 +        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cboz_blocksize);
 +    }
  }
- static void microchip_icicle_kit_machine_class_init(ObjectClass *oc, void *data)
+ void kvm_riscv_init_user_properties(Object *cpu_obj)
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
      select SIFIVE
      select UNIMP
      select MCHP_PFSOC_MMUART
 +    select CADENCE_SDHCI
 --
-.28.0
+.40.1

-[PULL 05/30] target/riscv: cpu: Set reset vector based on the configured property value
+[PULL 54/54] riscv: Add support for the Zfa extension
-From: Bin Meng <bin.meng@windriver.com>
+From: Christoph Müllner <christoph.muellner@vrull.eu>
-Now that we have the newly introduced 'resetvec' property in the
+This patch introduces the RISC-V Zfa extension, which introduces
-RISC-V CPU and HART, instead of hard-coding the reset vector addr
+additional floating-point instructions:
-in the CPU's instance_init(), move that to riscv_cpu_realize()
+* fli (load-immediate) with pre-defined immediates
-based on the configured property value from the RISC-V machines.
+* fminm/fmaxm (like fmin/fmax but with different NaN behaviour)
 * fround/froundmx (round to integer)
 * fcvtmod.w.d (Modular Convert-to-Integer)
 * fmv* to access high bits of float register bigger than XLEN
 * Quiet comparison instructions (fleq/fltq)
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Zfa defines its instructions in combination with the following extensions:
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+* single-precision floating-point (F)
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+* double-precision floating-point (D)
-Message-Id: <1598924352-89526-4-git-send-email-bmeng.cn@gmail.com>
+* quad-precision floating-point (Q)
 * half-precision floating-point (Zfh)
 Since QEMU does not support the RISC-V quad-precision floating-point
 ISA extension (Q), this patch does not include the instructions that
 depend on this extension. All other instructions are included in this
 patch.
 The Zfa specification can be found here:
   https://github.com/riscv/riscv-isa-manual/blob/master/src/zfa.tex
 The Zfa specifciation is frozen and is in public review since May 3, 2023:
   https://groups.google.com/a/groups.riscv.org/g/isa-dev/c/SED4ntBkabg
 The patch also includes a TCG test for the fcvtmod.w.d instruction.
 The test cases test for correct results and flag behaviour.
 Note, that the Zfa specification requires fcvtmod's flag behaviour
 to be identical to a fcvt with the same operands (which is also
 tested).
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Message-Id: <20230710071243.282464-1-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/opentitan.c | 1 +
+ disas/riscv.h                             |   3 +
- hw/riscv/sifive_e.c  | 1 +
+ target/riscv/cpu_cfg.h                    |   1 +
- hw/riscv/sifive_u.c  | 2 ++
+ target/riscv/helper.h                     |  19 +
- target/riscv/cpu.c   | 7 ++-----
+ target/riscv/insn32.decode                |  26 ++
-files changed, 6 insertions(+), 5 deletions(-)
+ disas/riscv.c                             | 139 ++++++
  target/riscv/cpu.c                        |   8 +
  target/riscv/fpu_helper.c                 | 154 +++++++
  target/riscv/translate.c                  |   1 +
  tests/tcg/riscv64/test-fcvtmod.c          | 345 ++++++++++++++
  target/riscv/insn_trans/trans_rvzfa.c.inc | 521 ++++++++++++++++++++++
  tests/tcg/riscv64/Makefile.target         |   6 +
 files changed, 1223 insertions(+)
  create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
  create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc
-diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
+diff --git a/disas/riscv.h b/disas/riscv.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/opentitan.c
+--- a/disas/riscv.h
-+++ b/hw/riscv/opentitan.c
++++ b/disas/riscv.h
-@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
+@@ -XXX,XX +XXX,XX @@ typedef enum {
-                             &error_abort);
+     rv_codec_r_imm2,
-     object_property_set_int(OBJECT(&s->cpus), "num-harts", ms->smp.cpus,
+     rv_codec_r2_immhl,
-                             &error_abort);
+     rv_codec_r2_imm2_imm5,
-+    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x8090, &error_abort);
++    rv_codec_fli,
-     sysbus_realize(SYS_BUS_DEVICE(&s->cpus), &error_abort);
+ } rv_codec;
-     /* Boot ROM */
+ /* structures */
-diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
+@@ -XXX,XX +XXX,XX @@ enum {
  #define rv_fmt_rd_offset              "O\t0,o"
  #define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
  #define rv_fmt_frd_rs1                "O\t3,1"
 +#define rv_fmt_frd_rs1_rs2            "O\t3,1,2"
  #define rv_fmt_frd_frs1               "O\t3,4"
  #define rv_fmt_rd_frs1                "O\t0,4"
  #define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
@@ -XXX,XX +XXX,XX @@ enum {
  #define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
  #define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
  #define rv_fmt_rd2_imm                "O\t0,2,(1),i"
 +#define rv_fmt_fli                    "O\t3,h"
  #endif /* DISAS_RISCV_H */
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_e.c
+--- a/target/riscv/cpu_cfg.h
-+++ b/hw/riscv/sifive_e.c
++++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     object_initialize_child(obj, "cpus", &s->cpus, TYPE_RISCV_HART_ARRAY);
+     bool ext_svpbmt;
-     object_property_set_int(OBJECT(&s->cpus), "num-harts", ms->smp.cpus,
+     bool ext_zdinx;
-                             &error_abort);
+     bool ext_zawrs;
-+    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x1004, &error_abort);
++    bool ext_zfa;
-     object_initialize_child(obj, "riscv.sifive.e.gpio0", &s->gpio,
+     bool ext_zfbfmin;
-                             TYPE_SIFIVE_GPIO);
+     bool ext_zfh;
- }
+     bool ext_zfhmin;
-diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_u.c
+--- a/target/riscv/helper.h
-+++ b/hw/riscv/sifive_u.c
++++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_instance_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
-     qdev_prop_set_uint32(DEVICE(&s->e_cpus), "num-harts", 1);
+ DEF_HELPER_FLAGS_3(fmul_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
-     qdev_prop_set_uint32(DEVICE(&s->e_cpus), "hartid-base", 0);
+ DEF_HELPER_FLAGS_3(fdiv_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
-     qdev_prop_set_string(DEVICE(&s->e_cpus), "cpu-type", SIFIVE_E_CPU);
+ DEF_HELPER_FLAGS_3(fmin_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
-+    qdev_prop_set_uint64(DEVICE(&s->e_cpus), "resetvec", 0x1004);
++DEF_HELPER_FLAGS_3(fminm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+ DEF_HELPER_FLAGS_3(fmax_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
-     object_initialize_child(obj, "u-cluster", &s->u_cluster, TYPE_CPU_CLUSTER);
++DEF_HELPER_FLAGS_3(fmaxm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
-     qdev_prop_set_uint32(DEVICE(&s->u_cluster), "cluster-id", 1);
+ DEF_HELPER_FLAGS_2(fsqrt_s, TCG_CALL_NO_RWG, i64, env, i64)
-@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_instance_init(Object *obj)
+ DEF_HELPER_FLAGS_3(fle_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
-     qdev_prop_set_uint32(DEVICE(&s->u_cpus), "num-harts", ms->smp.cpus - 1);
++DEF_HELPER_FLAGS_3(fleq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
-     qdev_prop_set_uint32(DEVICE(&s->u_cpus), "hartid-base", 1);
+ DEF_HELPER_FLAGS_3(flt_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
-     qdev_prop_set_string(DEVICE(&s->u_cpus), "cpu-type", SIFIVE_U_CPU);
++DEF_HELPER_FLAGS_3(fltq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
-+    qdev_prop_set_uint64(DEVICE(&s->u_cpus), "resetvec", 0x1004);
+ DEF_HELPER_FLAGS_3(feq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
+ DEF_HELPER_FLAGS_2(fcvt_w_s, TCG_CALL_NO_RWG, tl, env, i64)
-     object_initialize_child(obj, "prci", &s->prci, TYPE_SIFIVE_U_PRCI);
+ DEF_HELPER_FLAGS_2(fcvt_wu_s, TCG_CALL_NO_RWG, tl, env, i64)
-     object_initialize_child(obj, "otp", &s->otp, TYPE_SIFIVE_U_OTP);
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_wu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_s_l, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_s_lu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fclass_s, TCG_CALL_NO_RWG_SE, tl, env, i64)
 +DEF_HELPER_FLAGS_2(fround_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
 +DEF_HELPER_FLAGS_2(froundnx_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
  /* Floating Point - Double Precision */
  DEF_HELPER_FLAGS_3(fadd_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmul_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fdiv_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmin_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fminm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmax_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fmaxm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_2(fcvt_s_d, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_d_s, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fsqrt_d, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_3(fle_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fleq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(flt_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fltq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(feq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_2(fcvt_w_d, TCG_CALL_NO_RWG, tl, env, i64)
 +DEF_HELPER_FLAGS_2(fcvtmod_w_d, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_wu_d, TCG_CALL_NO_RWG, tl, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_l_d, TCG_CALL_NO_RWG, tl, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_lu_d, TCG_CALL_NO_RWG, tl, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_d_wu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_d_l, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_d_lu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
 +DEF_HELPER_FLAGS_2(fround_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
 +DEF_HELPER_FLAGS_2(froundnx_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
  /* Bitmanip */
  DEF_HELPER_FLAGS_2(clmul, TCG_CALL_NO_RWG_SE, tl, tl, tl)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmul_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fdiv_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmin_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fminm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_3(fmax_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fmaxm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
  DEF_HELPER_FLAGS_2(fsqrt_h, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_3(fle_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fleq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(flt_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 +DEF_HELPER_FLAGS_3(fltq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_3(feq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
  DEF_HELPER_FLAGS_2(fcvt_s_h, TCG_CALL_NO_RWG, i64, env, i64)
  DEF_HELPER_FLAGS_2(fcvt_h_s, TCG_CALL_NO_RWG, i64, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_h_wu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
 +DEF_HELPER_FLAGS_2(fround_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
 +DEF_HELPER_FLAGS_2(froundnx_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
  /* Cache-block operations */
  DEF_HELPER_2(cbo_clean_flush, void, env, tl)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ binvi      01101. ........... 001 ..... 0010011 @sh
  bset       0010100 .......... 001 ..... 0110011 @r
  bseti      00101. ........... 001 ..... 0010011 @sh
 +# *** Zfa Standard Extension ***
 +fli_s       1111000 00001 ..... 000 ..... 1010011 @r2
 +fli_d       1111001 00001 ..... 000 ..... 1010011 @r2
 +fli_h       1111010 00001 ..... 000 ..... 1010011 @r2
 +fminm_s     0010100 ..... ..... 010 ..... 1010011 @r
 +fmaxm_s     0010100 ..... ..... 011 ..... 1010011 @r
 +fminm_d     0010101 ..... ..... 010 ..... 1010011 @r
 +fmaxm_d     0010101 ..... ..... 011 ..... 1010011 @r
 +fminm_h     0010110 ..... ..... 010 ..... 1010011 @r
 +fmaxm_h     0010110 ..... ..... 011 ..... 1010011 @r
 +fround_s    0100000 00100 ..... ... ..... 1010011 @r2_rm
 +froundnx_s  0100000 00101 ..... ... ..... 1010011 @r2_rm
 +fround_d    0100001 00100 ..... ... ..... 1010011 @r2_rm
 +froundnx_d  0100001 00101 ..... ... ..... 1010011 @r2_rm
 +fround_h    0100010 00100 ..... ... ..... 1010011 @r2_rm
 +froundnx_h  0100010 00101 ..... ... ..... 1010011 @r2_rm
 +fcvtmod_w_d 1100001 01000 ..... 001 ..... 1010011 @r2
 +fmvh_x_d    1110001 00001 ..... 000 ..... 1010011 @r2
 +fmvp_d_x    1011001 ..... ..... 000 ..... 1010011 @r
 +fleq_s      1010000 ..... ..... 100 ..... 1010011 @r
 +fltq_s      1010000 ..... ..... 101 ..... 1010011 @r
 +fleq_d      1010001 ..... ..... 100 ..... 1010011 @r
 +fltq_d      1010001 ..... ..... 101 ..... 1010011 @r
 +fleq_h      1010010 ..... ..... 100 ..... 1010011 @r
 +fltq_h      1010010 ..... ..... 101 ..... 1010011 @r
 +
  # *** RV32 Zfh Extension ***
  flh        ............   ..... 001 ..... 0000111 @i
  fsh        .......  ..... ..... 001 ..... 0100111 @s
 diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
 --- a/disas/riscv.c
 +++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
      rv_op_fsh = 798,
      rv_op_fmv_h_x = 799,
      rv_op_fmv_x_h = 800,
 +    rv_op_fli_s = 801,
 +    rv_op_fli_d = 802,
 +    rv_op_fli_q = 803,
 +    rv_op_fli_h = 804,
 +    rv_op_fminm_s = 805,
 +    rv_op_fmaxm_s = 806,
 +    rv_op_fminm_d = 807,
 +    rv_op_fmaxm_d = 808,
 +    rv_op_fminm_q = 809,
 +    rv_op_fmaxm_q = 810,
 +    rv_op_fminm_h = 811,
 +    rv_op_fmaxm_h = 812,
 +    rv_op_fround_s = 813,
 +    rv_op_froundnx_s = 814,
 +    rv_op_fround_d = 815,
 +    rv_op_froundnx_d = 816,
 +    rv_op_fround_q = 817,
 +    rv_op_froundnx_q = 818,
 +    rv_op_fround_h = 819,
 +    rv_op_froundnx_h = 820,
 +    rv_op_fcvtmod_w_d = 821,
 +    rv_op_fmvh_x_d = 822,
 +    rv_op_fmvp_d_x = 823,
 +    rv_op_fmvh_x_q = 824,
 +    rv_op_fmvp_q_x = 825,
 +    rv_op_fleq_s = 826,
 +    rv_op_fltq_s = 827,
 +    rv_op_fleq_d = 828,
 +    rv_op_fltq_d = 829,
 +    rv_op_fleq_q = 830,
 +    rv_op_fltq_q = 831,
 +    rv_op_fleq_h = 832,
 +    rv_op_fltq_h = 833,
  } rv_op;
  /* register names */
@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
      "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
  };
 +/* The FLI.[HSDQ] numeric constants (0.0 for symbolic constants).
 + * The constants use the hex floating-point literal representation
 + * that is printed when using the printf %a format specifier,
 + * which matches the output that is generated by the disassembler.
 + */
 +static const char rv_fli_name_const[32][9] =
 +{
 +    "0x1p+0", "min", "0x1p-16", "0x1p-15",
 +    "0x1p-8", "0x1p-7", "0x1p-4", "0x1p-3",
 +    "0x1p-2", "0x1.4p-2", "0x1.8p-2", "0x1.cp-2",
 +    "0x1p-1", "0x1.4p-1", "0x1.8p-1", "0x1.cp-1",
 +    "0x1p+0", "0x1.4p+0", "0x1.8p+0", "0x1.cp+0",
 +    "0x1p+1", "0x1.4p+1", "0x1.8p+1", "0x1p+2",
 +    "0x1p+3", "0x1p+4", "0x1p+7", "0x1p+8",
 +    "0x1p+15", "0x1p+16", "inf", "nan"
 +};
 +
  /* pseudo-instruction constraints */
  static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
      { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
      { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
      { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    { "fli.s", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fli.d", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fli.q", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fli.h", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
 +    { "fminm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fminm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fminm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fminm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fmaxm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fround.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fround.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fround.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fround.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "froundnx.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
 +    { "fcvtmod.w.d", rv_codec_r_m, rv_fmt_rm_rd_frs1, NULL, 0, 0, 0 },
 +    { "fmvh.x.d", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    { "fmvp.d.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "fmvh.x.q", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 +    { "fmvp.q.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
 +    { "fleq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fleq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fleq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fleq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 +    { "fltq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
  };
  /* CSR names */
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  switch ((inst >> 12) & 0b111) {
                  case 0: op = rv_op_fmin_s; break;
                  case 1: op = rv_op_fmax_s; break;
 +                case 2: op = rv_op_fminm_s; break;
 +                case 3: op = rv_op_fmaxm_s; break;
                  }
                  break;
              case 21:
                  switch ((inst >> 12) & 0b111) {
                  case 0: op = rv_op_fmin_d; break;
                  case 1: op = rv_op_fmax_d; break;
 +                case 2: op = rv_op_fminm_d; break;
 +                case 3: op = rv_op_fmaxm_d; break;
 +                }
 +                break;
 +            case 22:
 +                switch (((inst >> 12) & 0b111)) {
 +                case 2: op = rv_op_fminm_h; break;
 +                case 3: op = rv_op_fmaxm_h; break;
                  }
                  break;
              case 23:
                  switch ((inst >> 12) & 0b111) {
                  case 0: op = rv_op_fmin_q; break;
                  case 1: op = rv_op_fmax_q; break;
 +                case 2: op = rv_op_fminm_q; break;
 +                case 3: op = rv_op_fmaxm_q; break;
                  }
                  break;
              case 32:
                  switch ((inst >> 20) & 0b11111) {
                  case 1: op = rv_op_fcvt_s_d; break;
                  case 3: op = rv_op_fcvt_s_q; break;
 +                case 4: op = rv_op_fround_s; break;
 +                case 5: op = rv_op_froundnx_s; break;
                  case 6: op = rv_op_fcvt_s_bf16; break;
                  }
                  break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  switch ((inst >> 20) & 0b11111) {
                  case 0: op = rv_op_fcvt_d_s; break;
                  case 3: op = rv_op_fcvt_d_q; break;
 +                case 4: op = rv_op_fround_d; break;
 +                case 5: op = rv_op_froundnx_d; break;
                  }
                  break;
              case 34:
                  switch (((inst >> 20) & 0b11111)) {
 +                case 4: op = rv_op_fround_h; break;
 +                case 5: op = rv_op_froundnx_h; break;
                  case 8: op = rv_op_fcvt_bf16_s; break;
                  }
                  break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  switch ((inst >> 20) & 0b11111) {
                  case 0: op = rv_op_fcvt_q_s; break;
                  case 1: op = rv_op_fcvt_q_d; break;
 +                case 4: op = rv_op_fround_q; break;
 +                case 5: op = rv_op_froundnx_q; break;
                  }
                  break;
              case 44:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 0: op = rv_op_fle_s; break;
                  case 1: op = rv_op_flt_s; break;
                  case 2: op = rv_op_feq_s; break;
 +                case 4: op = rv_op_fleq_s; break;
 +                case 5: op = rv_op_fltq_s; break;
                  }
                  break;
              case 81:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 0: op = rv_op_fle_d; break;
                  case 1: op = rv_op_flt_d; break;
                  case 2: op = rv_op_feq_d; break;
 +                case 4: op = rv_op_fleq_d; break;
 +                case 5: op = rv_op_fltq_d; break;
 +                }
 +                break;
 +            case 82:
 +                switch (((inst >> 12) & 0b111)) {
 +                case 4: op = rv_op_fleq_h; break;
 +                case 5: op = rv_op_fltq_h; break;
                  }
                  break;
              case 83:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 0: op = rv_op_fle_q; break;
                  case 1: op = rv_op_flt_q; break;
                  case 2: op = rv_op_feq_q; break;
 +                case 4: op = rv_op_fleq_q; break;
 +                case 5: op = rv_op_fltq_q; break;
 +                }
 +                break;
 +            case 89:
 +        switch (((inst >> 12) & 0b111)) {
 +                case 0: op = rv_op_fmvp_d_x; break;
 +                }
 +                break;
 +            case 91:
 +        switch (((inst >> 12) & 0b111)) {
 +                case 0: op = rv_op_fmvp_q_x; break;
                  }
                  break;
              case 96:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                  case 1: op = rv_op_fcvt_wu_d; break;
                  case 2: op = rv_op_fcvt_l_d; break;
                  case 3: op = rv_op_fcvt_lu_d; break;
 +                case 8: op = rv_op_fcvtmod_w_d; break;
                  }
                  break;
              case 99:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_x_d; break;
                  case 1: op = rv_op_fclass_d; break;
 +                case 8: op = rv_op_fmvh_x_d; break;
                  }
                  break;
              case 114:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_x_q; break;
                  case 1: op = rv_op_fclass_q; break;
 +                case 8: op = rv_op_fmvh_x_q; break;
                  }
                  break;
              case 120:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_s_x; break;
 +                case 8: op = rv_op_fli_s; break;
                  }
                  break;
              case 121:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_d_x; break;
 +                case 8: op = rv_op_fli_d; break;
                  }
                  break;
              case 122:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_h_x; break;
 +                case 8: op = rv_op_fli_h; break;
                  }
                  break;
              case 123:
                  switch (((inst >> 17) & 0b11111000) |
                          ((inst >> 12) & 0b00000111)) {
                  case 0: op = rv_op_fmv_q_x; break;
 +                case 8: op = rv_op_fli_q; break;
                  }
                  break;
              }
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
          break;
      case rv_codec_zcmt_jt:
          dec->imm = operand_tbl_index(inst);
 +    break;
 +    case rv_codec_fli:
 +        dec->rd = operand_rd(inst);
 +        dec->imm = operand_rs1(inst);
          break;
      case rv_codec_r2_imm5:
          dec->rd = operand_rd(inst);
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
              append(buf, tmp, buflen);
              break;
          }
 +        case 'h':
 +            append(buf, rv_fli_name_const[dec->imm], buflen);
 +            break;
          default:
              break;
          }
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_any_cpu_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
-     set_misa(env, RVXLEN | RVI | RVM | RVA | RVF | RVD | RVC | RVU);
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
-     set_priv_version(env, PRIV_VERSION_1_11_0);
+     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
--    set_resetvec(env, DEFAULT_RSTVEC);
++    ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
      ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
      ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
      ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
      set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU);
      env->priv_ver = PRIV_VERSION_1_11_0;
 +    cpu->cfg.ext_zfa = true;
      cpu->cfg.ext_zfh = true;
      cpu->cfg.mmu = true;
      cpu->cfg.ext_xtheadba = true;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
 +    if (cpu->cfg.ext_zfa && !riscv_has_ext(env, RVF)) {
 +        error_setg(errp, "Zfa extension requires F extension");
 +        return;
 +    }
 +
      if (cpu->cfg.ext_zfh) {
          cpu->cfg.ext_zfhmin = true;
      }
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
      DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
      DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
 +    DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
      DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
      DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
      DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
 diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/fpu_helper.c
 +++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                           float32_minimum_number(frs1, frs2, &env->fp_status));
  }
- static void riscv_base_cpu_init(Object *obj)
++uint64_t helper_fminm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-@@ -XXX,XX +XXX,XX @@ static void riscv_base_cpu_init(Object *obj)
++{
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
++    float32 frs1 = check_nanbox_s(env, rs1);
-     /* We set this in the realise function */
++    float32 frs2 = check_nanbox_s(env, rs2);
-     set_misa(env, 0);
++    float32 ret = float32_min(frs1, frs2, &env->fp_status);
--    set_resetvec(env, DEFAULT_RSTVEC);
++    return nanbox_s(env, ret);
 +}
 +
  uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                           float32_maximum_number(frs1, frs2, &env->fp_status));
  }
- static void rvxx_sifive_u_cpu_init(Object *obj)
++uint64_t helper_fmaxm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-@@ -XXX,XX +XXX,XX @@ static void rvxx_sifive_u_cpu_init(Object *obj)
++{
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
++    float32 frs1 = check_nanbox_s(env, rs1);
-     set_misa(env, RVXLEN | RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
++    float32 frs2 = check_nanbox_s(env, rs2);
-     set_priv_version(env, PRIV_VERSION_1_10_0);
++    float32 ret = float32_max(frs1, frs2, &env->fp_status);
--    set_resetvec(env, 0x1004);
++    return nanbox_s(env, ret);
 +}
 +
  uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
  {
      float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
      return float32_le(frs1, frs2, &env->fp_status);
  }
- static void rvxx_sifive_e_cpu_init(Object *obj)
++target_ulong helper_fleq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-@@ -XXX,XX +XXX,XX @@ static void rvxx_sifive_e_cpu_init(Object *obj)
++{
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
++    float32 frs1 = check_nanbox_s(env, rs1);
-     set_misa(env, RVXLEN | RVI | RVM | RVA | RVC | RVU);
++    float32 frs2 = check_nanbox_s(env, rs2);
-     set_priv_version(env, PRIV_VERSION_1_10_0);
++    return float32_le_quiet(frs1, frs2, &env->fp_status);
--    set_resetvec(env, 0x1004);
++}
-     qdev_prop_set_bit(DEVICE(obj), "mmu", false);
++
  target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
      return float32_lt(frs1, frs2, &env->fp_status);
  }
-@@ -XXX,XX +XXX,XX @@ static void rv32_ibex_cpu_init(Object *obj)
++target_ulong helper_fltq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
-     CPURISCVState *env = &RISCV_CPU(obj)->env;
++{
-     set_misa(env, RV32 | RVI | RVM | RVC | RVU);
++    float32 frs1 = check_nanbox_s(env, rs1);
-     set_priv_version(env, PRIV_VERSION_1_10_0);
++    float32 frs2 = check_nanbox_s(env, rs2);
--    set_resetvec(env, 0x8090);
++    return float32_lt_quiet(frs1, frs2, &env->fp_status);
-     qdev_prop_set_bit(DEVICE(obj), "mmu", false);
++}
 +
  target_ulong helper_feq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_s(CPURISCVState *env, uint64_t rs1)
      return fclass_s(frs1);
  }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
++uint64_t helper_fround_s(CPURISCVState *env, uint64_t rs1)
-         set_feature(env, RISCV_FEATURE_PMP);
++{
-     }
++    float_status *fs = &env->fp_status;
++    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
-+    set_resetvec(env, cpu->cfg.resetvec);
++    float32 frs1 = check_nanbox_s(env, rs1);
 +
-     /* If misa isn't set (rv32 and rv64 machines) set it here */
++    frs1 = float32_round_to_int(frs1, fs);
-     if (!env->misa) {
++
-         /* Do some ISA extension error checking */
++    /* Restore the original NX flag. */
 +    uint16_t flags = get_float_exception_flags(fs);
 +    flags &= ~float_flag_inexact;
 +    flags |= nx_old;
 +    set_float_exception_flags(flags, fs);
 +
 +    return nanbox_s(env, frs1);
 +}
 +
 +uint64_t helper_froundnx_s(CPURISCVState *env, uint64_t rs1)
 +{
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    frs1 = float32_round_to_int(frs1, &env->fp_status);
 +    return nanbox_s(env, frs1);
 +}
 +
  uint64_t helper_fadd_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return float64_add(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
             float64_minimum_number(frs1, frs2, &env->fp_status);
  }
 +uint64_t helper_fminm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_min(frs1, frs2, &env->fp_status);
 +}
 +
  uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return env->priv_ver < PRIV_VERSION_1_11_0 ?
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
             float64_maximum_number(frs1, frs2, &env->fp_status);
  }
 +uint64_t helper_fmaxm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_max(frs1, frs2, &env->fp_status);
 +}
 +
  uint64_t helper_fcvt_s_d(CPURISCVState *env, uint64_t rs1)
  {
      return nanbox_s(env, float64_to_float32(rs1, &env->fp_status));
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
      return float64_le(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fleq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_le_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_flt_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return float64_lt(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fltq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 +{
 +    return float64_lt_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_feq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  {
      return float64_eq_quiet(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fcvt_w_d(CPURISCVState *env, uint64_t frs1)
      return float64_to_int32(frs1, &env->fp_status);
  }
 +uint64_t helper_fcvtmod_w_d(CPURISCVState *env, uint64_t value)
 +{
 +    return float64_to_int32_modulo(value, float_round_to_zero, &env->fp_status);
 +}
 +
  target_ulong helper_fcvt_wu_d(CPURISCVState *env, uint64_t frs1)
  {
      return (int32_t)float64_to_uint32(frs1, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_d(uint64_t frs1)
      return fclass_d(frs1);
  }
 +uint64_t helper_fround_d(CPURISCVState *env, uint64_t frs1)
 +{
 +    float_status *fs = &env->fp_status;
 +    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
 +
 +    frs1 = float64_round_to_int(frs1, fs);
 +
 +    /* Restore the original NX flag. */
 +    uint16_t flags = get_float_exception_flags(fs);
 +    flags &= ~float_flag_inexact;
 +    flags |= nx_old;
 +    set_float_exception_flags(flags, fs);
 +
 +    return frs1;
 +}
 +
 +uint64_t helper_froundnx_d(CPURISCVState *env, uint64_t frs1)
 +{
 +    return float64_round_to_int(frs1, &env->fp_status);
 +}
 +
  uint64_t helper_fadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                           float16_minimum_number(frs1, frs2, &env->fp_status));
  }
 +uint64_t helper_fminm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    float16 ret = float16_min(frs1, frs2, &env->fp_status);
 +    return nanbox_h(env, ret);
 +}
 +
  uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                           float16_maximum_number(frs1, frs2, &env->fp_status));
  }
 +uint64_t helper_fmaxm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    float16 ret = float16_max(frs1, frs2, &env->fp_status);
 +    return nanbox_h(env, ret);
 +}
 +
  uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
      return float16_le(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fleq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return float16_le_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
      return float16_lt(frs1, frs2, &env->fp_status);
  }
 +target_ulong helper_fltq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 +{
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return float16_lt_quiet(frs1, frs2, &env->fp_status);
 +}
 +
  target_ulong helper_feq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_h(CPURISCVState *env, uint64_t rs1)
      return fclass_h(frs1);
  }
 +uint64_t helper_fround_h(CPURISCVState *env, uint64_t rs1)
 +{
 +    float_status *fs = &env->fp_status;
 +    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +
 +    frs1 = float16_round_to_int(frs1, fs);
 +
 +    /* Restore the original NX flag. */
 +    uint16_t flags = get_float_exception_flags(fs);
 +    flags &= ~float_flag_inexact;
 +    flags |= nx_old;
 +    set_float_exception_flags(flags, fs);
 +
 +    return nanbox_h(env, frs1);
 +}
 +
 +uint64_t helper_froundnx_h(CPURISCVState *env, uint64_t rs1)
 +{
 +    float16 frs1 = check_nanbox_s(env, rs1);
 +    frs1 = float16_round_to_int(frs1, &env->fp_status);
 +    return nanbox_h(env, frs1);
 +}
 +
  target_ulong helper_fcvt_w_h(CPURISCVState *env, uint64_t rs1)
  {
      float16 frs1 = check_nanbox_h(env, rs1);
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
  #include "insn_trans/trans_rvzicond.c.inc"
  #include "insn_trans/trans_rvzawrs.c.inc"
  #include "insn_trans/trans_rvzicbo.c.inc"
 +#include "insn_trans/trans_rvzfa.c.inc"
  #include "insn_trans/trans_rvzfh.c.inc"
  #include "insn_trans/trans_rvk.c.inc"
  #include "insn_trans/trans_privileged.c.inc"
 diff --git a/tests/tcg/riscv64/test-fcvtmod.c b/tests/tcg/riscv64/test-fcvtmod.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/riscv64/test-fcvtmod.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <stddef.h>
 +#include <stdint.h>
 +
 +#define FFLAG_NX_SHIFT 0 /* inexact */
 +#define FFLAG_UF_SHIFT 1 /* underflow */
 +#define FFLAG_OF_SHIFT 2 /* overflow */
 +#define FFLAG_DZ_SHIFT 3 /* divide by zero */
 +#define FFLAG_NV_SHIFT 4 /* invalid operation */
 +
 +#define FFLAG_NV (1UL << FFLAG_NV_SHIFT)
 +#define FFLAG_DZ (1UL << FFLAG_DZ_SHIFT)
 +#define FFLAG_OF (1UL << FFLAG_OF_SHIFT)
 +#define FFLAG_UF (1UL << FFLAG_UF_SHIFT)
 +#define FFLAG_NX (1UL << FFLAG_NX_SHIFT)
 +
 +typedef struct fp64_fcvt_fcvtmod_testcase {
 +    const char* name;
 +    union {
 +        uint64_t inp_lu;
 +        double inp_lf;
 +    };
 +    uint64_t exp_fcvt;
 +    uint8_t exp_fcvt_fflags;
 +    uint64_t exp_fcvtmod;
 +    uint8_t exp_fcvtmod_fflags;
 +} fp64_fcvt_fcvtmod_testcase_t;
 +
 +void print_fflags(uint8_t fflags)
 +{
 +    int set = 0;
 +
 +    if (fflags == 0) {
 +        printf("-");
 +        return;
 +    }
 +
 +    if (fflags & FFLAG_NV) {
 +        printf("%sFFLAG_NV", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_DZ) {
 +        printf("%sFFLAG_DZ", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_OF) {
 +        printf("%sFFLAG_OF", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_UF) {
 +        printf("%sFFLAG_UF", set ? " | " : "");
 +        set = 1;
 +    }
 +    if (fflags & FFLAG_NX) {
 +        printf("%sFFLAG_NX", set ? " | " : "");
 +        set = 1;
 +    }
 +}
 +
 +/* Clear all FP flags. */
 +static inline void clear_fflags()
 +{
 +    __asm__ __volatile__("fsflags zero");
 +}
 +
 +/* Read all FP flags. */
 +static inline uint8_t get_fflags()
 +{
 +    uint64_t v;
 +    __asm__ __volatile__("frflags %0" : "=r"(v));
 +    return (uint8_t)v;
 +}
 +
 +/* Move input value (without conversations) into an FP register. */
 +static inline double do_fmv_d_x(uint64_t inp)
 +{
 +    double fpr;
 +    __asm__ __volatile__("fmv.d.x %0, %1" : "=f"(fpr) : "r"(inp));
 +    return fpr;
 +}
 +
 +static inline uint64_t do_fcvt_w_d(uint64_t inp, uint8_t *fflags)
 +{
 +    uint64_t ret;
 +    double fpr = do_fmv_d_x(inp);
 +
 +    clear_fflags();
 +
 +    __asm__ __volatile__("fcvt.w.d %0, %1, rtz" : "=r"(ret) : "f"(fpr));
 +
 +    *fflags = get_fflags();
 +
 +    return ret;
 +}
 +
 +static inline uint64_t do_fcvtmod_w_d(uint64_t inp, uint8_t *fflags)
 +{
 +    uint64_t ret;
 +    double fpr = do_fmv_d_x(inp);
 +
 +    clear_fflags();
 +
 +    /* fcvtmod.w.d rd, rs1, rtz = 1100001 01000 rs1 001 rd 1010011 */
 +    asm(".insn r  0x53, 0x1, 0x61, %0, %1, f8" : "=r"(ret) : "f"(fpr));
 +
 +    *fflags = get_fflags();
 +
 +    return ret;
 +}
 +
 +static const fp64_fcvt_fcvtmod_testcase_t tests[] = {
 +    /* Zero (exp=0, frac=0) */
 +    { .name = "+0.0",
 +      .inp_lf = 0x0p0,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x0000000000000000,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "-0.0",
 +      .inp_lf = -0x0p0,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x0000000000000000,
 +      .exp_fcvtmod_fflags = 0 },
 +
 +    /* Subnormal: exp=0 frac!=0 */
 +    { .name = "Subnormal frac=1",
 +      .inp_lu = 0x0000000000000001,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "Subnormal frac=0xf..f",
 +      .inp_lu = 0x0000ffffffffffff,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "Neg subnormal frac=1",
 +      .inp_lu = 0x0000000000000001,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "Neg subnormal frac=0xf..f",
 +      .inp_lu = 0x8000ffffffffffff,
 +      .exp_fcvt = 0x0000000000000000,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    /* Infinity: exp=0x7ff, frac=0 */
 +    { .name = "+INF",
 +      .inp_lu = 0x7ff0000000000000,
 +      .exp_fcvt = 0x000000007fffffff, /* int32 max */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "-INF",
 +      .inp_lu = 0xfff0000000000000,
 +      .exp_fcvt = 0xffffffff80000000, /* int32 min */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +
 +    /* NaN: exp=7ff, frac!=0 */
 +    { .name = "canonical NaN",
 +      .inp_lu = 0x7ff8000000000000,
 +      .exp_fcvt = 0x000000007fffffff, /* int32 max */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "non-canonical NaN",
 +      .inp_lu = 0x7ff8000000100000,
 +      .exp_fcvt = 0x000000007fffffff, /* int32 min */
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +
 +    /* Normal numbers: exp!=0, exp!=7ff */
 +    { .name = "+smallest normal value",
 +      .inp_lu = 0x0010000000000000,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-smallest normal value",
 +      .inp_lu = 0x8010000000000000,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+0.5",
 +      .inp_lf = 0x1p-1,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-0.5",
 +      .inp_lf = -0x1p-1,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+value just below 1.0",
 +      .inp_lu = 0x3fefffffffffffff,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-value just above -1.0",
 +      .inp_lu = 0xbfefffffffffffff,
 +      .exp_fcvt = 0,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+1.0",
 +      .inp_lf = 0x1p0,
 +      .exp_fcvt = 0x0000000000000001,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x0000000000000001,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "-1.0",
 +      .inp_lf = -0x1p0,
 +      .exp_fcvt = 0xffffffffffffffff,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0xffffffffffffffff,
 +      .exp_fcvtmod_fflags = 0 },
 +
 +    { .name = "+1.5",
 +      .inp_lu = 0x3ff8000000000000,
 +      .exp_fcvt = 1,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 1,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +    { .name = "-1.5",
 +      .inp_lu = 0xbff8000000000000,
 +      .exp_fcvt = 0xffffffffffffffff,
 +      .exp_fcvt_fflags = FFLAG_NX,
 +      .exp_fcvtmod = 0xffffffffffffffff,
 +      .exp_fcvtmod_fflags = FFLAG_NX },
 +
 +    { .name = "+max int32 (2147483647)",
 +      .inp_lu = 0x41dfffffffc00000,
 +      .exp_fcvt = 0x000000007fffffff,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0x000000007fffffff,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "+max int32 +1 (2147483648)",
 +      .inp_lf = 0x1p31,
 +      .exp_fcvt = 0x000000007fffffff,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = (uint64_t)-2147483648l, /* int32 min */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "+max int32 +2 (2147483649)",
 +      .inp_lu = 0x41e0000000200000,
 +      .exp_fcvt = 0x000000007fffffff,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = (uint64_t)-2147483647l, /* int32 min +1 */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +
 +    { .name = "-max int32 (-2147483648)",
 +      .inp_lf = -0x1p31,
 +      .exp_fcvt = 0xffffffff80000000,
 +      .exp_fcvt_fflags = 0,
 +      .exp_fcvtmod = 0xffffffff80000000,
 +      .exp_fcvtmod_fflags = 0 },
 +    { .name = "-max int32 -1 (-2147483649)",
 +      .inp_lf = -0x1.00000002p+31,
 +      .exp_fcvt = 0xffffffff80000000,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 2147483647, /* int32 max */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +    { .name = "-max int32 -2 (-2147483650)",
 +      .inp_lf = -0x1.00000004p+31,
 +      .exp_fcvt = 0xffffffff80000000,
 +      .exp_fcvt_fflags = FFLAG_NV,
 +      .exp_fcvtmod = 2147483646, /* int32 max -1 */
 +      .exp_fcvtmod_fflags = FFLAG_NV },
 +};
 +
 +int run_fcvtmod_tests()
 +{
 +    uint64_t act_fcvt;
 +    uint8_t act_fcvt_fflags;
 +    uint64_t act_fcvtmod;
 +    uint8_t act_fcvtmod_fflags;
 +
 +    for (size_t i = 0; i < sizeof(tests)/sizeof(tests[0]); i++) {
 +        const fp64_fcvt_fcvtmod_testcase_t *t = &tests[i];
 +
 +        act_fcvt = do_fcvt_w_d(t->inp_lu, &act_fcvt_fflags);
 +        int fcvt_correct = act_fcvt == t->exp_fcvt &&
 +                    act_fcvt_fflags == t->exp_fcvt_fflags;
 +        act_fcvtmod = do_fcvtmod_w_d(t->inp_lu, &act_fcvtmod_fflags);
 +        int fcvtmod_correct = act_fcvtmod == t->exp_fcvtmod &&
 +                       act_fcvtmod_fflags == t->exp_fcvtmod_fflags;
 +
 +        if (fcvt_correct && fcvtmod_correct) {
 +            continue;
 +        }
 +
 +        printf("Test %zu (%s) failed!\n", i, t->name);
 +
 +        double fpr = do_fmv_d_x(t->inp_lu);
 +        printf("inp_lu: 0x%016lx == %lf\n", t->inp_lu, fpr);
 +        printf("inp_lf: %lf\n", t->inp_lf);
 +
 +        uint32_t sign = (t->inp_lu >> 63);
 +        uint32_t exp = (uint32_t)(t->inp_lu >> 52) & 0x7ff;
 +        uint64_t frac = t->inp_lu & 0xfffffffffffffull; /* significand */
 +        int true_exp = exp - 1023;
 +        int shift = true_exp - 52;
 +        uint64_t true_frac = frac | 1ull << 52;
 +
 +        printf("sign=%d, exp=0x%03x, frac=0x%012lx\n", sign, exp, frac);
 +        printf("true_exp=%d, shift=%d, true_frac=0x%016lx\n", true_exp, shift, true_frac);
 +
 +        if (!fcvt_correct) {
 +            printf("act_fcvt: 0x%016lx == %li\n", act_fcvt, act_fcvt);
 +            printf("exp_fcvt: 0x%016lx == %li\n", t->exp_fcvt, t->exp_fcvt);
 +            printf("act_fcvt_fflags: "); print_fflags(act_fcvt_fflags); printf("\n");
 +            printf("exp_fcvt_fflags: "); print_fflags(t->exp_fcvt_fflags); printf("\n");
 +        }
 +
 +        if (!fcvtmod_correct) {
 +            printf("act_fcvtmod: 0x%016lx == %li\n", act_fcvtmod, act_fcvtmod);
 +            printf("exp_fcvtmod: 0x%016lx == %li\n", t->exp_fcvtmod, t->exp_fcvtmod);
 +            printf("act_fcvtmod_fflags: "); print_fflags(act_fcvtmod_fflags); printf("\n");
 +            printf("exp_fcvtmod_fflags: "); print_fflags(t->exp_fcvtmod_fflags); printf("\n");
 +        }
 +
 +        return 1;
 +    }
 +
 +    return 0;
 +}
 +
 +int main()
 +{
 +    return run_fcvtmod_tests();
 +}
 diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
@@ -XXX,XX +XXX,XX @@
 +/*
 + * RISC-V translation routines for the Zfa Standard Extension.
 + *
 + * Copyright (c) 2023 Christoph Müllner, christoph.muellner@vrull.eu
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#define REQUIRE_ZFA(ctx) do {     \
 +    if (!ctx->cfg_ptr->ext_zfa) { \
 +        return false;             \
 +    }                             \
 +} while (0)
 +
 +#define REQUIRE_ZFH(ctx) do {     \
 +    if (!ctx->cfg_ptr->ext_zfh) { \
 +        return false;             \
 +    }                             \
 +} while (0)
 +
 +static bool trans_fli_s(DisasContext *ctx, arg_fli_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    /* Values below are NaN-boxed to avoid a gen_nanbox_s(). */
 +    static const uint64_t fli_s_table[] = {
 +        0xffffffffbf800000,  /* -1.0 */
 +        0xffffffff00800000,  /* minimum positive normal */
 +        0xffffffff37800000,  /* 1.0 * 2^-16 */
 +        0xffffffff38000000,  /* 1.0 * 2^-15 */
 +        0xffffffff3b800000,  /* 1.0 * 2^-8  */
 +        0xffffffff3c000000,  /* 1.0 * 2^-7  */
 +        0xffffffff3d800000,  /* 1.0 * 2^-4  */
 +        0xffffffff3e000000,  /* 1.0 * 2^-3  */
 +        0xffffffff3e800000,  /* 0.25 */
 +        0xffffffff3ea00000,  /* 0.3125 */
 +        0xffffffff3ec00000,  /* 0.375 */
 +        0xffffffff3ee00000,  /* 0.4375 */
 +        0xffffffff3f000000,  /* 0.5 */
 +        0xffffffff3f200000,  /* 0.625 */
 +        0xffffffff3f400000,  /* 0.75 */
 +        0xffffffff3f600000,  /* 0.875 */
 +        0xffffffff3f800000,  /* 1.0 */
 +        0xffffffff3fa00000,  /* 1.25 */
 +        0xffffffff3fc00000,  /* 1.5 */
 +        0xffffffff3fe00000,  /* 1.75 */
 +        0xffffffff40000000,  /* 2.0 */
 +        0xffffffff40200000,  /* 2.5 */
 +        0xffffffff40400000,  /* 3 */
 +        0xffffffff40800000,  /* 4 */
 +        0xffffffff41000000,  /* 8 */
 +        0xffffffff41800000,  /* 16 */
 +        0xffffffff43000000,  /* 2^7 */
 +        0xffffffff43800000,  /* 2^8 */
 +        0xffffffff47000000,  /* 2^15 */
 +        0xffffffff47800000,  /* 2^16 */
 +        0xffffffff7f800000,  /* +inf */
 +        0xffffffff7fc00000,  /* Canonical NaN */
 +    };
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    tcg_gen_movi_i64(dest, fli_s_table[a->rs1]);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fli_d(DisasContext *ctx, arg_fli_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    static const uint64_t fli_d_table[] = {
 +        0xbff0000000000000,  /* -1.0 */
 +        0x0010000000000000,  /* minimum positive normal */
 +        0x3ef0000000000000,  /* 1.0 * 2^-16 */
 +        0x3f00000000000000,  /* 1.0 * 2^-15 */
 +        0x3f70000000000000,  /* 1.0 * 2^-8  */
 +        0x3f80000000000000,  /* 1.0 * 2^-7  */
 +        0x3fb0000000000000,  /* 1.0 * 2^-4  */
 +        0x3fc0000000000000,  /* 1.0 * 2^-3  */
 +        0x3fd0000000000000,  /* 0.25 */
 +        0x3fd4000000000000,  /* 0.3125 */
 +        0x3fd8000000000000,  /* 0.375 */
 +        0x3fdc000000000000,  /* 0.4375 */
 +        0x3fe0000000000000,  /* 0.5 */
 +        0x3fe4000000000000,  /* 0.625 */
 +        0x3fe8000000000000,  /* 0.75 */
 +        0x3fec000000000000,  /* 0.875 */
 +        0x3ff0000000000000,  /* 1.0 */
 +        0x3ff4000000000000,  /* 1.25 */
 +        0x3ff8000000000000,  /* 1.5 */
 +        0x3ffc000000000000,  /* 1.75 */
 +        0x4000000000000000,  /* 2.0 */
 +        0x4004000000000000,  /* 2.5 */
 +        0x4008000000000000,  /* 3 */
 +        0x4010000000000000,  /* 4 */
 +        0x4020000000000000,  /* 8 */
 +        0x4030000000000000,  /* 16 */
 +        0x4060000000000000,  /* 2^7 */
 +        0x4070000000000000,  /* 2^8 */
 +        0x40e0000000000000,  /* 2^15 */
 +        0x40f0000000000000,  /* 2^16 */
 +        0x7ff0000000000000,  /* +inf */
 +        0x7ff8000000000000,  /* Canonical NaN */
 +    };
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    tcg_gen_movi_i64(dest, fli_d_table[a->rs1]);
 +    gen_set_fpr_d(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fli_h(DisasContext *ctx, arg_fli_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    /* Values below are NaN-boxed to avoid a gen_nanbox_h(). */
 +    static const uint64_t fli_h_table[] = {
 +        0xffffffffffffbc00,  /* -1.0 */
 +        0xffffffffffff0400,  /* minimum positive normal */
 +        0xffffffffffff0100,  /* 1.0 * 2^-16 */
 +        0xffffffffffff0200,  /* 1.0 * 2^-15 */
 +        0xffffffffffff1c00,  /* 1.0 * 2^-8  */
 +        0xffffffffffff2000,  /* 1.0 * 2^-7  */
 +        0xffffffffffff2c00,  /* 1.0 * 2^-4  */
 +        0xffffffffffff3000,  /* 1.0 * 2^-3  */
 +        0xffffffffffff3400,  /* 0.25 */
 +        0xffffffffffff3500,  /* 0.3125 */
 +        0xffffffffffff3600,  /* 0.375 */
 +        0xffffffffffff3700,  /* 0.4375 */
 +        0xffffffffffff3800,  /* 0.5 */
 +        0xffffffffffff3900,  /* 0.625 */
 +        0xffffffffffff3a00,  /* 0.75 */
 +        0xffffffffffff3b00,  /* 0.875 */
 +        0xffffffffffff3c00,  /* 1.0 */
 +        0xffffffffffff3d00,  /* 1.25 */
 +        0xffffffffffff3e00,  /* 1.5 */
 +        0xffffffffffff3f00,  /* 1.75 */
 +        0xffffffffffff4000,  /* 2.0 */
 +        0xffffffffffff4100,  /* 2.5 */
 +        0xffffffffffff4200,  /* 3 */
 +        0xffffffffffff4400,  /* 4 */
 +        0xffffffffffff4800,  /* 8 */
 +        0xffffffffffff4c00,  /* 16 */
 +        0xffffffffffff5800,  /* 2^7 */
 +        0xffffffffffff5c00,  /* 2^8 */
 +        0xffffffffffff7800,  /* 2^15 */
 +        0xffffffffffff7c00,  /* 2^16 */
 +        0xffffffffffff7c00,  /* +inf */
 +        0xffffffffffff7e00,  /* Canonical NaN */
 +    };
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    tcg_gen_movi_i64(dest, fli_h_table[a->rs1]);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fminm_s(DisasContext *ctx, arg_fminm_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fminm_s(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fmaxm_s(DisasContext *ctx, arg_fmaxm_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fmaxm_s(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fminm_d(DisasContext *ctx, arg_fminm_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +
 +    gen_helper_fminm_d(dest, cpu_env, src1, src2);
 +    gen_set_fpr_d(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fmaxm_d(DisasContext *ctx, arg_fmaxm_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +
 +    gen_helper_fmaxm_d(dest, cpu_env, src1, src2);
 +    gen_set_fpr_d(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fminm_h(DisasContext *ctx, arg_fminm_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fminm_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fmaxm_h(DisasContext *ctx, arg_fmaxm_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fmaxm_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fround_s(DisasContext *ctx, arg_fround_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fround_s(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_froundnx_s(DisasContext *ctx, arg_froundnx_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_froundnx_s(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fround_d(DisasContext *ctx, arg_fround_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fround_d(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_froundnx_d(DisasContext *ctx, arg_froundnx_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_froundnx_d(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_fround_h(DisasContext *ctx, arg_fround_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fround_h(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +static bool trans_froundnx_h(DisasContext *ctx, arg_froundnx_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_froundnx_h(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +bool trans_fcvtmod_w_d(DisasContext *ctx, arg_fcvtmod_w_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv dst = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 t1 = tcg_temp_new_i64();
 +
 +    /* Rounding mode is RTZ. */
 +    gen_set_rm(ctx, RISCV_FRM_RTZ);
 +    gen_helper_fcvtmod_w_d(t1, cpu_env, src1);
 +    tcg_gen_trunc_i64_tl(dst, t1);
 +    gen_set_gpr(ctx, a->rd, dst);
 +
 +    return true;
 +}
 +
 +bool trans_fmvh_x_d(DisasContext *ctx, arg_fmvh_x_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_32BIT(ctx);
 +
 +    TCGv dst = dest_gpr(ctx, a->rd);
 +    TCGv_i64 t1 = tcg_temp_new_i64();
 +    tcg_gen_sari_i64(t1, cpu_fpr[a->rs1], 32);
 +    tcg_gen_trunc_i64_tl(dst, t1);
 +    gen_set_gpr(ctx, a->rd, dst);
 +    return true;
 +}
 +
 +bool trans_fmvp_d_x(DisasContext *ctx, arg_fmvp_d_x *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_32BIT(ctx);
 +
 +    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
 +    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
 +    tcg_gen_concat_tl_i64(cpu_fpr[a->rd], src1, src2);
 +
 +    mark_fs_dirty(ctx);
 +    return true;
 +}
 +
 +bool trans_fleq_s(DisasContext *ctx, arg_fleq_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fleq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fltq_s(DisasContext *ctx, arg_fltq_s *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVF);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_EXT(ctx, RVD);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_s(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fleq_h(DisasContext *ctx, arg_fleq_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fleq_h(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 +
 +bool trans_fltq_h(DisasContext *ctx, arg_fltq_h *a)
 +{
 +    REQUIRE_FPU;
 +    REQUIRE_ZFA(ctx);
 +    REQUIRE_ZFH(ctx);
 +
 +    TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fltq_h(dest, cpu_env, src1, src2);
 +    gen_set_gpr(ctx, a->rd, dest);
 +    return true;
 +}
 diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/riscv64/Makefile.target
 +++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-test-noc: QEMU_OPTS += -cpu rv64,c=false
  TESTS += test-aes
  run-test-aes: QEMU_OPTS += -cpu rv64,zk=on
 +
 +# Test for fcvtmod
 +TESTS += test-fcvtmod
 +test-fcvtmod: CFLAGS += -march=rv64imafdc
 +test-fcvtmod: LDFLAGS += -static
 +run-test-fcvtmod: QEMU_OPTS += -cpu rv64,d=true,Zfa=true
 --
-.28.0
+.40.1

The following changes since commit 9435a8b3dd35f1f926f1b9127e8a906217a5518a:

Merge remote-tracking branch 'remotes/kraxel/tags/sirius/ipxe-20200908-pull-request' into staging (2020-09-08 21:21:13 +0100)

are available in the Git repository at:

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20200910

for you to fetch changes up to 7595a65818ea9b49c36650a8c217a1ef9bd6e62a:

hw/riscv: Sort the Kconfig options in alphabetical order (2020-09-09 15:54:19 -0700)

----------------------------------------------------------------
This PR includes multiple fixes and features for RISC-V:
 - Fixes a bug in printing trap causes
 - Allows 16-bit writes to the SiFive test device. This fixes the
   failure to reboot the RISC-V virt machine
 - Support for the Microchip PolarFire SoC and Icicle Kit
 - A reafactor of RISC-V code out of hw/riscv

----------------------------------------------------------------
Bin Meng (28):
      target/riscv: cpu: Add a new 'resetvec' property
      hw/riscv: hart: Add a new 'resetvec' property
      target/riscv: cpu: Set reset vector based on the configured property value
      hw/riscv: Initial support for Microchip PolarFire SoC Icicle Kit board
      hw/char: Add Microchip PolarFire SoC MMUART emulation
      hw/riscv: microchip_pfsoc: Connect 5 MMUARTs
      hw/sd: Add Cadence SDHCI emulation
      hw/riscv: microchip_pfsoc: Connect a Cadence SDHCI controller and an SD card
      hw/dma: Add SiFive platform DMA controller emulation
      hw/riscv: microchip_pfsoc: Connect a DMA controller
      hw/net: cadence_gem: Add a new 'phy-addr' property
      hw/arm: xlnx: Set all boards' GEM 'phy-addr' property value to 23
      hw/riscv: microchip_pfsoc: Connect 2 Cadence GEMs
      hw/riscv: microchip_pfsoc: Hook GPIO controllers
      hw/riscv: clint: Avoid using hard-coded timebase frequency
      hw/riscv: sifive_u: Connect a DMA controller
      hw/riscv: Move sifive_e_prci model to hw/misc
      hw/riscv: Move sifive_u_prci model to hw/misc
      hw/riscv: Move sifive_u_otp model to hw/misc
      hw/riscv: Move sifive_gpio model to hw/gpio
      hw/riscv: Move sifive_clint model to hw/intc
      hw/riscv: Move sifive_plic model to hw/intc
      hw/riscv: Move riscv_htif model to hw/char
      hw/riscv: Move sifive_uart model to hw/char
      hw/riscv: Move sifive_test model to hw/misc
      hw/riscv: Always build riscv_hart.c
      hw/riscv: Drop CONFIG_SIFIVE
      hw/riscv: Sort the Kconfig options in alphabetical order

Nathan Chancellor (1):
      riscv: sifive_test: Allow 16-bit writes to memory region

Yifei Jiang (1):
      target/riscv: Fix bug in getting trap cause name for trace_riscv_trap

default-configs/riscv64-softmmu.mak         |   1 +
 {include/hw/riscv => hw/intc}/sifive_plic.h |   0
 hw/riscv/trace.h                            |   1 -
 include/hw/char/mchp_pfsoc_mmuart.h         |  61 ++++
 include/hw/{riscv => char}/riscv_htif.h     |   0
 include/hw/{riscv => char}/sifive_uart.h    |   0
 include/hw/dma/sifive_pdma.h                |  57 ++++
 include/hw/{riscv => gpio}/sifive_gpio.h    |   0
 include/hw/{riscv => intc}/sifive_clint.h   |   4 +-
 include/hw/{riscv => misc}/sifive_e_prci.h  |   0
 include/hw/{riscv => misc}/sifive_test.h    |   0
 include/hw/{riscv => misc}/sifive_u_otp.h   |   0
 include/hw/{riscv => misc}/sifive_u_prci.h  |   0
 include/hw/net/cadence_gem.h                |   2 +
 include/hw/riscv/microchip_pfsoc.h          | 133 +++++++++
 include/hw/riscv/riscv_hart.h               |   1 +
 include/hw/riscv/sifive_e.h                 |   2 +-
 include/hw/riscv/sifive_u.h                 |  17 +-
 include/hw/sd/cadence_sdhci.h               |  47 +++
 target/riscv/cpu.h                          |   8 +-
 hw/arm/xilinx_zynq.c                        |   1 +
 hw/arm/xlnx-versal.c                        |   1 +
 hw/arm/xlnx-zynqmp.c                        |   2 +
 hw/char/mchp_pfsoc_mmuart.c                 |  86 ++++++
 hw/{riscv => char}/riscv_htif.c             |   2 +-
 hw/{riscv => char}/sifive_uart.c            |   2 +-
 hw/dma/sifive_pdma.c                        | 313 ++++++++++++++++++++
 hw/{riscv => gpio}/sifive_gpio.c            |   2 +-
 hw/{riscv => intc}/sifive_clint.c           |  28 +-
 hw/{riscv => intc}/sifive_plic.c            |   2 +-
 hw/{riscv => misc}/sifive_e_prci.c          |   2 +-
 hw/{riscv => misc}/sifive_test.c            |   4 +-
 hw/{riscv => misc}/sifive_u_otp.c           |   2 +-
 hw/{riscv => misc}/sifive_u_prci.c          |   2 +-
 hw/net/cadence_gem.c                        |   7 +-
 hw/riscv/microchip_pfsoc.c                  | 437 ++++++++++++++++++++++++++++
 hw/riscv/opentitan.c                        |   1 +
 hw/riscv/riscv_hart.c                       |   3 +
 hw/riscv/sifive_e.c                         |  12 +-
 hw/riscv/sifive_u.c                         |  41 ++-
 hw/riscv/spike.c                            |   7 +-
 hw/riscv/virt.c                             |   9 +-
 hw/sd/cadence_sdhci.c                       | 193 ++++++++++++
 target/riscv/cpu.c                          |  19 +-
 target/riscv/cpu_helper.c                   |   8 +-
 target/riscv/csr.c                          |   4 +-
 MAINTAINERS                                 |   9 +
 hw/char/Kconfig                             |   9 +
 hw/char/meson.build                         |   3 +
 hw/dma/Kconfig                              |   3 +
 hw/dma/meson.build                          |   1 +
 hw/gpio/Kconfig                             |   3 +
 hw/gpio/meson.build                         |   1 +
 hw/gpio/trace-events                        |   6 +
 hw/intc/Kconfig                             |   6 +
 hw/intc/meson.build                         |   2 +
 hw/misc/Kconfig                             |  12 +
 hw/misc/meson.build                         |   6 +
 hw/riscv/Kconfig                            |  70 +++--
 hw/riscv/meson.build                        |  12 +-
 hw/riscv/trace-events                       |   7 -
 hw/sd/Kconfig                               |   4 +
 hw/sd/meson.build                           |   1 +
 meson.build                                 |   1 -
 64 files changed, 1575 insertions(+), 105 deletions(-)
 rename {include/hw/riscv => hw/intc}/sifive_plic.h (100%)
 delete mode 100644 hw/riscv/trace.h
 create mode 100644 include/hw/char/mchp_pfsoc_mmuart.h
 rename include/hw/{riscv => char}/riscv_htif.h (100%)
 rename include/hw/{riscv => char}/sifive_uart.h (100%)
 create mode 100644 include/hw/dma/sifive_pdma.h
 rename include/hw/{riscv => gpio}/sifive_gpio.h (100%)
 rename include/hw/{riscv => intc}/sifive_clint.h (92%)
 rename include/hw/{riscv => misc}/sifive_e_prci.h (100%)
 rename include/hw/{riscv => misc}/sifive_test.h (100%)
 rename include/hw/{riscv => misc}/sifive_u_otp.h (100%)
 rename include/hw/{riscv => misc}/sifive_u_prci.h (100%)
 create mode 100644 include/hw/riscv/microchip_pfsoc.h
 create mode 100644 include/hw/sd/cadence_sdhci.h
 create mode 100644 hw/char/mchp_pfsoc_mmuart.c
 rename hw/{riscv => char}/riscv_htif.c (99%)
 rename hw/{riscv => char}/sifive_uart.c (99%)
 create mode 100644 hw/dma/sifive_pdma.c
 rename hw/{riscv => gpio}/sifive_gpio.c (99%)
 rename hw/{riscv => intc}/sifive_clint.c (90%)
 rename hw/{riscv => intc}/sifive_plic.c (99%)
 rename hw/{riscv => misc}/sifive_e_prci.c (99%)
 rename hw/{riscv => misc}/sifive_test.c (97%)
 rename hw/{riscv => misc}/sifive_u_otp.c (99%)
 rename hw/{riscv => misc}/sifive_u_prci.c (99%)
 create mode 100644 hw/riscv/microchip_pfsoc.c
 create mode 100644 hw/sd/cadence_sdhci.c
 delete mode 100644 hw/riscv/trace-events

From: Yifei Jiang <jiangyifei@huawei.com>

When the cause number is equal to or greater than 23, print "(unknown)" in
trace_riscv_trap. The max valid number of riscv_excp_names is 23, so the last
excpetion "guest_store_page_fault" can not be printed.

In addition, the current check of cause is invalid for riscv_intr_names. So
introduce riscv_cpu_get_trap_name to get the trap cause name.

Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
Signed-off-by: Yipeng Yin <yinyipeng1@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20200814035819.1214-1-jiangyifei@huawei.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  1 +
 target/riscv/cpu.c        | 11 +++++++++++
 target/riscv/cpu_helper.c |  4 ++--
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ extern const char * const riscv_fpr_regnames[];
 extern const char * const riscv_excp_names[];
 extern const char * const riscv_intr_names[];
 
+const char *riscv_cpu_get_trap_name(target_ulong cause, bool async);
 void riscv_cpu_do_interrupt(CPUState *cpu);
 int riscv_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int riscv_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const char * const riscv_intr_names[] = {
     "reserved"
 };
 
+const char *riscv_cpu_get_trap_name(target_ulong cause, bool async)
+{
+    if (async) {
+        return (cause < ARRAY_SIZE(riscv_intr_names)) ?
+               riscv_intr_names[cause] : "(unknown)";
+    } else {
+        return (cause < ARRAY_SIZE(riscv_excp_names)) ?
+               riscv_excp_names[cause] : "(unknown)";
+    }
+}
+
 static void set_misa(CPURISCVState *env, target_ulong misa)
 {
     env->misa_mask = env->misa = misa;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         }
     }
 
-    trace_riscv_trap(env->mhartid, async, cause, env->pc, tval, cause < 23 ?
-        (async ? riscv_intr_names : riscv_excp_names)[cause] : "(unknown)");
+    trace_riscv_trap(env->mhartid, async, cause, env->pc, tval,
+        riscv_cpu_get_trap_name(cause, async));
 
     if (env->priv <= PRV_S &&
             cause < TARGET_LONG_BITS && ((deleg >> cause) & 1)) {
-- 
2.28.0

From: Nathan Chancellor <natechancellor@gmail.com>

When shutting down the machine running a mainline Linux kernel, the
following error happens:

$ build/riscv64-softmmu/qemu-system-riscv64 -bios default -M virt \
    -display none -initrd rootfs.cpio -kernel Image -m 512m \
    -nodefaults -serial mon:stdio
...
Requesting system poweroff
[    4.999630] reboot: Power down
sbi_trap_error: hart0: trap handler failed (error -2)
sbi_trap_error: hart0: mcause=0x0000000000000007 mtval=0x0000000000100000
sbi_trap_error: hart0: mepc=0x000000008000d4cc mstatus=0x0000000000001822
sbi_trap_error: hart0: ra=0x000000008000999e sp=0x0000000080015c78
sbi_trap_error: hart0: gp=0xffffffe000e76610 tp=0xffffffe0081b89c0
sbi_trap_error: hart0: s0=0x0000000080015c88 s1=0x0000000000000040
sbi_trap_error: hart0: a0=0x0000000000000000 a1=0x0000000080004024
sbi_trap_error: hart0: a2=0x0000000080004024 a3=0x0000000080004024
sbi_trap_error: hart0: a4=0x0000000000100000 a5=0x0000000000005555
sbi_trap_error: hart0: a6=0x0000000000004024 a7=0x0000000080011158
sbi_trap_error: hart0: s2=0x0000000000000000 s3=0x0000000080016000
sbi_trap_error: hart0: s4=0x0000000000000000 s5=0x0000000000000000
sbi_trap_error: hart0: s6=0x0000000000000001 s7=0x0000000000000000
sbi_trap_error: hart0: s8=0x0000000000000000 s9=0x0000000000000000
sbi_trap_error: hart0: s10=0x0000000000000000 s11=0x0000000000000008
sbi_trap_error: hart0: t0=0x0000000000000000 t1=0x0000000000000000
sbi_trap_error: hart0: t2=0x0000000000000000 t3=0x0000000000000000
sbi_trap_error: hart0: t4=0x0000000000000000 t5=0x0000000000000000
sbi_trap_error: hart0: t6=0x0000000000000000

The kernel does a 16-bit write when powering off the machine, which
was allowed before commit 5d971f9e67 ("memory: Revert "memory: accept
mismatching sizes in memory_region_access_valid""). Make min_access_size
match reality so that the machine can shut down properly now.

Cc: qemu-stable@nongnu.org
Fixes: 88a07990fa ("SiFive RISC-V Test Finisher")
Fixes: 5d971f9e67 ("memory: Revert "memory: accept mismatching sizes in memory_region_access_valid"")
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20200901055822.2721209-1-natechancellor@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/sifive_test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/sifive_test.c b/hw/riscv/sifive_test.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_test.c
+++ b/hw/riscv/sifive_test.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps sifive_test_ops = {
     .write = sifive_test_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
     .valid = {
-        .min_access_size = 4,
+        .min_access_size = 2,
         .max_access_size = 4
     }
 };
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

Currently the reset vector address is hard-coded in a RISC-V CPU's
instance_init() routine. In a real world we can have 2 exact same
CPUs except for the reset vector address, which is pretty common in
the RISC-V core IP licensing business.

Normally reset vector address is a configurable parameter. Let's
create a 64-bit property to store the reset vector address which
covers both 32-bit and 64-bit CPUs.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <1598924352-89526-2-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 1 +
 target/riscv/cpu.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVCPU {
         uint16_t elen;
         bool mmu;
         bool pmp;
+        uint64_t resetvec;
     } cfg;
 } RISCVCPU;
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
     DEFINE_PROP_BOOL("mmu", RISCVCPU, cfg.mmu, true),
     DEFINE_PROP_BOOL("pmp", RISCVCPU, cfg.pmp, true),
+    DEFINE_PROP_UINT64("resetvec", RISCVCPU, cfg.resetvec, DEFAULT_RSTVEC),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

RISC-V machines do not instantiate RISC-V CPUs directly, instead
they do that via the hart array. Add a new property for the reset
vector address to allow the value to be passed to the CPU, before
CPU is realized.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <1598924352-89526-3-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/riscv_hart.h | 1 +
 hw/riscv/riscv_hart.c         | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/include/hw/riscv/riscv_hart.h b/include/hw/riscv/riscv_hart.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/riscv_hart.h
+++ b/include/hw/riscv/riscv_hart.h
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVHartArrayState {
     uint32_t num_harts;
     uint32_t hartid_base;
     char *cpu_type;
+    uint64_t resetvec;
     RISCVCPU *harts;
 } RISCVHartArrayState;
 
diff --git a/hw/riscv/riscv_hart.c b/hw/riscv/riscv_hart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv_hart.c
+++ b/hw/riscv/riscv_hart.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_harts_props[] = {
     DEFINE_PROP_UINT32("num-harts", RISCVHartArrayState, num_harts, 1),
     DEFINE_PROP_UINT32("hartid-base", RISCVHartArrayState, hartid_base, 0),
     DEFINE_PROP_STRING("cpu-type", RISCVHartArrayState, cpu_type),
+    DEFINE_PROP_UINT64("resetvec", RISCVHartArrayState, resetvec,
+                       DEFAULT_RSTVEC),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -XXX,XX +XXX,XX @@ static bool riscv_hart_realize(RISCVHartArrayState *s, int idx,
                                char *cpu_type, Error **errp)
 {
     object_initialize_child(OBJECT(s), "harts[*]", &s->harts[idx], cpu_type);
+    qdev_prop_set_uint64(DEVICE(&s->harts[idx]), "resetvec", s->resetvec);
     s->harts[idx].env.mhartid = s->hartid_base + idx;
     qemu_register_reset(riscv_harts_cpu_reset, &s->harts[idx]);
     return qdev_realize(DEVICE(&s->harts[idx]), NULL, errp);
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

Now that we have the newly introduced 'resetvec' property in the
RISC-V CPU and HART, instead of hard-coding the reset vector addr
in the CPU's instance_init(), move that to riscv_cpu_realize()
based on the configured property value from the RISC-V machines.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <1598924352-89526-4-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/opentitan.c | 1 +
 hw/riscv/sifive_e.c  | 1 +
 hw/riscv/sifive_u.c  | 2 ++
 target/riscv/cpu.c   | 7 ++-----
 4 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
                             &error_abort);
     object_property_set_int(OBJECT(&s->cpus), "num-harts", ms->smp.cpus,
                             &error_abort);
+    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x8090, &error_abort);
     sysbus_realize(SYS_BUS_DEVICE(&s->cpus), &error_abort);
 
     /* Boot ROM */
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_init(Object *obj)
     object_initialize_child(obj, "cpus", &s->cpus, TYPE_RISCV_HART_ARRAY);
     object_property_set_int(OBJECT(&s->cpus), "num-harts", ms->smp.cpus,
                             &error_abort);
+    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x1004, &error_abort);
     object_initialize_child(obj, "riscv.sifive.e.gpio0", &s->gpio,
                             TYPE_SIFIVE_GPIO);
 }
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_instance_init(Object *obj)
     qdev_prop_set_uint32(DEVICE(&s->e_cpus), "num-harts", 1);
     qdev_prop_set_uint32(DEVICE(&s->e_cpus), "hartid-base", 0);
     qdev_prop_set_string(DEVICE(&s->e_cpus), "cpu-type", SIFIVE_E_CPU);
+    qdev_prop_set_uint64(DEVICE(&s->e_cpus), "resetvec", 0x1004);
 
     object_initialize_child(obj, "u-cluster", &s->u_cluster, TYPE_CPU_CLUSTER);
     qdev_prop_set_uint32(DEVICE(&s->u_cluster), "cluster-id", 1);
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_instance_init(Object *obj)
     qdev_prop_set_uint32(DEVICE(&s->u_cpus), "num-harts", ms->smp.cpus - 1);
     qdev_prop_set_uint32(DEVICE(&s->u_cpus), "hartid-base", 1);
     qdev_prop_set_string(DEVICE(&s->u_cpus), "cpu-type", SIFIVE_U_CPU);
+    qdev_prop_set_uint64(DEVICE(&s->u_cpus), "resetvec", 0x1004);
 
     object_initialize_child(obj, "prci", &s->prci, TYPE_SIFIVE_U_PRCI);
     object_initialize_child(obj, "otp", &s->otp, TYPE_SIFIVE_U_OTP);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_any_cpu_init(Object *obj)
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     set_misa(env, RVXLEN | RVI | RVM | RVA | RVF | RVD | RVC | RVU);
     set_priv_version(env, PRIV_VERSION_1_11_0);
-    set_resetvec(env, DEFAULT_RSTVEC);
 }
 
 static void riscv_base_cpu_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_base_cpu_init(Object *obj)
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     /* We set this in the realise function */
     set_misa(env, 0);
-    set_resetvec(env, DEFAULT_RSTVEC);
 }
 
 static void rvxx_sifive_u_cpu_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void rvxx_sifive_u_cpu_init(Object *obj)
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     set_misa(env, RVXLEN | RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
     set_priv_version(env, PRIV_VERSION_1_10_0);
-    set_resetvec(env, 0x1004);
 }
 
 static void rvxx_sifive_e_cpu_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void rvxx_sifive_e_cpu_init(Object *obj)
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     set_misa(env, RVXLEN | RVI | RVM | RVA | RVC | RVU);
     set_priv_version(env, PRIV_VERSION_1_10_0);
-    set_resetvec(env, 0x1004);
     qdev_prop_set_bit(DEVICE(obj), "mmu", false);
 }
 
@@ -XXX,XX +XXX,XX @@ static void rv32_ibex_cpu_init(Object *obj)
     CPURISCVState *env = &RISCV_CPU(obj)->env;
     set_misa(env, RV32 | RVI | RVM | RVC | RVU);
     set_priv_version(env, PRIV_VERSION_1_10_0);
-    set_resetvec(env, 0x8090);
     qdev_prop_set_bit(DEVICE(obj), "mmu", false);
 }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         set_feature(env, RISCV_FEATURE_PMP);
     }
 
+    set_resetvec(env, cpu->cfg.resetvec);
+
     /* If misa isn't set (rv32 and rv64 machines) set it here */
     if (!env->misa) {
         /* Do some ISA extension error checking */
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

This is an initial support for Microchip PolarFire SoC Icicle Kit.
The Icicle Kit board integrates a PolarFire SoC, with one SiFive's
E51 plus four U54 cores and many on-chip peripherals and an FPGA.

For more details about Microchip PolarFire Soc, please see:
https://www.microsemi.com/product-directory/soc-fpgas/5498-polarfire-soc-fpga

Unlike SiFive FU540, the RISC-V core resect vector is at 0x20220000.
The following perepherals are created as an unimplemented device:

- Bus Error Uint 0/1/2/3/4
- L2 cache controller
- SYSREG
- MPUCFG
- IOSCBCFG

More devices will be added later.

The BIOS image used by this machine is hss.bin, aka Hart Software
Services, which can be built from:
https://github.com/polarfire-soc/hart-software-services

To launch this machine:
$ qemu-system-riscv64 -nographic -M microchip-icicle-kit

The memory is set to 1 GiB by default to match the hardware.
A sanity check on ram size is performed in the machine init routine
to prompt user to increase the RAM size to > 1 GiB when less than
1 GiB ram is detected.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1598924352-89526-5-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 default-configs/riscv64-softmmu.mak |   1 +
 include/hw/riscv/microchip_pfsoc.h  |  88 ++++++++
 hw/riscv/microchip_pfsoc.c          | 312 ++++++++++++++++++++++++++++
 MAINTAINERS                         |   7 +
 hw/riscv/Kconfig                    |   6 +
 hw/riscv/meson.build                |   1 +
 6 files changed, 415 insertions(+)
 create mode 100644 include/hw/riscv/microchip_pfsoc.h
 create mode 100644 hw/riscv/microchip_pfsoc.c

diff --git a/default-configs/riscv64-softmmu.mak b/default-configs/riscv64-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/riscv64-softmmu.mak
+++ b/default-configs/riscv64-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_SPIKE=y
 CONFIG_SIFIVE_E=y
 CONFIG_SIFIVE_U=y
 CONFIG_RISCV_VIRT=y
+CONFIG_MICROCHIP_PFSOC=y
diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Microchip PolarFire SoC machine interface
+ *
+ * Copyright (c) 2020 Wind River Systems, Inc.
+ *
+ * Author:
+ *   Bin Meng <bin.meng@windriver.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_MICROCHIP_PFSOC_H
+#define HW_MICROCHIP_PFSOC_H
+
+typedef struct MicrochipPFSoCState {
+    /*< private >*/
+    DeviceState parent_obj;
+
+    /*< public >*/
+    CPUClusterState e_cluster;
+    CPUClusterState u_cluster;
+    RISCVHartArrayState e_cpus;
+    RISCVHartArrayState u_cpus;
+    DeviceState *plic;
+} MicrochipPFSoCState;
+
+#define TYPE_MICROCHIP_PFSOC    "microchip.pfsoc"
+#define MICROCHIP_PFSOC(obj) \
+    OBJECT_CHECK(MicrochipPFSoCState, (obj), TYPE_MICROCHIP_PFSOC)
+
+typedef struct MicrochipIcicleKitState {
+    /*< private >*/
+    MachineState parent_obj;
+
+    /*< public >*/
+    MicrochipPFSoCState soc;
+} MicrochipIcicleKitState;
+
+#define TYPE_MICROCHIP_ICICLE_KIT_MACHINE \
+    MACHINE_TYPE_NAME("microchip-icicle-kit")
+#define MICROCHIP_ICICLE_KIT_MACHINE(obj) \
+    OBJECT_CHECK(MicrochipIcicleKitState, (obj), \
+                 TYPE_MICROCHIP_ICICLE_KIT_MACHINE)
+
+enum {
+    MICROCHIP_PFSOC_DEBUG,
+    MICROCHIP_PFSOC_E51_DTIM,
+    MICROCHIP_PFSOC_BUSERR_UNIT0,
+    MICROCHIP_PFSOC_BUSERR_UNIT1,
+    MICROCHIP_PFSOC_BUSERR_UNIT2,
+    MICROCHIP_PFSOC_BUSERR_UNIT3,
+    MICROCHIP_PFSOC_BUSERR_UNIT4,
+    MICROCHIP_PFSOC_CLINT,
+    MICROCHIP_PFSOC_L2CC,
+    MICROCHIP_PFSOC_L2LIM,
+    MICROCHIP_PFSOC_PLIC,
+    MICROCHIP_PFSOC_SYSREG,
+    MICROCHIP_PFSOC_MPUCFG,
+    MICROCHIP_PFSOC_ENVM_CFG,
+    MICROCHIP_PFSOC_ENVM_DATA,
+    MICROCHIP_PFSOC_IOSCB_CFG,
+    MICROCHIP_PFSOC_DRAM,
+};
+
+#define MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT    1
+#define MICROCHIP_PFSOC_COMPUTE_CPU_COUNT       4
+
+#define MICROCHIP_PFSOC_PLIC_HART_CONFIG        "MS"
+#define MICROCHIP_PFSOC_PLIC_NUM_SOURCES        185
+#define MICROCHIP_PFSOC_PLIC_NUM_PRIORITIES     7
+#define MICROCHIP_PFSOC_PLIC_PRIORITY_BASE      0x04
+#define MICROCHIP_PFSOC_PLIC_PENDING_BASE       0x1000
+#define MICROCHIP_PFSOC_PLIC_ENABLE_BASE        0x2000
+#define MICROCHIP_PFSOC_PLIC_ENABLE_STRIDE      0x80
+#define MICROCHIP_PFSOC_PLIC_CONTEXT_BASE       0x200000
+#define MICROCHIP_PFSOC_PLIC_CONTEXT_STRIDE     0x1000
+
+#endif /* HW_MICROCHIP_PFSOC_H */
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU RISC-V Board Compatible with Microchip PolarFire SoC Icicle Kit
+ *
+ * Copyright (c) 2020 Wind River Systems, Inc.
+ *
+ * Author:
+ *   Bin Meng <bin.meng@windriver.com>
+ *
+ * Provides a board compatible with the Microchip PolarFire SoC Icicle Kit
+ *
+ * 0) CLINT (Core Level Interruptor)
+ * 1) PLIC (Platform Level Interrupt Controller)
+ * 2) eNVM (Embedded Non-Volatile Memory)
+ *
+ * This board currently generates devicetree dynamically that indicates at least
+ * two harts and up to five harts.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "qemu/log.h"
+#include "qemu/units.h"
+#include "qemu/cutils.h"
+#include "qapi/error.h"
+#include "hw/boards.h"
+#include "hw/irq.h"
+#include "hw/loader.h"
+#include "hw/sysbus.h"
+#include "hw/cpu/cluster.h"
+#include "target/riscv/cpu.h"
+#include "hw/misc/unimp.h"
+#include "hw/riscv/boot.h"
+#include "hw/riscv/riscv_hart.h"
+#include "hw/riscv/sifive_clint.h"
+#include "hw/riscv/sifive_plic.h"
+#include "hw/riscv/microchip_pfsoc.h"
+
+/*
+ * The BIOS image used by this machine is called Hart Software Services (HSS).
+ * See https://github.com/polarfire-soc/hart-software-services
+ */
+#define BIOS_FILENAME   "hss.bin"
+#define RESET_VECTOR    0x20220000
+
+static const struct MemmapEntry {
+    hwaddr base;
+    hwaddr size;
+} microchip_pfsoc_memmap[] = {
+    [MICROCHIP_PFSOC_DEBUG] =           {        0x0,     0x1000 },
+    [MICROCHIP_PFSOC_E51_DTIM] =        {  0x1000000,     0x2000 },
+    [MICROCHIP_PFSOC_BUSERR_UNIT0] =    {  0x1700000,     0x1000 },
+    [MICROCHIP_PFSOC_BUSERR_UNIT1] =    {  0x1701000,     0x1000 },
+    [MICROCHIP_PFSOC_BUSERR_UNIT2] =    {  0x1702000,     0x1000 },
+    [MICROCHIP_PFSOC_BUSERR_UNIT3] =    {  0x1703000,     0x1000 },
+    [MICROCHIP_PFSOC_BUSERR_UNIT4] =    {  0x1704000,     0x1000 },
+    [MICROCHIP_PFSOC_CLINT] =           {  0x2000000,    0x10000 },
+    [MICROCHIP_PFSOC_L2CC] =            {  0x2010000,     0x1000 },
+    [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,  0x2000000 },
+    [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,  0x4000000 },
+    [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,     0x2000 },
+    [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,     0x1000 },
+    [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,     0x1000 },
+    [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
+    [MICROCHIP_PFSOC_IOSCB_CFG] =       { 0x37080000,     0x1000 },
+    [MICROCHIP_PFSOC_DRAM] =            { 0x80000000,        0x0 },
+};
+
+static void microchip_pfsoc_soc_instance_init(Object *obj)
+{
+    MachineState *ms = MACHINE(qdev_get_machine());
+    MicrochipPFSoCState *s = MICROCHIP_PFSOC(obj);
+
+    object_initialize_child(obj, "e-cluster", &s->e_cluster, TYPE_CPU_CLUSTER);
+    qdev_prop_set_uint32(DEVICE(&s->e_cluster), "cluster-id", 0);
+
+    object_initialize_child(OBJECT(&s->e_cluster), "e-cpus", &s->e_cpus,
+                            TYPE_RISCV_HART_ARRAY);
+    qdev_prop_set_uint32(DEVICE(&s->e_cpus), "num-harts", 1);
+    qdev_prop_set_uint32(DEVICE(&s->e_cpus), "hartid-base", 0);
+    qdev_prop_set_string(DEVICE(&s->e_cpus), "cpu-type",
+                         TYPE_RISCV_CPU_SIFIVE_E51);
+    qdev_prop_set_uint64(DEVICE(&s->e_cpus), "resetvec", RESET_VECTOR);
+
+    object_initialize_child(obj, "u-cluster", &s->u_cluster, TYPE_CPU_CLUSTER);
+    qdev_prop_set_uint32(DEVICE(&s->u_cluster), "cluster-id", 1);
+
+    object_initialize_child(OBJECT(&s->u_cluster), "u-cpus", &s->u_cpus,
+                            TYPE_RISCV_HART_ARRAY);
+    qdev_prop_set_uint32(DEVICE(&s->u_cpus), "num-harts", ms->smp.cpus - 1);
+    qdev_prop_set_uint32(DEVICE(&s->u_cpus), "hartid-base", 1);
+    qdev_prop_set_string(DEVICE(&s->u_cpus), "cpu-type",
+                         TYPE_RISCV_CPU_SIFIVE_U54);
+    qdev_prop_set_uint64(DEVICE(&s->u_cpus), "resetvec", RESET_VECTOR);
+}
+
+static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
+{
+    MachineState *ms = MACHINE(qdev_get_machine());
+    MicrochipPFSoCState *s = MICROCHIP_PFSOC(dev);
+    const struct MemmapEntry *memmap = microchip_pfsoc_memmap;
+    MemoryRegion *system_memory = get_system_memory();
+    MemoryRegion *e51_dtim_mem = g_new(MemoryRegion, 1);
+    MemoryRegion *l2lim_mem = g_new(MemoryRegion, 1);
+    MemoryRegion *envm_data = g_new(MemoryRegion, 1);
+    char *plic_hart_config;
+    size_t plic_hart_config_len;
+    int i;
+
+    sysbus_realize(SYS_BUS_DEVICE(&s->e_cpus), &error_abort);
+    sysbus_realize(SYS_BUS_DEVICE(&s->u_cpus), &error_abort);
+    /*
+     * The cluster must be realized after the RISC-V hart array container,
+     * as the container's CPU object is only created on realize, and the
+     * CPU must exist and have been parented into the cluster before the
+     * cluster is realized.
+     */
+    qdev_realize(DEVICE(&s->e_cluster), NULL, &error_abort);
+    qdev_realize(DEVICE(&s->u_cluster), NULL, &error_abort);
+
+    /* E51 DTIM */
+    memory_region_init_ram(e51_dtim_mem, NULL, "microchip.pfsoc.e51_dtim_mem",
+                           memmap[MICROCHIP_PFSOC_E51_DTIM].size, &error_fatal);
+    memory_region_add_subregion(system_memory,
+                                memmap[MICROCHIP_PFSOC_E51_DTIM].base,
+                                e51_dtim_mem);
+
+    /* Bus Error Units */
+    create_unimplemented_device("microchip.pfsoc.buserr_unit0_mem",
+        memmap[MICROCHIP_PFSOC_BUSERR_UNIT0].base,
+        memmap[MICROCHIP_PFSOC_BUSERR_UNIT0].size);
+    create_unimplemented_device("microchip.pfsoc.buserr_unit1_mem",
+        memmap[MICROCHIP_PFSOC_BUSERR_UNIT1].base,
+        memmap[MICROCHIP_PFSOC_BUSERR_UNIT1].size);
+    create_unimplemented_device("microchip.pfsoc.buserr_unit2_mem",
+        memmap[MICROCHIP_PFSOC_BUSERR_UNIT2].base,
+        memmap[MICROCHIP_PFSOC_BUSERR_UNIT2].size);
+    create_unimplemented_device("microchip.pfsoc.buserr_unit3_mem",
+        memmap[MICROCHIP_PFSOC_BUSERR_UNIT3].base,
+        memmap[MICROCHIP_PFSOC_BUSERR_UNIT3].size);
+    create_unimplemented_device("microchip.pfsoc.buserr_unit4_mem",
+        memmap[MICROCHIP_PFSOC_BUSERR_UNIT4].base,
+        memmap[MICROCHIP_PFSOC_BUSERR_UNIT4].size);
+
+    /* CLINT */
+    sifive_clint_create(memmap[MICROCHIP_PFSOC_CLINT].base,
+        memmap[MICROCHIP_PFSOC_CLINT].size, 0, ms->smp.cpus,
+        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
+
+    /* L2 cache controller */
+    create_unimplemented_device("microchip.pfsoc.l2cc",
+        memmap[MICROCHIP_PFSOC_L2CC].base, memmap[MICROCHIP_PFSOC_L2CC].size);
+
+    /*
+     * Add L2-LIM at reset size.
+     * This should be reduced in size as the L2 Cache Controller WayEnable
+     * register is incremented. Unfortunately I don't see a nice (or any) way
+     * to handle reducing or blocking out the L2 LIM while still allowing it
+     * be re returned to all enabled after a reset. For the time being, just
+     * leave it enabled all the time. This won't break anything, but will be
+     * too generous to misbehaving guests.
+     */
+    memory_region_init_ram(l2lim_mem, NULL, "microchip.pfsoc.l2lim",
+                           memmap[MICROCHIP_PFSOC_L2LIM].size, &error_fatal);
+    memory_region_add_subregion(system_memory,
+                                memmap[MICROCHIP_PFSOC_L2LIM].base,
+                                l2lim_mem);
+
+    /* create PLIC hart topology configuration string */
+    plic_hart_config_len = (strlen(MICROCHIP_PFSOC_PLIC_HART_CONFIG) + 1) *
+                           ms->smp.cpus;
+    plic_hart_config = g_malloc0(plic_hart_config_len);
+    for (i = 0; i < ms->smp.cpus; i++) {
+        if (i != 0) {
+            strncat(plic_hart_config, "," MICROCHIP_PFSOC_PLIC_HART_CONFIG,
+                    plic_hart_config_len);
+        } else {
+            strncat(plic_hart_config, "M", plic_hart_config_len);
+        }
+        plic_hart_config_len -= (strlen(MICROCHIP_PFSOC_PLIC_HART_CONFIG) + 1);
+    }
+
+    /* PLIC */
+    s->plic = sifive_plic_create(memmap[MICROCHIP_PFSOC_PLIC].base,
+        plic_hart_config, 0,
+        MICROCHIP_PFSOC_PLIC_NUM_SOURCES,
+        MICROCHIP_PFSOC_PLIC_NUM_PRIORITIES,
+        MICROCHIP_PFSOC_PLIC_PRIORITY_BASE,
+        MICROCHIP_PFSOC_PLIC_PENDING_BASE,
+        MICROCHIP_PFSOC_PLIC_ENABLE_BASE,
+        MICROCHIP_PFSOC_PLIC_ENABLE_STRIDE,
+        MICROCHIP_PFSOC_PLIC_CONTEXT_BASE,
+        MICROCHIP_PFSOC_PLIC_CONTEXT_STRIDE,
+        memmap[MICROCHIP_PFSOC_PLIC].size);
+    g_free(plic_hart_config);
+
+    /* SYSREG */
+    create_unimplemented_device("microchip.pfsoc.sysreg",
+        memmap[MICROCHIP_PFSOC_SYSREG].base,
+        memmap[MICROCHIP_PFSOC_SYSREG].size);
+
+    /* MPUCFG */
+    create_unimplemented_device("microchip.pfsoc.mpucfg",
+        memmap[MICROCHIP_PFSOC_MPUCFG].base,
+        memmap[MICROCHIP_PFSOC_MPUCFG].size);
+
+    /* eNVM */
+    memory_region_init_rom(envm_data, OBJECT(dev), "microchip.pfsoc.envm.data",
+                           memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
+                           &error_fatal);
+    memory_region_add_subregion(system_memory,
+                                memmap[MICROCHIP_PFSOC_ENVM_DATA].base,
+                                envm_data);
+
+    /* IOSCBCFG */
+    create_unimplemented_device("microchip.pfsoc.ioscb.cfg",
+        memmap[MICROCHIP_PFSOC_IOSCB_CFG].base,
+        memmap[MICROCHIP_PFSOC_IOSCB_CFG].size);
+}
+
+static void microchip_pfsoc_soc_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = microchip_pfsoc_soc_realize;
+    /* Reason: Uses serial_hds in realize function, thus can't be used twice */
+    dc->user_creatable = false;
+}
+
+static const TypeInfo microchip_pfsoc_soc_type_info = {
+    .name = TYPE_MICROCHIP_PFSOC,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(MicrochipPFSoCState),
+    .instance_init = microchip_pfsoc_soc_instance_init,
+    .class_init = microchip_pfsoc_soc_class_init,
+};
+
+static void microchip_pfsoc_soc_register_types(void)
+{
+    type_register_static(&microchip_pfsoc_soc_type_info);
+}
+
+type_init(microchip_pfsoc_soc_register_types)
+
+static void microchip_icicle_kit_machine_init(MachineState *machine)
+{
+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+    const struct MemmapEntry *memmap = microchip_pfsoc_memmap;
+    MicrochipIcicleKitState *s = MICROCHIP_ICICLE_KIT_MACHINE(machine);
+    MemoryRegion *system_memory = get_system_memory();
+    MemoryRegion *main_mem = g_new(MemoryRegion, 1);
+
+    /* Sanity check on RAM size */
+    if (machine->ram_size < mc->default_ram_size) {
+        char *sz = size_to_str(mc->default_ram_size);
+        error_report("Invalid RAM size, should be bigger than %s", sz);
+        g_free(sz);
+        exit(EXIT_FAILURE);
+    }
+
+    /* Initialize SoC */
+    object_initialize_child(OBJECT(machine), "soc", &s->soc,
+                            TYPE_MICROCHIP_PFSOC);
+    qdev_realize(DEVICE(&s->soc), NULL, &error_abort);
+
+    /* Register RAM */
+    memory_region_init_ram(main_mem, NULL, "microchip.icicle.kit.ram",
+                           machine->ram_size, &error_fatal);
+    memory_region_add_subregion(system_memory,
+                                memmap[MICROCHIP_PFSOC_DRAM].base, main_mem);
+
+    /* Load the firmware */
+    riscv_find_and_load_firmware(machine, BIOS_FILENAME, RESET_VECTOR, NULL);
+}
+
+static void microchip_icicle_kit_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->desc = "Microchip PolarFire SoC Icicle Kit";
+    mc->init = microchip_icicle_kit_machine_init;
+    mc->max_cpus = MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT +
+                   MICROCHIP_PFSOC_COMPUTE_CPU_COUNT;
+    mc->min_cpus = MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT + 1;
+    mc->default_cpus = mc->min_cpus;
+    mc->default_ram_size = 1 * GiB;
+}
+
+static const TypeInfo microchip_icicle_kit_machine_typeinfo = {
+    .name       = MACHINE_TYPE_NAME("microchip-icicle-kit"),
+    .parent     = TYPE_MACHINE,
+    .class_init = microchip_icicle_kit_machine_class_init,
+    .instance_size = sizeof(MicrochipIcicleKitState),
+};
+
+static void microchip_icicle_kit_machine_init_register_types(void)
+{
+    type_register_static(&microchip_icicle_kit_machine_typeinfo);
+}
+
+type_init(microchip_icicle_kit_machine_init_register_types)
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/riscv/opentitan.h
 F: include/hw/char/ibex_uart.h
 F: include/hw/intc/ibex_plic.h
 
+Microchip PolarFire SoC Icicle Kit
+M: Bin Meng <bin.meng@windriver.com>
+L: qemu-riscv@nongnu.org
+S: Supported
+F: hw/riscv/microchip_pfsoc.c
+F: include/hw/riscv/microchip_pfsoc.h
+
 RX Machines
 -----------
 rx-gdbsim
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select PCI_EXPRESS_GENERIC_BRIDGE
     select PFLASH_CFI01
     select SIFIVE
+
+config MICROCHIP_PFSOC
+    bool
+    select HART
+    select SIFIVE
+    select UNIMP
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_otp.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_prci.c'))
 riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('riscv_htif.c'))
 riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
+riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
 
 hw_arch += {'riscv': riscv_ss}
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

Microchip PolarFire SoC MMUART is ns16550 compatible, with some
additional registers. Create a simple MMUART model built on top
of the existing ns16550 model.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1598924352-89526-6-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/char/mchp_pfsoc_mmuart.h | 61 ++++++++++++++++++++
 hw/char/mchp_pfsoc_mmuart.c         | 86 +++++++++++++++++++++++++++++
 MAINTAINERS                         |  2 +
 hw/char/Kconfig                     |  3 +
 hw/char/meson.build                 |  1 +
 5 files changed, 153 insertions(+)
 create mode 100644 include/hw/char/mchp_pfsoc_mmuart.h
 create mode 100644 hw/char/mchp_pfsoc_mmuart.c

diff --git a/include/hw/char/mchp_pfsoc_mmuart.h b/include/hw/char/mchp_pfsoc_mmuart.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/char/mchp_pfsoc_mmuart.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Microchip PolarFire SoC MMUART emulation
+ *
+ * Copyright (c) 2020 Wind River Systems, Inc.
+ *
+ * Author:
+ *   Bin Meng <bin.meng@windriver.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_MCHP_PFSOC_MMUART_H
+#define HW_MCHP_PFSOC_MMUART_H
+
+#include "hw/char/serial.h"
+
+#define MCHP_PFSOC_MMUART_REG_SIZE  52
+
+typedef struct MchpPfSoCMMUartState {
+    MemoryRegion iomem;
+    hwaddr base;
+    qemu_irq irq;
+
+    SerialMM *serial;
+
+    uint32_t reg[MCHP_PFSOC_MMUART_REG_SIZE / sizeof(uint32_t)];
+} MchpPfSoCMMUartState;
+
+/**
+ * mchp_pfsoc_mmuart_create - Create a Microchip PolarFire SoC MMUART
+ *
+ * This is a helper routine for board to create a MMUART device that is
+ * compatible with Microchip PolarFire SoC.
+ *
+ * @sysmem: system memory region to map
+ * @base: base address of the MMUART registers
+ * @irq: IRQ number of the MMUART device
+ * @chr: character device to associate to
+ *
+ * @return: a pointer to the device specific control structure
+ */
+MchpPfSoCMMUartState *mchp_pfsoc_mmuart_create(MemoryRegion *sysmem,
+    hwaddr base, qemu_irq irq, Chardev *chr);
+
+#endif /* HW_MCHP_PFSOC_MMUART_H */
diff --git a/hw/char/mchp_pfsoc_mmuart.c b/hw/char/mchp_pfsoc_mmuart.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/char/mchp_pfsoc_mmuart.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Microchip PolarFire SoC MMUART emulation
+ *
+ * Copyright (c) 2020 Wind River Systems, Inc.
+ *
+ * Author:
+ *   Bin Meng <bin.meng@windriver.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "chardev/char.h"
+#include "exec/address-spaces.h"
+#include "hw/char/mchp_pfsoc_mmuart.h"
+
+static uint64_t mchp_pfsoc_mmuart_read(void *opaque, hwaddr addr, unsigned size)
+{
+    MchpPfSoCMMUartState *s = opaque;
+
+    if (addr >= MCHP_PFSOC_MMUART_REG_SIZE) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: read: addr=0x%" HWADDR_PRIx "\n",
+                      __func__, addr);
+        return 0;
+    }
+
+    return s->reg[addr / sizeof(uint32_t)];
+}
+
+static void mchp_pfsoc_mmuart_write(void *opaque, hwaddr addr,
+                                    uint64_t value, unsigned size)
+{
+    MchpPfSoCMMUartState *s = opaque;
+    uint32_t val32 = (uint32_t)value;
+
+    if (addr >= MCHP_PFSOC_MMUART_REG_SIZE) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%" HWADDR_PRIx
+                      " v=0x%x\n", __func__, addr, val32);
+        return;
+    }
+
+    s->reg[addr / sizeof(uint32_t)] = val32;
+}
+
+static const MemoryRegionOps mchp_pfsoc_mmuart_ops = {
+    .read = mchp_pfsoc_mmuart_read,
+    .write = mchp_pfsoc_mmuart_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+MchpPfSoCMMUartState *mchp_pfsoc_mmuart_create(MemoryRegion *sysmem,
+    hwaddr base, qemu_irq irq, Chardev *chr)
+{
+    MchpPfSoCMMUartState *s;
+
+    s = g_new0(MchpPfSoCMMUartState, 1);
+
+    memory_region_init_io(&s->iomem, NULL, &mchp_pfsoc_mmuart_ops, s,
+                          "mchp.pfsoc.mmuart", 0x1000);
+
+    s->base = base;
+    s->irq = irq;
+
+    s->serial = serial_mm_init(sysmem, base, 2, irq, 399193, chr,
+                               DEVICE_LITTLE_ENDIAN);
+
+    memory_region_add_subregion(sysmem, base + 0x20, &s->iomem);
+
+    return s;
+}
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Bin Meng <bin.meng@windriver.com>
 L: qemu-riscv@nongnu.org
 S: Supported
 F: hw/riscv/microchip_pfsoc.c
+F: hw/char/mchp_pfsoc_mmuart.c
 F: include/hw/riscv/microchip_pfsoc.h
+F: include/hw/char/mchp_pfsoc_mmuart.h
 
 RX Machines
 -----------
diff --git a/hw/char/Kconfig b/hw/char/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/Kconfig
+++ b/hw/char/Kconfig
@@ -XXX,XX +XXX,XX @@ config RENESAS_SCI
 
 config AVR_USART
     bool
+
+config MCHP_PFSOC_MMUART
+    bool
diff --git a/hw/char/meson.build b/hw/char/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/meson.build
+++ b/hw/char/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_aux.c'))
 softmmu_ss.add(when: 'CONFIG_RENESAS_SCI', if_true: files('renesas_sci.c'))
 softmmu_ss.add(when: 'CONFIG_SH4', if_true: files('sh_serial.c'))
 softmmu_ss.add(when: 'CONFIG_STM32F2XX_USART', if_true: files('stm32f2xx_usart.c'))
+softmmu_ss.add(when: 'CONFIG_MCHP_PFSOC_MMUART', if_true: files('mchp_pfsoc_mmuart.c'))
 
 specific_ss.add(when: 'CONFIG_TERMINAL3270', if_true: files('terminal3270.c'))
 specific_ss.add(when: 'CONFIG_VIRTIO', if_true: files('virtio-serial-bus.c'))
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

Microchip PolarFire SoC has 5 MMUARTs, and the Icicle Kit board
wires 4 of them out. Let's connect all 5 MMUARTs.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1598924352-89526-7-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h | 20 ++++++++++++++++++++
 hw/riscv/microchip_pfsoc.c         | 30 ++++++++++++++++++++++++++++++
 hw/riscv/Kconfig                   |  1 +
 3 files changed, 51 insertions(+)

diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HW_MICROCHIP_PFSOC_H
 #define HW_MICROCHIP_PFSOC_H
 
+#include "hw/char/mchp_pfsoc_mmuart.h"
+
 typedef struct MicrochipPFSoCState {
     /*< private >*/
     DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct MicrochipPFSoCState {
     RISCVHartArrayState e_cpus;
     RISCVHartArrayState u_cpus;
     DeviceState *plic;
+    MchpPfSoCMMUartState *serial0;
+    MchpPfSoCMMUartState *serial1;
+    MchpPfSoCMMUartState *serial2;
+    MchpPfSoCMMUartState *serial3;
+    MchpPfSoCMMUartState *serial4;
 } MicrochipPFSoCState;
 
 #define TYPE_MICROCHIP_PFSOC    "microchip.pfsoc"
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_L2CC,
     MICROCHIP_PFSOC_L2LIM,
     MICROCHIP_PFSOC_PLIC,
+    MICROCHIP_PFSOC_MMUART0,
     MICROCHIP_PFSOC_SYSREG,
     MICROCHIP_PFSOC_MPUCFG,
+    MICROCHIP_PFSOC_MMUART1,
+    MICROCHIP_PFSOC_MMUART2,
+    MICROCHIP_PFSOC_MMUART3,
+    MICROCHIP_PFSOC_MMUART4,
     MICROCHIP_PFSOC_ENVM_CFG,
     MICROCHIP_PFSOC_ENVM_DATA,
     MICROCHIP_PFSOC_IOSCB_CFG,
     MICROCHIP_PFSOC_DRAM,
 };
 
+enum {
+    MICROCHIP_PFSOC_MMUART0_IRQ = 90,
+    MICROCHIP_PFSOC_MMUART1_IRQ = 91,
+    MICROCHIP_PFSOC_MMUART2_IRQ = 92,
+    MICROCHIP_PFSOC_MMUART3_IRQ = 93,
+    MICROCHIP_PFSOC_MMUART4_IRQ = 94,
+};
+
 #define MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT    1
 #define MICROCHIP_PFSOC_COMPUTE_CPU_COUNT       4
 
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
  * 0) CLINT (Core Level Interruptor)
  * 1) PLIC (Platform Level Interrupt Controller)
  * 2) eNVM (Embedded Non-Volatile Memory)
+ * 3) MMUARTs (Multi-Mode UART)
  *
  * This board currently generates devicetree dynamically that indicates at least
  * two harts and up to five harts.
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/loader.h"
 #include "hw/sysbus.h"
+#include "chardev/char.h"
 #include "hw/cpu/cluster.h"
 #include "target/riscv/cpu.h"
 #include "hw/misc/unimp.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/sifive_clint.h"
 #include "hw/riscv/sifive_plic.h"
 #include "hw/riscv/microchip_pfsoc.h"
+#include "sysemu/sysemu.h"
 
 /*
  * The BIOS image used by this machine is called Hart Software Services (HSS).
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
     [MICROCHIP_PFSOC_L2CC] =            {  0x2010000,     0x1000 },
     [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,  0x2000000 },
     [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,  0x4000000 },
+    [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,     0x1000 },
     [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,     0x2000 },
     [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,     0x1000 },
+    [MICROCHIP_PFSOC_MMUART1] =         { 0x20100000,     0x1000 },
+    [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,     0x1000 },
+    [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,     0x1000 },
+    [MICROCHIP_PFSOC_MMUART4] =         { 0x20106000,     0x1000 },
     [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,     0x1000 },
     [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
     [MICROCHIP_PFSOC_IOSCB_CFG] =       { 0x37080000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
         memmap[MICROCHIP_PFSOC_MPUCFG].base,
         memmap[MICROCHIP_PFSOC_MPUCFG].size);
 
+    /* MMUARTs */
+    s->serial0 = mchp_pfsoc_mmuart_create(system_memory,
+        memmap[MICROCHIP_PFSOC_MMUART0].base,
+        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART0_IRQ),
+        serial_hd(0));
+    s->serial1 = mchp_pfsoc_mmuart_create(system_memory,
+        memmap[MICROCHIP_PFSOC_MMUART1].base,
+        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART1_IRQ),
+        serial_hd(1));
+    s->serial2 = mchp_pfsoc_mmuart_create(system_memory,
+        memmap[MICROCHIP_PFSOC_MMUART2].base,
+        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART2_IRQ),
+        serial_hd(2));
+    s->serial3 = mchp_pfsoc_mmuart_create(system_memory,
+        memmap[MICROCHIP_PFSOC_MMUART3].base,
+        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART3_IRQ),
+        serial_hd(3));
+    s->serial4 = mchp_pfsoc_mmuart_create(system_memory,
+        memmap[MICROCHIP_PFSOC_MMUART4].base,
+        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART4_IRQ),
+        serial_hd(4));
+
     /* eNVM */
     memory_region_init_rom(envm_data, OBJECT(dev), "microchip.pfsoc.envm.data",
                            memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
     select HART
     select SIFIVE
     select UNIMP
+    select MCHP_PFSOC_MMUART
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

Cadence SD/SDIO/eMMC Host Controller (SD4HC) is an SDHCI compatible
controller. The SDHCI compatible registers start from offset 0x200,
which are called Slot Register Set (SRS) in its datasheet.

This creates a Cadence SDHCI model built on top of the existing
generic SDHCI model. Cadence specific Host Register Set (HRS) is
implemented to make guest software happy.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1598924352-89526-8-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/sd/cadence_sdhci.h |  47 +++++++++
 hw/sd/cadence_sdhci.c         | 193 ++++++++++++++++++++++++++++++++++
 hw/sd/Kconfig                 |   4 +
 hw/sd/meson.build             |   1 +
 4 files changed, 245 insertions(+)
 create mode 100644 include/hw/sd/cadence_sdhci.h
 create mode 100644 hw/sd/cadence_sdhci.c

diff --git a/include/hw/sd/cadence_sdhci.h b/include/hw/sd/cadence_sdhci.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/sd/cadence_sdhci.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Cadence SDHCI emulation
+ *
+ * Copyright (c) 2020 Wind River Systems, Inc.
+ *
+ * Author:
+ *   Bin Meng <bin.meng@windriver.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef CADENCE_SDHCI_H
+#define CADENCE_SDHCI_H
+
+#include "hw/sd/sdhci.h"
+
+#define CADENCE_SDHCI_REG_SIZE  0x100
+#define CADENCE_SDHCI_NUM_REGS  (CADENCE_SDHCI_REG_SIZE / sizeof(uint32_t))
+
+typedef struct CadenceSDHCIState {
+    SysBusDevice parent;
+
+    MemoryRegion container;
+    MemoryRegion iomem;
+    BusState *bus;
+
+    uint32_t regs[CADENCE_SDHCI_NUM_REGS];
+
+    SDHCIState sdhci;
+} CadenceSDHCIState;
+
+#define TYPE_CADENCE_SDHCI  "cadence.sdhci"
+#define CADENCE_SDHCI(obj)  OBJECT_CHECK(CadenceSDHCIState, (obj), \
+                                         TYPE_CADENCE_SDHCI)
+
+#endif /* CADENCE_SDHCI_H */
diff --git a/hw/sd/cadence_sdhci.c b/hw/sd/cadence_sdhci.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/sd/cadence_sdhci.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Cadence SDHCI emulation
+ *
+ * Copyright (c) 2020 Wind River Systems, Inc.
+ *
+ * Author:
+ *   Bin Meng <bin.meng@windriver.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/bitops.h"
+#include "qemu/error-report.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "migration/vmstate.h"
+#include "hw/irq.h"
+#include "hw/sd/cadence_sdhci.h"
+#include "sdhci-internal.h"
+
+/* HRS - Host Register Set (specific to Cadence) */
+
+#define CADENCE_SDHCI_HRS00             0x00    /* general information */
+#define CADENCE_SDHCI_HRS00_SWR             BIT(0)
+#define CADENCE_SDHCI_HRS00_POR_VAL         0x00010000
+
+#define CADENCE_SDHCI_HRS04             0x10    /* PHY access port */
+#define CADENCE_SDHCI_HRS04_WR              BIT(24)
+#define CADENCE_SDHCI_HRS04_RD              BIT(25)
+#define CADENCE_SDHCI_HRS04_ACK             BIT(26)
+
+#define CADENCE_SDHCI_HRS06             0x18    /* eMMC control */
+#define CADENCE_SDHCI_HRS06_TUNE_UP         BIT(15)
+
+/* SRS - Slot Register Set (SDHCI-compatible) */
+
+#define CADENCE_SDHCI_SRS_BASE          0x200
+
+#define TO_REG(addr)    ((addr) / sizeof(uint32_t))
+
+static void cadence_sdhci_instance_init(Object *obj)
+{
+    CadenceSDHCIState *s = CADENCE_SDHCI(obj);
+
+    object_initialize_child(OBJECT(s), "generic-sdhci",
+                            &s->sdhci, TYPE_SYSBUS_SDHCI);
+}
+
+static void cadence_sdhci_reset(DeviceState *dev)
+{
+    CadenceSDHCIState *s = CADENCE_SDHCI(dev);
+
+    memset(s->regs, 0, CADENCE_SDHCI_REG_SIZE);
+    s->regs[TO_REG(CADENCE_SDHCI_HRS00)] = CADENCE_SDHCI_HRS00_POR_VAL;
+
+    device_cold_reset(DEVICE(&s->sdhci));
+}
+
+static uint64_t cadence_sdhci_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    CadenceSDHCIState *s = opaque;
+    uint32_t val;
+
+    val = s->regs[TO_REG(addr)];
+
+    return (uint64_t)val;
+}
+
+static void cadence_sdhci_write(void *opaque, hwaddr addr, uint64_t val,
+                                unsigned int size)
+{
+    CadenceSDHCIState *s = opaque;
+    uint32_t val32 = (uint32_t)val;
+
+    switch (addr) {
+    case CADENCE_SDHCI_HRS00:
+        /*
+         * The only writable bit is SWR (software reset) and it automatically
+         * clears to zero, so essentially this register remains unchanged.
+         */
+        if (val32 & CADENCE_SDHCI_HRS00_SWR) {
+            cadence_sdhci_reset(DEVICE(s));
+        }
+
+        break;
+    case CADENCE_SDHCI_HRS04:
+        /*
+         * Only emulate the ACK bit behavior when read or write transaction
+         * are requested.
+         */
+        if (val32 & (CADENCE_SDHCI_HRS04_WR | CADENCE_SDHCI_HRS04_RD)) {
+            val32 |= CADENCE_SDHCI_HRS04_ACK;
+        } else {
+            val32 &= ~CADENCE_SDHCI_HRS04_ACK;
+        }
+
+        s->regs[TO_REG(addr)] = val32;
+        break;
+    case CADENCE_SDHCI_HRS06:
+        if (val32 & CADENCE_SDHCI_HRS06_TUNE_UP) {
+            val32 &= ~CADENCE_SDHCI_HRS06_TUNE_UP;
+        }
+
+        s->regs[TO_REG(addr)] = val32;
+        break;
+    default:
+        s->regs[TO_REG(addr)] = val32;
+        break;
+    }
+}
+
+static const MemoryRegionOps cadence_sdhci_ops = {
+    .read = cadence_sdhci_read,
+    .write = cadence_sdhci_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    }
+};
+
+static void cadence_sdhci_realize(DeviceState *dev, Error **errp)
+{
+    CadenceSDHCIState *s = CADENCE_SDHCI(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    SysBusDevice *sbd_sdhci = SYS_BUS_DEVICE(&s->sdhci);
+
+    memory_region_init(&s->container, OBJECT(s),
+                       "cadence.sdhci-container", 0x1000);
+    sysbus_init_mmio(sbd, &s->container);
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &cadence_sdhci_ops,
+                          s, TYPE_CADENCE_SDHCI, CADENCE_SDHCI_REG_SIZE);
+    memory_region_add_subregion(&s->container, 0, &s->iomem);
+
+    sysbus_realize(sbd_sdhci, errp);
+    memory_region_add_subregion(&s->container, CADENCE_SDHCI_SRS_BASE,
+                                sysbus_mmio_get_region(sbd_sdhci, 0));
+
+    /* propagate irq and "sd-bus" from generic-sdhci */
+    sysbus_pass_irq(sbd, sbd_sdhci);
+    s->bus = qdev_get_child_bus(DEVICE(sbd_sdhci), "sd-bus");
+}
+
+static const VMStateDescription vmstate_cadence_sdhci = {
+    .name = TYPE_CADENCE_SDHCI,
+    .version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, CadenceSDHCIState, CADENCE_SDHCI_NUM_REGS),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static void cadence_sdhci_class_init(ObjectClass *classp, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(classp);
+
+    dc->desc = "Cadence SD/SDIO/eMMC Host Controller (SD4HC)";
+    dc->realize = cadence_sdhci_realize;
+    dc->reset = cadence_sdhci_reset;
+    dc->vmsd = &vmstate_cadence_sdhci;
+}
+
+static TypeInfo cadence_sdhci_info = {
+    .name          = TYPE_CADENCE_SDHCI,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(CadenceSDHCIState),
+    .instance_init = cadence_sdhci_instance_init,
+    .class_init    = cadence_sdhci_class_init,
+};
+
+static void cadence_sdhci_register_types(void)
+{
+    type_register_static(&cadence_sdhci_info);
+}
+
+type_init(cadence_sdhci_register_types)
diff --git a/hw/sd/Kconfig b/hw/sd/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/Kconfig
+++ b/hw/sd/Kconfig
@@ -XXX,XX +XXX,XX @@ config SDHCI_PCI
     default y if PCI_DEVICES
     depends on PCI
     select SDHCI
+
+config CADENCE_SDHCI
+    bool
+    select SDHCI
diff --git a/hw/sd/meson.build b/hw/sd/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/meson.build
+++ b/hw/sd/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx_mmci.c'))
 softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_sdhost.c'))
 softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_sdhci.c'))
 softmmu_ss.add(when: 'CONFIG_ALLWINNER_H3', if_true: files('allwinner-sdhost.c'))
+softmmu_ss.add(when: 'CONFIG_CADENCE_SDHCI', if_true: files('cadence_sdhci.c'))
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

Microchip PolarFire SoC integrates one Cadence SDHCI controller.
On the Icicle Kit board, one eMMC chip and an external SD card
connect to this controller depending on different configuration.

As QEMU does not support eMMC yet, we just emulate the SD card
configuration. To test this, the Hart Software Services (HSS)
should choose the SD card configuration:

$ cp boards/icicle-kit-es/def_config.sdcard .config
$ make BOARD=icicle-kit-es

The SD card image can be built from the Yocto BSP at:
https://github.com/polarfire-soc/meta-polarfire-soc-yocto-bsp

Note the generated SD card image should be resized before use:
$ qemu-img resize /path/to/sdcard.img 4G

Launch QEMU with the following command:
$ qemu-system-riscv64 -nographic -M microchip-icicle-kit -sd sdcard.img

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1598924352-89526-9-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h |  4 ++++
 hw/riscv/microchip_pfsoc.c         | 23 +++++++++++++++++++++++
 hw/riscv/Kconfig                   |  1 +
 3 files changed, 28 insertions(+)

diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -XXX,XX +XXX,XX @@
 #define HW_MICROCHIP_PFSOC_H
 
 #include "hw/char/mchp_pfsoc_mmuart.h"
+#include "hw/sd/cadence_sdhci.h"
 
 typedef struct MicrochipPFSoCState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct MicrochipPFSoCState {
     MchpPfSoCMMUartState *serial2;
     MchpPfSoCMMUartState *serial3;
     MchpPfSoCMMUartState *serial4;
+    CadenceSDHCIState sdhci;
 } MicrochipPFSoCState;
 
 #define TYPE_MICROCHIP_PFSOC    "microchip.pfsoc"
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_MMUART0,
     MICROCHIP_PFSOC_SYSREG,
     MICROCHIP_PFSOC_MPUCFG,
+    MICROCHIP_PFSOC_EMMC_SD,
     MICROCHIP_PFSOC_MMUART1,
     MICROCHIP_PFSOC_MMUART2,
     MICROCHIP_PFSOC_MMUART3,
@@ -XXX,XX +XXX,XX @@ enum {
 };
 
 enum {
+    MICROCHIP_PFSOC_EMMC_SD_IRQ = 88,
     MICROCHIP_PFSOC_MMUART0_IRQ = 90,
     MICROCHIP_PFSOC_MMUART1_IRQ = 91,
     MICROCHIP_PFSOC_MMUART2_IRQ = 92,
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
  * 1) PLIC (Platform Level Interrupt Controller)
  * 2) eNVM (Embedded Non-Volatile Memory)
  * 3) MMUARTs (Multi-Mode UART)
+ * 4) Cadence eMMC/SDHC controller and an SD card connected to it
  *
  * This board currently generates devicetree dynamically that indicates at least
  * two harts and up to five harts.
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
     [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,     0x1000 },
     [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,     0x2000 },
     [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,     0x1000 },
+    [MICROCHIP_PFSOC_EMMC_SD] =         { 0x20008000,     0x1000 },
     [MICROCHIP_PFSOC_MMUART1] =         { 0x20100000,     0x1000 },
     [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,     0x1000 },
     [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
     qdev_prop_set_string(DEVICE(&s->u_cpus), "cpu-type",
                          TYPE_RISCV_CPU_SIFIVE_U54);
     qdev_prop_set_uint64(DEVICE(&s->u_cpus), "resetvec", RESET_VECTOR);
+
+    object_initialize_child(obj, "sd-controller", &s->sdhci,
+                            TYPE_CADENCE_SDHCI);
 }
 
 static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
         memmap[MICROCHIP_PFSOC_MPUCFG].base,
         memmap[MICROCHIP_PFSOC_MPUCFG].size);
 
+    /* SDHCI */
+    sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
+                    memmap[MICROCHIP_PFSOC_EMMC_SD].base);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
+        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_EMMC_SD_IRQ));
+
     /* MMUARTs */
     s->serial0 = mchp_pfsoc_mmuart_create(system_memory,
         memmap[MICROCHIP_PFSOC_MMUART0].base,
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
     MicrochipIcicleKitState *s = MICROCHIP_ICICLE_KIT_MACHINE(machine);
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *main_mem = g_new(MemoryRegion, 1);
+    DriveInfo *dinfo = drive_get_next(IF_SD);
 
     /* Sanity check on RAM size */
     if (machine->ram_size < mc->default_ram_size) {
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
 
     /* Load the firmware */
     riscv_find_and_load_firmware(machine, BIOS_FILENAME, RESET_VECTOR, NULL);
+
+    /* Attach an SD card */
+    if (dinfo) {
+        CadenceSDHCIState *sdhci = &(s->soc.sdhci);
+        DeviceState *card = qdev_new(TYPE_SD_CARD);
+
+        qdev_prop_set_drive_err(card, "drive", blk_by_legacy_dinfo(dinfo),
+                                &error_fatal);
+        qdev_realize_and_unref(card, sdhci->bus, &error_fatal);
+    }
 }
 
 static void microchip_icicle_kit_machine_class_init(ObjectClass *oc, void *data)
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
     select SIFIVE
     select UNIMP
     select MCHP_PFSOC_MMUART
+    select CADENCE_SDHCI
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

Microchip PolarFire SoC integrates a DMA engine that supports:
* Independent concurrent DMA transfers using 4 DMA channels
* Generation of interrupts on various conditions during execution
which is actually an IP reused from the SiFive FU540 chip.

This creates a model to support both polling and interrupt modes.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1598924352-89526-10-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/dma/sifive_pdma.h |  57 +++++++
 hw/dma/sifive_pdma.c         | 313 +++++++++++++++++++++++++++++++++++
 hw/dma/Kconfig               |   3 +
 hw/dma/meson.build           |   1 +
 4 files changed, 374 insertions(+)
 create mode 100644 include/hw/dma/sifive_pdma.h
 create mode 100644 hw/dma/sifive_pdma.c

diff --git a/include/hw/dma/sifive_pdma.h b/include/hw/dma/sifive_pdma.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/dma/sifive_pdma.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * SiFive Platform DMA emulation
+ *
+ * Copyright (c) 2020 Wind River Systems, Inc.
+ *
+ * Author:
+ *   Bin Meng <bin.meng@windriver.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef SIFIVE_PDMA_H
+#define SIFIVE_PDMA_H
+
+struct sifive_pdma_chan {
+    uint32_t control;
+    uint32_t next_config;
+    uint64_t next_bytes;
+    uint64_t next_dst;
+    uint64_t next_src;
+    uint32_t exec_config;
+    uint64_t exec_bytes;
+    uint64_t exec_dst;
+    uint64_t exec_src;
+    int state;
+};
+
+#define SIFIVE_PDMA_CHANS           4
+#define SIFIVE_PDMA_IRQS            (SIFIVE_PDMA_CHANS * 2)
+#define SIFIVE_PDMA_REG_SIZE        0x100000
+#define SIFIVE_PDMA_CHAN_NO(reg)    ((reg & (SIFIVE_PDMA_REG_SIZE - 1)) >> 12)
+
+typedef struct SiFivePDMAState {
+    SysBusDevice parent;
+    MemoryRegion iomem;
+    qemu_irq irq[SIFIVE_PDMA_IRQS];
+
+    struct sifive_pdma_chan chan[SIFIVE_PDMA_CHANS];
+} SiFivePDMAState;
+
+#define TYPE_SIFIVE_PDMA    "sifive.pdma"
+
+#define SIFIVE_PDMA(obj)    \
+    OBJECT_CHECK(SiFivePDMAState, (obj), TYPE_SIFIVE_PDMA)
+
+#endif /* SIFIVE_PDMA_H */
diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/dma/sifive_pdma.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * SiFive Platform DMA emulation
+ *
+ * Copyright (c) 2020 Wind River Systems, Inc.
+ *
+ * Author:
+ *   Bin Meng <bin.meng@windriver.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "hw/hw.h"
+#include "hw/irq.h"
+#include "hw/qdev-properties.h"
+#include "hw/sysbus.h"
+#include "migration/vmstate.h"
+#include "sysemu/dma.h"
+#include "hw/dma/sifive_pdma.h"
+
+#define DMA_CONTROL         0x000
+#define   CONTROL_CLAIM     BIT(0)
+#define   CONTROL_RUN       BIT(1)
+#define   CONTROL_DONE_IE   BIT(14)
+#define   CONTROL_ERR_IE    BIT(15)
+#define   CONTROL_DONE      BIT(30)
+#define   CONTROL_ERR       BIT(31)
+
+#define DMA_NEXT_CONFIG     0x004
+#define   CONFIG_REPEAT     BIT(2)
+#define   CONFIG_ORDER      BIT(3)
+#define   CONFIG_WRSZ_SHIFT 24
+#define   CONFIG_RDSZ_SHIFT 28
+#define   CONFIG_SZ_MASK    0xf
+
+#define DMA_NEXT_BYTES      0x008
+#define DMA_NEXT_DST        0x010
+#define DMA_NEXT_SRC        0x018
+#define DMA_EXEC_CONFIG     0x104
+#define DMA_EXEC_BYTES      0x108
+#define DMA_EXEC_DST        0x110
+#define DMA_EXEC_SRC        0x118
+
+enum dma_chan_state {
+    DMA_CHAN_STATE_IDLE,
+    DMA_CHAN_STATE_STARTED,
+    DMA_CHAN_STATE_ERROR,
+    DMA_CHAN_STATE_DONE
+};
+
+static void sifive_pdma_run(SiFivePDMAState *s, int ch)
+{
+    uint64_t bytes = s->chan[ch].next_bytes;
+    uint64_t dst = s->chan[ch].next_dst;
+    uint64_t src = s->chan[ch].next_src;
+    uint32_t config = s->chan[ch].next_config;
+    int wsize, rsize, size;
+    uint8_t buf[64];
+    int n;
+
+    /* do nothing if bytes to transfer is zero */
+    if (!bytes) {
+        goto error;
+    }
+
+    /*
+     * The manual does not describe how the hardware behaviors when
+     * config.wsize and config.rsize are given different values.
+     * A common case is memory to memory DMA, and in this case they
+     * are normally the same. Abort if this expectation fails.
+     */
+    wsize = (config >> CONFIG_WRSZ_SHIFT) & CONFIG_SZ_MASK;
+    rsize = (config >> CONFIG_RDSZ_SHIFT) & CONFIG_SZ_MASK;
+    if (wsize != rsize) {
+        goto error;
+    }
+
+    /*
+     * Calculate the transaction size
+     *
+     * size field is base 2 logarithm of DMA transaction size,
+     * but there is an upper limit of 64 bytes per transaction.
+     */
+    size = wsize;
+    if (size > 6) {
+        size = 6;
+    }
+    size = 1 << size;
+
+    /* the bytes to transfer should be multiple of transaction size */
+    if (bytes % size) {
+        goto error;
+    }
+
+    /* indicate a DMA transfer is started */
+    s->chan[ch].state = DMA_CHAN_STATE_STARTED;
+    s->chan[ch].control &= ~CONTROL_DONE;
+    s->chan[ch].control &= ~CONTROL_ERR;
+
+    /* load the next_ registers into their exec_ counterparts */
+    s->chan[ch].exec_config = config;
+    s->chan[ch].exec_bytes = bytes;
+    s->chan[ch].exec_dst = dst;
+    s->chan[ch].exec_src = src;
+
+    for (n = 0; n < bytes / size; n++) {
+        cpu_physical_memory_read(s->chan[ch].exec_src, buf, size);
+        cpu_physical_memory_write(s->chan[ch].exec_dst, buf, size);
+        s->chan[ch].exec_src += size;
+        s->chan[ch].exec_dst += size;
+        s->chan[ch].exec_bytes -= size;
+    }
+
+    /* indicate a DMA transfer is done */
+    s->chan[ch].state = DMA_CHAN_STATE_DONE;
+    s->chan[ch].control &= ~CONTROL_RUN;
+    s->chan[ch].control |= CONTROL_DONE;
+
+    /* reload exec_ registers if repeat is required */
+    if (s->chan[ch].next_config & CONFIG_REPEAT) {
+        s->chan[ch].exec_bytes = bytes;
+        s->chan[ch].exec_dst = dst;
+        s->chan[ch].exec_src = src;
+    }
+
+    return;
+
+error:
+    s->chan[ch].state = DMA_CHAN_STATE_ERROR;
+    s->chan[ch].control |= CONTROL_ERR;
+    return;
+}
+
+static inline void sifive_pdma_update_irq(SiFivePDMAState *s, int ch)
+{
+    bool done_ie, err_ie;
+
+    done_ie = !!(s->chan[ch].control & CONTROL_DONE_IE);
+    err_ie = !!(s->chan[ch].control & CONTROL_ERR_IE);
+
+    if (done_ie && (s->chan[ch].control & CONTROL_DONE)) {
+        qemu_irq_raise(s->irq[ch * 2]);
+    } else {
+        qemu_irq_lower(s->irq[ch * 2]);
+    }
+
+    if (err_ie && (s->chan[ch].control & CONTROL_ERR)) {
+        qemu_irq_raise(s->irq[ch * 2 + 1]);
+    } else {
+        qemu_irq_lower(s->irq[ch * 2 + 1]);
+    }
+
+    s->chan[ch].state = DMA_CHAN_STATE_IDLE;
+}
+
+static uint64_t sifive_pdma_read(void *opaque, hwaddr offset, unsigned size)
+{
+    SiFivePDMAState *s = opaque;
+    int ch = SIFIVE_PDMA_CHAN_NO(offset);
+    uint64_t val = 0;
+
+    if (ch >= SIFIVE_PDMA_CHANS) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Invalid channel no %d\n",
+                      __func__, ch);
+        return 0;
+    }
+
+    offset &= 0xfff;
+    switch (offset) {
+    case DMA_CONTROL:
+        val = s->chan[ch].control;
+        break;
+    case DMA_NEXT_CONFIG:
+        val = s->chan[ch].next_config;
+        break;
+    case DMA_NEXT_BYTES:
+        val = s->chan[ch].next_bytes;
+        break;
+    case DMA_NEXT_DST:
+        val = s->chan[ch].next_dst;
+        break;
+    case DMA_NEXT_SRC:
+        val = s->chan[ch].next_src;
+        break;
+    case DMA_EXEC_CONFIG:
+        val = s->chan[ch].exec_config;
+        break;
+    case DMA_EXEC_BYTES:
+        val = s->chan[ch].exec_bytes;
+        break;
+    case DMA_EXEC_DST:
+        val = s->chan[ch].exec_dst;
+        break;
+    case DMA_EXEC_SRC:
+        val = s->chan[ch].exec_src;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIX "\n",
+                      __func__, offset);
+        break;
+    }
+
+    return val;
+}
+
+static void sifive_pdma_write(void *opaque, hwaddr offset,
+                              uint64_t value, unsigned size)
+{
+    SiFivePDMAState *s = opaque;
+    int ch = SIFIVE_PDMA_CHAN_NO(offset);
+
+    if (ch >= SIFIVE_PDMA_CHANS) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Invalid channel no %d\n",
+                      __func__, ch);
+        return;
+    }
+
+    offset &= 0xfff;
+    switch (offset) {
+    case DMA_CONTROL:
+        s->chan[ch].control = value;
+
+        if (value & CONTROL_RUN) {
+            sifive_pdma_run(s, ch);
+        }
+
+        sifive_pdma_update_irq(s, ch);
+        break;
+    case DMA_NEXT_CONFIG:
+        s->chan[ch].next_config = value;
+        break;
+    case DMA_NEXT_BYTES:
+        s->chan[ch].next_bytes = value;
+        break;
+    case DMA_NEXT_DST:
+        s->chan[ch].next_dst = value;
+        break;
+    case DMA_NEXT_SRC:
+        s->chan[ch].next_src = value;
+        break;
+    case DMA_EXEC_CONFIG:
+    case DMA_EXEC_BYTES:
+    case DMA_EXEC_DST:
+    case DMA_EXEC_SRC:
+        /* these are read-only registers */
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIX "\n",
+                      __func__, offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps sifive_pdma_ops = {
+    .read = sifive_pdma_read,
+    .write = sifive_pdma_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    /* there are 32-bit and 64-bit wide registers */
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 8,
+    }
+};
+
+static void sifive_pdma_realize(DeviceState *dev, Error **errp)
+{
+    SiFivePDMAState *s = SIFIVE_PDMA(dev);
+    int i;
+
+    memory_region_init_io(&s->iomem, OBJECT(dev), &sifive_pdma_ops, s,
+                          TYPE_SIFIVE_PDMA, SIFIVE_PDMA_REG_SIZE);
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
+
+    for (i = 0; i < SIFIVE_PDMA_IRQS; i++) {
+        sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq[i]);
+    }
+}
+
+static void sifive_pdma_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->desc = "SiFive Platform DMA controller";
+    dc->realize = sifive_pdma_realize;
+}
+
+static const TypeInfo sifive_pdma_info = {
+    .name          = TYPE_SIFIVE_PDMA,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(SiFivePDMAState),
+    .class_init    = sifive_pdma_class_init,
+};
+
+static void sifive_pdma_register_types(void)
+{
+    type_register_static(&sifive_pdma_info);
+}
+
+type_init(sifive_pdma_register_types)
diff --git a/hw/dma/Kconfig b/hw/dma/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/Kconfig
+++ b/hw/dma/Kconfig
@@ -XXX,XX +XXX,XX @@ config ZYNQ_DEVCFG
 
 config STP2000
     bool
+
+config SIFIVE_PDMA
+    bool
diff --git a/hw/dma/meson.build b/hw/dma/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/meson.build
+++ b/hw/dma/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zdma.c'))
 softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_dma.c', 'soc_dma.c'))
 softmmu_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx_dma.c'))
 softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_dma.c'))
+softmmu_ss.add(when: 'CONFIG_SIFIVE_PDMA', if_true: files('sifive_pdma.c'))
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

On the Icicle Kit board, the HSS firmware utilizes the on-chip DMA
controller to move the 2nd stage bootloader in the system memory.
Let's connect a DMA controller to Microchip PolarFire SoC.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1598924352-89526-11-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h | 11 +++++++++++
 hw/riscv/microchip_pfsoc.c         | 15 +++++++++++++++
 hw/riscv/Kconfig                   |  1 +
 3 files changed, 27 insertions(+)

diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -XXX,XX +XXX,XX @@
 #define HW_MICROCHIP_PFSOC_H
 
 #include "hw/char/mchp_pfsoc_mmuart.h"
+#include "hw/dma/sifive_pdma.h"
 #include "hw/sd/cadence_sdhci.h"
 
 typedef struct MicrochipPFSoCState {
@@ -XXX,XX +XXX,XX @@ typedef struct MicrochipPFSoCState {
     MchpPfSoCMMUartState *serial2;
     MchpPfSoCMMUartState *serial3;
     MchpPfSoCMMUartState *serial4;
+    SiFivePDMAState dma;
     CadenceSDHCIState sdhci;
 } MicrochipPFSoCState;
 
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_BUSERR_UNIT4,
     MICROCHIP_PFSOC_CLINT,
     MICROCHIP_PFSOC_L2CC,
+    MICROCHIP_PFSOC_DMA,
     MICROCHIP_PFSOC_L2LIM,
     MICROCHIP_PFSOC_PLIC,
     MICROCHIP_PFSOC_MMUART0,
@@ -XXX,XX +XXX,XX @@ enum {
 };
 
 enum {
+    MICROCHIP_PFSOC_DMA_IRQ0 = 5,
+    MICROCHIP_PFSOC_DMA_IRQ1 = 6,
+    MICROCHIP_PFSOC_DMA_IRQ2 = 7,
+    MICROCHIP_PFSOC_DMA_IRQ3 = 8,
+    MICROCHIP_PFSOC_DMA_IRQ4 = 9,
+    MICROCHIP_PFSOC_DMA_IRQ5 = 10,
+    MICROCHIP_PFSOC_DMA_IRQ6 = 11,
+    MICROCHIP_PFSOC_DMA_IRQ7 = 12,
     MICROCHIP_PFSOC_EMMC_SD_IRQ = 88,
     MICROCHIP_PFSOC_MMUART0_IRQ = 90,
     MICROCHIP_PFSOC_MMUART1_IRQ = 91,
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
  * 2) eNVM (Embedded Non-Volatile Memory)
  * 3) MMUARTs (Multi-Mode UART)
  * 4) Cadence eMMC/SDHC controller and an SD card connected to it
+ * 5) SiFive Platform DMA (Direct Memory Access Controller)
  *
  * This board currently generates devicetree dynamically that indicates at least
  * two harts and up to five harts.
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
     [MICROCHIP_PFSOC_BUSERR_UNIT4] =    {  0x1704000,     0x1000 },
     [MICROCHIP_PFSOC_CLINT] =           {  0x2000000,    0x10000 },
     [MICROCHIP_PFSOC_L2CC] =            {  0x2010000,     0x1000 },
+    [MICROCHIP_PFSOC_DMA] =             {  0x3000000,   0x100000 },
     [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,  0x2000000 },
     [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,  0x4000000 },
     [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
                          TYPE_RISCV_CPU_SIFIVE_U54);
     qdev_prop_set_uint64(DEVICE(&s->u_cpus), "resetvec", RESET_VECTOR);
 
+    object_initialize_child(obj, "dma-controller", &s->dma,
+                            TYPE_SIFIVE_PDMA);
+
     object_initialize_child(obj, "sd-controller", &s->sdhci,
                             TYPE_CADENCE_SDHCI);
 }
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
         memmap[MICROCHIP_PFSOC_PLIC].size);
     g_free(plic_hart_config);
 
+    /* DMA */
+    sysbus_realize(SYS_BUS_DEVICE(&s->dma), errp);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->dma), 0,
+                    memmap[MICROCHIP_PFSOC_DMA].base);
+    for (i = 0; i < SIFIVE_PDMA_IRQS; i++) {
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->dma), i,
+                           qdev_get_gpio_in(DEVICE(s->plic),
+                                            MICROCHIP_PFSOC_DMA_IRQ0 + i));
+    }
+
     /* SYSREG */
     create_unimplemented_device("microchip.pfsoc.sysreg",
         memmap[MICROCHIP_PFSOC_SYSREG].base,
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
     select SIFIVE
     select UNIMP
     select MCHP_PFSOC_MMUART
+    select SIFIVE_PDMA
     select CADENCE_SDHCI
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

At present the PHY address of the PHY connected to GEM is hard-coded
to either 23 (BOARD_PHY_ADDRESS) or 0. This might not be the case for
all boards. Add a new 'phy-addr' property so that board can specify
the PHY address for each GEM instance.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1598924352-89526-12-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/net/cadence_gem.h | 2 ++
 hw/net/cadence_gem.c         | 5 +++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/cadence_gem.h
+++ b/include/hw/net/cadence_gem.h
@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
     /* Mask of register bits which are write 1 to clear */
     uint32_t regs_w1c[CADENCE_GEM_MAXREG];
 
+    /* PHY address */
+    uint8_t phy_addr;
     /* PHY registers backing store */
     uint16_t phy_regs[32];
 
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static uint64_t gem_read(void *opaque, hwaddr offset, unsigned size)
             uint32_t phy_addr, reg_num;
 
             phy_addr = (retval & GEM_PHYMNTNC_ADDR) >> GEM_PHYMNTNC_ADDR_SHFT;
-            if (phy_addr == BOARD_PHY_ADDRESS || phy_addr == 0) {
+            if (phy_addr == s->phy_addr || phy_addr == 0) {
                 reg_num = (retval & GEM_PHYMNTNC_REG) >> GEM_PHYMNTNC_REG_SHIFT;
                 retval &= 0xFFFF0000;
                 retval |= gem_phy_read(s, reg_num);
@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
             uint32_t phy_addr, reg_num;
 
             phy_addr = (val & GEM_PHYMNTNC_ADDR) >> GEM_PHYMNTNC_ADDR_SHFT;
-            if (phy_addr == BOARD_PHY_ADDRESS || phy_addr == 0) {
+            if (phy_addr == s->phy_addr || phy_addr == 0) {
                 reg_num = (val & GEM_PHYMNTNC_REG) >> GEM_PHYMNTNC_REG_SHIFT;
                 gem_phy_write(s, reg_num, val);
             }
@@ -XXX,XX +XXX,XX @@ static Property gem_properties[] = {
     DEFINE_NIC_PROPERTIES(CadenceGEMState, conf),
     DEFINE_PROP_UINT32("revision", CadenceGEMState, revision,
                        GEM_MODID_VALUE),
+    DEFINE_PROP_UINT8("phy-addr", CadenceGEMState, phy_addr, BOARD_PHY_ADDRESS),
     DEFINE_PROP_UINT8("num-priority-queues", CadenceGEMState,
                       num_priority_queues, 1),
     DEFINE_PROP_UINT8("num-type1-screeners", CadenceGEMState,
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

When cadence_gem model was created for Xilinx boards, the PHY address
was hard-coded to 23 in the GEM model. Now that we have introduced a
property we can use that to tell GEM model what our PHY address is.
Change all boards' GEM 'phy-addr' property value to 23, and set the
PHY address default value to 0 in the GEM model.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1598924352-89526-13-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/arm/xilinx_zynq.c | 1 +
 hw/arm/xlnx-versal.c | 1 +
 hw/arm/xlnx-zynqmp.c | 2 ++
 hw/net/cadence_gem.c | 6 +++---
 4 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@ static void gem_init(NICInfo *nd, uint32_t base, qemu_irq irq)
         qemu_check_nic_model(nd, TYPE_CADENCE_GEM);
         qdev_set_nic_properties(dev, nd);
     }
+    object_property_set_int(OBJECT(dev), "phy-addr", 23, &error_abort);
     s = SYS_BUS_DEVICE(dev);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, base);
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_create_gems(Versal *s, qemu_irq *pic)
             qemu_check_nic_model(nd, "cadence_gem");
             qdev_set_nic_properties(dev, nd);
         }
+        object_property_set_int(OBJECT(dev), "phy-addr", 23, &error_abort);
         object_property_set_int(OBJECT(dev), "num-priority-queues", 2,
                                 &error_abort);
         object_property_set_link(OBJECT(dev), "dma", OBJECT(&s->mr_ps),
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         }
         object_property_set_int(OBJECT(&s->gem[i]), "revision", GEM_REVISION,
                                 &error_abort);
+        object_property_set_int(OBJECT(&s->gem[i]), "phy-addr", 23,
+                                &error_abort);
         object_property_set_int(OBJECT(&s->gem[i]), "num-priority-queues", 2,
                                 &error_abort);
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->gem[i]), errp)) {
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 #define GEM_PHYMNTNC_REG_SHIFT 18
 
 /* Marvell PHY definitions */
-#define BOARD_PHY_ADDRESS    23 /* PHY address we will emulate a device at */
+#define BOARD_PHY_ADDRESS    0 /* PHY address we will emulate a device at */
 
 #define PHY_REG_CONTROL      0
 #define PHY_REG_STATUS       1
@@ -XXX,XX +XXX,XX @@ static uint64_t gem_read(void *opaque, hwaddr offset, unsigned size)
             uint32_t phy_addr, reg_num;
 
             phy_addr = (retval & GEM_PHYMNTNC_ADDR) >> GEM_PHYMNTNC_ADDR_SHFT;
-            if (phy_addr == s->phy_addr || phy_addr == 0) {
+            if (phy_addr == s->phy_addr) {
                 reg_num = (retval & GEM_PHYMNTNC_REG) >> GEM_PHYMNTNC_REG_SHIFT;
                 retval &= 0xFFFF0000;
                 retval |= gem_phy_read(s, reg_num);
@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
             uint32_t phy_addr, reg_num;
 
             phy_addr = (val & GEM_PHYMNTNC_ADDR) >> GEM_PHYMNTNC_ADDR_SHFT;
-            if (phy_addr == s->phy_addr || phy_addr == 0) {
+            if (phy_addr == s->phy_addr) {
                 reg_num = (val & GEM_PHYMNTNC_REG) >> GEM_PHYMNTNC_REG_SHIFT;
                 gem_phy_write(s, reg_num, val);
             }
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

Microchip PolarFire SoC integrates 2 Candence GEMs to provide
IEEE 802.3 standard-compliant 10/100/1000 Mbps ethernet interface.

On the Icicle Kit board, GEM0 connects to a PHY at address 8 while
GEM1 connects to a PHY at address 9.

The 2nd stage bootloader (U-Boot) is using GEM1 by default, so we
must specify 2 '-nic' options from the command line in order to get
a working ethernet.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <1598924352-89526-14-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h |  7 ++++++
 hw/riscv/microchip_pfsoc.c         | 39 ++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/char/mchp_pfsoc_mmuart.h"
 #include "hw/dma/sifive_pdma.h"
+#include "hw/net/cadence_gem.h"
 #include "hw/sd/cadence_sdhci.h"
 
 typedef struct MicrochipPFSoCState {
@@ -XXX,XX +XXX,XX @@ typedef struct MicrochipPFSoCState {
     MchpPfSoCMMUartState *serial3;
     MchpPfSoCMMUartState *serial4;
     SiFivePDMAState dma;
+    CadenceGEMState gem0;
+    CadenceGEMState gem1;
     CadenceSDHCIState sdhci;
 } MicrochipPFSoCState;
 
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_MMUART2,
     MICROCHIP_PFSOC_MMUART3,
     MICROCHIP_PFSOC_MMUART4,
+    MICROCHIP_PFSOC_GEM0,
+    MICROCHIP_PFSOC_GEM1,
     MICROCHIP_PFSOC_ENVM_CFG,
     MICROCHIP_PFSOC_ENVM_DATA,
     MICROCHIP_PFSOC_IOSCB_CFG,
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_DMA_IRQ5 = 10,
     MICROCHIP_PFSOC_DMA_IRQ6 = 11,
     MICROCHIP_PFSOC_DMA_IRQ7 = 12,
+    MICROCHIP_PFSOC_GEM0_IRQ = 64,
+    MICROCHIP_PFSOC_GEM1_IRQ = 70,
     MICROCHIP_PFSOC_EMMC_SD_IRQ = 88,
     MICROCHIP_PFSOC_MMUART0_IRQ = 90,
     MICROCHIP_PFSOC_MMUART1_IRQ = 91,
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
  * 3) MMUARTs (Multi-Mode UART)
  * 4) Cadence eMMC/SDHC controller and an SD card connected to it
  * 5) SiFive Platform DMA (Direct Memory Access Controller)
+ * 6) GEM (Gigabit Ethernet MAC Controller)
  *
  * This board currently generates devicetree dynamically that indicates at least
  * two harts and up to five harts.
@@ -XXX,XX +XXX,XX @@
 #define BIOS_FILENAME   "hss.bin"
 #define RESET_VECTOR    0x20220000
 
+/* GEM version */
+#define GEM_REVISION    0x0107010c
+
 static const struct MemmapEntry {
     hwaddr base;
     hwaddr size;
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
     [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,     0x1000 },
     [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,     0x1000 },
     [MICROCHIP_PFSOC_MMUART4] =         { 0x20106000,     0x1000 },
+    [MICROCHIP_PFSOC_GEM0] =            { 0x20110000,     0x2000 },
+    [MICROCHIP_PFSOC_GEM1] =            { 0x20112000,     0x2000 },
     [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,     0x1000 },
     [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
     [MICROCHIP_PFSOC_IOSCB_CFG] =       { 0x37080000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
     object_initialize_child(obj, "dma-controller", &s->dma,
                             TYPE_SIFIVE_PDMA);
 
+    object_initialize_child(obj, "gem0", &s->gem0, TYPE_CADENCE_GEM);
+    object_initialize_child(obj, "gem1", &s->gem1, TYPE_CADENCE_GEM);
+
     object_initialize_child(obj, "sd-controller", &s->sdhci,
                             TYPE_CADENCE_SDHCI);
 }
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     MemoryRegion *envm_data = g_new(MemoryRegion, 1);
     char *plic_hart_config;
     size_t plic_hart_config_len;
+    NICInfo *nd;
     int i;
 
     sysbus_realize(SYS_BUS_DEVICE(&s->e_cpus), &error_abort);
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
         qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART4_IRQ),
         serial_hd(4));
 
+    /* GEMs */
+
+    nd = &nd_table[0];
+    if (nd->used) {
+        qemu_check_nic_model(nd, TYPE_CADENCE_GEM);
+        qdev_set_nic_properties(DEVICE(&s->gem0), nd);
+    }
+    nd = &nd_table[1];
+    if (nd->used) {
+        qemu_check_nic_model(nd, TYPE_CADENCE_GEM);
+        qdev_set_nic_properties(DEVICE(&s->gem1), nd);
+    }
+
+    object_property_set_int(OBJECT(&s->gem0), "revision", GEM_REVISION, errp);
+    object_property_set_int(OBJECT(&s->gem0), "phy-addr", 8, errp);
+    sysbus_realize(SYS_BUS_DEVICE(&s->gem0), errp);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gem0), 0,
+                    memmap[MICROCHIP_PFSOC_GEM0].base);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gem0), 0,
+        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_GEM0_IRQ));
+
+    object_property_set_int(OBJECT(&s->gem1), "revision", GEM_REVISION, errp);
+    object_property_set_int(OBJECT(&s->gem1), "phy-addr", 9, errp);
+    sysbus_realize(SYS_BUS_DEVICE(&s->gem1), errp);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gem1), 0,
+                    memmap[MICROCHIP_PFSOC_GEM1].base);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gem1), 0,
+        qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_GEM1_IRQ));
+
     /* eNVM */
     memory_region_init_rom(envm_data, OBJECT(dev), "microchip.pfsoc.envm.data",
                            memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

Microchip PolarFire SoC integrates 3 GPIOs controllers. It seems
enough to create unimplemented devices to cover their register
spaces at this point.

With this commit, QEMU can boot to U-Boot (2nd stage bootloader)
all the way to the Linux shell login prompt, with a modified HSS
(1st stage bootloader).

For detailed instructions on how to create images for the Icicle
Kit board, please check QEMU RISC-V WiKi page at:
https://wiki.qemu.org/Documentation/Platforms/RISCV

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <1598924352-89526-15-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h |  3 +++
 hw/riscv/microchip_pfsoc.c         | 14 ++++++++++++++
 2 files changed, 17 insertions(+)

From: Bin Meng <bin.meng@windriver.com>

At present the CLINT timestamp is using a hard-coded timebase
frequency value SIFIVE_CLINT_TIMEBASE_FREQ. This might not be
true for all boards.

Add a new 'timebase-freq' property to the CLINT device, and
update various functions to accept this as a parameter.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1598924352-89526-16-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/sifive_clint.h |  4 +++-
 target/riscv/cpu.h              |  6 ++++--
 hw/riscv/microchip_pfsoc.c      |  6 +++++-
 hw/riscv/sifive_clint.c         | 26 +++++++++++++++-----------
 hw/riscv/sifive_e.c             |  3 ++-
 hw/riscv/sifive_u.c             |  3 ++-
 hw/riscv/spike.c                |  3 ++-
 hw/riscv/virt.c                 |  3 ++-
 target/riscv/cpu_helper.c       |  4 +++-
 target/riscv/csr.c              |  4 ++--
 10 files changed, 40 insertions(+), 22 deletions(-)

diff --git a/include/hw/riscv/sifive_clint.h b/include/hw/riscv/sifive_clint.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_clint.h
+++ b/include/hw/riscv/sifive_clint.h
@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveCLINTState {
     uint32_t timecmp_base;
     uint32_t time_base;
     uint32_t aperture_size;
+    uint32_t timebase_freq;
 } SiFiveCLINTState;
 
 DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
     uint32_t hartid_base, uint32_t num_harts, uint32_t sip_base,
-    uint32_t timecmp_base, uint32_t time_base, bool provide_rdtime);
+    uint32_t timecmp_base, uint32_t time_base, uint32_t timebase_freq,
+    bool provide_rdtime);
 
 enum {
     SIFIVE_SIP_BASE     = 0x0,
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
     pmp_table_t pmp_state;
 
     /* machine specific rdtime callback */
-    uint64_t (*rdtime_fn)(void);
+    uint64_t (*rdtime_fn)(uint32_t);
+    uint32_t rdtime_fn_arg;
 
     /* True if in debugger mode.  */
     bool debugger;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env);
 int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint32_t interrupts);
 uint32_t riscv_cpu_update_mip(RISCVCPU *cpu, uint32_t mask, uint32_t value);
 #define BOOL_TO_MASK(x) (-!!(x)) /* helper for riscv_cpu_update_mip value */
-void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(void));
+void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(uint32_t),
+                             uint32_t arg);
 #endif
 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv);
 
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
 #define BIOS_FILENAME   "hss.bin"
 #define RESET_VECTOR    0x20220000
 
+/* CLINT timebase frequency */
+#define CLINT_TIMEBASE_FREQ 1000000
+
 /* GEM version */
 #define GEM_REVISION    0x0107010c
 
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     /* CLINT */
     sifive_clint_create(memmap[MICROCHIP_PFSOC_CLINT].base,
         memmap[MICROCHIP_PFSOC_CLINT].size, 0, ms->smp.cpus,
-        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
+        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
+        CLINT_TIMEBASE_FREQ, false);
 
     /* L2 cache controller */
     create_unimplemented_device("microchip.pfsoc.l2cc",
diff --git a/hw/riscv/sifive_clint.c b/hw/riscv/sifive_clint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_clint.c
+++ b/hw/riscv/sifive_clint.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/sifive_clint.h"
 #include "qemu/timer.h"
 
-static uint64_t cpu_riscv_read_rtc(void)
+static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
 {
     return muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL),
-        SIFIVE_CLINT_TIMEBASE_FREQ, NANOSECONDS_PER_SECOND);
+        timebase_freq, NANOSECONDS_PER_SECOND);
 }
 
 /*
  * Called when timecmp is written to update the QEMU timer or immediately
  * trigger timer interrupt if mtimecmp <= current timer value.
  */
-static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value)
+static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
+                                       uint32_t timebase_freq)
 {
     uint64_t next;
     uint64_t diff;
 
-    uint64_t rtc_r = cpu_riscv_read_rtc();
+    uint64_t rtc_r = cpu_riscv_read_rtc(timebase_freq);
 
     cpu->env.timecmp = value;
     if (cpu->env.timecmp <= rtc_r) {
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value)
     diff = cpu->env.timecmp - rtc_r;
     /* back to ns (note args switched in muldiv64) */
     next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
-        muldiv64(diff, NANOSECONDS_PER_SECOND, SIFIVE_CLINT_TIMEBASE_FREQ);
+        muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
     timer_mod(cpu->env.timer, next);
 }
 
@@ -XXX,XX +XXX,XX @@ static uint64_t sifive_clint_read(void *opaque, hwaddr addr, unsigned size)
         }
     } else if (addr == clint->time_base) {
         /* time_lo */
-        return cpu_riscv_read_rtc() & 0xFFFFFFFF;
+        return cpu_riscv_read_rtc(clint->timebase_freq) & 0xFFFFFFFF;
     } else if (addr == clint->time_base + 4) {
         /* time_hi */
-        return (cpu_riscv_read_rtc() >> 32) & 0xFFFFFFFF;
+        return (cpu_riscv_read_rtc(clint->timebase_freq) >> 32) & 0xFFFFFFFF;
     }
 
     error_report("clint: invalid read: %08x", (uint32_t)addr);
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write(void *opaque, hwaddr addr, uint64_t value,
             /* timecmp_lo */
             uint64_t timecmp_hi = env->timecmp >> 32;
             sifive_clint_write_timecmp(RISCV_CPU(cpu),
-                timecmp_hi << 32 | (value & 0xFFFFFFFF));
+                timecmp_hi << 32 | (value & 0xFFFFFFFF), clint->timebase_freq);
             return;
         } else if ((addr & 0x7) == 4) {
             /* timecmp_hi */
             uint64_t timecmp_lo = env->timecmp;
             sifive_clint_write_timecmp(RISCV_CPU(cpu),
-                value << 32 | (timecmp_lo & 0xFFFFFFFF));
+                value << 32 | (timecmp_lo & 0xFFFFFFFF), clint->timebase_freq);
         } else {
             error_report("clint: invalid timecmp write: %08x", (uint32_t)addr);
         }
@@ -XXX,XX +XXX,XX @@ static Property sifive_clint_properties[] = {
     DEFINE_PROP_UINT32("timecmp-base", SiFiveCLINTState, timecmp_base, 0),
     DEFINE_PROP_UINT32("time-base", SiFiveCLINTState, time_base, 0),
     DEFINE_PROP_UINT32("aperture-size", SiFiveCLINTState, aperture_size, 0),
+    DEFINE_PROP_UINT32("timebase-freq", SiFiveCLINTState, timebase_freq, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -XXX,XX +XXX,XX @@ type_init(sifive_clint_register_types)
  */
 DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
     uint32_t hartid_base, uint32_t num_harts, uint32_t sip_base,
-    uint32_t timecmp_base, uint32_t time_base, bool provide_rdtime)
+    uint32_t timecmp_base, uint32_t time_base, uint32_t timebase_freq,
+    bool provide_rdtime)
 {
     int i;
     for (i = 0; i < num_harts; i++) {
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
             continue;
         }
         if (provide_rdtime) {
-            riscv_cpu_set_rdtime_fn(env, cpu_riscv_read_rtc);
+            riscv_cpu_set_rdtime_fn(env, cpu_riscv_read_rtc, timebase_freq);
         }
         env->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
                                   &sifive_clint_timer_cb, cpu);
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
     qdev_prop_set_uint32(dev, "timecmp-base", timecmp_base);
     qdev_prop_set_uint32(dev, "time-base", time_base);
     qdev_prop_set_uint32(dev, "aperture-size", size);
+    qdev_prop_set_uint32(dev, "timebase-freq", timebase_freq);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
     return dev;
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
         memmap[SIFIVE_E_PLIC].size);
     sifive_clint_create(memmap[SIFIVE_E_CLINT].base,
         memmap[SIFIVE_E_CLINT].size, 0, ms->smp.cpus,
-        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
+        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
+        SIFIVE_CLINT_TIMEBASE_FREQ, false);
     create_unimplemented_device("riscv.sifive.e.aon",
         memmap[SIFIVE_E_AON].base, memmap[SIFIVE_E_AON].size);
     sifive_e_prci_create(memmap[SIFIVE_E_PRCI].base);
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
         serial_hd(1), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_U_UART1_IRQ));
     sifive_clint_create(memmap[SIFIVE_U_CLINT].base,
         memmap[SIFIVE_U_CLINT].size, 0, ms->smp.cpus,
-        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
+        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
+        SIFIVE_CLINT_TIMEBASE_FREQ, false);
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->prci), errp)) {
         return;
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
         sifive_clint_create(
             memmap[SPIKE_CLINT].base + i * memmap[SPIKE_CLINT].size,
             memmap[SPIKE_CLINT].size, base_hartid, hart_count,
-            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, false);
+            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
+            SIFIVE_CLINT_TIMEBASE_FREQ, false);
     }
 
     /* register system main memory (actual RAM) */
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         sifive_clint_create(
             memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
             memmap[VIRT_CLINT].size, base_hartid, hart_count,
-            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE, true);
+            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
+            SIFIVE_CLINT_TIMEBASE_FREQ, true);
 
         /* Per-socket PLIC hart topology configuration string */
         plic_hart_config_len =
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t riscv_cpu_update_mip(RISCVCPU *cpu, uint32_t mask, uint32_t value)
     return old;
 }
 
-void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(void))
+void riscv_cpu_set_rdtime_fn(CPURISCVState *env, uint64_t (*fn)(uint32_t),
+                             uint32_t arg)
 {
     env->rdtime_fn = fn;
+    env->rdtime_fn_arg = arg;
 }
 
 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int read_time(CPURISCVState *env, int csrno, target_ulong *val)
         return -RISCV_EXCP_ILLEGAL_INST;
     }
 
-    *val = env->rdtime_fn() + delta;
+    *val = env->rdtime_fn(env->rdtime_fn_arg) + delta;
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static int read_timeh(CPURISCVState *env, int csrno, target_ulong *val)
         return -RISCV_EXCP_ILLEGAL_INST;
     }
 
-    *val = (env->rdtime_fn() + delta) >> 32;
+    *val = (env->rdtime_fn(env->rdtime_fn_arg) + delta) >> 32;
     return 0;
 }
 #endif
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

SiFive FU540 SoC integrates a platform DMA controller with 4 DMA
channels. This connects the exsiting SiFive PDMA model to the SoC,
and adds its device tree data as well.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1598924352-89526-17-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/sifive_u.h | 11 +++++++++++
 hw/riscv/sifive_u.c         | 30 ++++++++++++++++++++++++++++++
 hw/riscv/Kconfig            |  1 +
 3 files changed, 42 insertions(+)

diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_u.h
+++ b/include/hw/riscv/sifive_u.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HW_SIFIVE_U_H
 #define HW_SIFIVE_U_H
 
+#include "hw/dma/sifive_pdma.h"
 #include "hw/net/cadence_gem.h"
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_cpu.h"
@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveUSoCState {
     SiFiveUPRCIState prci;
     SIFIVEGPIOState gpio;
     SiFiveUOTPState otp;
+    SiFivePDMAState dma;
     CadenceGEMState gem;
 
     uint32_t serial;
@@ -XXX,XX +XXX,XX @@ enum {
     SIFIVE_U_MROM,
     SIFIVE_U_CLINT,
     SIFIVE_U_L2CC,
+    SIFIVE_U_PDMA,
     SIFIVE_U_L2LIM,
     SIFIVE_U_PLIC,
     SIFIVE_U_PRCI,
@@ -XXX,XX +XXX,XX @@ enum {
     SIFIVE_U_GPIO_IRQ13 = 20,
     SIFIVE_U_GPIO_IRQ14 = 21,
     SIFIVE_U_GPIO_IRQ15 = 22,
+    SIFIVE_U_PDMA_IRQ0 = 23,
+    SIFIVE_U_PDMA_IRQ1 = 24,
+    SIFIVE_U_PDMA_IRQ2 = 25,
+    SIFIVE_U_PDMA_IRQ3 = 26,
+    SIFIVE_U_PDMA_IRQ4 = 27,
+    SIFIVE_U_PDMA_IRQ5 = 28,
+    SIFIVE_U_PDMA_IRQ6 = 29,
+    SIFIVE_U_PDMA_IRQ7 = 30,
     SIFIVE_U_GEM_IRQ = 0x35
 };
 
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@
  * 4) GPIO (General Purpose Input/Output Controller)
  * 5) OTP (One-Time Programmable) memory with stored serial number
  * 6) GEM (Gigabit Ethernet Controller) and management block
+ * 7) DMA (Direct Memory Access Controller)
  *
  * This board currently generates devicetree dynamically that indicates at least
  * two harts and up to five harts.
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
     [SIFIVE_U_MROM] =     {     0x1000,     0xf000 },
     [SIFIVE_U_CLINT] =    {  0x2000000,    0x10000 },
     [SIFIVE_U_L2CC] =     {  0x2010000,     0x1000 },
+    [SIFIVE_U_PDMA] =     {  0x3000000,   0x100000 },
     [SIFIVE_U_L2LIM] =    {  0x8000000,  0x2000000 },
     [SIFIVE_U_PLIC] =     {  0xc000000,  0x4000000 },
     [SIFIVE_U_PRCI] =     { 0x10000000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const struct MemmapEntry *memmap,
     qemu_fdt_setprop_string(fdt, nodename, "compatible", "gpio-restart");
     g_free(nodename);
 
+    nodename = g_strdup_printf("/soc/dma@%lx",
+        (long)memmap[SIFIVE_U_PDMA].base);
+    qemu_fdt_add_subnode(fdt, nodename);
+    qemu_fdt_setprop_cell(fdt, nodename, "#dma-cells", 1);
+    qemu_fdt_setprop_cells(fdt, nodename, "interrupts",
+        SIFIVE_U_PDMA_IRQ0, SIFIVE_U_PDMA_IRQ1, SIFIVE_U_PDMA_IRQ2,
+        SIFIVE_U_PDMA_IRQ3, SIFIVE_U_PDMA_IRQ4, SIFIVE_U_PDMA_IRQ5,
+        SIFIVE_U_PDMA_IRQ6, SIFIVE_U_PDMA_IRQ7);
+    qemu_fdt_setprop_cell(fdt, nodename, "interrupt-parent", plic_phandle);
+    qemu_fdt_setprop_cells(fdt, nodename, "reg",
+        0x0, memmap[SIFIVE_U_PDMA].base,
+        0x0, memmap[SIFIVE_U_PDMA].size);
+    qemu_fdt_setprop_string(fdt, nodename, "compatible",
+                            "sifive,fu540-c000-pdma");
+    g_free(nodename);
+
     nodename = g_strdup_printf("/soc/cache-controller@%lx",
         (long)memmap[SIFIVE_U_L2CC].base);
     qemu_fdt_add_subnode(fdt, nodename);
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_instance_init(Object *obj)
     object_initialize_child(obj, "otp", &s->otp, TYPE_SIFIVE_U_OTP);
     object_initialize_child(obj, "gem", &s->gem, TYPE_CADENCE_GEM);
     object_initialize_child(obj, "gpio", &s->gpio, TYPE_SIFIVE_GPIO);
+    object_initialize_child(obj, "pdma", &s->dma, TYPE_SIFIVE_PDMA);
 }
 
 static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
                                             SIFIVE_U_GPIO_IRQ0 + i));
     }
 
+    /* PDMA */
+    sysbus_realize(SYS_BUS_DEVICE(&s->dma), errp);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->dma), 0, memmap[SIFIVE_U_PDMA].base);
+
+    /* Connect PDMA interrupts to the PLIC */
+    for (i = 0; i < SIFIVE_PDMA_IRQS; i++) {
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->dma), i,
+                           qdev_get_gpio_in(DEVICE(s->plic),
+                                            SIFIVE_U_PDMA_IRQ0 + i));
+    }
+
     qdev_prop_set_uint32(DEVICE(&s->otp), "serial", s->serial);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->otp), errp)) {
         return;
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
     select CADENCE
     select HART
     select SIFIVE
+    select SIFIVE_PDMA
     select UNIMP
 
 config SPIKE
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

This is an effort to clean up the hw/riscv directory. Ideally it
should only contain the RISC-V SoC / machine codes plus generic
codes. Let's move sifive_e_prci model to hw/misc directory.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-2-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/{riscv => misc}/sifive_e_prci.h | 0
 hw/{riscv => misc}/sifive_e_prci.c         | 2 +-
 hw/riscv/sifive_e.c                        | 2 +-
 hw/misc/Kconfig                            | 3 +++
 hw/misc/meson.build                        | 3 +++
 hw/riscv/Kconfig                           | 1 +
 hw/riscv/meson.build                       | 1 -
 7 files changed, 9 insertions(+), 3 deletions(-)
 rename include/hw/{riscv => misc}/sifive_e_prci.h (100%)
 rename hw/{riscv => misc}/sifive_e_prci.c (99%)

diff --git a/include/hw/riscv/sifive_e_prci.h b/include/hw/misc/sifive_e_prci.h
similarity index 100%
rename from include/hw/riscv/sifive_e_prci.h
rename to include/hw/misc/sifive_e_prci.h
diff --git a/hw/riscv/sifive_e_prci.c b/hw/misc/sifive_e_prci.c
similarity index 99%
rename from hw/riscv/sifive_e_prci.c
rename to hw/misc/sifive_e_prci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e_prci.c
+++ b/hw/misc/sifive_e_prci.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "hw/hw.h"
-#include "hw/riscv/sifive_e_prci.h"
+#include "hw/misc/sifive_e_prci.h"
 
 static uint64_t sifive_e_prci_read(void *opaque, hwaddr addr, unsigned int size)
 {
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/sifive_clint.h"
 #include "hw/riscv/sifive_uart.h"
 #include "hw/riscv/sifive_e.h"
-#include "hw/riscv/sifive_e_prci.h"
 #include "hw/riscv/boot.h"
+#include "hw/misc/sifive_e_prci.h"
 #include "chardev/char.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config MAC_VIA
 config AVR_POWER
     bool
 
+config SIFIVE_E_PRCI
+    bool
+
 source macio/Kconfig
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM11SCU', if_true: files('arm11scu.c'))
 # Mac devices
 softmmu_ss.add(when: 'CONFIG_MOS6522', if_true: files('mos6522.c'))
 
+# RISC-V devices
+softmmu_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
+
 # PKUnity SoC devices
 softmmu_ss.add(when: 'CONFIG_PUV3', if_true: files('puv3_pm.c'))
 
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
     bool
     select HART
     select SIFIVE
+    select SIFIVE_E_PRCI
     select UNIMP
 
 config SIFIVE_U
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_plic.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
-riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e_prci.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_otp.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_prci.c'))
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

This is an effort to clean up the hw/riscv directory. Ideally it
should only contain the RISC-V SoC / machine codes plus generic
codes. Let's move sifive_u_prci model to hw/misc directory.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-3-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/{riscv => misc}/sifive_u_prci.h | 0
 include/hw/riscv/sifive_u.h                | 2 +-
 hw/{riscv => misc}/sifive_u_prci.c         | 2 +-
 hw/misc/Kconfig                            | 3 +++
 hw/misc/meson.build                        | 1 +
 hw/riscv/Kconfig                           | 1 +
 hw/riscv/meson.build                       | 1 -
 7 files changed, 7 insertions(+), 3 deletions(-)
 rename include/hw/{riscv => misc}/sifive_u_prci.h (100%)
 rename hw/{riscv => misc}/sifive_u_prci.c (99%)

diff --git a/include/hw/riscv/sifive_u_prci.h b/include/hw/misc/sifive_u_prci.h
similarity index 100%
rename from include/hw/riscv/sifive_u_prci.h
rename to include/hw/misc/sifive_u_prci.h
diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_u.h
+++ b/include/hw/riscv/sifive_u.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_cpu.h"
 #include "hw/riscv/sifive_gpio.h"
-#include "hw/riscv/sifive_u_prci.h"
 #include "hw/riscv/sifive_u_otp.h"
+#include "hw/misc/sifive_u_prci.h"
 
 #define TYPE_RISCV_U_SOC "riscv.sifive.u.soc"
 #define RISCV_U_SOC(obj) \
diff --git a/hw/riscv/sifive_u_prci.c b/hw/misc/sifive_u_prci.c
similarity index 99%
rename from hw/riscv/sifive_u_prci.c
rename to hw/misc/sifive_u_prci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u_prci.c
+++ b/hw/misc/sifive_u_prci.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
-#include "hw/riscv/sifive_u_prci.h"
+#include "hw/misc/sifive_u_prci.h"
 
 static uint64_t sifive_u_prci_read(void *opaque, hwaddr addr, unsigned int size)
 {
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config AVR_POWER
 config SIFIVE_E_PRCI
     bool
 
+config SIFIVE_U_PRCI
+    bool
+
 source macio/Kconfig
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_MOS6522', if_true: files('mos6522.c'))
 
 # RISC-V devices
 softmmu_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
+softmmu_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
 
 # PKUnity SoC devices
 softmmu_ss.add(when: 'CONFIG_PUV3', if_true: files('puv3_pm.c'))
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
     select HART
     select SIFIVE
     select SIFIVE_PDMA
+    select SIFIVE_U_PRCI
     select UNIMP
 
 config SPIKE
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_otp.c'))
-riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_prci.c'))
 riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('riscv_htif.c'))
 riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
 riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

This is an effort to clean up the hw/riscv directory. Ideally it
should only contain the RISC-V SoC / machine codes plus generic
codes. Let's move sifive_u_otp model to hw/misc directory.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-4-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/{riscv => misc}/sifive_u_otp.h | 0
 include/hw/riscv/sifive_u.h               | 2 +-
 hw/{riscv => misc}/sifive_u_otp.c         | 2 +-
 hw/misc/Kconfig                           | 3 +++
 hw/misc/meson.build                       | 1 +
 hw/riscv/Kconfig                          | 1 +
 hw/riscv/meson.build                      | 1 -
 7 files changed, 7 insertions(+), 3 deletions(-)
 rename include/hw/{riscv => misc}/sifive_u_otp.h (100%)
 rename hw/{riscv => misc}/sifive_u_otp.c (99%)

diff --git a/include/hw/riscv/sifive_u_otp.h b/include/hw/misc/sifive_u_otp.h
similarity index 100%
rename from include/hw/riscv/sifive_u_otp.h
rename to include/hw/misc/sifive_u_otp.h
diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_u.h
+++ b/include/hw/riscv/sifive_u.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_cpu.h"
 #include "hw/riscv/sifive_gpio.h"
-#include "hw/riscv/sifive_u_otp.h"
+#include "hw/misc/sifive_u_otp.h"
 #include "hw/misc/sifive_u_prci.h"
 
 #define TYPE_RISCV_U_SOC "riscv.sifive.u.soc"
diff --git a/hw/riscv/sifive_u_otp.c b/hw/misc/sifive_u_otp.c
similarity index 99%
rename from hw/riscv/sifive_u_otp.c
rename to hw/misc/sifive_u_otp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u_otp.c
+++ b/hw/misc/sifive_u_otp.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
-#include "hw/riscv/sifive_u_otp.h"
+#include "hw/misc/sifive_u_otp.h"
 
 static uint64_t sifive_u_otp_read(void *opaque, hwaddr addr, unsigned int size)
 {
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config AVR_POWER
 config SIFIVE_E_PRCI
     bool
 
+config SIFIVE_U_OTP
+    bool
+
 config SIFIVE_U_PRCI
     bool
 
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_MOS6522', if_true: files('mos6522.c'))
 
 # RISC-V devices
 softmmu_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
+softmmu_ss.add(when: 'CONFIG_SIFIVE_U_OTP', if_true: files('sifive_u_otp.c'))
 softmmu_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
 
 # PKUnity SoC devices
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
     select HART
     select SIFIVE
     select SIFIVE_PDMA
+    select SIFIVE_U_OTP
     select SIFIVE_U_PRCI
     select UNIMP
 
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
-riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u_otp.c'))
 riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('riscv_htif.c'))
 riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
 riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

This is an effort to clean up the hw/riscv directory. Ideally it
should only contain the RISC-V SoC / machine codes plus generic
codes. Let's move sifive_gpio model to hw/gpio directory.

Note this also removes the trace-events in the hw/riscv directory,
since gpio is the only supported trace target in that directory.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-5-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/trace.h                         | 1 -
 include/hw/{riscv => gpio}/sifive_gpio.h | 0
 include/hw/riscv/sifive_e.h              | 2 +-
 include/hw/riscv/sifive_u.h              | 2 +-
 hw/{riscv => gpio}/sifive_gpio.c         | 2 +-
 hw/gpio/Kconfig                          | 3 +++
 hw/gpio/meson.build                      | 1 +
 hw/gpio/trace-events                     | 6 ++++++
 hw/riscv/Kconfig                         | 2 ++
 hw/riscv/meson.build                     | 1 -
 hw/riscv/trace-events                    | 7 -------
 meson.build                              | 1 -
 12 files changed, 15 insertions(+), 13 deletions(-)
 delete mode 100644 hw/riscv/trace.h
 rename include/hw/{riscv => gpio}/sifive_gpio.h (100%)
 rename hw/{riscv => gpio}/sifive_gpio.c (99%)
 delete mode 100644 hw/riscv/trace-events

diff --git a/hw/riscv/trace.h b/hw/riscv/trace.h
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/hw/riscv/trace.h
+++ /dev/null
@@ -1 +0,0 @@
-#include "trace/trace-hw_riscv.h"
diff --git a/include/hw/riscv/sifive_gpio.h b/include/hw/gpio/sifive_gpio.h
similarity index 100%
rename from include/hw/riscv/sifive_gpio.h
rename to include/hw/gpio/sifive_gpio.h
diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_e.h
+++ b/include/hw/riscv/sifive_e.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_cpu.h"
-#include "hw/riscv/sifive_gpio.h"
+#include "hw/gpio/sifive_gpio.h"
 
 #define TYPE_RISCV_E_SOC "riscv.sifive.e.soc"
 #define RISCV_E_SOC(obj) \
diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_u.h
+++ b/include/hw/riscv/sifive_u.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/cadence_gem.h"
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_cpu.h"
-#include "hw/riscv/sifive_gpio.h"
+#include "hw/gpio/sifive_gpio.h"
 #include "hw/misc/sifive_u_otp.h"
 #include "hw/misc/sifive_u_prci.h"
 
diff --git a/hw/riscv/sifive_gpio.c b/hw/gpio/sifive_gpio.c
similarity index 99%
rename from hw/riscv/sifive_gpio.c
rename to hw/gpio/sifive_gpio.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_gpio.c
+++ b/hw/gpio/sifive_gpio.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
-#include "hw/riscv/sifive_gpio.h"
+#include "hw/gpio/sifive_gpio.h"
 #include "migration/vmstate.h"
 #include "trace.h"
 
diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Kconfig
+++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config PL061
 
 config GPIO_KEY
     bool
+
+config SIFIVE_GPIO
+    bool
diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/meson.build
+++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_gpio.c'))
 softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_gpio.c'))
 softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_gpio.c'))
 softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
+softmmu_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/trace-events
+++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ nrf51_gpio_read(uint64_t offset, uint64_t r) "offset 0x%" PRIx64 " value 0x%" PR
 nrf51_gpio_write(uint64_t offset, uint64_t value) "offset 0x%" PRIx64 " value 0x%" PRIx64
 nrf51_gpio_set(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
 nrf51_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
+
+# sifive_gpio.c
+sifive_gpio_read(uint64_t offset, uint64_t r) "offset 0x%" PRIx64 " value 0x%" PRIx64
+sifive_gpio_write(uint64_t offset, uint64_t value) "offset 0x%" PRIx64 " value 0x%" PRIx64
+sifive_gpio_set(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
+sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
     bool
     select HART
     select SIFIVE
+    select SIFIVE_GPIO
     select SIFIVE_E_PRCI
     select UNIMP
 
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
     select CADENCE
     select HART
     select SIFIVE
+    select SIFIVE_GPIO
     select SIFIVE_PDMA
     select SIFIVE_U_OTP
     select SIFIVE_U_PRCI
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
 riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
 riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_clint.c'))
-riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_gpio.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_plic.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
diff --git a/hw/riscv/trace-events b/hw/riscv/trace-events
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/hw/riscv/trace-events
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# See docs/devel/tracing.txt for syntax documentation.
-
-# hw/gpio/sifive_gpio.c
-sifive_gpio_read(uint64_t offset, uint64_t r) "offset 0x%" PRIx64 " value 0x%" PRIx64
-sifive_gpio_write(uint64_t offset, uint64_t value) "offset 0x%" PRIx64 " value 0x%" PRIx64
-sifive_gpio_set(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
-sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if have_system
     'hw/watchdog',
     'hw/xen',
     'hw/gpio',
-    'hw/riscv',
     'migration',
     'net',
     'ui',
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

This is an effort to clean up the hw/riscv directory. Ideally it
should only contain the RISC-V SoC / machine codes plus generic
codes. Let's move sifive_clint model to hw/intc directory.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-6-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/{riscv => intc}/sifive_clint.h | 0
 hw/{riscv => intc}/sifive_clint.c         | 2 +-
 hw/riscv/microchip_pfsoc.c                | 2 +-
 hw/riscv/sifive_e.c                       | 2 +-
 hw/riscv/sifive_u.c                       | 2 +-
 hw/riscv/spike.c                          | 2 +-
 hw/riscv/virt.c                           | 2 +-
 hw/intc/Kconfig                           | 3 +++
 hw/intc/meson.build                       | 1 +
 hw/riscv/Kconfig                          | 5 +++++
 hw/riscv/meson.build                      | 1 -
 11 files changed, 15 insertions(+), 7 deletions(-)
 rename include/hw/{riscv => intc}/sifive_clint.h (100%)
 rename hw/{riscv => intc}/sifive_clint.c (99%)

diff --git a/include/hw/riscv/sifive_clint.h b/include/hw/intc/sifive_clint.h
similarity index 100%
rename from include/hw/riscv/sifive_clint.h
rename to include/hw/intc/sifive_clint.h
diff --git a/hw/riscv/sifive_clint.c b/hw/intc/sifive_clint.c
similarity index 99%
rename from hw/riscv/sifive_clint.c
rename to hw/intc/sifive_clint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_clint.c
+++ b/hw/intc/sifive_clint.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "target/riscv/cpu.h"
 #include "hw/qdev-properties.h"
-#include "hw/riscv/sifive_clint.h"
+#include "hw/intc/sifive_clint.h"
 #include "qemu/timer.h"
 
 static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/unimp.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/riscv_hart.h"
-#include "hw/riscv/sifive_clint.h"
 #include "hw/riscv/sifive_plic.h"
 #include "hw/riscv/microchip_pfsoc.h"
+#include "hw/intc/sifive_clint.h"
 #include "sysemu/sysemu.h"
 
 /*
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_plic.h"
-#include "hw/riscv/sifive_clint.h"
 #include "hw/riscv/sifive_uart.h"
 #include "hw/riscv/sifive_e.h"
 #include "hw/riscv/boot.h"
+#include "hw/intc/sifive_clint.h"
 #include "hw/misc/sifive_e_prci.h"
 #include "chardev/char.h"
 #include "sysemu/arch_init.h"
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_plic.h"
-#include "hw/riscv/sifive_clint.h"
 #include "hw/riscv/sifive_uart.h"
 #include "hw/riscv/sifive_u.h"
 #include "hw/riscv/boot.h"
+#include "hw/intc/sifive_clint.h"
 #include "chardev/char.h"
 #include "net/eth.h"
 #include "sysemu/arch_init.h"
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "hw/riscv/riscv_htif.h"
 #include "hw/riscv/riscv_hart.h"
-#include "hw/riscv/sifive_clint.h"
 #include "hw/riscv/spike.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
+#include "hw/intc/sifive_clint.h"
 #include "chardev/char.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/device_tree.h"
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_plic.h"
-#include "hw/riscv/sifive_clint.h"
 #include "hw/riscv/sifive_test.h"
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
+#include "hw/intc/sifive_clint.h"
 #include "chardev/char.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/device_tree.h"
diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -XXX,XX +XXX,XX @@ config RX_ICU
 
 config LOONGSON_LIOINTC
     bool
+
+config SIFIVE_CLINT
+    bool
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: 'CONFIG_RX_ICU', if_true: files('rx_icu.c'))
 specific_ss.add(when: 'CONFIG_S390_FLIC', if_true: files('s390_flic.c'))
 specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: files('s390_flic_kvm.c'))
 specific_ss.add(when: 'CONFIG_SH4', if_true: files('sh_intc.c'))
+specific_ss.add(when: 'CONFIG_SIFIVE_CLINT', if_true: files('sifive_clint.c'))
 specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c'))
 specific_ss.add(when: 'CONFIG_XICS_KVM', if_true: files('xics_kvm.c'))
 specific_ss.add(when: 'CONFIG_XICS_SPAPR', if_true: files('xics_spapr.c'))
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
     bool
     select HART
     select SIFIVE
+    select SIFIVE_CLINT
     select SIFIVE_GPIO
     select SIFIVE_E_PRCI
     select UNIMP
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
     select CADENCE
     select HART
     select SIFIVE
+    select SIFIVE_CLINT
     select SIFIVE_GPIO
     select SIFIVE_PDMA
     select SIFIVE_U_OTP
@@ -XXX,XX +XXX,XX @@ config SPIKE
     select HART
     select HTIF
     select SIFIVE
+    select SIFIVE_CLINT
 
 config OPENTITAN
     bool
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select PCI_EXPRESS_GENERIC_BRIDGE
     select PFLASH_CFI01
     select SIFIVE
+    select SIFIVE_CLINT
 
 config MICROCHIP_PFSOC
     bool
     select HART
     select SIFIVE
+    select SIFIVE_CLINT
     select UNIMP
     select MCHP_PFSOC_MMUART
     select SIFIVE_PDMA
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files('numa.c'))
 riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
 riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
 riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
-riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_clint.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_plic.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

This is an effort to clean up the hw/riscv directory. Ideally it
should only contain the RISC-V SoC / machine codes plus generic
codes. Let's move sifive_plic model to hw/intc directory.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-7-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 {include/hw/riscv => hw/intc}/sifive_plic.h | 0
 hw/{riscv => intc}/sifive_plic.c            | 2 +-
 hw/riscv/microchip_pfsoc.c                  | 2 +-
 hw/riscv/sifive_e.c                         | 2 +-
 hw/riscv/sifive_u.c                         | 2 +-
 hw/riscv/virt.c                             | 2 +-
 hw/intc/Kconfig                             | 3 +++
 hw/intc/meson.build                         | 1 +
 hw/riscv/Kconfig                            | 5 +++++
 hw/riscv/meson.build                        | 1 -
 10 files changed, 14 insertions(+), 6 deletions(-)
 rename {include/hw/riscv => hw/intc}/sifive_plic.h (100%)
 rename hw/{riscv => intc}/sifive_plic.c (99%)

diff --git a/include/hw/riscv/sifive_plic.h b/hw/intc/sifive_plic.h
similarity index 100%
rename from include/hw/riscv/sifive_plic.h
rename to hw/intc/sifive_plic.h
diff --git a/hw/riscv/sifive_plic.c b/hw/intc/sifive_plic.c
similarity index 99%
rename from hw/riscv/sifive_plic.c
rename to hw/intc/sifive_plic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_plic.c
+++ b/hw/intc/sifive_plic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/pci/msi.h"
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"
+#include "hw/intc/sifive_plic.h"
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
-#include "hw/riscv/sifive_plic.h"
 
 #define RISCV_DEBUG_PLIC 0
 
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/unimp.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/riscv_hart.h"
-#include "hw/riscv/sifive_plic.h"
 #include "hw/riscv/microchip_pfsoc.h"
 #include "hw/intc/sifive_clint.h"
+#include "hw/intc/sifive_plic.h"
 #include "sysemu/sysemu.h"
 
 /*
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/unimp.h"
 #include "target/riscv/cpu.h"
 #include "hw/riscv/riscv_hart.h"
-#include "hw/riscv/sifive_plic.h"
 #include "hw/riscv/sifive_uart.h"
 #include "hw/riscv/sifive_e.h"
 #include "hw/riscv/boot.h"
 #include "hw/intc/sifive_clint.h"
+#include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_e_prci.h"
 #include "chardev/char.h"
 #include "sysemu/arch_init.h"
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/unimp.h"
 #include "target/riscv/cpu.h"
 #include "hw/riscv/riscv_hart.h"
-#include "hw/riscv/sifive_plic.h"
 #include "hw/riscv/sifive_uart.h"
 #include "hw/riscv/sifive_u.h"
 #include "hw/riscv/boot.h"
 #include "hw/intc/sifive_clint.h"
+#include "hw/intc/sifive_plic.h"
 #include "chardev/char.h"
 #include "net/eth.h"
 #include "sysemu/arch_init.h"
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/char/serial.h"
 #include "target/riscv/cpu.h"
 #include "hw/riscv/riscv_hart.h"
-#include "hw/riscv/sifive_plic.h"
 #include "hw/riscv/sifive_test.h"
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
 #include "hw/intc/sifive_clint.h"
+#include "hw/intc/sifive_plic.h"
 #include "chardev/char.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/device_tree.h"
diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -XXX,XX +XXX,XX @@ config LOONGSON_LIOINTC
 
 config SIFIVE_CLINT
     bool
+
+config SIFIVE_PLIC
+    bool
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: 'CONFIG_S390_FLIC', if_true: files('s390_flic.c'))
 specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: files('s390_flic_kvm.c'))
 specific_ss.add(when: 'CONFIG_SH4', if_true: files('sh_intc.c'))
 specific_ss.add(when: 'CONFIG_SIFIVE_CLINT', if_true: files('sifive_clint.c'))
+specific_ss.add(when: 'CONFIG_SIFIVE_PLIC', if_true: files('sifive_plic.c'))
 specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c'))
 specific_ss.add(when: 'CONFIG_XICS_KVM', if_true: files('xics_kvm.c'))
 specific_ss.add(when: 'CONFIG_XICS_SPAPR', if_true: files('xics_spapr.c'))
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
     select SIFIVE
     select SIFIVE_CLINT
     select SIFIVE_GPIO
+    select SIFIVE_PLIC
     select SIFIVE_E_PRCI
     select UNIMP
 
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
     select SIFIVE_CLINT
     select SIFIVE_GPIO
     select SIFIVE_PDMA
+    select SIFIVE_PLIC
     select SIFIVE_U_OTP
     select SIFIVE_U_PRCI
     select UNIMP
@@ -XXX,XX +XXX,XX @@ config SPIKE
     select HTIF
     select SIFIVE
     select SIFIVE_CLINT
+    select SIFIVE_PLIC
 
 config OPENTITAN
     bool
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select PFLASH_CFI01
     select SIFIVE
     select SIFIVE_CLINT
+    select SIFIVE_PLIC
 
 config MICROCHIP_PFSOC
     bool
@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
     select UNIMP
     select MCHP_PFSOC_MMUART
     select SIFIVE_PDMA
+    select SIFIVE_PLIC
     select CADENCE_SDHCI
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files('numa.c'))
 riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
 riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
 riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
-riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_plic.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

This is an effort to clean up the hw/riscv directory. Ideally it
should only contain the RISC-V SoC / machine codes plus generic
codes. Let's move riscv_htif model to hw/char directory.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-8-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/{riscv => char}/riscv_htif.h | 0
 hw/{riscv => char}/riscv_htif.c         | 2 +-
 hw/riscv/spike.c                        | 2 +-
 hw/char/Kconfig                         | 3 +++
 hw/char/meson.build                     | 1 +
 hw/riscv/Kconfig                        | 3 ---
 hw/riscv/meson.build                    | 1 -
 7 files changed, 6 insertions(+), 6 deletions(-)
 rename include/hw/{riscv => char}/riscv_htif.h (100%)
 rename hw/{riscv => char}/riscv_htif.c (99%)

diff --git a/include/hw/riscv/riscv_htif.h b/include/hw/char/riscv_htif.h
similarity index 100%
rename from include/hw/riscv/riscv_htif.h
rename to include/hw/char/riscv_htif.h
diff --git a/hw/riscv/riscv_htif.c b/hw/char/riscv_htif.c
similarity index 99%
rename from hw/riscv/riscv_htif.c
rename to hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/log.h"
 #include "hw/sysbus.h"
+#include "hw/char/riscv_htif.h"
 #include "hw/char/serial.h"
 #include "chardev/char.h"
 #include "chardev/char-fe.h"
-#include "hw/riscv/riscv_htif.h"
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
 
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/loader.h"
 #include "hw/sysbus.h"
 #include "target/riscv/cpu.h"
-#include "hw/riscv/riscv_htif.h"
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/spike.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
+#include "hw/char/riscv_htif.h"
 #include "hw/intc/sifive_clint.h"
 #include "chardev/char.h"
 #include "sysemu/arch_init.h"
diff --git a/hw/char/Kconfig b/hw/char/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/Kconfig
+++ b/hw/char/Kconfig
@@ -XXX,XX +XXX,XX @@
 config ESCC
     bool
 
+config HTIF
+    bool
+
 config PARALLEL
     bool
     default y
diff --git a/hw/char/meson.build b/hw/char/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/meson.build
+++ b/hw/char/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_SH4', if_true: files('sh_serial.c'))
 softmmu_ss.add(when: 'CONFIG_STM32F2XX_USART', if_true: files('stm32f2xx_usart.c'))
 softmmu_ss.add(when: 'CONFIG_MCHP_PFSOC_MMUART', if_true: files('mchp_pfsoc_mmuart.c'))
 
+specific_ss.add(when: 'CONFIG_HTIF', if_true: files('riscv_htif.c'))
 specific_ss.add(when: 'CONFIG_TERMINAL3270', if_true: files('terminal3270.c'))
 specific_ss.add(when: 'CONFIG_VIRTIO', if_true: files('virtio-serial-bus.c'))
 specific_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr_vty.c'))
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@
-config HTIF
-    bool
-
 config HART
     bool
 
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
-riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('riscv_htif.c'))
 riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
 riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
 
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

This is an effort to clean up the hw/riscv directory. Ideally it
should only contain the RISC-V SoC / machine codes plus generic
codes. Let's move sifive_uart model to hw/char directory.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-9-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/{riscv => char}/sifive_uart.h | 0
 hw/{riscv => char}/sifive_uart.c         | 2 +-
 hw/riscv/sifive_e.c                      | 2 +-
 hw/riscv/sifive_u.c                      | 2 +-
 hw/char/Kconfig                          | 3 +++
 hw/char/meson.build                      | 1 +
 hw/riscv/Kconfig                         | 2 ++
 hw/riscv/meson.build                     | 1 -
 8 files changed, 9 insertions(+), 4 deletions(-)
 rename include/hw/{riscv => char}/sifive_uart.h (100%)
 rename hw/{riscv => char}/sifive_uart.c (99%)

diff --git a/include/hw/riscv/sifive_uart.h b/include/hw/char/sifive_uart.h
similarity index 100%
rename from include/hw/riscv/sifive_uart.h
rename to include/hw/char/sifive_uart.h
diff --git a/hw/riscv/sifive_uart.c b/hw/char/sifive_uart.c
similarity index 99%
rename from hw/riscv/sifive_uart.c
rename to hw/char/sifive_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_uart.c
+++ b/hw/char/sifive_uart.c
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "hw/hw.h"
 #include "hw/irq.h"
-#include "hw/riscv/sifive_uart.h"
+#include "hw/char/sifive_uart.h"
 
 /*
  * Not yet implemented:
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/unimp.h"
 #include "target/riscv/cpu.h"
 #include "hw/riscv/riscv_hart.h"
-#include "hw/riscv/sifive_uart.h"
 #include "hw/riscv/sifive_e.h"
 #include "hw/riscv/boot.h"
+#include "hw/char/sifive_uart.h"
 #include "hw/intc/sifive_clint.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_e_prci.h"
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/unimp.h"
 #include "target/riscv/cpu.h"
 #include "hw/riscv/riscv_hart.h"
-#include "hw/riscv/sifive_uart.h"
 #include "hw/riscv/sifive_u.h"
 #include "hw/riscv/boot.h"
+#include "hw/char/sifive_uart.h"
 #include "hw/intc/sifive_clint.h"
 #include "hw/intc/sifive_plic.h"
 #include "chardev/char.h"
diff --git a/hw/char/Kconfig b/hw/char/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/Kconfig
+++ b/hw/char/Kconfig
@@ -XXX,XX +XXX,XX @@ config AVR_USART
 
 config MCHP_PFSOC_MMUART
     bool
+
+config SIFIVE_UART
+    bool
diff --git a/hw/char/meson.build b/hw/char/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/meson.build
+++ b/hw/char/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4210_uart.c'))
 softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_uart.c'))
 softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_aux.c'))
 softmmu_ss.add(when: 'CONFIG_RENESAS_SCI', if_true: files('renesas_sci.c'))
+softmmu_ss.add(when: 'CONFIG_SIFIVE_UART', if_true: files('sifive_uart.c'))
 softmmu_ss.add(when: 'CONFIG_SH4', if_true: files('sh_serial.c'))
 softmmu_ss.add(when: 'CONFIG_STM32F2XX_USART', if_true: files('stm32f2xx_usart.c'))
 softmmu_ss.add(when: 'CONFIG_MCHP_PFSOC_MMUART', if_true: files('mchp_pfsoc_mmuart.c'))
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
     select SIFIVE_CLINT
     select SIFIVE_GPIO
     select SIFIVE_PLIC
+    select SIFIVE_UART
     select SIFIVE_E_PRCI
     select UNIMP
 
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
     select SIFIVE_GPIO
     select SIFIVE_PDMA
     select SIFIVE_PLIC
+    select SIFIVE_UART
     select SIFIVE_U_OTP
     select SIFIVE_U_PRCI
     select UNIMP
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
 riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
 riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
-riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_uart.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
 riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

This is an effort to clean up the hw/riscv directory. Ideally it
should only contain the RISC-V SoC / machine codes plus generic
codes. Let's move sifive_test model to hw/misc directory.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-10-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/{riscv => misc}/sifive_test.h | 0
 hw/{riscv => misc}/sifive_test.c         | 2 +-
 hw/riscv/virt.c                          | 2 +-
 hw/misc/Kconfig                          | 3 +++
 hw/misc/meson.build                      | 1 +
 hw/riscv/Kconfig                         | 1 +
 hw/riscv/meson.build                     | 1 -
 7 files changed, 7 insertions(+), 3 deletions(-)
 rename include/hw/{riscv => misc}/sifive_test.h (100%)
 rename hw/{riscv => misc}/sifive_test.c (98%)

diff --git a/include/hw/riscv/sifive_test.h b/include/hw/misc/sifive_test.h
similarity index 100%
rename from include/hw/riscv/sifive_test.h
rename to include/hw/misc/sifive_test.h
diff --git a/hw/riscv/sifive_test.c b/hw/misc/sifive_test.c
similarity index 98%
rename from hw/riscv/sifive_test.c
rename to hw/misc/sifive_test.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_test.c
+++ b/hw/misc/sifive_test.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "sysemu/runstate.h"
 #include "hw/hw.h"
-#include "hw/riscv/sifive_test.h"
+#include "hw/misc/sifive_test.h"
 
 static uint64_t sifive_test_read(void *opaque, hwaddr addr, unsigned int size)
 {
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/char/serial.h"
 #include "target/riscv/cpu.h"
 #include "hw/riscv/riscv_hart.h"
-#include "hw/riscv/sifive_test.h"
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
 #include "hw/intc/sifive_clint.h"
 #include "hw/intc/sifive_plic.h"
+#include "hw/misc/sifive_test.h"
 #include "chardev/char.h"
 #include "sysemu/arch_init.h"
 #include "sysemu/device_tree.h"
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config MAC_VIA
 config AVR_POWER
     bool
 
+config SIFIVE_TEST
+    bool
+
 config SIFIVE_E_PRCI
     bool
 
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM11SCU', if_true: files('arm11scu.c'))
 softmmu_ss.add(when: 'CONFIG_MOS6522', if_true: files('mos6522.c'))
 
 # RISC-V devices
+softmmu_ss.add(when: 'CONFIG_SIFIVE_TEST', if_true: files('sifive_test.c'))
 softmmu_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
 softmmu_ss.add(when: 'CONFIG_SIFIVE_U_OTP', if_true: files('sifive_u_otp.c'))
 softmmu_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select SIFIVE
     select SIFIVE_CLINT
     select SIFIVE_PLIC
+    select SIFIVE_TEST
 
 config MICROCHIP_PFSOC
     bool
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files('numa.c'))
 riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
 riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
 riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
-riscv_ss.add(when: 'CONFIG_SIFIVE', if_true: files('sifive_test.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
 riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

Every RISC-V machine needs riscv_hart hence there is no need to
have a dedicated Kconfig option for it. Drop the Kconfig option
and always build riscv_hart.c.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-11-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/Kconfig     | 9 ---------
 hw/riscv/meson.build | 2 +-
 2 files changed, 1 insertion(+), 10 deletions(-)

diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@
-config HART
-    bool
-
 config IBEX
     bool
 
@@ -XXX,XX +XXX,XX @@ config SIFIVE
 
 config SIFIVE_E
     bool
-    select HART
     select SIFIVE
     select SIFIVE_CLINT
     select SIFIVE_GPIO
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
 config SIFIVE_U
     bool
     select CADENCE
-    select HART
     select SIFIVE
     select SIFIVE_CLINT
     select SIFIVE_GPIO
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
 
 config SPIKE
     bool
-    select HART
     select HTIF
     select SIFIVE
     select SIFIVE_CLINT
@@ -XXX,XX +XXX,XX @@ config SPIKE
 config OPENTITAN
     bool
     select IBEX
-    select HART
     select UNIMP
 
 config RISCV_VIRT
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     imply PCI_DEVICES
     imply TEST_DEVICES
     select PCI
-    select HART
     select SERIAL
     select GOLDFISH_RTC
     select VIRTIO_MMIO
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
 
 config MICROCHIP_PFSOC
     bool
-    select HART
     select SIFIVE
     select SIFIVE_CLINT
     select UNIMP
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@
 riscv_ss = ss.source_set()
 riscv_ss.add(files('boot.c'), fdt)
 riscv_ss.add(files('numa.c'))
-riscv_ss.add(when: 'CONFIG_HART', if_true: files('riscv_hart.c'))
+riscv_ss.add(files('riscv_hart.c'))
 riscv_ss.add(when: 'CONFIG_OPENTITAN', if_true: files('opentitan.c'))
 riscv_ss.add(when: 'CONFIG_RISCV_VIRT', if_true: files('virt.c'))
 riscv_ss.add(when: 'CONFIG_SIFIVE_E', if_true: files('sifive_e.c'))
-- 
2.28.0

From: Bin Meng <bin.meng@windriver.com>

The name SIFIVE is too vague to convey the required component of
MSI_NONBROKEN. Let's drop the option, and select MSI_NONBROKEN in
each machine instead.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-12-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/Kconfig | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

From: Bin Meng <bin.meng@windriver.com>

At present the Kconfig file is in disorder. Let's sort the options.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1599129623-68957-13-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/Kconfig | 58 ++++++++++++++++++++++++------------------------
 1 file changed, 29 insertions(+), 29 deletions(-)

diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@
 config IBEX
     bool
 
-config SIFIVE_E
-    bool
-    select MSI_NONBROKEN
-    select SIFIVE_CLINT
-    select SIFIVE_GPIO
-    select SIFIVE_PLIC
-    select SIFIVE_UART
-    select SIFIVE_E_PRCI
-    select UNIMP
-
-config SIFIVE_U
+config MICROCHIP_PFSOC
     bool
-    select CADENCE
+    select CADENCE_SDHCI
+    select MCHP_PFSOC_MMUART
     select MSI_NONBROKEN
     select SIFIVE_CLINT
-    select SIFIVE_GPIO
     select SIFIVE_PDMA
     select SIFIVE_PLIC
-    select SIFIVE_UART
-    select SIFIVE_U_OTP
-    select SIFIVE_U_PRCI
     select UNIMP
 
-config SPIKE
-    bool
-    select HTIF
-    select MSI_NONBROKEN
-    select SIFIVE_CLINT
-    select SIFIVE_PLIC
-
 config OPENTITAN
     bool
     select IBEX
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     bool
     imply PCI_DEVICES
     imply TEST_DEVICES
+    select GOLDFISH_RTC
     select MSI_NONBROKEN
     select PCI
-    select SERIAL
-    select GOLDFISH_RTC
-    select VIRTIO_MMIO
     select PCI_EXPRESS_GENERIC_BRIDGE
     select PFLASH_CFI01
+    select SERIAL
     select SIFIVE_CLINT
     select SIFIVE_PLIC
     select SIFIVE_TEST
+    select VIRTIO_MMIO
 
-config MICROCHIP_PFSOC
+config SIFIVE_E
     bool
     select MSI_NONBROKEN
     select SIFIVE_CLINT
+    select SIFIVE_GPIO
+    select SIFIVE_PLIC
+    select SIFIVE_UART
+    select SIFIVE_E_PRCI
     select UNIMP
-    select MCHP_PFSOC_MMUART
+
+config SIFIVE_U
+    bool
+    select CADENCE
+    select MSI_NONBROKEN
+    select SIFIVE_CLINT
+    select SIFIVE_GPIO
     select SIFIVE_PDMA
     select SIFIVE_PLIC
-    select CADENCE_SDHCI
+    select SIFIVE_UART
+    select SIFIVE_U_OTP
+    select SIFIVE_U_PRCI
+    select UNIMP
+
+config SPIKE
+    bool
+    select HTIF
+    select MSI_NONBROKEN
+    select SIFIVE_CLINT
+    select SIFIVE_PLIC
-- 
2.28.0

The following changes since commit fcb237e64f9d026c03d635579c7b288d0008a6e5:

Merge tag 'pull-vfio-20230710' of https://github.com/legoater/qemu into staging (2023-07-10 09:17:06 +0100)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230710-1

for you to fetch changes up to a47842d16653b4f73b5d56ff0c252dd8a329481b:

riscv: Add support for the Zfa extension (2023-07-10 22:29:20 +1000)

----------------------------------------------------------------
Third RISC-V PR for 8.1

* Use xl instead of mxl for disassemble
* Factor out extension tests to cpu_cfg.h
* disas/riscv: Add vendor extension support
* disas/riscv: Add support for XVentanaCondOps
* disas/riscv: Add support for XThead* instructions
* Fix mstatus related problems
* Fix veyron-v1 CPU properties
* Fix the xlen for data address when MPRV=1
* opensbi: Upgrade from v1.2 to v1.3
* Enable 32-bit Spike OpenSBI boot testing
* Support the watchdog timer of HiFive 1 rev b
* Only build qemu-system-riscv$$ on rv$$ host
* Add RVV registers to log
* Restrict ACLINT to TCG
* Add syscall riscv_hwprobe
* Add support for BF16 extensions
* KVM_RISCV_SET_TIMER macro is not configured correctly
* Generate devicetree only after machine initialization is complete
* virt: Convert fdt_load_addr to uint64_t
* KVM: fixes and enhancements
* Add support for the Zfa extension

----------------------------------------------------------------
Bin Meng (2):
      roms/opensbi: Upgrade from v1.2 to v1.3
      tests/avocado: riscv: Enable 32-bit Spike OpenSBI boot testing

Christoph Müllner (8):
      target/riscv: Factor out extension tests to cpu_cfg.h
      disas/riscv: Move types/constants to new header file
      disas/riscv: Make rv_op_illegal a shared enum value
      disas/riscv: Encapsulate opcode_data into decode
      disas/riscv: Provide infrastructure for vendor extensions
      disas/riscv: Add support for XVentanaCondOps
      disas/riscv: Add support for XThead* instructions
      riscv: Add support for the Zfa extension

Daniel Henrique Barboza (20):
      target/riscv/cpu.c: fix veyron-v1 CPU properties
      target/riscv: skip features setup for KVM CPUs
      hw/riscv/virt.c: skip 'mmu-type' FDT if satp mode not set
      target/riscv/cpu.c: restrict 'mvendorid' value
      target/riscv/cpu.c: restrict 'mimpid' value
      target/riscv/cpu.c: restrict 'marchid' value
      target/riscv: use KVM scratch CPUs to init KVM properties
      target/riscv: read marchid/mimpid in kvm_riscv_init_machine_ids()
      target/riscv: handle mvendorid/marchid/mimpid for KVM CPUs
      target/riscv/kvm.c: init 'misa_ext_mask' with scratch CPU
      target/riscv/cpu: add misa_ext_info_arr[]
      target/riscv: add KVM specific MISA properties
      target/riscv/kvm.c: update KVM MISA bits
      target/riscv/kvm.c: add multi-letter extension KVM properties
      target/riscv/cpu.c: add satp_mode properties earlier
      target/riscv/cpu.c: remove priv_ver check from riscv_isa_string_ext()
      target/riscv/cpu.c: create KVM mock properties
      target/riscv: update multi-letter extension KVM properties
      target/riscv/kvm.c: add kvmconfig_get_cfg_addr() helper
      target/riscv/kvm.c: read/write (cbom|cboz)_blocksize in KVM

Guenter Roeck (1):
      riscv: Generate devicetree only after machine initialization is complete

Ivan Klokov (1):
      target/riscv: Add RVV registers to log

Jason Chien (1):
      target/riscv: Set the correct exception for implict G-stage translation fail

LIU Zhiwei (1):
      target/riscv: Use xl instead of mxl for disassemble

Lakshmi Bai Raja Subramanian (1):
      hw/riscv: virt: Convert fdt_load_addr to uint64_t

Philippe Mathieu-Daudé (3):
      target/riscv: Only unify 'riscv32/64' -> 'riscv' for host cpu in meson
      target/riscv: Only build KVM guest with same wordsize as host
      hw/riscv/virt: Restrict ACLINT to TCG

Robbin Ehn (1):
      linux-user/riscv: Add syscall riscv_hwprobe

Tommy Wu (3):
      hw/misc: sifive_e_aon: Support the watchdog timer of HiFive 1 rev b.
      hw/riscv: sifive_e: Support the watchdog timer of HiFive 1 rev b.
      tests/qtest: sifive-e-aon-watchdog-test.c: Add QTest of watchdog of sifive_e

Weiwei Li (11):
      target/riscv: Make MPV only work when MPP != PRV_M
      target/riscv: Support MSTATUS.MPV/GVA only when RVH is enabled
      target/riscv: Remove redundant assignment to SXL
      target/riscv: Add additional xlen for address when MPRV=1
      target/riscv: update cur_pmbase/pmmask based on mode affected by MPRV
      target/riscv: Add properties for BF16 extensions
      target/riscv: Add support for Zfbfmin extension
      target/riscv: Add support for Zvfbfmin extension
      target/riscv: Add support for Zvfbfwma extension
      target/riscv: Expose properties for BF16 extensions
      target/riscv: Add disas support for BF16 extensions

yang.zhang (1):
      target/riscv KVM_RISCV_SET_TIMER macro is not configured correctly

docs/system/riscv/virt.rst                     |   1 +
 meson.build                                    |  15 +-
 disas/riscv-xthead.h                           |  28 +
 disas/riscv-xventana.h                         |  18 +
 disas/riscv.h                                  | 302 +++++++++++
 include/hw/misc/sifive_e_aon.h                 |  60 +++
 include/hw/riscv/sifive_e.h                    |   9 +-
 linux-user/riscv/syscall32_nr.h                |   1 +
 linux-user/riscv/syscall64_nr.h                |   1 +
 target/riscv/cpu.h                             |  56 +-
 target/riscv/cpu_cfg.h                         |  41 ++
 target/riscv/helper.h                          |  29 +
 target/riscv/kvm_riscv.h                       |   1 +
 target/riscv/insn32.decode                     |  38 ++
 disas/riscv-xthead.c                           | 707 +++++++++++++++++++++++++
 disas/riscv-xventana.c                         |  41 ++
 disas/riscv.c                                  | 559 +++++++++----------
 hw/misc/sifive_e_aon.c                         | 319 +++++++++++
 hw/riscv/sifive_e.c                            |  17 +-
 hw/riscv/virt.c                                |  56 +-
 linux-user/syscall.c                           | 146 +++++
 target/riscv/cpu.c                             | 439 +++++++++++++--
 target/riscv/cpu_helper.c                      |  12 +-
 target/riscv/csr.c                             |  41 +-
 target/riscv/fpu_helper.c                      | 166 ++++++
 target/riscv/kvm.c                             | 501 +++++++++++++++++-
 target/riscv/op_helper.c                       |   3 +-
 target/riscv/translate.c                       |  42 +-
 target/riscv/vector_helper.c                   |  17 +
 tests/qtest/sifive-e-aon-watchdog-test.c       | 450 ++++++++++++++++
 tests/tcg/riscv64/test-fcvtmod.c               | 345 ++++++++++++
 target/riscv/insn_trans/trans_rvbf16.c.inc     | 175 ++++++
 target/riscv/insn_trans/trans_rvzfa.c.inc      | 521 ++++++++++++++++++
 target/riscv/insn_trans/trans_rvzfh.c.inc      |  12 +-
 disas/meson.build                              |   6 +-
 hw/misc/Kconfig                                |   3 +
 hw/misc/meson.build                            |   1 +
 hw/riscv/Kconfig                               |   1 +
 pc-bios/opensbi-riscv32-generic-fw_dynamic.bin | Bin 123072 -> 135344 bytes
 pc-bios/opensbi-riscv64-generic-fw_dynamic.bin | Bin 121800 -> 138304 bytes
 roms/opensbi                                   |   2 +-
 tests/avocado/riscv_opensbi.py                 |   2 -
 tests/qtest/meson.build                        |   3 +
 tests/tcg/riscv64/Makefile.target              |   6 +
 44 files changed, 4751 insertions(+), 442 deletions(-)
 create mode 100644 disas/riscv-xthead.h
 create mode 100644 disas/riscv-xventana.h
 create mode 100644 disas/riscv.h
 create mode 100644 include/hw/misc/sifive_e_aon.h
 create mode 100644 disas/riscv-xthead.c
 create mode 100644 disas/riscv-xventana.c
 create mode 100644 hw/misc/sifive_e_aon.c
 create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c
 create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
 create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc
 create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Disassemble function(plugin_disas, target_disas, monitor_disas) will
always call set_disas_info before disassembling instructions.

plugin_disas  and target_disas will always be called under a TB, which
has the same XLEN.

We can't ensure that monitor_disas will always be called under a TB,
but current XLEN will still be a better choice, thus we can ensure at
least the disassemble of the nearest one TB is right.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-2-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
 static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
 {
     RISCVCPU *cpu = RISCV_CPU(s);
+    CPURISCVState *env = &cpu->env;
     info->target_info = &cpu->cfg;
 
-    switch (riscv_cpu_mxl(&cpu->env)) {
+    switch (env->xl) {
     case MXL_RV32:
         info->print_insn = print_insn_riscv32;
         break;
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch moves the extension test functions that are used
to gate vendor extension decoders, into cpu_cfg.h.
This allows to reuse them in the disassembler.

This patch does not introduce new functionality.
However, the patch includes a small change:
The parameter for the extension test functions has been changed
from 'DisasContext*' to 'const RISCVCPUConfig*' to keep
the code in cpu_cfg.h self-contained.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-Id: <20230612111034.3955227-3-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h   | 26 ++++++++++++++++++++++++++
 target/riscv/translate.c | 27 ++-------------------------
 2 files changed, 28 insertions(+), 25 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
 };
 
 typedef struct RISCVCPUConfig RISCVCPUConfig;
+
+/* Helper functions to test for extensions.  */
+
+static inline bool always_true_p(const RISCVCPUConfig *cfg __attribute__((__unused__)))
+{
+    return true;
+}
+
+static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
+{
+    return cfg->ext_xtheadba || cfg->ext_xtheadbb ||
+           cfg->ext_xtheadbs || cfg->ext_xtheadcmo ||
+           cfg->ext_xtheadcondmov ||
+           cfg->ext_xtheadfmemidx || cfg->ext_xtheadfmv ||
+           cfg->ext_xtheadmac || cfg->ext_xtheadmemidx ||
+           cfg->ext_xtheadmempair || cfg->ext_xtheadsync;
+}
+
+#define MATERIALISE_EXT_PREDICATE(ext) \
+    static inline bool has_ ## ext ## _p(const RISCVCPUConfig *cfg) \
+    { \
+        return cfg->ext_ ## ext ; \
+    }
+
+MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
+
 #endif
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
     return ctx->misa_ext & ext;
 }
 
-static bool always_true_p(DisasContext *ctx  __attribute__((__unused__)))
-{
-    return true;
-}
-
-static bool has_xthead_p(DisasContext *ctx  __attribute__((__unused__)))
-{
-    return ctx->cfg_ptr->ext_xtheadba || ctx->cfg_ptr->ext_xtheadbb ||
-           ctx->cfg_ptr->ext_xtheadbs || ctx->cfg_ptr->ext_xtheadcmo ||
-           ctx->cfg_ptr->ext_xtheadcondmov ||
-           ctx->cfg_ptr->ext_xtheadfmemidx || ctx->cfg_ptr->ext_xtheadfmv ||
-           ctx->cfg_ptr->ext_xtheadmac || ctx->cfg_ptr->ext_xtheadmemidx ||
-           ctx->cfg_ptr->ext_xtheadmempair || ctx->cfg_ptr->ext_xtheadsync;
-}
-
-#define MATERIALISE_EXT_PREDICATE(ext)  \
-    static bool has_ ## ext ## _p(DisasContext *ctx)    \
-    { \
-        return ctx->cfg_ptr->ext_ ## ext ; \
-    }
-
-MATERIALISE_EXT_PREDICATE(XVentanaCondOps);
-
 #ifdef TARGET_RISCV32
 #define get_xl(ctx)    MXL_RV32
 #elif defined(CONFIG_USER_ONLY)
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
      * that are tested in-order until a decoder matches onto the opcode.
      */
     static const struct {
-        bool (*guard_func)(DisasContext *);
+        bool (*guard_func)(const RISCVCPUConfig *);
         bool (*decode_func)(DisasContext *, uint32_t);
     } decoders[] = {
         { always_true_p,  decode_insn32 },
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
         ctx->opcode = opcode32;
 
         for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
-            if (decoders[i].guard_func(ctx) &&
+            if (decoders[i].guard_func(ctx->cfg_ptr) &&
                 decoders[i].decode_func(ctx, opcode32)) {
                 return;
             }
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

In order to enable vendor disassembler support, we need to
move types and constants into a header file so that other
compilation units can use them as well.

This patch does not introduce any functional changes.

Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-4-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h | 282 ++++++++++++++++++++++++++++++++++++++++++++++++++
 disas/riscv.c | 270 +----------------------------------------------
 2 files changed, 283 insertions(+), 269 deletions(-)
 create mode 100644 disas/riscv.h

diff --git a/disas/riscv.h b/disas/riscv.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU disassembler -- RISC-V specific header.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_H
+#define DISAS_RISCV_H
+
+#include "qemu/osdep.h"
+#include "target/riscv/cpu_cfg.h"
+
+/* types */
+
+typedef uint64_t rv_inst;
+typedef uint16_t rv_opcode;
+
+/* enums */
+
+typedef enum {
+    rv32,
+    rv64,
+    rv128
+} rv_isa;
+
+typedef enum {
+    rv_rm_rne = 0,
+    rv_rm_rtz = 1,
+    rv_rm_rdn = 2,
+    rv_rm_rup = 3,
+    rv_rm_rmm = 4,
+    rv_rm_dyn = 7,
+} rv_rm;
+
+typedef enum {
+    rv_fence_i = 8,
+    rv_fence_o = 4,
+    rv_fence_r = 2,
+    rv_fence_w = 1,
+} rv_fence;
+
+typedef enum {
+    rv_ireg_zero,
+    rv_ireg_ra,
+    rv_ireg_sp,
+    rv_ireg_gp,
+    rv_ireg_tp,
+    rv_ireg_t0,
+    rv_ireg_t1,
+    rv_ireg_t2,
+    rv_ireg_s0,
+    rv_ireg_s1,
+    rv_ireg_a0,
+    rv_ireg_a1,
+    rv_ireg_a2,
+    rv_ireg_a3,
+    rv_ireg_a4,
+    rv_ireg_a5,
+    rv_ireg_a6,
+    rv_ireg_a7,
+    rv_ireg_s2,
+    rv_ireg_s3,
+    rv_ireg_s4,
+    rv_ireg_s5,
+    rv_ireg_s6,
+    rv_ireg_s7,
+    rv_ireg_s8,
+    rv_ireg_s9,
+    rv_ireg_s10,
+    rv_ireg_s11,
+    rv_ireg_t3,
+    rv_ireg_t4,
+    rv_ireg_t5,
+    rv_ireg_t6,
+} rv_ireg;
+
+typedef enum {
+    rvc_end,
+    rvc_rd_eq_ra,
+    rvc_rd_eq_x0,
+    rvc_rs1_eq_x0,
+    rvc_rs2_eq_x0,
+    rvc_rs2_eq_rs1,
+    rvc_rs1_eq_ra,
+    rvc_imm_eq_zero,
+    rvc_imm_eq_n1,
+    rvc_imm_eq_p1,
+    rvc_csr_eq_0x001,
+    rvc_csr_eq_0x002,
+    rvc_csr_eq_0x003,
+    rvc_csr_eq_0xc00,
+    rvc_csr_eq_0xc01,
+    rvc_csr_eq_0xc02,
+    rvc_csr_eq_0xc80,
+    rvc_csr_eq_0xc81,
+    rvc_csr_eq_0xc82,
+} rvc_constraint;
+
+typedef enum {
+    rv_codec_illegal,
+    rv_codec_none,
+    rv_codec_u,
+    rv_codec_uj,
+    rv_codec_i,
+    rv_codec_i_sh5,
+    rv_codec_i_sh6,
+    rv_codec_i_sh7,
+    rv_codec_i_csr,
+    rv_codec_s,
+    rv_codec_sb,
+    rv_codec_r,
+    rv_codec_r_m,
+    rv_codec_r4_m,
+    rv_codec_r_a,
+    rv_codec_r_l,
+    rv_codec_r_f,
+    rv_codec_cb,
+    rv_codec_cb_imm,
+    rv_codec_cb_sh5,
+    rv_codec_cb_sh6,
+    rv_codec_ci,
+    rv_codec_ci_sh5,
+    rv_codec_ci_sh6,
+    rv_codec_ci_16sp,
+    rv_codec_ci_lwsp,
+    rv_codec_ci_ldsp,
+    rv_codec_ci_lqsp,
+    rv_codec_ci_li,
+    rv_codec_ci_lui,
+    rv_codec_ci_none,
+    rv_codec_ciw_4spn,
+    rv_codec_cj,
+    rv_codec_cj_jal,
+    rv_codec_cl_lw,
+    rv_codec_cl_ld,
+    rv_codec_cl_lq,
+    rv_codec_cr,
+    rv_codec_cr_mv,
+    rv_codec_cr_jalr,
+    rv_codec_cr_jr,
+    rv_codec_cs,
+    rv_codec_cs_sw,
+    rv_codec_cs_sd,
+    rv_codec_cs_sq,
+    rv_codec_css_swsp,
+    rv_codec_css_sdsp,
+    rv_codec_css_sqsp,
+    rv_codec_k_bs,
+    rv_codec_k_rnum,
+    rv_codec_v_r,
+    rv_codec_v_ldst,
+    rv_codec_v_i,
+    rv_codec_vsetvli,
+    rv_codec_vsetivli,
+    rv_codec_zcb_ext,
+    rv_codec_zcb_mul,
+    rv_codec_zcb_lb,
+    rv_codec_zcb_lh,
+    rv_codec_zcmp_cm_pushpop,
+    rv_codec_zcmp_cm_mv,
+    rv_codec_zcmt_jt,
+} rv_codec;
+
+/* structures */
+
+typedef struct {
+    RISCVCPUConfig *cfg;
+    uint64_t  pc;
+    uint64_t  inst;
+    int32_t   imm;
+    uint16_t  op;
+    uint8_t   codec;
+    uint8_t   rd;
+    uint8_t   rs1;
+    uint8_t   rs2;
+    uint8_t   rs3;
+    uint8_t   rm;
+    uint8_t   pred;
+    uint8_t   succ;
+    uint8_t   aq;
+    uint8_t   rl;
+    uint8_t   bs;
+    uint8_t   rnum;
+    uint8_t   vm;
+    uint32_t  vzimm;
+    uint8_t   rlist;
+} rv_decode;
+
+typedef struct {
+    const int op;
+    const rvc_constraint *constraints;
+} rv_comp_data;
+
+enum {
+    rvcd_imm_nz = 0x1
+};
+
+typedef struct {
+    const char * const name;
+    const rv_codec codec;
+    const char * const format;
+    const rv_comp_data *pseudo;
+    const short decomp_rv32;
+    const short decomp_rv64;
+    const short decomp_rv128;
+    const short decomp_data;
+} rv_opcode_data;
+
+/* instruction formats */
+
+#define rv_fmt_none                   "O\t"
+#define rv_fmt_rs1                    "O\t1"
+#define rv_fmt_offset                 "O\to"
+#define rv_fmt_pred_succ              "O\tp,s"
+#define rv_fmt_rs1_rs2                "O\t1,2"
+#define rv_fmt_rd_imm                 "O\t0,i"
+#define rv_fmt_rd_offset              "O\t0,o"
+#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
+#define rv_fmt_frd_rs1                "O\t3,1"
+#define rv_fmt_frd_frs1               "O\t3,4"
+#define rv_fmt_rd_frs1                "O\t0,4"
+#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
+#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
+#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
+#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
+#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
+#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
+#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
+#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
+#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
+#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
+#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
+#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
+#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
+#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
+#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
+#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
+#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
+#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
+#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
+#define rv_fmt_rd                     "O\t0"
+#define rv_fmt_rd_zimm                "O\t0,7"
+#define rv_fmt_rd_rs1                 "O\t0,1"
+#define rv_fmt_rd_rs2                 "O\t0,2"
+#define rv_fmt_rs1_offset             "O\t1,o"
+#define rv_fmt_rs2_offset             "O\t2,o"
+#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
+#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
+#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
+#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
+#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
+#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
+#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
+#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
+#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
+#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
+#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
+#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
+#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
+#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
+#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
+#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
+#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
+#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
+#define rv_fmt_vd_vs1                 "O\tD,E"
+#define rv_fmt_vd_rs1                 "O\tD,1"
+#define rv_fmt_vd_fs1                 "O\tD,4"
+#define rv_fmt_vd_imm                 "O\tD,i"
+#define rv_fmt_vd_vs2                 "O\tD,F"
+#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
+#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
+#define rv_fmt_rd_vs2                 "O\t0,F"
+#define rv_fmt_fd_vs2                 "O\t3,F"
+#define rv_fmt_vd_vm                  "O\tDm"
+#define rv_fmt_vsetvli                "O\t0,1,v"
+#define rv_fmt_vsetivli               "O\t0,u,v"
+#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
+#define rv_fmt_push_rlist             "O\tx,-i"
+#define rv_fmt_pop_rlist              "O\tx,i"
+#define rv_fmt_zcmt_index             "O\ti"
+
+#endif /* DISAS_RISCV_H */
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "disas/dis-asm.h"
 #include "target/riscv/cpu_cfg.h"
-
-/* types */
-
-typedef uint64_t rv_inst;
-typedef uint16_t rv_opcode;
-
-/* enums */
-
-typedef enum {
-    rv32,
-    rv64,
-    rv128
-} rv_isa;
-
-typedef enum {
-    rv_rm_rne = 0,
-    rv_rm_rtz = 1,
-    rv_rm_rdn = 2,
-    rv_rm_rup = 3,
-    rv_rm_rmm = 4,
-    rv_rm_dyn = 7,
-} rv_rm;
-
-typedef enum {
-    rv_fence_i = 8,
-    rv_fence_o = 4,
-    rv_fence_r = 2,
-    rv_fence_w = 1,
-} rv_fence;
-
-typedef enum {
-    rv_ireg_zero,
-    rv_ireg_ra,
-    rv_ireg_sp,
-    rv_ireg_gp,
-    rv_ireg_tp,
-    rv_ireg_t0,
-    rv_ireg_t1,
-    rv_ireg_t2,
-    rv_ireg_s0,
-    rv_ireg_s1,
-    rv_ireg_a0,
-    rv_ireg_a1,
-    rv_ireg_a2,
-    rv_ireg_a3,
-    rv_ireg_a4,
-    rv_ireg_a5,
-    rv_ireg_a6,
-    rv_ireg_a7,
-    rv_ireg_s2,
-    rv_ireg_s3,
-    rv_ireg_s4,
-    rv_ireg_s5,
-    rv_ireg_s6,
-    rv_ireg_s7,
-    rv_ireg_s8,
-    rv_ireg_s9,
-    rv_ireg_s10,
-    rv_ireg_s11,
-    rv_ireg_t3,
-    rv_ireg_t4,
-    rv_ireg_t5,
-    rv_ireg_t6,
-} rv_ireg;
-
-typedef enum {
-    rvc_end,
-    rvc_rd_eq_ra,
-    rvc_rd_eq_x0,
-    rvc_rs1_eq_x0,
-    rvc_rs2_eq_x0,
-    rvc_rs2_eq_rs1,
-    rvc_rs1_eq_ra,
-    rvc_imm_eq_zero,
-    rvc_imm_eq_n1,
-    rvc_imm_eq_p1,
-    rvc_csr_eq_0x001,
-    rvc_csr_eq_0x002,
-    rvc_csr_eq_0x003,
-    rvc_csr_eq_0xc00,
-    rvc_csr_eq_0xc01,
-    rvc_csr_eq_0xc02,
-    rvc_csr_eq_0xc80,
-    rvc_csr_eq_0xc81,
-    rvc_csr_eq_0xc82,
-} rvc_constraint;
-
-typedef enum {
-    rv_codec_illegal,
-    rv_codec_none,
-    rv_codec_u,
-    rv_codec_uj,
-    rv_codec_i,
-    rv_codec_i_sh5,
-    rv_codec_i_sh6,
-    rv_codec_i_sh7,
-    rv_codec_i_csr,
-    rv_codec_s,
-    rv_codec_sb,
-    rv_codec_r,
-    rv_codec_r_m,
-    rv_codec_r4_m,
-    rv_codec_r_a,
-    rv_codec_r_l,
-    rv_codec_r_f,
-    rv_codec_cb,
-    rv_codec_cb_imm,
-    rv_codec_cb_sh5,
-    rv_codec_cb_sh6,
-    rv_codec_ci,
-    rv_codec_ci_sh5,
-    rv_codec_ci_sh6,
-    rv_codec_ci_16sp,
-    rv_codec_ci_lwsp,
-    rv_codec_ci_ldsp,
-    rv_codec_ci_lqsp,
-    rv_codec_ci_li,
-    rv_codec_ci_lui,
-    rv_codec_ci_none,
-    rv_codec_ciw_4spn,
-    rv_codec_cj,
-    rv_codec_cj_jal,
-    rv_codec_cl_lw,
-    rv_codec_cl_ld,
-    rv_codec_cl_lq,
-    rv_codec_cr,
-    rv_codec_cr_mv,
-    rv_codec_cr_jalr,
-    rv_codec_cr_jr,
-    rv_codec_cs,
-    rv_codec_cs_sw,
-    rv_codec_cs_sd,
-    rv_codec_cs_sq,
-    rv_codec_css_swsp,
-    rv_codec_css_sdsp,
-    rv_codec_css_sqsp,
-    rv_codec_k_bs,
-    rv_codec_k_rnum,
-    rv_codec_v_r,
-    rv_codec_v_ldst,
-    rv_codec_v_i,
-    rv_codec_vsetvli,
-    rv_codec_vsetivli,
-    rv_codec_zcb_ext,
-    rv_codec_zcb_mul,
-    rv_codec_zcb_lb,
-    rv_codec_zcb_lh,
-    rv_codec_zcmp_cm_pushpop,
-    rv_codec_zcmp_cm_mv,
-    rv_codec_zcmt_jt,
-} rv_codec;
+#include "disas/riscv.h"
 
 typedef enum {
     rv_op_illegal = 0,
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_czero_nez = 790,
 } rv_op;
 
-/* structures */
-
-typedef struct {
-    RISCVCPUConfig *cfg;
-    uint64_t  pc;
-    uint64_t  inst;
-    int32_t   imm;
-    uint16_t  op;
-    uint8_t   codec;
-    uint8_t   rd;
-    uint8_t   rs1;
-    uint8_t   rs2;
-    uint8_t   rs3;
-    uint8_t   rm;
-    uint8_t   pred;
-    uint8_t   succ;
-    uint8_t   aq;
-    uint8_t   rl;
-    uint8_t   bs;
-    uint8_t   rnum;
-    uint8_t   vm;
-    uint32_t  vzimm;
-    uint8_t   rlist;
-} rv_decode;
-
-typedef struct {
-    const int op;
-    const rvc_constraint *constraints;
-} rv_comp_data;
-
-enum {
-    rvcd_imm_nz = 0x1
-};
-
-typedef struct {
-    const char * const name;
-    const rv_codec codec;
-    const char * const format;
-    const rv_comp_data *pseudo;
-    const short decomp_rv32;
-    const short decomp_rv64;
-    const short decomp_rv128;
-    const short decomp_data;
-} rv_opcode_data;
-
 /* register names */
 
 static const char rv_ireg_name_sym[32][5] = {
@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
     "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
 };
 
-/* instruction formats */
-
-#define rv_fmt_none                   "O\t"
-#define rv_fmt_rs1                    "O\t1"
-#define rv_fmt_offset                 "O\to"
-#define rv_fmt_pred_succ              "O\tp,s"
-#define rv_fmt_rs1_rs2                "O\t1,2"
-#define rv_fmt_rd_imm                 "O\t0,i"
-#define rv_fmt_rd_offset              "O\t0,o"
-#define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
-#define rv_fmt_frd_rs1                "O\t3,1"
-#define rv_fmt_frd_frs1               "O\t3,4"
-#define rv_fmt_rd_frs1                "O\t0,4"
-#define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
-#define rv_fmt_frd_frs1_frs2          "O\t3,4,5"
-#define rv_fmt_rm_frd_frs1            "O\tr,3,4"
-#define rv_fmt_rm_frd_rs1             "O\tr,3,1"
-#define rv_fmt_rm_rd_frs1             "O\tr,0,4"
-#define rv_fmt_rm_frd_frs1_frs2       "O\tr,3,4,5"
-#define rv_fmt_rm_frd_frs1_frs2_frs3  "O\tr,3,4,5,6"
-#define rv_fmt_rd_rs1_imm             "O\t0,1,i"
-#define rv_fmt_rd_rs1_offset          "O\t0,1,i"
-#define rv_fmt_rd_offset_rs1          "O\t0,i(1)"
-#define rv_fmt_frd_offset_rs1         "O\t3,i(1)"
-#define rv_fmt_rd_csr_rs1             "O\t0,c,1"
-#define rv_fmt_rd_csr_zimm            "O\t0,c,7"
-#define rv_fmt_rs2_offset_rs1         "O\t2,i(1)"
-#define rv_fmt_frs2_offset_rs1        "O\t5,i(1)"
-#define rv_fmt_rs1_rs2_offset         "O\t1,2,o"
-#define rv_fmt_rs2_rs1_offset         "O\t2,1,o"
-#define rv_fmt_aqrl_rd_rs2_rs1        "OAR\t0,2,(1)"
-#define rv_fmt_aqrl_rd_rs1            "OAR\t0,(1)"
-#define rv_fmt_rd                     "O\t0"
-#define rv_fmt_rd_zimm                "O\t0,7"
-#define rv_fmt_rd_rs1                 "O\t0,1"
-#define rv_fmt_rd_rs2                 "O\t0,2"
-#define rv_fmt_rs1_offset             "O\t1,o"
-#define rv_fmt_rs2_offset             "O\t2,o"
-#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
-#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
-#define rv_fmt_ldst_vd_rs1_vm         "O\tD,(1)m"
-#define rv_fmt_ldst_vd_rs1_rs2_vm     "O\tD,(1),2m"
-#define rv_fmt_ldst_vd_rs1_vs2_vm     "O\tD,(1),Fm"
-#define rv_fmt_vd_vs2_vs1             "O\tD,F,E"
-#define rv_fmt_vd_vs2_vs1_vl          "O\tD,F,El"
-#define rv_fmt_vd_vs2_vs1_vm          "O\tD,F,Em"
-#define rv_fmt_vd_vs2_rs1_vl          "O\tD,F,1l"
-#define rv_fmt_vd_vs2_fs1_vl          "O\tD,F,4l"
-#define rv_fmt_vd_vs2_rs1_vm          "O\tD,F,1m"
-#define rv_fmt_vd_vs2_fs1_vm          "O\tD,F,4m"
-#define rv_fmt_vd_vs2_imm_vl          "O\tD,F,il"
-#define rv_fmt_vd_vs2_imm_vm          "O\tD,F,im"
-#define rv_fmt_vd_vs2_uimm_vm         "O\tD,F,um"
-#define rv_fmt_vd_vs1_vs2_vm          "O\tD,E,Fm"
-#define rv_fmt_vd_rs1_vs2_vm          "O\tD,1,Fm"
-#define rv_fmt_vd_fs1_vs2_vm          "O\tD,4,Fm"
-#define rv_fmt_vd_vs1                 "O\tD,E"
-#define rv_fmt_vd_rs1                 "O\tD,1"
-#define rv_fmt_vd_fs1                 "O\tD,4"
-#define rv_fmt_vd_imm                 "O\tD,i"
-#define rv_fmt_vd_vs2                 "O\tD,F"
-#define rv_fmt_vd_vs2_vm              "O\tD,Fm"
-#define rv_fmt_rd_vs2_vm              "O\t0,Fm"
-#define rv_fmt_rd_vs2                 "O\t0,F"
-#define rv_fmt_fd_vs2                 "O\t3,F"
-#define rv_fmt_vd_vm                  "O\tDm"
-#define rv_fmt_vsetvli                "O\t0,1,v"
-#define rv_fmt_vsetivli               "O\t0,u,v"
-#define rv_fmt_rs1_rs2_zce_ldst       "O\t2,i(1)"
-#define rv_fmt_push_rlist             "O\tx,-i"
-#define rv_fmt_pop_rlist              "O\tx,i"
-#define rv_fmt_zcmt_index             "O\ti"
-
 /* pseudo-instruction constraints */
 
 static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

The enum value 'rv_op_illegal' does not represent an
instruction, but is a catch-all value in case we have
no match in the decoder. Let's make the value a shared
one, so that other compile units can reuse it.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-5-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h | 4 ++++
 disas/riscv.c | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
     const rvc_constraint *constraints;
 } rv_comp_data;
 
+enum {
+    rv_op_illegal = 0
+};
+
 enum {
     rvcd_imm_nz = 0x1
 };
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
 #include "disas/riscv.h"
 
 typedef enum {
-    rv_op_illegal = 0,
+    /* 0 is reserved for rv_op_illegal. */
     rv_op_lui = 1,
     rv_op_auipc = 2,
     rv_op_jal = 3,
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch adds a reference to a struct rv_opcode_data object
into struct rv_decode. This further allows to remove all references
to the global variable opcode_data (which is renamed to rvi_opcode_data).

This patch does not introduce any functional change, but prepares
the code for more struct rv_opcode_data objects in the future.

This patch is based on previous work from Liu Zhiwei:
  https://lists.nongnu.org/archive/html/qemu-devel/2022-08/msg03662.html

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-6-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h | 33 +++++++++++++++++----------------
 disas/riscv.c |  9 ++++++++-
 2 files changed, 25 insertions(+), 17 deletions(-)

diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 
 /* structures */
 
+typedef struct {
+    const int op;
+    const rvc_constraint *constraints;
+} rv_comp_data;
+
+typedef struct {
+    const char * const name;
+    const rv_codec codec;
+    const char * const format;
+    const rv_comp_data *pseudo;
+    const short decomp_rv32;
+    const short decomp_rv64;
+    const short decomp_rv128;
+    const short decomp_data;
+} rv_opcode_data;
+
 typedef struct {
     RISCVCPUConfig *cfg;
     uint64_t  pc;
     uint64_t  inst;
+    const rv_opcode_data *opcode_data;
     int32_t   imm;
     uint16_t  op;
     uint8_t   codec;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint8_t   rlist;
 } rv_decode;
 
-typedef struct {
-    const int op;
-    const rvc_constraint *constraints;
-} rv_comp_data;
-
 enum {
     rv_op_illegal = 0
 };
@@ -XXX,XX +XXX,XX @@ enum {
     rvcd_imm_nz = 0x1
 };
 
-typedef struct {
-    const char * const name;
-    const rv_codec codec;
-    const char * const format;
-    const rv_comp_data *pseudo;
-    const short decomp_rv32;
-    const short decomp_rv64;
-    const short decomp_rv128;
-    const short decomp_data;
-} rv_opcode_data;
-
 /* instruction formats */
 
 #define rv_fmt_none                   "O\t"
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ static const rv_comp_data rvcp_fsgnjx_q[] = {
 
 /* instruction metadata */
 
-const rv_opcode_data opcode_data[] = {
+const rv_opcode_data rvi_opcode_data[] = {
     { "illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
     { "lui", rv_codec_u, rv_fmt_rd_imm, NULL, 0, 0, 0 },
     { "auipc", rv_codec_u, rv_fmt_rd_offset, NULL, 0, 0, 0 },
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_tbl_index(rv_inst inst)
 
 static void decode_inst_operands(rv_decode *dec, rv_isa isa)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     rv_inst inst = dec->inst;
     dec->codec = opcode_data[dec->op].codec;
     switch (dec->codec) {
@@ -XXX,XX +XXX,XX @@ static void append(char *s1, const char *s2, size_t n)
 
 static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     char tmp[64];
     const char *fmt;
 
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
 
 static void decode_inst_lift_pseudo(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     const rv_comp_data *comp_data = opcode_data[dec->op].pseudo;
     if (!comp_data) {
         return;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_lift_pseudo(rv_decode *dec)
 
 static void decode_inst_decompress_rv32(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv32;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv32(rv_decode *dec)
 
 static void decode_inst_decompress_rv64(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv64;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -XXX,XX +XXX,XX @@ static void decode_inst_decompress_rv64(rv_decode *dec)
 
 static void decode_inst_decompress_rv128(rv_decode *dec)
 {
+    const rv_opcode_data *opcode_data = dec->opcode_data;
     int decomp_op = opcode_data[dec->op].decomp_rv128;
     if (decomp_op != rv_op_illegal) {
         if ((opcode_data[dec->op].decomp_data & rvcd_imm_nz)
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
     rv_decode dec = { 0 };
     dec.pc = pc;
     dec.inst = inst;
+    dec.opcode_data = rvi_opcode_data;
     dec.cfg = cfg;
     decode_inst_opcode(&dec, isa);
     decode_inst_operands(&dec, isa);
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

A previous patch provides a pointer to the RISCVCPUConfig data.
Let's use this to add the necessary code for vendor extensions.
This patch does not change the current behaviour, but clearly
defines how vendor extension support can be added to the disassembler.

Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-7-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
     rv_decode dec = { 0 };
     dec.pc = pc;
     dec.inst = inst;
-    dec.opcode_data = rvi_opcode_data;
     dec.cfg = cfg;
-    decode_inst_opcode(&dec, isa);
+
+    static const struct {
+        bool (*guard_func)(const RISCVCPUConfig *);
+        const rv_opcode_data *opcode_data;
+        void (*decode_func)(rv_decode *, rv_isa);
+    } decoders[] = {
+        { always_true_p, rvi_opcode_data, decode_inst_opcode },
+    };
+
+    for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
+        bool (*guard_func)(const RISCVCPUConfig *) = decoders[i].guard_func;
+        const rv_opcode_data *opcode_data = decoders[i].opcode_data;
+        void (*decode_func)(rv_decode *, rv_isa) = decoders[i].decode_func;
+
+        if (guard_func(cfg)) {
+            dec.opcode_data = opcode_data;
+            decode_func(&dec, isa);
+            if (dec.op != rv_op_illegal)
+                break;
+        }
+    }
+
+    if (dec.op == rv_op_illegal) {
+        dec.opcode_data = rvi_opcode_data;
+    }
+
     decode_inst_operands(&dec, isa);
     decode_inst_decompress(&dec, isa);
     decode_inst_lift_pseudo(&dec);
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch adds XVentanaCondOps support to the RISC-V disassembler.

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230612111034.3955227-8-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv-xventana.h | 18 ++++++++++++++++++
 disas/riscv-xventana.c | 41 +++++++++++++++++++++++++++++++++++++++++
 disas/riscv.c          |  4 ++++
 disas/meson.build      |  5 ++++-
 4 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 disas/riscv-xventana.h
 create mode 100644 disas/riscv-xventana.c

diff --git a/disas/riscv-xventana.h b/disas/riscv-xventana.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xventana.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU disassembler -- RISC-V specific header (xventana*).
+ *
+ * Copyright (c) 2023 VRULL GmbH
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_XVENTANA_H
+#define DISAS_RISCV_XVENTANA_H
+
+#include "disas/riscv.h"
+
+extern const rv_opcode_data ventana_opcode_data[];
+
+void decode_xventanacondops(rv_decode*, rv_isa);
+
+#endif /* DISAS_RISCV_XVENTANA_H */
diff --git a/disas/riscv-xventana.c b/disas/riscv-xventana.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xventana.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU RISC-V Disassembler for xventana.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "disas/riscv.h"
+#include "disas/riscv-xventana.h"
+
+typedef enum {
+    /* 0 is reserved for rv_op_illegal. */
+    ventana_op_vt_maskc = 1,
+    ventana_op_vt_maskcn = 2,
+} rv_ventana_op;
+
+const rv_opcode_data ventana_opcode_data[] = {
+    { "vt.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
+    { "vt.maskc", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "vt.maskcn", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+};
+
+void decode_xventanacondops(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 30:
+            switch (((inst >> 22) & 0b1111111000) | ((inst >> 12) & 0b0000000111)) {
+            case 6: op = ventana_op_vt_maskc; break;
+            case 7: op = ventana_op_vt_maskcn; break;
+            }
+            break;
+        }
+        break;
+    }
+
+    dec->op = op;
+}
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu_cfg.h"
 #include "disas/riscv.h"
 
+/* Vendor extensions */
+#include "disas/riscv-xventana.h"
+
 typedef enum {
     /* 0 is reserved for rv_op_illegal. */
     rv_op_lui = 1,
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
         void (*decode_func)(rv_decode *, rv_isa);
     } decoders[] = {
         { always_true_p, rvi_opcode_data, decode_inst_opcode },
+        { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
     };
 
     for (size_t i = 0; i < ARRAY_SIZE(decoders); i++) {
diff --git a/disas/meson.build b/disas/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/disas/meson.build
+++ b/disas/meson.build
@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_M68K_DIS', if_true: files('m68k.c'))
 common_ss.add(when: 'CONFIG_MICROBLAZE_DIS', if_true: files('microblaze.c'))
 common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
 common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
-common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files('riscv.c'))
+common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
+    'riscv.c',
+    'riscv-xventana.c'
+))
 common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
 common_ss.add(when: 'CONFIG_SPARC_DIS', if_true: files('sparc.c'))
 common_ss.add(when: 'CONFIG_XTENSA_DIS', if_true: files('xtensa.c'))
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

Support for emulating XThead* instruction has been added recently.
This patch adds support for these instructions to the RISC-V disassembler.

Co-developed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230612111034.3955227-9-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv-xthead.h   |  28 ++
 disas/riscv.h          |  12 +
 target/riscv/cpu_cfg.h |  11 +
 disas/riscv-xthead.c   | 707 +++++++++++++++++++++++++++++++++++++++++
 disas/riscv.c          |  69 ++++
 disas/meson.build      |   1 +
 6 files changed, 828 insertions(+)
 create mode 100644 disas/riscv-xthead.h
 create mode 100644 disas/riscv-xthead.c

diff --git a/disas/riscv-xthead.h b/disas/riscv-xthead.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xthead.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU disassembler -- RISC-V specific header (xthead*).
+ *
+ * Copyright (c) 2023 VRULL GmbH
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef DISAS_RISCV_XTHEAD_H
+#define DISAS_RISCV_XTHEAD_H
+
+#include "disas/riscv.h"
+
+extern const rv_opcode_data xthead_opcode_data[];
+
+void decode_xtheadba(rv_decode *, rv_isa);
+void decode_xtheadbb(rv_decode *, rv_isa);
+void decode_xtheadbs(rv_decode *, rv_isa);
+void decode_xtheadcmo(rv_decode *, rv_isa);
+void decode_xtheadcondmov(rv_decode *, rv_isa);
+void decode_xtheadfmemidx(rv_decode *, rv_isa);
+void decode_xtheadfmv(rv_decode *, rv_isa);
+void decode_xtheadmac(rv_decode *, rv_isa);
+void decode_xtheadmemidx(rv_decode *, rv_isa);
+void decode_xtheadmempair(rv_decode *, rv_isa);
+void decode_xtheadsync(rv_decode *, rv_isa);
+
+#endif /* DISAS_RISCV_XTHEAD_H */
diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_codec_zcmp_cm_pushpop,
     rv_codec_zcmp_cm_mv,
     rv_codec_zcmt_jt,
+    rv_codec_r2_imm5,
+    rv_codec_r2,
+    rv_codec_r2_imm6,
+    rv_codec_r_imm2,
+    rv_codec_r2_immhl,
+    rv_codec_r2_imm2_imm5,
 } rv_codec;
 
 /* structures */
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint64_t  inst;
     const rv_opcode_data *opcode_data;
     int32_t   imm;
+    int32_t   imm1;
     uint16_t  op;
     uint8_t   codec;
     uint8_t   rd;
@@ -XXX,XX +XXX,XX @@ enum {
 #define rv_fmt_push_rlist             "O\tx,-i"
 #define rv_fmt_pop_rlist              "O\tx,i"
 #define rv_fmt_zcmt_index             "O\ti"
+#define rv_fmt_rd_rs1_rs2_imm         "O\t0,1,2,i"
+#define rv_fmt_frd_rs1_rs2_imm        "O\t3,1,2,i"
+#define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
+#define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
+#define rv_fmt_rd2_imm                "O\t0,2,(1),i"
 
 #endif /* DISAS_RISCV_H */
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ static inline bool has_xthead_p(const RISCVCPUConfig *cfg)
         return cfg->ext_ ## ext ; \
     }
 
+MATERIALISE_EXT_PREDICATE(xtheadba)
+MATERIALISE_EXT_PREDICATE(xtheadbb)
+MATERIALISE_EXT_PREDICATE(xtheadbs)
+MATERIALISE_EXT_PREDICATE(xtheadcmo)
+MATERIALISE_EXT_PREDICATE(xtheadcondmov)
+MATERIALISE_EXT_PREDICATE(xtheadfmemidx)
+MATERIALISE_EXT_PREDICATE(xtheadfmv)
+MATERIALISE_EXT_PREDICATE(xtheadmac)
+MATERIALISE_EXT_PREDICATE(xtheadmemidx)
+MATERIALISE_EXT_PREDICATE(xtheadmempair)
+MATERIALISE_EXT_PREDICATE(xtheadsync)
 MATERIALISE_EXT_PREDICATE(XVentanaCondOps)
 
 #endif
diff --git a/disas/riscv-xthead.c b/disas/riscv-xthead.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/disas/riscv-xthead.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU RISC-V Disassembler for xthead.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "disas/riscv.h"
+#include "disas/riscv-xthead.h"
+
+typedef enum {
+    /* 0 is reserved for rv_op_illegal. */
+    /* XTheadBa */
+    rv_op_th_addsl = 1,
+    /* XTheadBb */
+    rv_op_th_srri,
+    rv_op_th_srriw,
+    rv_op_th_ext,
+    rv_op_th_extu,
+    rv_op_th_ff0,
+    rv_op_th_ff1,
+    rv_op_th_rev,
+    rv_op_th_revw,
+    rv_op_th_tstnbz,
+    /* XTheadBs */
+    rv_op_th_tst,
+    /* XTheadCmo */
+    rv_op_th_dcache_call,
+    rv_op_th_dcache_ciall,
+    rv_op_th_dcache_iall,
+    rv_op_th_dcache_cpa,
+    rv_op_th_dcache_cipa,
+    rv_op_th_dcache_ipa,
+    rv_op_th_dcache_cva,
+    rv_op_th_dcache_civa,
+    rv_op_th_dcache_iva,
+    rv_op_th_dcache_csw,
+    rv_op_th_dcache_cisw,
+    rv_op_th_dcache_isw,
+    rv_op_th_dcache_cpal1,
+    rv_op_th_dcache_cval1,
+    rv_op_th_icache_iall,
+    rv_op_th_icache_ialls,
+    rv_op_th_icache_ipa,
+    rv_op_th_icache_iva,
+    rv_op_th_l2cache_call,
+    rv_op_th_l2cache_ciall,
+    rv_op_th_l2cache_iall,
+    /* XTheadCondMov */
+    rv_op_th_mveqz,
+    rv_op_th_mvnez,
+    /* XTheadFMemIdx */
+    rv_op_th_flrd,
+    rv_op_th_flrw,
+    rv_op_th_flurd,
+    rv_op_th_flurw,
+    rv_op_th_fsrd,
+    rv_op_th_fsrw,
+    rv_op_th_fsurd,
+    rv_op_th_fsurw,
+    /* XTheadFmv */
+    rv_op_th_fmv_hw_x,
+    rv_op_th_fmv_x_hw,
+    /* XTheadMac */
+    rv_op_th_mula,
+    rv_op_th_mulah,
+    rv_op_th_mulaw,
+    rv_op_th_muls,
+    rv_op_th_mulsw,
+    rv_op_th_mulsh,
+    /* XTheadMemIdx */
+    rv_op_th_lbia,
+    rv_op_th_lbib,
+    rv_op_th_lbuia,
+    rv_op_th_lbuib,
+    rv_op_th_lhia,
+    rv_op_th_lhib,
+    rv_op_th_lhuia,
+    rv_op_th_lhuib,
+    rv_op_th_lwia,
+    rv_op_th_lwib,
+    rv_op_th_lwuia,
+    rv_op_th_lwuib,
+    rv_op_th_ldia,
+    rv_op_th_ldib,
+    rv_op_th_sbia,
+    rv_op_th_sbib,
+    rv_op_th_shia,
+    rv_op_th_shib,
+    rv_op_th_swia,
+    rv_op_th_swib,
+    rv_op_th_sdia,
+    rv_op_th_sdib,
+    rv_op_th_lrb,
+    rv_op_th_lrbu,
+    rv_op_th_lrh,
+    rv_op_th_lrhu,
+    rv_op_th_lrw,
+    rv_op_th_lrwu,
+    rv_op_th_lrd,
+    rv_op_th_srb,
+    rv_op_th_srh,
+    rv_op_th_srw,
+    rv_op_th_srd,
+    rv_op_th_lurb,
+    rv_op_th_lurbu,
+    rv_op_th_lurh,
+    rv_op_th_lurhu,
+    rv_op_th_lurw,
+    rv_op_th_lurwu,
+    rv_op_th_lurd,
+    rv_op_th_surb,
+    rv_op_th_surh,
+    rv_op_th_surw,
+    rv_op_th_surd,
+    /* XTheadMemPair */
+    rv_op_th_ldd,
+    rv_op_th_lwd,
+    rv_op_th_lwud,
+    rv_op_th_sdd,
+    rv_op_th_swd,
+    /* XTheadSync */
+    rv_op_th_sfence_vmas,
+    rv_op_th_sync,
+    rv_op_th_sync_i,
+    rv_op_th_sync_is,
+    rv_op_th_sync_s,
+} rv_xthead_op;
+
+const rv_opcode_data xthead_opcode_data[] = {
+    { "th.illegal", rv_codec_illegal, rv_fmt_none, NULL, 0, 0, 0 },
+    /* XTheadBa */
+    { "th.addsl", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadBb */
+    { "th.srri", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    { "th.srriw", rv_codec_r2_imm5, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    { "th.ext", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.extu", rv_codec_r2_immhl, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.ff0", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.ff1", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.rev", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.revw", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "th.tstnbz", rv_codec_r2, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    /* XTheadBs */
+    { "th.tst", rv_codec_r2_imm6, rv_fmt_rd_rs1_imm, NULL, 0, 0, 0 },
+    /* XTheadCmo */
+    { "th.dcache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.dcache.cpa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.civa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.csw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cisw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.isw", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cpal1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.dcache.cval1", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.icache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.icache.ialls", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.icache.ipa", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.icache.iva", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 },
+    { "th.l2cache.call", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.l2cache.ciall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.l2cache.iall", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    /* XTheadCondMov */
+    { "th.mveqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mvnez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    /* XTheadFMemIdx */
+    { "th.flrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.flurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsrd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsrw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsurd", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.fsurw", rv_codec_r_imm2, rv_fmt_frd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadFmv */
+    { "th.fmv.hw.x", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "th.fmv.x.hw", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    /* XTheadMac */
+    { "th.mula", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulaw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulah", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.muls", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulsw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.mulsh", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    /* XTheadMemIdx */
+    { "th.lbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml, NULL, 0, 0, 0 },
+    { "th.lbuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lbuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lhuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwuia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lwuib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.ldia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.ldib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sbia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sbib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.shia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.shib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.swia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.swib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sdia", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.sdib", rv_codec_r2_imm2_imm5, rv_fmt_rd_rs1_immh_imml_addr, NULL, 0, 0, 0 },
+    { "th.lrb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lrd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.srd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurbu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurhu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurwu", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.lurd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surb", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surh", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surw", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    { "th.surd", rv_codec_r_imm2, rv_fmt_rd_rs1_rs2_imm, NULL, 0, 0, 0 },
+    /* XTheadMemPair */
+    { "th.ldd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.lwd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.lwud", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.sdd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    { "th.swd", rv_codec_r_imm2, rv_fmt_rd2_imm, NULL, 0, 0, 0 },
+    /* XTheadSync */
+    { "th.sfence.vmas", rv_codec_r, rv_fmt_rs1_rs2, NULL, 0, 0, 0 },
+    { "th.sync", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.i", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.is", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "th.sync.s", rv_codec_none, rv_fmt_none, NULL, 0, 0, 0 },
+};
+
+void decode_xtheadba(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0000000:
+                case 0b0000001:
+                case 0b0000010:
+                case 0b0000011: op = rv_op_th_addsl; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadbb(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0001010: op = rv_op_th_srriw; break;
+                case 0b1000000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_tstnbz;
+                    }
+                    break;
+                case 0b1000001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_rev;
+                    }
+                    break;
+                case 0b1000010:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_ff0;
+                    }
+                    break;
+                case 0b1000011:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_ff1;
+                    }
+                    break;
+                case 0b1000100:
+                case 0b1001000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_revw;
+                    }
+                    break;
+                case 0b0000100:
+                case 0b0000101: op = rv_op_th_srri; break;
+                }
+                break;
+            case 2: op = rv_op_th_ext; break;
+            case 3: op = rv_op_th_extu; break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadbs(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 26) & 0b111111) {
+                case 0b100010: op = rv_op_th_tst; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadcmo(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 0:
+                switch ((inst >> 20 & 0b111111111111)) {
+                case 0b000000000001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_call;
+                    }
+                    break;
+                case 0b000000000011:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_ciall;
+                    }
+                    break;
+                case 0b000000000010:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_dcache_iall;
+                    }
+                    break;
+                case 0b000000101001: op = rv_op_th_dcache_cpa; break;
+                case 0b000000101011: op = rv_op_th_dcache_cipa; break;
+                case 0b000000101010: op = rv_op_th_dcache_ipa; break;
+                case 0b000000100101: op = rv_op_th_dcache_cva; break;
+                case 0b000000100111: op = rv_op_th_dcache_civa; break;
+                case 0b000000100110: op = rv_op_th_dcache_iva; break;
+                case 0b000000100001: op = rv_op_th_dcache_csw; break;
+                case 0b000000100011: op = rv_op_th_dcache_cisw; break;
+                case 0b000000100010: op = rv_op_th_dcache_isw; break;
+                case 0b000000101000: op = rv_op_th_dcache_cpal1; break;
+                case 0b000000100100: op = rv_op_th_dcache_cval1; break;
+                case 0b000000010000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_icache_iall;
+                    }
+                    break;
+                case 0b000000010001:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_icache_ialls;
+                    }
+                    break;
+                case 0b000000111000: op = rv_op_th_icache_ipa; break;
+                case 0b000000110000: op = rv_op_th_icache_iva; break;
+                case 0b000000010101:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_call;
+                    }
+                    break;
+                case 0b000000010111:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_ciall;
+                    }
+                    break;
+                case 0b000000010110:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_l2cache_iall;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadcondmov(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0100000: op = rv_op_th_mveqz; break;
+                case 0b0100001: op = rv_op_th_mvnez; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadfmemidx(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 6:
+                switch ((inst >> 27) & 0b11111) {
+                case 8: op = rv_op_th_flrw; break;
+                case 10: op = rv_op_th_flurw; break;
+                case 12: op = rv_op_th_flrd; break;
+                case 14: op = rv_op_th_flurd; break;
+                }
+                break;
+            case 7:
+                switch ((inst >> 27) & 0b11111) {
+                case 8: op = rv_op_th_fsrw; break;
+                case 10: op = rv_op_th_fsurw; break;
+                case 12: op = rv_op_th_fsrd; break;
+                case 14: op = rv_op_th_fsurd; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadfmv(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b1010000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_fmv_hw_x;
+                    }
+                    break;
+                case 0b1100000:
+                    if (((inst >> 20) & 0b11111) == 0) {
+                        op = rv_op_th_fmv_x_hw;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmac(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 1:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0010000: op = rv_op_th_mula; break;
+                case 0b0010001: op = rv_op_th_muls; break;
+                case 0b0010010: op = rv_op_th_mulaw; break;
+                case 0b0010011: op = rv_op_th_mulsw; break;
+                case 0b0010100: op = rv_op_th_mulah; break;
+                case 0b0010101: op = rv_op_th_mulsh; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmemidx(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 4:
+                switch ((inst >> 27) & 0b11111) {
+                case 0: op = rv_op_th_lrb; break;
+                case 1: op = rv_op_th_lbib; break;
+                case 2: op = rv_op_th_lurb; break;
+                case 3: op = rv_op_th_lbia; break;
+                case 4: op = rv_op_th_lrh; break;
+                case 5: op = rv_op_th_lhib; break;
+                case 6: op = rv_op_th_lurh; break;
+                case 7: op = rv_op_th_lhia; break;
+                case 8: op = rv_op_th_lrw; break;
+                case 9: op = rv_op_th_lwib; break;
+                case 10: op = rv_op_th_lurw; break;
+                case 11: op = rv_op_th_lwia; break;
+                case 12: op = rv_op_th_lrd; break;
+                case 13: op = rv_op_th_ldib; break;
+                case 14: op = rv_op_th_lurd; break;
+                case 15: op = rv_op_th_ldia; break;
+                case 16: op = rv_op_th_lrbu; break;
+                case 17: op = rv_op_th_lbuib; break;
+                case 18: op = rv_op_th_lurbu; break;
+                case 19: op = rv_op_th_lbuia; break;
+                case 20: op = rv_op_th_lrhu; break;
+                case 21: op = rv_op_th_lhuib; break;
+                case 22: op = rv_op_th_lurhu; break;
+                case 23: op = rv_op_th_lhuia; break;
+                case 24: op = rv_op_th_lrwu; break;
+                case 25: op = rv_op_th_lwuib; break;
+                case 26: op = rv_op_th_lurwu; break;
+                case 27: op = rv_op_th_lwuia; break;
+                }
+                break;
+            case 5:
+                switch ((inst >> 27) & 0b11111) {
+                case 0: op = rv_op_th_srb; break;
+                case 1: op = rv_op_th_sbib; break;
+                case 2: op = rv_op_th_surb; break;
+                case 3: op = rv_op_th_sbia; break;
+                case 4: op = rv_op_th_srh; break;
+                case 5: op = rv_op_th_shib; break;
+                case 6: op = rv_op_th_surh; break;
+                case 7: op = rv_op_th_shia; break;
+                case 8: op = rv_op_th_srw; break;
+                case 9: op = rv_op_th_swib; break;
+                case 10: op = rv_op_th_surw; break;
+                case 11: op = rv_op_th_swia; break;
+                case 12: op = rv_op_th_srd; break;
+                case 13: op = rv_op_th_sdib; break;
+                case 14: op = rv_op_th_surd; break;
+                case 15: op = rv_op_th_sdia; break;
+                }
+                break;
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadmempair(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 4:
+                switch ((inst >> 27) & 0b11111) {
+                case 28: op = rv_op_th_lwd; break;
+                case 30: op = rv_op_th_lwud; break;
+                case 31: op = rv_op_th_ldd; break;
+                }
+                break;
+            case 5:
+                switch ((inst >> 27) & 0b11111) {
+                case 28: op = rv_op_th_swd; break;
+                case 31: op = rv_op_th_sdd; break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
+
+void decode_xtheadsync(rv_decode *dec, rv_isa isa)
+{
+    rv_inst inst = dec->inst;
+    rv_opcode op = rv_op_illegal;
+
+    switch (((inst >> 0) & 0b11)) {
+    case 3:
+        switch (((inst >> 2) & 0b11111)) {
+        case 2:
+            /* custom-0 */
+            switch ((inst >> 12) & 0b111) {
+            case 0:
+                switch ((inst >> 25) & 0b1111111) {
+                case 0b0000010: op = rv_op_th_sfence_vmas; break;
+                case 0b0000000:
+                    switch ((inst >> 20) & 0b11111) {
+                    case 0b11000: op = rv_op_th_sync; break;
+                    case 0b11010: op = rv_op_th_sync_i; break;
+                    case 0b11011: op = rv_op_th_sync_is; break;
+                    case 0b11001: op = rv_op_th_sync_s; break;
+                    }
+                    break;
+                }
+                break;
+            }
+            break;
+            /* custom-0 */
+        }
+        break;
+    }
+
+    dec->op = op;
+}
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "disas/dis-asm.h"
 #include "target/riscv/cpu_cfg.h"
 #include "disas/riscv.h"
 
 /* Vendor extensions */
+#include "disas/riscv-xthead.h"
 #include "disas/riscv-xventana.h"
 
 typedef enum {
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_zcmp_rlist(rv_inst inst)
     return ((inst << 56) >> 60);
 }
 
+static uint32_t operand_imm6(rv_inst inst)
+{
+    return (inst << 38) >> 60;
+}
+
+static uint32_t operand_imm2(rv_inst inst)
+{
+    return (inst << 37) >> 62;
+}
+
+static uint32_t operand_immh(rv_inst inst)
+{
+    return (inst << 32) >> 58;
+}
+
+static uint32_t operand_imml(rv_inst inst)
+{
+    return (inst << 38) >> 58;
+}
+
 static uint32_t calculate_stack_adj(rv_isa isa, uint32_t rlist, uint32_t spimm)
 {
     int xlen_bytes_log2 = isa == rv64 ? 3 : 2;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
     case rv_codec_zcmt_jt:
         dec->imm = operand_tbl_index(inst);
         break;
+    case rv_codec_r2_imm5:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_rs2(inst);
+        break;
+    case rv_codec_r2:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        break;
+    case rv_codec_r2_imm6:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_imm6(inst);
+        break;
+    case rv_codec_r_imm2:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->rs2 = operand_rs2(inst);
+        dec->imm = operand_imm2(inst);
+        break;
+    case rv_codec_r2_immhl:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = operand_immh(inst);
+        dec->imm1 = operand_imml(inst);
+        break;
+    case rv_codec_r2_imm2_imm5:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->imm = sextract32(operand_rs2(inst), 0, 5);
+        dec->imm1 = operand_imm2(inst);
+        break;
     };
 }
 
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
             snprintf(tmp, sizeof(tmp), "%u", ((uint32_t)dec->imm & 0b11111));
             append(buf, tmp, buflen);
             break;
+        case 'j':
+            snprintf(tmp, sizeof(tmp), "%d", dec->imm1);
+            append(buf, tmp, buflen);
+            break;
         case 'o':
             snprintf(tmp, sizeof(tmp), "%d", dec->imm);
             append(buf, tmp, buflen);
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst,
         void (*decode_func)(rv_decode *, rv_isa);
     } decoders[] = {
         { always_true_p, rvi_opcode_data, decode_inst_opcode },
+        { has_xtheadba_p, xthead_opcode_data, decode_xtheadba },
+        { has_xtheadbb_p, xthead_opcode_data, decode_xtheadbb },
+        { has_xtheadbs_p, xthead_opcode_data, decode_xtheadbs },
+        { has_xtheadcmo_p, xthead_opcode_data, decode_xtheadcmo },
+        { has_xtheadcondmov_p, xthead_opcode_data, decode_xtheadcondmov },
+        { has_xtheadfmemidx_p, xthead_opcode_data, decode_xtheadfmemidx },
+        { has_xtheadfmv_p, xthead_opcode_data, decode_xtheadfmv },
+        { has_xtheadmac_p, xthead_opcode_data, decode_xtheadmac },
+        { has_xtheadmemidx_p, xthead_opcode_data, decode_xtheadmemidx },
+        { has_xtheadmempair_p, xthead_opcode_data, decode_xtheadmempair },
+        { has_xtheadsync_p, xthead_opcode_data, decode_xtheadsync },
         { has_XVentanaCondOps_p, ventana_opcode_data, decode_xventanacondops },
     };
 
diff --git a/disas/meson.build b/disas/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/disas/meson.build
+++ b/disas/meson.build
@@ -XXX,XX +XXX,XX @@ common_ss.add(when: 'CONFIG_MIPS_DIS', if_true: files('mips.c', 'nanomips.c'))
 common_ss.add(when: 'CONFIG_NIOS2_DIS', if_true: files('nios2.c'))
 common_ss.add(when: 'CONFIG_RISCV_DIS', if_true: files(
     'riscv.c',
+    'riscv-xthead.c',
     'riscv-xventana.c'
 ))
 common_ss.add(when: 'CONFIG_SH4_DIS', if_true: files('sh4.c'))
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Upon MRET or explicit memory access with MPRV=1, MPV should be ignored
when MPP=PRV_M.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 3 ++-
 target/riscv/op_helper.c  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 
         if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
             mode = get_field(env->mstatus, MSTATUS_MPP);
-            virt = get_field(env->mstatus, MSTATUS_MPV);
+            virt = get_field(env->mstatus, MSTATUS_MPV) &&
+                   (mode != PRV_M);
             if (virt) {
                 status = env->vsstatus;
             }
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
         riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
     }
 
-    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV);
+    target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV) &&
+                             (prev_priv != PRV_M);
     mstatus = set_field(mstatus, MSTATUS_MIE,
                         get_field(mstatus, MSTATUS_MPIE));
     mstatus = set_field(mstatus, MSTATUS_MPIE, 1);
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

MPV and GVA bits are added by hypervisor extension to mstatus
and mstatush (if MXLEN=32).

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
     }
 
     if (xl != MXL_RV32 || env->debugger) {
-        /*
-         * RV32: MPV and GVA are not in mstatus. The current plan is to
-         * add them to mstatush. For now, we just don't support it.
-         */
-        mask |= MSTATUS_MPV | MSTATUS_GVA;
+        if (riscv_has_ext(env, RVH)) {
+            mask |= MSTATUS_MPV | MSTATUS_GVA;
+        }
         if ((val & MSTATUS64_UXL) != 0) {
             mask |= MSTATUS64_UXL;
         }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
     uint64_t valh = (uint64_t)val << 32;
-    uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
+    uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
 
     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
 
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

SXL is initialized as env->misa_mxl which is also the mxl value.
So we can just remain it unchanged to keep it read-only.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230603134236.15719-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
 
     mstatus = (mstatus & ~mask) | (val & mask);
 
-    if (xl > MXL_RV32) {
-        /* SXL field is for now read only */
-        mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
-    }
     env->mstatus = mstatus;
 
     /*
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from
riscv_cpu_init()") removed code that was enabling mmu, pmp, ext_ifencei
and ext_icsr from riscv_cpu_init(), the init() function of
TYPE_RISCV_CPU, parent type of all RISC-V CPUss. This was done to force
CPUs to explictly enable all extensions and features it requires,
without any 'magic values' that were inherited by the parent type.

This commit failed to make appropriate changes in the 'veyron-v1' CPU,
added earlier by commit e1d084a8524a. The result is that the veyron-v1
CPU has ext_ifencei, ext_icsr and pmp set to 'false', which is not the
case.

The reason why it took this long to notice (thanks LIU Zhiwei for
reporting it) is because Linux doesn't mind 'ifencei' and 'icsr' being
absent in the 'riscv,isa' DT, implying that they're both present if the
'i' extension is enabled. OpenSBI also doesn't error out or warns about
the lack of 'pmp', it'll just not protect memory pages.

Fix it by setting them to 'true' in rv64_veyron_v1_cpu_init() like
7f0bdfb5bfc2 already did with other CPUs.

Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Fixes: 7f0bdfb5bfc2 ("target/riscv/cpu.c: remove cfg setup from riscv_cpu_init()")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-Id: <20230620152443.137079-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_veyron_v1_cpu_init(Object *obj)
 
     /* Enable ISA extensions */
     cpu->cfg.mmu = true;
+    cpu->cfg.ext_ifencei = true;
+    cpu->cfg.ext_icsr = true;
+    cpu->cfg.pmp = true;
     cpu->cfg.ext_icbom = true;
     cpu->cfg.cbom_blocksize = 64;
     cpu->cfg.cboz_blocksize = 64;
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

As specified in privilege spec:"When MPRV=1, load and store memory
addresses are treated as though the current XLEN were set to MPP’s
XLEN". So the xlen for address may be different from current xlen.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230614032547.35895-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        | 49 +++++++++++++++++++++++++++++++++------
 target/riscv/cpu_helper.c |  1 +
 target/riscv/translate.c  | 13 ++++++++++-
 3 files changed, 55 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, ITRIGGER, 22, 1)
 /* Virtual mode enabled */
 FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1)
 FIELD(TB_FLAGS, PRIV, 24, 2)
+FIELD(TB_FLAGS, AXL, 26, 2)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
@@ -XXX,XX +XXX,XX @@ static inline const RISCVCPUConfig *riscv_cpu_cfg(CPURISCVState *env)
     return &env_archcpu(env)->cfg;
 }
 
-#if defined(TARGET_RISCV32)
-#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
-#else
-static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+#if !defined(CONFIG_USER_ONLY)
+static inline int cpu_address_mode(CPURISCVState *env)
+{
+    int mode = env->priv;
+
+    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
+        mode = get_field(env->mstatus, MSTATUS_MPP);
+    }
+    return mode;
+}
+
+static inline RISCVMXL cpu_get_xl(CPURISCVState *env, target_ulong mode)
 {
     RISCVMXL xl = env->misa_mxl;
-#if !defined(CONFIG_USER_ONLY)
     /*
      * When emulating a 32-bit-only cpu, use RV32.
      * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
      * back to RV64 for lower privs.
      */
     if (xl != MXL_RV32) {
-        switch (env->priv) {
+        switch (mode) {
         case PRV_M:
             break;
         case PRV_U:
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
             break;
         }
     }
-#endif
     return xl;
 }
 #endif
 
+#if defined(TARGET_RISCV32)
+#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
+#else
+static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+{
+#if !defined(CONFIG_USER_ONLY)
+    return cpu_get_xl(env, env->priv);
+#else
+    return env->misa_mxl;
+#endif
+}
+#endif
+
+#if defined(TARGET_RISCV32)
+#define cpu_address_xl(env)  ((void)(env), MXL_RV32)
+#else
+static inline RISCVMXL cpu_address_xl(CPURISCVState *env)
+{
+#ifdef CONFIG_USER_ONLY
+    return env->xl;
+#else
+    int mode = cpu_address_mode(env);
+
+    return cpu_get_xl(env, mode);
+#endif
+}
+#endif
+
 static inline int riscv_cpu_xlen(CPURISCVState *env)
 {
     return 16 << env->xl;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     flags = FIELD_DP32(flags, TB_FLAGS, FS, fs);
     flags = FIELD_DP32(flags, TB_FLAGS, VS, vs);
     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
+    flags = FIELD_DP32(flags, TB_FLAGS, AXL, cpu_address_xl(env));
     if (env->cur_pmmask != 0) {
         flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
     }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     target_ulong priv_ver;
     RISCVMXL misa_mxl_max;
     RISCVMXL xl;
+    RISCVMXL address_xl;
     uint32_t misa_ext;
     uint32_t opcode;
     RISCVExtStatus mstatus_fs;
@@ -XXX,XX +XXX,XX @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
 #define get_xl(ctx)    ((ctx)->xl)
 #endif
 
+#ifdef TARGET_RISCV32
+#define get_address_xl(ctx)    MXL_RV32
+#elif defined(CONFIG_USER_ONLY)
+#define get_address_xl(ctx)    MXL_RV64
+#else
+#define get_address_xl(ctx)    ((ctx)->address_xl)
+#endif
+
 /* The word size for this machine mode. */
 static inline int __attribute__((unused)) get_xlen(DisasContext *ctx)
 {
@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
     tcg_gen_addi_tl(addr, src1, imm);
     if (ctx->pm_mask_enabled) {
         tcg_gen_andc_tl(addr, addr, pm_mask);
-    } else if (get_xl(ctx) == MXL_RV32) {
+    } else if (get_address_xl(ctx) == MXL_RV32) {
         tcg_gen_ext32u_tl(addr, addr);
     }
     if (ctx->pm_base_enabled) {
         tcg_gen_or_tl(addr, addr, pm_base);
     }
+
     return addr;
 }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
     ctx->misa_mxl_max = env->misa_mxl_max;
     ctx->xl = FIELD_EX32(tb_flags, TB_FLAGS, XL);
+    ctx->address_xl = FIELD_EX32(tb_flags, TB_FLAGS, AXL);
     ctx->cs = cs;
     ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
     ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Pointer mask is also affected by MPRV which means cur_pmbase/pmmask
should also take MPRV into consideration. As pointer mask for instruction
is not supported currently, so we can directly update cur_pmbase/pmmask
based on address related mode and xlen affected by MPRV now.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230614032547.35895-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c |  7 +++++--
 target/riscv/csr.c        | 27 ++++++++++++++++++++-------
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
 void riscv_cpu_update_mask(CPURISCVState *env)
 {
     target_ulong mask = 0, base = 0;
+    RISCVMXL xl = env->xl;
     /*
      * TODO: Current RVJ spec does not specify
      * how the extension interacts with XLEN.
      */
 #ifndef CONFIG_USER_ONLY
+    int mode = cpu_address_mode(env);
+    xl = cpu_get_xl(env, mode);
     if (riscv_has_ext(env, RVJ)) {
-        switch (env->priv) {
+        switch (mode) {
         case PRV_M:
             if (env->mmte & M_PM_ENABLE) {
                 mask = env->mpmmask;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_update_mask(CPURISCVState *env)
         }
     }
 #endif
-    if (env->xl == MXL_RV32) {
+    if (xl == MXL_RV32) {
         env->cur_pmmask = mask & UINT32_MAX;
         env->cur_pmbase = base & UINT32_MAX;
     } else {
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
      */
     if (env->debugger) {
         env->xl = cpu_recompute_xl(env);
-        riscv_cpu_update_mask(env);
     }
+
+    riscv_cpu_update_mask(env);
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
     uint64_t mstatus;
 
     env->mpmmask = val;
-    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
         env->cur_pmmask = val;
     }
     env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmmask(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->spmmask = val;
-    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
         env->cur_pmmask = val;
+        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
+            env->cur_pmmask &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmmask(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->upmmask = val;
-    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
         env->cur_pmmask = val;
+        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
+            env->cur_pmmask &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
     uint64_t mstatus;
 
     env->mpmbase = val;
-    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
         env->cur_pmbase = val;
     }
     env->mmte |= EXT_STATUS_DIRTY;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmbase(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->spmbase = val;
-    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
         env->cur_pmbase = val;
+        if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
+            env->cur_pmbase &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->upmbase = val;
-    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+    if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
         env->cur_pmbase = val;
+        if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
+            env->cur_pmbase &= UINT32_MAX;
+        }
     }
     env->mmte |= EXT_STATUS_DIRTY;
 
-- 
2.40.1

From: Bin Meng <bmeng@tinylab.org>

Upgrade OpenSBI from v1.2 to v1.3 and the pre-built bios images.

The v1.3 release includes the following commits:

440fa81 treewide: Replace TRUE/FALSE with true/false
6509127 Makefile: Remove -N ldflag to prevent linker RWX warning
65638f8 lib: utils/sys: Allow custom HTIF base address for RV32
f14595a lib: sbi: Allow platform to influence cold boot HART selection
6957ae0 platform: generic: Allow platform_override to select cold boot HART
cb7e7c3 platform: generic: Allow platform_override to perform firmware init
8020df8 generic/starfive: Add Starfive JH7110 platform implementation
6997552 lib: sbi_hsm: Rename 'priv' argument to 'arg1'
9e397e3 docs: domain_support: Use capital letter for privilege modes
9e0ba09 include: sbi: Fine grain the permissions for M and SU modes
aace1e1 lib: sbi: Use finer permission semantics for address validation
22dbdb3 lib: sbi: Add permissions for the firmware start till end
1ac14f1 lib: sbi: Use finer permission sematics to decide on PMP bits
44f736c lib: sbi: Modify the boot time region flag prints
20646e0 lib: utils: Use SU-{R/W/X} flags for region permissions during parsing
3e2f573 lib: utils: Disallow non-root domains from adding M-mode regions
59a08cd lib: utils: Add M-mode {R/W} flags to the MMIO regions
001106d docs: Update domain's region permissions and requirements
da5594b platform: generic: allwinner: Fix PLIC array bounds
ce2a834 docs: generic.md: fix typo of andes-ae350
8ecbe6d lib: sbi_hsm: handle failure when hart_stop returns SBI_ENOTSUPP
b1818ee include: types: add always inline compiler attribute
9c4eb35 lib: utils: atcsmu: Add Andes System Management Unit support
787296a platform: andes/ae350: Implement hart hotplug using HSM extension
7aaeeab lib: reset/fdt_reset_atcwdt200: Use defined macros and function in atcsmu.h
a990309 lib: utils: Fix reserved memory node for firmware memory
fefa548 firmware: Split RO/RX and RW sections
2f40a99 firmware: Move dynsym and reladyn sections to RX section
c10e3fe firmware: Add RW section offset in scratch
b666760 lib: sbi: Print the RW section offset
230278d lib: sbi: Add separate entries for firmware RX and RW regions
dea0922 platform: renesas/rzfive: Configure Local memory regions as part of root domain
33bf917 lib: utils: Add fdt_add_cpu_idle_states() helper function
c45992c platform: generic: allwinner: Advertise nonretentive suspend
c8ea836 firmware: Fix fw_rw_offset computation in fw_base.S
8050081 firmware: Not to clear all the MIP
84d15f4 lib: sbi_hsm: Use csr_set to restore the MIP
199189b lib: utils: Mark only the largest region as reserved in FDT
66b0e23 lib: sbi: Ensure domidx_to_domain_table is null-terminated
642f3de Makefile: Add missing .dep files for fw_*.elf.ld
09b34d8 include: Add support for byteorder/endianness conversion
680bea0 lib: utils/fdt: Use byteorder conversion functions in libfdt_env.h
b224ddb include: types: Add typedefs for endianness
aa5dafc include: sbi: Fix BSWAPx() macros for big-endian host
e3bf1af include: Add defines for SBI debug console extension
0ee3a86 lib: sbi: Add sbi_nputs() function
4e0572f lib: sbi: Add sbi_ngets() function
eab48c3 lib: sbi: Add sbi_domain_check_addr_range() function
5a41a38 lib: sbi: Implement SBI debug console extension
c43903c lib: sbi: Add console_puts() callback in the console device
29285ae lib: utils/serial: Implement console_puts() for semihosting
65c2190 lib: sbi: Speed-up sbi_printf() and friends using nputs()
321293c lib: utils/fdt: Fix fdt_pmu.c header dependency
aafcc90 platform: generic/allwinner: Fix sun20i-d1.c header dependency
745aaec platform: generic/andes: Fix ae350.c header dependency
99d09b6 include: fdt/fdt_helper: Change fdt_get_address() to return root.next_arg1
6861ee9 lib: utils: fdt_fixup: Fix compile error
4f2be40 docs: fix typo in fw.md
30ea806 lib: sbi_hart: Enable hcontext and scontext
81adc62 lib: sbi: Align SBI vendor extension id with mvendorid CSR
31b82e0 include: sbi: Remove extid parameter from vendor_ext_provider() callback
c100951 platform: generic: renesas: rzfive: Add support to configure the PMA
2491242 platform: generic: renesas: rzfive: Configure the PMA region
67b2a40 lib: sbi: sbi_ecall: Check the range of SBI error
5a75f53 lib: sbi/sbi_domain: cosmetic style fixes
bc06ff6 lib: utils/fdt/fdt_domain: Simplify region access permission check
17b3776 docs: domain_support: Update the DT example
1364d5a lib: sbi_hsm: Factor out invalid state detection
40f16a8 lib: sbi_hsm: Don't try to restore state on failed change
c88e039 lib: sbi_hsm: Ensure errors are consistent with spec
b1ae6ef lib: sbi_hsm: Move misplaced comment
07673fc lib: sbi_hsm: Remove unnecessary include
8a40306 lib: sbi_hsm: Export some functions
73623a0 lib: sbi: Add system suspend skeleton
c9917b6 lib: sbi: Add system_suspend_allowed domain property
7c964e2 lib: sbi: Implement system suspend
37558dc docs: Correct opensbi-domain property name
5ccebf0 platform: generic: Add system suspend test
908be1b gpio/starfive: add gpio driver and support gpio reset
4b28afc make: Add a command line option for debugging OpenSBI
e9d08bd lib: utils/i2c: Add minimal StarFive jh7110 I2C driver
568ea49 platform: starfive: add PMIC power ops in JH7110 visionfive2 board
506144f lib: serial: Cadence: Enable compatibility for cdns,uart-r1p8
1fe8dc9 lib: sbi_pmu: add callback for counter width
51951d9 lib: sbi_pmu: Implement sbi_pmu_counter_fw_read_hi
60c358e lib: sbi_pmu: Reserve space for implementation specific firmware events
548e4b4 lib: sbi_pmu: Rename fw_counter_value
b51ddff lib: sbi_pmu: Update sbi_pmu dev ops
641d2e9 lib: sbi_pmu: Use dedicated event code for platform firmware events
57d3aa3 lib: sbi_pmu: Introduce fw_counter_write_value API
c631a7d lib: sbi_pmu: Add hartid parameter PMU device ops
d56049e lib: sbi: Refactor the calls to sbi_hart_switch_mode()
e8e9ed3 lib: sbi: Set the state of a hart to START_PENDING after the hart is ready
c6a092c lib: sbi: Clear IPIs before init_warm_startup in non-boot harts
ed88a63 lib: sbi_scratch: Optimize the alignment code for alloc size
73ab11d lib: sbi: Fix how to check whether the domain contains fw_region
f64dfcd lib: sbi: Introduce sbi_entry_count() function
30b9e7e lib: sbi_hsm: Fix sbi_hsm_hart_start() for platform with hart hotplug
8e90259 lib: sbi_hart: clear mip csr during hart init
45ba2b2 include: Add defines for SBI CPPC extension
33caae8 lib: sbi: Implement SBI CPPC extension
91767d0 lib: sbi: Print the CPPC device name
edc9914 lib: sbi_pmu: Align the event type offset as per SBI specification
ee016a7 docs: Correct FW_JUMP_FDT_ADDR calculation example
2868f26 lib: utils: fdt_fixup: avoid buffer overrun
66fa925 lib: sbi: Optimize sbi_tlb
24dde46 lib: sbi: Optimize sbi_ipi
80078ab sbi: tlb: Simplify to tlb_process_count/tlb_process function
bf40e07 lib: sbi: Optimize sbi_tlb queue waiting
eeab500 platform: generic: andes/renesas: Add SBI EXT to check for enabling IOCP errata
f692289 firmware: Optimize loading relocation type
e41dbb5 firmware: Change to use positive offset to access relocation entries
bdb3c42 lib: sbi: Do not clear active_events for cycle/instret when stopping
674e019 lib: sbi: Fix counter index calculation for SBI_PMU_CFG_FLAG_SKIP_MATCH
f5dfd99 lib: sbi: Don't check SBI error range for legacy console getchar
7919530 lib: sbi: Add debug print when sbi_pmu_init fails
4e33530 lib: sbi: Remove unnecessary semicolon
6bc02de lib: sbi: Simplify sbi_ipi_process remove goto
dc1c7db lib: sbi: Simplify BITS_PER_LONG definition
f58c140 lib: sbi: Introduce register_extensions extension callback
e307ba7 lib: sbi: Narrow vendor extension range
042f0c3 lib: sbi: pmu: Remove unnecessary probe function
8b952d4 lib: sbi: Only register available extensions
767b5fc lib: sbi: Optimize probe of srst/susp
c3e31cb lib: sbi: Remove 0/1 probe implementations
33f1722 lib: sbi: Document sbi_ecall_extension members
d4c46e0 Makefile: Dereference symlinks on install
8b99a7f lib: sbi: Fix return of sbi_console_init
264d0be lib: utils: Improve fdt_serial_init
9a0bdd0 lib: utils: Improve fdt_ipi
122f226 lib: utils: Improve fdt_timer
df75e09 lib: utils/ipi: buffer overrun aclint_mswi_cold_init
bdde2ec lib: sbi: Align system suspend errors with spec
aad7a37 include: sbi_scratch: Add helper macros to access data type
5cf9a54 platform: Allow platforms to specify heap size
40d36a6 lib: sbi: Introduce simple heap allocator
2a04f70 lib: sbi: Print scratch size and usage at boot time
bbff53f lib: sbi_pmu: Use heap for per-HART PMU state
ef4542d lib: sbi: Use heap for root domain creation
66daafe lib: sbi: Use scratch space to save per-HART domain pointer
fa5ad2e lib: utils/gpio: Use heap in SiFive and StartFive GPIO drivers
903e88c lib: utils/i2c: Use heap in DesignWare and SiFive I2C drivers
5a8cfcd lib: utils/ipi: Use heap in ACLINT MSWI driver
3013716 lib: utils/irqchip: Use heap in PLIC, APLIC and IMSIC drivers
7e5636a lib: utils/timer: Use heap in ACLINT MTIMER driver
3c1c972 lib: utils/fdt: Use heap in FDT domain parsing
acbd8fc lib: utils/ipi: Use scratch space to save per-HART MSWI pointer
f0516be lib: utils/timer: Use scratch space to save per-HART MTIMER pointer
b3594ac lib: utils/irqchip: Use scratch space to save per-HART PLIC pointer
1df52fa lib: utils/irqchip: Don't check hartid in imsic_update_hartid_table()
355796c lib: utils/irqchip: Use scratch space to save per-HART IMSIC pointer
524feec docs: Add OpenSBI logo and use it in the top-level README.md
932be2c README.md: Improve project copyright information
8153b26 platform/lib: Set no-map attribute on all PMP regions
d64942f firmware: Fix find hart index
27c957a lib: reset: Move fdt_reset_init into generic_early_init
8bd666a lib: sbi: check A2 register in ecall_dbcn_handler.
2552799 include: Bump-up version to 1.3

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Message-Id: <20230630160717.843044-1-bmeng@tinylab.org>
Tested-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 123072 -> 135344 bytes
 .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 121800 -> 138304 bytes
 roms/opensbi                                  |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
diff --git a/roms/opensbi b/roms/opensbi
index XXXXXXX..XXXXXXX 160000
--- a/roms/opensbi
+++ b/roms/opensbi
@@ -1 +1 @@
-Subproject commit 6b5188ca14e59ce7bf71afe4e7d3d557c3d31bf8
+Subproject commit 2552799a1df30a3dcd2321a8b75d61d06f5fb9fc
-- 
2.40.1

From: Bin Meng <bmeng@tinylab.org>

The 32-bit Spike boot issue has been fixed in the OpenSBI v1.3.
Let's enable the 32-bit Spike OpenSBI boot testing.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Message-Id: <20230630160717.843044-2-bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/avocado/riscv_opensbi.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tests/avocado/riscv_opensbi.py b/tests/avocado/riscv_opensbi.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/avocado/riscv_opensbi.py
+++ b/tests/avocado/riscv_opensbi.py
@@ -XXX,XX +XXX,XX @@
 # later.  See the COPYING file in the top-level directory.
 
 from avocado_qemu import QemuSystemTest
-from avocado import skip
 from avocado_qemu import wait_for_console_pattern
 
 class RiscvOpenSBI(QemuSystemTest):
@@ -XXX,XX +XXX,XX @@ def boot_opensbi(self):
         wait_for_console_pattern(self, 'Platform Name')
         wait_for_console_pattern(self, 'Boot HART MEDELEG')
 
-    @skip("requires OpenSBI fix to work")
     def test_riscv32_spike(self):
         """
         :avocado: tags=arch:riscv32
-- 
2.40.1

From: Tommy Wu <tommy.wu@sifive.com>

The watchdog timer is in the always-on domain device of HiFive 1 rev b,
so this patch added the AON device to the sifive_e machine. This patch
only implemented the functionality of the watchdog timer.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627141216.3962299-2-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/misc/sifive_e_aon.h |  60 +++++++
 hw/misc/sifive_e_aon.c         | 319 +++++++++++++++++++++++++++++++++
 hw/misc/Kconfig                |   3 +
 hw/misc/meson.build            |   1 +
 4 files changed, 383 insertions(+)
 create mode 100644 include/hw/misc/sifive_e_aon.h
 create mode 100644 hw/misc/sifive_e_aon.c

diff --git a/include/hw/misc/sifive_e_aon.h b/include/hw/misc/sifive_e_aon.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/sifive_e_aon.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * SiFive HiFive1 AON (Always On Domain) interface.
+ *
+ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_SIFIVE_AON_H
+#define HW_SIFIVE_AON_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_SIFIVE_E_AON "riscv.sifive.e.aon"
+OBJECT_DECLARE_SIMPLE_TYPE(SiFiveEAONState, SIFIVE_E_AON)
+
+#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
+#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
+#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
+
+enum {
+    SIFIVE_E_AON_WDT    = 0x0,
+    SIFIVE_E_AON_RTC    = 0x40,
+    SIFIVE_E_AON_LFROSC = 0x70,
+    SIFIVE_E_AON_BACKUP = 0x80,
+    SIFIVE_E_AON_PMU    = 0x100,
+    SIFIVE_E_AON_MAX    = 0x150
+};
+
+struct SiFiveEAONState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion mmio;
+
+    /*< watchdog timer >*/
+    QEMUTimer *wdog_timer;
+    qemu_irq wdog_irq;
+    uint64_t wdog_restart_time;
+    uint64_t wdogclk_freq;
+
+    uint32_t wdogcfg;
+    uint16_t wdogcmp0;
+    uint32_t wdogcount;
+    uint8_t wdogunlock;
+};
+
+#endif
diff --git a/hw/misc/sifive_e_aon.c b/hw/misc/sifive_e_aon.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/sifive_e_aon.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * SiFive HiFive1 AON (Always On Domain) for QEMU.
+ *
+ * Copyright (c) 2022 SiFive, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "qemu/log.h"
+#include "hw/irq.h"
+#include "hw/registerfields.h"
+#include "hw/misc/sifive_e_aon.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "sysemu/watchdog.h"
+#include "hw/qdev-properties.h"
+
+REG32(AON_WDT_WDOGCFG, 0x0)
+    FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
+    FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
+    FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
+    FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
+    FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
+    FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
+    FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
+    FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
+REG32(AON_WDT_WDOGCOUNT, 0x8)
+    FIELD(AON_WDT_WDOGCOUNT, VALUE, 0, 31)
+REG32(AON_WDT_WDOGS, 0x10)
+REG32(AON_WDT_WDOGFEED, 0x18)
+REG32(AON_WDT_WDOGKEY, 0x1c)
+REG32(AON_WDT_WDOGCMP0, 0x20)
+
+static void sifive_e_aon_wdt_update_wdogcount(SiFiveEAONState *r)
+{
+    int64_t now;
+    if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 0 &&
+        FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 0) {
+        return;
+    }
+
+    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+    r->wdogcount += muldiv64(now - r->wdog_restart_time,
+                             r->wdogclk_freq, NANOSECONDS_PER_SECOND);
+
+    /* Clean the most significant bit. */
+    r->wdogcount &= R_AON_WDT_WDOGCOUNT_VALUE_MASK;
+    r->wdog_restart_time = now;
+}
+
+static void sifive_e_aon_wdt_update_state(SiFiveEAONState *r)
+{
+    uint16_t wdogs;
+    bool cmp_signal = false;
+    sifive_e_aon_wdt_update_wdogcount(r);
+    wdogs = (uint16_t)(r->wdogcount >>
+                           FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE));
+
+    if (wdogs >= r->wdogcmp0) {
+        cmp_signal = true;
+        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, ZEROCMP) == 1) {
+            r->wdogcount = 0;
+            wdogs = 0;
+        }
+    }
+
+    if (cmp_signal) {
+        if (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN) == 1) {
+            watchdog_perform_action();
+        }
+        r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, IP0, 1);
+    }
+
+    qemu_set_irq(r->wdog_irq, FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, IP0));
+
+    if (wdogs < r->wdogcmp0 &&
+        (FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS) == 1 ||
+         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE) == 1)) {
+        int64_t next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        next += muldiv64((r->wdogcmp0 - wdogs) <<
+                         FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, SCALE),
+                         NANOSECONDS_PER_SECOND, r->wdogclk_freq);
+        timer_mod(r->wdog_timer, next);
+    } else {
+        timer_mod(r->wdog_timer, INT64_MAX);
+    }
+}
+
+/*
+ * Callback used when the timer set using timer_mod expires.
+ */
+static void sifive_e_aon_wdt_expired_cb(void *opaque)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static uint64_t
+sifive_e_aon_wdt_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+
+    switch (addr) {
+    case A_AON_WDT_WDOGCFG:
+        return r->wdogcfg;
+    case A_AON_WDT_WDOGCOUNT:
+        sifive_e_aon_wdt_update_wdogcount(r);
+        return r->wdogcount;
+    case A_AON_WDT_WDOGS:
+        sifive_e_aon_wdt_update_wdogcount(r);
+        return r->wdogcount >>
+               FIELD_EX32(r->wdogcfg,
+                          AON_WDT_WDOGCFG,
+                          SCALE);
+    case A_AON_WDT_WDOGFEED:
+        return 0;
+    case A_AON_WDT_WDOGKEY:
+        return r->wdogunlock;
+    case A_AON_WDT_WDOGCMP0:
+        return r->wdogcmp0;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+
+    return 0;
+}
+
+static void
+sifive_e_aon_wdt_write(void *opaque, hwaddr addr,
+                       uint64_t val64, unsigned int size)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(opaque);
+    uint32_t value = val64;
+
+    switch (addr) {
+    case A_AON_WDT_WDOGCFG: {
+        uint8_t new_en_always;
+        uint8_t new_en_core_awake;
+        uint8_t old_en_always;
+        uint8_t old_en_core_awake;
+        if (r->wdogunlock == 0) {
+            return;
+        }
+
+        new_en_always = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_ALWAYS);
+        new_en_core_awake = FIELD_EX32(value, AON_WDT_WDOGCFG, EN_CORE_AWAKE);
+        old_en_always = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS);
+        old_en_core_awake = FIELD_EX32(r->wdogcfg, AON_WDT_WDOGCFG,
+                                       EN_CORE_AWAKE);
+
+        if ((old_en_always ||
+             old_en_core_awake) == 1 &&
+            (new_en_always ||
+             new_en_core_awake) == 0) {
+            sifive_e_aon_wdt_update_wdogcount(r);
+        } else if ((old_en_always ||
+                    old_en_core_awake) == 0 &&
+                   (new_en_always ||
+                    new_en_core_awake) == 1) {
+            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        }
+        r->wdogcfg = value;
+        r->wdogunlock = 0;
+        break;
+    }
+    case A_AON_WDT_WDOGCOUNT:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        r->wdogcount = value & R_AON_WDT_WDOGCOUNT_VALUE_MASK;
+        r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        r->wdogunlock = 0;
+        break;
+    case A_AON_WDT_WDOGS:
+        return;
+    case A_AON_WDT_WDOGFEED:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        if (value == SIFIVE_E_AON_WDOGFEED) {
+            r->wdogcount = 0;
+            r->wdog_restart_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        }
+        r->wdogunlock = 0;
+        break;
+    case A_AON_WDT_WDOGKEY:
+        if (value == SIFIVE_E_AON_WDOGKEY) {
+            r->wdogunlock = 1;
+        }
+        break;
+    case A_AON_WDT_WDOGCMP0:
+        if (r->wdogunlock == 0) {
+            return;
+        }
+        r->wdogcmp0 = (uint16_t) value;
+        r->wdogunlock = 0;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x v=0x%x\n",
+                      __func__, (int)addr, (int)value);
+    }
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static uint64_t
+sifive_e_aon_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    if (addr < SIFIVE_E_AON_RTC) {
+        return sifive_e_aon_wdt_read(opaque, addr, size);
+    } else if (addr < SIFIVE_E_AON_MAX) {
+        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented read: addr=0x%x\n",
+                      __func__, (int)addr);
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad read: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+    return 0;
+}
+
+static void
+sifive_e_aon_write(void *opaque, hwaddr addr,
+                   uint64_t val64, unsigned int size)
+{
+    if (addr < SIFIVE_E_AON_RTC) {
+        sifive_e_aon_wdt_write(opaque, addr, val64, size);
+    } else if (addr < SIFIVE_E_AON_MAX) {
+        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented write: addr=0x%x\n",
+                      __func__, (int)addr);
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: bad write: addr=0x%x\n",
+                      __func__, (int)addr);
+    }
+}
+
+static const MemoryRegionOps sifive_e_aon_ops = {
+    .read = sifive_e_aon_read,
+    .write = sifive_e_aon_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4
+    },
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4
+    }
+};
+
+static void sifive_e_aon_reset(DeviceState *dev)
+{
+    SiFiveEAONState *r = SIFIVE_E_AON(dev);
+
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, RSTEN, 0);
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
+    r->wdogcfg = FIELD_DP32(r->wdogcfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE, 0);
+    r->wdogcmp0 = 0xbeef;
+
+    sifive_e_aon_wdt_update_state(r);
+}
+
+static void sifive_e_aon_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    SiFiveEAONState *r = SIFIVE_E_AON(obj);
+
+    memory_region_init_io(&r->mmio, OBJECT(r), &sifive_e_aon_ops, r,
+                          TYPE_SIFIVE_E_AON, SIFIVE_E_AON_MAX);
+    sysbus_init_mmio(sbd, &r->mmio);
+
+    /* watchdog timer */
+    r->wdog_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                 sifive_e_aon_wdt_expired_cb, r);
+    r->wdogclk_freq = SIFIVE_E_LFCLK_DEFAULT_FREQ;
+    sysbus_init_irq(sbd, &r->wdog_irq);
+}
+
+static Property sifive_e_aon_properties[] = {
+    DEFINE_PROP_UINT64("wdogclk-frequency", SiFiveEAONState, wdogclk_freq,
+                       SIFIVE_E_LFCLK_DEFAULT_FREQ),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void sifive_e_aon_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->reset = sifive_e_aon_reset;
+    device_class_set_props(dc, sifive_e_aon_properties);
+}
+
+static const TypeInfo sifive_e_aon_info = {
+    .name          = TYPE_SIFIVE_E_AON,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(SiFiveEAONState),
+    .instance_init = sifive_e_aon_init,
+    .class_init    = sifive_e_aon_class_init,
+};
+
+static void sifive_e_aon_register_types(void)
+{
+    type_register_static(&sifive_e_aon_info);
+}
+
+type_init(sifive_e_aon_register_types)
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_TEST
 config SIFIVE_E_PRCI
     bool
 
+config SIFIVE_E_AON
+    bool
+
 config SIFIVE_U_OTP
     bool
 
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_MCHP_PFSOC_IOSCB', if_true: files('mchp_pfsoc_ioscb.
 system_ss.add(when: 'CONFIG_MCHP_PFSOC_SYSREG', if_true: files('mchp_pfsoc_sysreg.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_TEST', if_true: files('sifive_test.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
+system_ss.add(when: 'CONFIG_SIFIVE_E_AON', if_true: files('sifive_e_aon.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_U_OTP', if_true: files('sifive_u_otp.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_U_PRCI', if_true: files('sifive_u_prci.c'))
 
-- 
2.40.1

From: Tommy Wu <tommy.wu@sifive.com>

Create the AON device when we realize the sifive_e machine.
This patch only implemented the functionality of the watchdog timer,
not all the functionality of the AON device.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230627141216.3962299-3-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/sifive_e.h |  9 ++++++---
 hw/riscv/sifive_e.c         | 17 +++++++++++++++--
 hw/riscv/Kconfig            |  1 +
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_e.h
+++ b/include/hw/riscv/sifive_e.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_cpu.h"
 #include "hw/gpio/sifive_gpio.h"
+#include "hw/misc/sifive_e_aon.h"
 #include "hw/boards.h"
 
 #define TYPE_RISCV_E_SOC "riscv.sifive.e.soc"
@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveESoCState {
     /*< public >*/
     RISCVHartArrayState cpus;
     DeviceState *plic;
+    SiFiveEAONState aon;
     SIFIVEGPIOState gpio;
     MemoryRegion xip_mem;
     MemoryRegion mask_rom;
@@ -XXX,XX +XXX,XX @@ enum {
 };
 
 enum {
-    SIFIVE_E_UART0_IRQ  = 3,
-    SIFIVE_E_UART1_IRQ  = 4,
-    SIFIVE_E_GPIO0_IRQ0 = 8
+    SIFIVE_E_AON_WDT_IRQ  = 1,
+    SIFIVE_E_UART0_IRQ    = 3,
+    SIFIVE_E_UART1_IRQ    = 4,
+    SIFIVE_E_GPIO0_IRQ0   = 8
 };
 
 #define SIFIVE_E_PLIC_HART_CONFIG "M"
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_e_prci.h"
+#include "hw/misc/sifive_e_aon.h"
 #include "chardev/char.h"
 #include "sysemu/sysemu.h"
 
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_init(Object *obj)
     object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x1004, &error_abort);
     object_initialize_child(obj, "riscv.sifive.e.gpio0", &s->gpio,
                             TYPE_SIFIVE_GPIO);
+    object_initialize_child(obj, "riscv.sifive.e.aon", &s->aon,
+                            TYPE_SIFIVE_E_AON);
 }
 
 static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
         RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
         RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
         RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
-    create_unimplemented_device("riscv.sifive.e.aon",
-        memmap[SIFIVE_E_DEV_AON].base, memmap[SIFIVE_E_DEV_AON].size);
     sifive_e_prci_create(memmap[SIFIVE_E_DEV_PRCI].base);
 
+    /* AON */
+
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->aon), errp)) {
+        return;
+    }
+
+    /* Map AON registers */
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->aon), 0, memmap[SIFIVE_E_DEV_AON].base);
+
     /* GPIO */
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
                            qdev_get_gpio_in(DEVICE(s->plic),
                                             SIFIVE_E_GPIO0_IRQ0 + i));
     }
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->aon), 0,
+                       qdev_get_gpio_in(DEVICE(s->plic),
+                                        SIFIVE_E_AON_WDT_IRQ));
 
     sifive_uart_create(sys_mem, memmap[SIFIVE_E_DEV_UART0].base,
         serial_hd(0), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_E_UART0_IRQ));
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
     select SIFIVE_PLIC
     select SIFIVE_UART
     select SIFIVE_E_PRCI
+    select SIFIVE_E_AON
     select UNIMP
 
 config SIFIVE_U
-- 
2.40.1

From: Tommy Wu <tommy.wu@sifive.com>

Add some simple tests of the watchdog timer in the always-on domain device
of HiFive 1 rev b.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627141216.3962299-4-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tests/qtest/sifive-e-aon-watchdog-test.c | 450 +++++++++++++++++++++++
 tests/qtest/meson.build                  |   3 +
 2 files changed, 453 insertions(+)
 create mode 100644 tests/qtest/sifive-e-aon-watchdog-test.c

diff --git a/tests/qtest/sifive-e-aon-watchdog-test.c b/tests/qtest/sifive-e-aon-watchdog-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/sifive-e-aon-watchdog-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for the watchdog timer of HiFive 1 rev b.
+ *
+ * Copyright (c) 2023 SiFive, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "qemu/bitops.h"
+#include "libqtest.h"
+#include "hw/registerfields.h"
+#include "hw/misc/sifive_e_aon.h"
+
+FIELD(AON_WDT_WDOGCFG, SCALE, 0, 4)
+FIELD(AON_WDT_WDOGCFG, RSVD0, 4, 4)
+FIELD(AON_WDT_WDOGCFG, RSTEN, 8, 1)
+FIELD(AON_WDT_WDOGCFG, ZEROCMP, 9, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD1, 10, 2)
+FIELD(AON_WDT_WDOGCFG, EN_ALWAYS, 12, 1)
+FIELD(AON_WDT_WDOGCFG, EN_CORE_AWAKE, 13, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD2, 14, 14)
+FIELD(AON_WDT_WDOGCFG, IP0, 28, 1)
+FIELD(AON_WDT_WDOGCFG, RSVD3, 29, 3)
+
+#define WDOG_BASE (0x10000000)
+#define WDOGCFG (0x0)
+#define WDOGCOUNT (0x8)
+#define WDOGS (0x10)
+#define WDOGFEED (0x18)
+#define WDOGKEY (0x1c)
+#define WDOGCMP0 (0x20)
+
+#define SIFIVE_E_AON_WDOGKEY (0x51F15E)
+#define SIFIVE_E_AON_WDOGFEED (0xD09F00D)
+#define SIFIVE_E_LFCLK_DEFAULT_FREQ (32768)
+
+static void test_init(QTestState *qts)
+{
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+}
+
+static void test_wdogcount(void)
+{
+    uint64_t tmp;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp = qtest_readl(qts, WDOG_BASE + WDOGCOUNT);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == tmp);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xBEEF);
+    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0xAAAAAAAA);
+    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
+    g_assert(0x2AAAAAAA == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, SIFIVE_E_AON_WDOGFEED);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogcfg(void)
+{
+    uint32_t tmp_cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCFG) == tmp_cfg);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0xFFFFFFFF);
+    g_assert(0xFFFFFFFF == qtest_readl(qts, WDOG_BASE + WDOGCFG));
+
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, 0);
+    tmp_cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(tmp_cfg, AON_WDT_WDOGCFG, IP0));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCFG));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogcmp0(void)
+{
+    uint32_t tmp;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    tmp = qtest_readl(qts, WDOG_BASE + WDOGCMP0);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCMP0) == tmp);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 0xBEEF);
+    g_assert(0xBEEF == qtest_readl(qts, WDOG_BASE + WDOGCMP0));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogkey(void)
+{
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, 0xFFFF);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    g_assert(1 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xAAAAAAAA);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGKEY));
+
+    qtest_quit(qts);
+}
+
+static void test_wdogfeed(void)
+{
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
+
+    qtest_writel(qts, WDOG_BASE + WDOGFEED, 0xFFFF);
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGFEED));
+
+    qtest_quit(qts);
+}
+
+static void test_scaled_wdogs(void)
+{
+    uint32_t cfg;
+    uint32_t fake_count = 0x12345678;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, fake_count);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) == fake_count);
+    g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
+             (uint16_t)fake_count);
+
+    for (int i = 0; i < 16; i++) {
+        cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+        cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, i);
+        qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+        qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+        g_assert((uint16_t)qtest_readl(qts, WDOG_BASE + WDOGS) ==
+                 (uint16_t)(fake_count >>
+                            FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE)));
+    }
+
+    qtest_quit(qts);
+}
+
+static void test_watchdog(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ);
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGS) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_scaled_watchdog(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 10);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
+
+    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_periodic_int(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, SIFIVE_E_LFCLK_DEFAULT_FREQ);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, ZEROCMP, 1);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGCOUNT));
+    g_assert(0 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+static void test_enable_disable(void)
+{
+    uint32_t cfg;
+    QTestState *qts = qtest_init("-machine sifive_e");
+
+    test_init(qts);
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCMP0, 10);
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, SCALE, 15);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 2);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
+    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 2);
+    g_assert(2 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS, 1);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+
+    qtest_clock_step(qts, NANOSECONDS_PER_SECOND * 8);
+
+    g_assert(qtest_readl(qts, WDOG_BASE + WDOGCOUNT) ==
+             SIFIVE_E_LFCLK_DEFAULT_FREQ * 10);
+    g_assert(10 == qtest_readl(qts, WDOG_BASE + WDOGS));
+
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(15 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, SCALE));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, RSTEN));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, ZEROCMP));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_ALWAYS));
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, EN_CORE_AWAKE));
+    g_assert(1 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCOUNT, 0);
+    cfg = FIELD_DP32(cfg, AON_WDT_WDOGCFG, IP0, 0);
+    qtest_writel(qts, WDOG_BASE + WDOGKEY, SIFIVE_E_AON_WDOGKEY);
+    qtest_writel(qts, WDOG_BASE + WDOGCFG, cfg);
+    cfg = qtest_readl(qts, WDOG_BASE + WDOGCFG);
+    g_assert(0 == FIELD_EX32(cfg, AON_WDT_WDOGCFG, IP0));
+
+    qtest_quit(qts);
+}
+
+int main(int argc, char *argv[])
+{
+    g_test_init(&argc, &argv, NULL);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcount",
+                   test_wdogcount);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcfg",
+                   test_wdogcfg);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogcmp0",
+                   test_wdogcmp0);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogkey",
+                   test_wdogkey);
+    qtest_add_func("/sifive-e-aon-watchdog-test/wdogfeed",
+                   test_wdogfeed);
+    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_wdogs",
+                   test_scaled_wdogs);
+    qtest_add_func("/sifive-e-aon-watchdog-test/watchdog",
+                   test_watchdog);
+    qtest_add_func("/sifive-e-aon-watchdog-test/scaled_watchdog",
+                   test_scaled_watchdog);
+    qtest_add_func("/sifive-e-aon-watchdog-test/periodic_int",
+                   test_periodic_int);
+    qtest_add_func("/sifive-e-aon-watchdog-test/enable_disable",
+                   test_enable_disable);
+    return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_s390x = \
    'cpu-plug-test',
    'migration-test']
 
+qtests_riscv32 = \
+  (config_all_devices.has_key('CONFIG_SIFIVE_E_AON') ? ['sifive-e-aon-watchdog-test'] : [])
+
 qos_test_ss = ss.source_set()
 qos_test_ss.add(
   'ac97-test.c',
-- 
2.40.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

We want to keep the ability to distinct between 32/64-bit host.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627143235.29947-2-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 meson.build | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ qapi_trace_events = []
 
 bsd_oses = ['gnu/kfreebsd', 'freebsd', 'netbsd', 'openbsd', 'dragonfly', 'darwin']
 supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux']
-supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv', 'x86', 'x86_64',
+supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv32', 'riscv64', 'x86', 'x86_64',
   'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64']
 
 cpu = host_machine.cpu_family()
 
-# Unify riscv* to a single family.
-if cpu in ['riscv32', 'riscv64']
-  cpu = 'riscv'
-endif
-
 target_dirs = config_host['TARGET_DIRS'].split()
 have_linux_user = false
 have_bsd_user = false
@@ -XXX,XX +XXX,XX @@ elif cpu == 'x86'
   host_arch = 'i386'
 elif cpu == 'mips64'
   host_arch = 'mips'
+elif cpu in ['riscv32', 'riscv64']
+  host_arch = 'riscv'
 else
   host_arch = cpu
 endif
@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
 elif cpu in ['mips', 'mips64']
   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
-elif cpu in ['riscv']
+elif cpu in ['riscv32', 'riscv64']
   kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
 else
   kvm_targets = []
-- 
2.40.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Per Anup Patel in [*]:

> Currently, we only support running rv64 guest on rv64 host
 > and rv32 guest on rv32 host.
 >
 > In the future, we might support running rv32 guest on rv64
 > host but as of now we don't see a strong push for it.

Therefore, when only using the KVM accelerator it is pointless
to build qemu-system-riscv32 on a rv64 host (or qemu-system-riscv64
on a rv32 host). Restrict meson to only build the correct binary,
avoiding to waste ressources building unusable code.

[*] https://lore.kernel.org/qemu-devel/CAAhSdy2JeRHeeoEc1XKQhPO3aDz4YKeyQsPT4S8yKJcYTA+AiQ@mail.gmail.com/

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627143235.29947-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 meson.build | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
 elif cpu in ['mips', 'mips64']
   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
-elif cpu in ['riscv32', 'riscv64']
-  kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
+elif cpu in ['riscv32']
+  kvm_targets = ['riscv32-softmmu']
+elif cpu in ['riscv64']
+  kvm_targets = ['riscv64-softmmu']
 else
   kvm_targets = []
 endif
-- 
2.40.1

From: Ivan Klokov <ivan.klokov@syntacore.com>

Print RvV extension register to log if VPU option is enabled.

Signed-off-by: Ivan Klokov <ivan.klokov@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230629083730.386604-1-ivan.klokov@syntacore.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 57 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 56 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ struct isa_ext_data {
 #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
     {#_name, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
 
+/*
+ * From vector_helper.c
+ * Note that vector data is stored in host-endian 64-bit chunks,
+ * so addressing bytes needs a host-endian fixup.
+ */
+#if HOST_BIG_ENDIAN
+#define BYTE(x)   ((x) ^ 7)
+#else
+#define BYTE(x)   (x)
+#endif
+
 /*
  * Here are the ordering rules of extension naming defined by RISC-V
  * specification :
@@ -XXX,XX +XXX,XX @@ const char * const riscv_fpr_regnames[] = {
     "f30/ft10", "f31/ft11"
 };
 
+const char * const riscv_rvv_regnames[] = {
+  "v0",  "v1",  "v2",  "v3",  "v4",  "v5",  "v6",
+  "v7",  "v8",  "v9",  "v10", "v11", "v12", "v13",
+  "v14", "v15", "v16", "v17", "v18", "v19", "v20",
+  "v21", "v22", "v23", "v24", "v25", "v26", "v27",
+  "v28", "v29", "v30", "v31"
+};
+
 static const char * const riscv_excp_names[] = {
     "misaligned_fetch",
     "fault_fetch",
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
-    int i;
+    int i, j;
+    uint8_t *p;
 
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVH)) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
             }
         }
     }
+    if (riscv_has_ext(env, RVV) && (flags & CPU_DUMP_VPU)) {
+        static const int dump_rvv_csrs[] = {
+                    CSR_VSTART,
+                    CSR_VXSAT,
+                    CSR_VXRM,
+                    CSR_VCSR,
+                    CSR_VL,
+                    CSR_VTYPE,
+                    CSR_VLENB,
+                };
+        for (int i = 0; i < ARRAY_SIZE(dump_rvv_csrs); ++i) {
+            int csrno = dump_rvv_csrs[i];
+            target_ulong val = 0;
+            RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
+
+            /*
+             * Rely on the smode, hmode, etc, predicates within csr.c
+             * to do the filtering of the registers that are present.
+             */
+            if (res == RISCV_EXCP_NONE) {
+                qemu_fprintf(f, " %-8s " TARGET_FMT_lx "\n",
+                             csr_ops[csrno].name, val);
+            }
+        }
+        uint16_t vlenb = cpu->cfg.vlen >> 3;
+
+        for (i = 0; i < 32; i++) {
+            qemu_fprintf(f, " %-8s ", riscv_rvv_regnames[i]);
+            p = (uint8_t *)env->vreg;
+            for (j = vlenb - 1 ; j >= 0; j--) {
+                qemu_fprintf(f, "%02x", *(p + i * vlenb + BYTE(j)));
+            }
+            qemu_fprintf(f, "\n");
+        }
+    }
 }
 
 static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
-- 
2.40.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The Advanced Core Local Interruptor (ACLINT) device can
only be used with TCG. Check for TCG enabled instead of
KVM being not. Only add the property when TCG is used.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230629121103.87733-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/virt.rst |  1 +
 hw/riscv/virt.c            | 18 ++++++++++--------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
 
   When this option is "on", ACLINT devices will be emulated instead of
   SiFive CLINT. When not specified, this option is assumed to be "off".
+  This option is restricted to the TCG accelerator.
 
 - aia=[none|aplic|aplic-imsic]
 
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/tcg.h"
 #include "sysemu/kvm.h"
 #include "sysemu/tpm.h"
 #include "hw/pci/pci.h"
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
         g_free(clust_name);
 
-        if (!kvm_enabled()) {
+        if (tcg_enabled()) {
             if (s->have_aclint) {
                 create_fdt_socket_aclint(s, memmap, socket,
                     &intc_phandles[phandle_pos]);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                                 hart_count, &error_abort);
         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_fatal);
 
-        if (!kvm_enabled()) {
+        if (tcg_enabled()) {
             if (s->have_aclint) {
                 if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
                     /* Per-socket ACLINT MTIMER */
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
 #endif
 
-    object_class_property_add_bool(oc, "aclint", virt_get_aclint,
-                                   virt_set_aclint);
-    object_class_property_set_description(oc, "aclint",
-                                          "Set on/off to enable/disable "
-                                          "emulating ACLINT devices");
-
+    if (tcg_enabled()) {
+        object_class_property_add_bool(oc, "aclint", virt_get_aclint,
+                                       virt_set_aclint);
+        object_class_property_set_description(oc, "aclint",
+                                              "Set on/off to enable/disable "
+                                              "emulating ACLINT devices");
+    }
     object_class_property_add_str(oc, "aia", virt_get_aia,
                                   virt_set_aia);
     object_class_property_set_description(oc, "aia",
-- 
2.40.1

From: Robbin Ehn <rehn@rivosinc.com>

This patch adds the new syscall for the
"RISC-V Hardware Probing Interface"
(https://docs.kernel.org/riscv/hwprobe.html).

Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
Message-Id: <06a4543df2aa6101ca9a48f21a3198064b4f1f87.camel@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/riscv/syscall32_nr.h |   1 +
 linux-user/riscv/syscall64_nr.h |   1 +
 linux-user/syscall.c            | 146 ++++++++++++++++++++++++++++++++
 3 files changed, 148 insertions(+)

diff --git a/linux-user/riscv/syscall32_nr.h b/linux-user/riscv/syscall32_nr.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/riscv/syscall32_nr.h
+++ b/linux-user/riscv/syscall32_nr.h
@@ -XXX,XX +XXX,XX @@
 #define TARGET_NR_accept4 242
 #define TARGET_NR_arch_specific_syscall 244
 #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
 #define TARGET_NR_prlimit64 261
 #define TARGET_NR_fanotify_init 262
 #define TARGET_NR_fanotify_mark 263
diff --git a/linux-user/riscv/syscall64_nr.h b/linux-user/riscv/syscall64_nr.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/riscv/syscall64_nr.h
+++ b/linux-user/riscv/syscall64_nr.h
@@ -XXX,XX +XXX,XX @@
 #define TARGET_NR_recvmmsg 243
 #define TARGET_NR_arch_specific_syscall 244
 #define TARGET_NR_riscv_flush_icache (TARGET_NR_arch_specific_syscall + 15)
+#define TARGET_NR_riscv_hwprobe (TARGET_NR_arch_specific_syscall + 14)
 #define TARGET_NR_wait4 260
 #define TARGET_NR_prlimit64 261
 #define TARGET_NR_fanotify_init 262
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
 }
 #endif /* TARGET_NR_getdents64 */
 
+#if defined(TARGET_NR_riscv_hwprobe)
+
+#define RISCV_HWPROBE_KEY_MVENDORID     0
+#define RISCV_HWPROBE_KEY_MARCHID       1
+#define RISCV_HWPROBE_KEY_MIMPID        2
+
+#define RISCV_HWPROBE_KEY_BASE_BEHAVIOR 3
+#define     RISCV_HWPROBE_BASE_BEHAVIOR_IMA (1 << 0)
+
+#define RISCV_HWPROBE_KEY_IMA_EXT_0     4
+#define     RISCV_HWPROBE_IMA_FD       (1 << 0)
+#define     RISCV_HWPROBE_IMA_C        (1 << 1)
+
+#define RISCV_HWPROBE_KEY_CPUPERF_0     5
+#define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_EMULATED    (1 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_SLOW        (2 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_FAST        (3 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_UNSUPPORTED (4 << 0)
+#define     RISCV_HWPROBE_MISALIGNED_MASK        (7 << 0)
+
+struct riscv_hwprobe {
+    abi_llong  key;
+    abi_ullong value;
+};
+
+static void risc_hwprobe_fill_pairs(CPURISCVState *env,
+                                    struct riscv_hwprobe *pair,
+                                    size_t pair_count)
+{
+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
+
+    for (; pair_count > 0; pair_count--, pair++) {
+        abi_llong key;
+        abi_ullong value;
+        __put_user(0, &pair->value);
+        __get_user(key, &pair->key);
+        switch (key) {
+        case RISCV_HWPROBE_KEY_MVENDORID:
+            __put_user(cfg->mvendorid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_MARCHID:
+            __put_user(cfg->marchid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_MIMPID:
+            __put_user(cfg->mimpid, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_BASE_BEHAVIOR:
+            value = riscv_has_ext(env, RVI) &&
+                    riscv_has_ext(env, RVM) &&
+                    riscv_has_ext(env, RVA) ?
+                    RISCV_HWPROBE_BASE_BEHAVIOR_IMA : 0;
+            __put_user(value, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_IMA_EXT_0:
+            value = riscv_has_ext(env, RVF) &&
+                    riscv_has_ext(env, RVD) ?
+                    RISCV_HWPROBE_IMA_FD : 0;
+            value |= riscv_has_ext(env, RVC) ?
+                     RISCV_HWPROBE_IMA_C : pair->value;
+            __put_user(value, &pair->value);
+            break;
+        case RISCV_HWPROBE_KEY_CPUPERF_0:
+            __put_user(RISCV_HWPROBE_MISALIGNED_FAST, &pair->value);
+            break;
+        default:
+            __put_user(-1, &pair->key);
+            break;
+        }
+    }
+}
+
+static int cpu_set_valid(abi_long arg3, abi_long arg4)
+{
+    int ret, i, tmp;
+    size_t host_mask_size, target_mask_size;
+    unsigned long *host_mask;
+
+    /*
+     * cpu_set_t represent CPU masks as bit masks of type unsigned long *.
+     * arg3 contains the cpu count.
+     */
+    tmp = (8 * sizeof(abi_ulong));
+    target_mask_size = ((arg3 + tmp - 1) / tmp) * sizeof(abi_ulong);
+    host_mask_size = (target_mask_size + (sizeof(*host_mask) - 1)) &
+                     ~(sizeof(*host_mask) - 1);
+
+    host_mask = alloca(host_mask_size);
+
+    ret = target_to_host_cpu_mask(host_mask, host_mask_size,
+                                  arg4, target_mask_size);
+    if (ret != 0) {
+        return ret;
+    }
+
+    for (i = 0 ; i < host_mask_size / sizeof(*host_mask); i++) {
+        if (host_mask[i] != 0) {
+            return 0;
+        }
+    }
+    return -TARGET_EINVAL;
+}
+
+static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
+                                 abi_long arg2, abi_long arg3,
+                                 abi_long arg4, abi_long arg5)
+{
+    int ret;
+    struct riscv_hwprobe *host_pairs;
+
+    /* flags must be 0 */
+    if (arg5 != 0) {
+        return -TARGET_EINVAL;
+    }
+
+    /* check cpu_set */
+    if (arg3 != 0) {
+        ret = cpu_set_valid(arg3, arg4);
+        if (ret != 0) {
+            return ret;
+        }
+    } else if (arg4 != 0) {
+        return -TARGET_EINVAL;
+    }
+
+    /* no pairs */
+    if (arg2 == 0) {
+        return 0;
+    }
+
+    host_pairs = lock_user(VERIFY_WRITE, arg1,
+                           sizeof(*host_pairs) * (size_t)arg2, 0);
+    if (host_pairs == NULL) {
+        return -TARGET_EFAULT;
+    }
+    risc_hwprobe_fill_pairs(cpu_env, host_pairs, arg2);
+    unlock_user(host_pairs, arg1, sizeof(*host_pairs) * (size_t)arg2);
+    return 0;
+}
+#endif /* TARGET_NR_riscv_hwprobe */
+
 #if defined(TARGET_NR_pivot_root) && defined(__NR_pivot_root)
 _syscall2(int, pivot_root, const char *, new_root, const char *, put_old)
 #endif
@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
         return ret;
 #endif
 
+#if defined(TARGET_NR_riscv_hwprobe)
+    case TARGET_NR_riscv_hwprobe:
+        return do_riscv_hwprobe(cpu_env, arg1, arg2, arg3, arg4, arg5);
+#endif
+
     default:
         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
         return -TARGET_ENOSYS;
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add ext_zfbfmin/zvfbfmin/zvfbfwma properties.
Add require check for BF16 extensions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230615063302.102409-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h |  3 +++
 target/riscv/cpu.c     | 20 ++++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_svpbmt;
     bool ext_zdinx;
     bool ext_zawrs;
+    bool ext_zfbfmin;
     bool ext_zfh;
     bool ext_zfhmin;
     bool ext_zfinx;
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve64f;
     bool ext_zve64d;
     bool ext_zmmul;
+    bool ext_zvfbfmin;
+    bool ext_zvfbfwma;
     bool ext_zvfh;
     bool ext_zvfhmin;
     bool ext_smaia;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    if (cpu->cfg.ext_zfbfmin && !riscv_has_ext(env, RVF)) {
+        error_setg(errp, "Zfbfmin extension depends on F extension");
+        return;
+    }
+
     if (riscv_has_ext(env, RVD) && !riscv_has_ext(env, RVF)) {
         error_setg(errp, "D extension requires F extension");
         return;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    if (cpu->cfg.ext_zvfbfmin && !cpu->cfg.ext_zfbfmin) {
+        error_setg(errp, "Zvfbfmin extension depends on Zfbfmin extension");
+        return;
+    }
+
+    if (cpu->cfg.ext_zvfbfmin && !cpu->cfg.ext_zve32f) {
+        error_setg(errp, "Zvfbfmin extension depends on Zve32f extension");
+        return;
+    }
+
+    if (cpu->cfg.ext_zvfbfwma && !cpu->cfg.ext_zvfbfmin) {
+        error_setg(errp, "Zvfbfwma extension depends on Zvfbfmin extension");
+        return;
+    }
+
     /* Set the ISA extensions, checks should have happened above */
     if (cpu->cfg.ext_zhinx) {
         cpu->cfg.ext_zhinxmin = true;
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add trans_* and helper function for Zfbfmin instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                      |  4 ++
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/fpu_helper.c                  | 12 +++++
 target/riscv/translate.c                   |  1 +
 target/riscv/insn_trans/trans_rvbf16.c.inc | 53 ++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvzfh.c.inc  | 12 ++---
 6 files changed, 80 insertions(+), 6 deletions(-)
 create mode 100644 target/riscv/insn_trans/trans_rvbf16.c.inc

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sm4ks, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
 
 /* Zce helper */
 DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
+
+/* BF16 functions */
+DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
+DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ sm4ks       .. 11010 ..... ..... 000 ..... 0110011 @k_aes
 # *** RV32 Zicond Standard Extension ***
 czero_eqz   0000111  ..... ..... 101 ..... 0110011 @r
 czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
+
+# *** Zfbfmin Standard Extension ***
+fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
+fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fcvt_d_h(CPURISCVState *env, uint64_t rs1)
     float16 frs1 = check_nanbox_h(env, rs1);
     return float16_to_float64(frs1, true, &env->fp_status);
 }
+
+uint64_t helper_fcvt_bf16_s(CPURISCVState *env, uint64_t rs1)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    return nanbox_h(env, float32_to_bfloat16(frs1, &env->fp_status));
+}
+
+uint64_t helper_fcvt_s_bf16(CPURISCVState *env, uint64_t rs1)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    return nanbox_s(env, bfloat16_to_float32(frs1, &env->fp_status));
+}
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvk.c.inc"
 #include "insn_trans/trans_privileged.c.inc"
 #include "insn_trans/trans_svinval.c.inc"
+#include "insn_trans/trans_rvbf16.c.inc"
 #include "decode-xthead.c.inc"
 #include "insn_trans/trans_xthead.c.inc"
 #include "insn_trans/trans_xventanacondops.c.inc"
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the BF16 Standard Extensions.
+ *
+ * Copyright (c) 2020-2023 PLCT Lab
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZFBFMIN(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zfbfmin) { \
+        return false; \
+    } \
+} while (0)
+
+static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFBFMIN(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_bf16_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFBFMIN(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_s_bf16(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+    mark_fs_dirty(ctx);
+    return true;
+}
diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzfh.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
@@ -XXX,XX +XXX,XX @@
     }                                  \
 } while (0)
 
-#define REQUIRE_ZFHMIN(ctx) do {              \
-    if (!ctx->cfg_ptr->ext_zfhmin) {          \
+#define REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx) do {   \
+    if (!ctx->cfg_ptr->ext_zfhmin && !ctx->cfg_ptr->ext_zfbfmin) { \
         return false;                         \
     }                                         \
 } while (0)
@@ -XXX,XX +XXX,XX @@ static bool trans_flh(DisasContext *ctx, arg_flh *a)
     TCGv t0;
 
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     decode_save_opc(ctx);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
     TCGv t0;
 
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     decode_save_opc(ctx);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_wu(DisasContext *ctx, arg_fcvt_h_wu *a)
 static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_x_h(DisasContext *ctx, arg_fmv_x_h *a)
 static bool trans_fmv_h_x(DisasContext *ctx, arg_fmv_h_x *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFHMIN(ctx);
+    REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
     TCGv t0 = get_gpr(ctx, a->rs1, EXT_ZERO);
 
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add trans_* and helper function for Zvfbfmin instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                      |  3 +
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/vector_helper.c               |  6 ++
 target/riscv/insn_trans/trans_rvbf16.c.inc | 64 ++++++++++++++++++++++
 4 files changed, 77 insertions(+)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(cm_jalt, TCG_CALL_NO_WG, tl, env, i32)
 /* BF16 functions */
 DEF_HELPER_FLAGS_2(fcvt_bf16_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
+
+DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ czero_nez   0000111  ..... ..... 111 ..... 0110011 @r
 # *** Zfbfmin Standard Extension ***
 fcvt_bf16_s       0100010  01000 ..... ... ..... 1010011 @r2_rm
 fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
+
+# *** Zvfbfmin Standard Extension ***
+vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
+vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfwcvt_f_f_v_w, WOP_UU_W, H8, H4, float32_to_float64)
 GEN_VEXT_V_ENV(vfwcvt_f_f_v_h, 4)
 GEN_VEXT_V_ENV(vfwcvt_f_f_v_w, 8)
 
+RVVCALL(OPFVV1, vfwcvtbf16_f_f_v, WOP_UU_H, H4, H2, bfloat16_to_float32)
+GEN_VEXT_V_ENV(vfwcvtbf16_f_f_v, 4)
+
 /* Narrowing Floating-Point/Integer Type-Convert Instructions */
 /* (TD, T2, TX2) */
 #define NOP_UU_B uint8_t,  uint16_t, uint32_t
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVV1, vfncvt_f_f_w_w, NOP_UU_W, H4, H8, float64_to_float32)
 GEN_VEXT_V_ENV(vfncvt_f_f_w_h, 2)
 GEN_VEXT_V_ENV(vfncvt_f_f_w_w, 4)
 
+RVVCALL(OPFVV1, vfncvtbf16_f_f_w, NOP_UU_H, H2, H4, float32_to_bfloat16)
+GEN_VEXT_V_ENV(vfncvtbf16_f_f_w, 2)
+
 /*
  * Vector Reduction Operations
  */
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvbf16.c.inc
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -XXX,XX +XXX,XX @@
     } \
 } while (0)
 
+#define REQUIRE_ZVFBFMIN(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zvfbfmin) { \
+        return false; \
+    } \
+} while (0)
+
 static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
 {
     REQUIRE_FPU;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_bf16(DisasContext *ctx, arg_fcvt_s_bf16 *a)
     mark_fs_dirty(ctx);
     return true;
 }
+
+static bool trans_vfncvtbf16_f_f_w(DisasContext *ctx, arg_vfncvtbf16_f_f_w *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFMIN(ctx);
+
+    if (opfv_narrow_check(ctx, a) && (ctx->sew == MO_16)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfncvtbf16_f_f_w);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFMIN(ctx);
+
+    if (opfv_widen_check(ctx, a) && (ctx->sew == MO_16)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_3_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfwcvtbf16_f_f_v);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add trans_* and helper function for Zvfbfwma instructions.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20230615063302.102409-5-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                      |  3 ++
 target/riscv/insn32.decode                 |  4 ++
 target/riscv/vector_helper.c               | 11 ++++
 target/riscv/insn_trans/trans_rvbf16.c.inc | 58 ++++++++++++++++++++++
 4 files changed, 76 insertions(+)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_bf16, TCG_CALL_NO_RWG, i64, env, i64)
 
 DEF_HELPER_5(vfncvtbf16_f_f_w, void, ptr, ptr, ptr, env, i32)
 DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ fcvt_s_bf16       0100000  00110 ..... ... ..... 1010011 @r2_rm
 # *** Zvfbfmin Standard Extension ***
 vfncvtbf16_f_f_w  010010 . ..... 11101 001 ..... 1010111 @r2_vm
 vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
+
+# *** Zvfbfwma Standard Extension ***
+vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
+vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPFVF3, vfwmacc_vf_w, WOP_UUU_W, H8, H4, fwmacc32)
 GEN_VEXT_VF(vfwmacc_vf_h, 4)
 GEN_VEXT_VF(vfwmacc_vf_w, 8)
 
+static uint32_t fwmaccbf16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
+{
+    return float32_muladd(bfloat16_to_float32(a, s),
+                          bfloat16_to_float32(b, s), d, 0, s);
+}
+
+RVVCALL(OPFVV3, vfwmaccbf16_vv, WOP_UUU_H, H4, H2, H2, fwmaccbf16)
+GEN_VEXT_VV_ENV(vfwmaccbf16_vv, 4)
+RVVCALL(OPFVF3, vfwmaccbf16_vf, WOP_UUU_H, H4, H2, fwmacc16)
+GEN_VEXT_VF(vfwmaccbf16_vf, 4)
+
 static uint32_t fwnmacc16(uint16_t a, uint16_t b, uint32_t d, float_status *s)
 {
     return float32_muladd(float16_to_float32(a, true, s),
diff --git a/target/riscv/insn_trans/trans_rvbf16.c.inc b/target/riscv/insn_trans/trans_rvbf16.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvbf16.c.inc
+++ b/target/riscv/insn_trans/trans_rvbf16.c.inc
@@ -XXX,XX +XXX,XX @@
     } \
 } while (0)
 
+#define REQUIRE_ZVFBFWMA(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zvfbfwma) { \
+        return false; \
+    } \
+} while (0)
+
 static bool trans_fcvt_bf16_s(DisasContext *ctx, arg_fcvt_bf16_s *a)
 {
     REQUIRE_FPU;
@@ -XXX,XX +XXX,XX @@ static bool trans_vfwcvtbf16_f_f_v(DisasContext *ctx, arg_vfwcvtbf16_f_f_v *a)
     }
     return false;
 }
+
+static bool trans_vfwmaccbf16_vv(DisasContext *ctx, arg_vfwmaccbf16_vv *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFWMA(ctx);
+
+    if (require_rvv(ctx) && vext_check_isa_ill(ctx) && (ctx->sew == MO_16) &&
+        vext_check_dss(ctx, a->rd, a->rs1, a->rs2, a->vm)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+
+        gen_set_rm_chkfrm(ctx, RISCV_FRM_DYN);
+        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        tcg_gen_gvec_4_ptr(vreg_ofs(ctx, a->rd), vreg_ofs(ctx, 0),
+                           vreg_ofs(ctx, a->rs1),
+                           vreg_ofs(ctx, a->rs2), cpu_env,
+                           ctx->cfg_ptr->vlen / 8,
+                           ctx->cfg_ptr->vlen / 8, data,
+                           gen_helper_vfwmaccbf16_vv);
+        mark_vs_dirty(ctx);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vfwmaccbf16_vf(DisasContext *ctx, arg_vfwmaccbf16_vf *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZVFBFWMA(ctx);
+
+    if (require_rvv(ctx) && (ctx->sew == MO_16) && vext_check_isa_ill(ctx) &&
+        vext_check_ds(ctx, a->rd, a->rs2, a->vm)) {
+        uint32_t data = 0;
+
+        gen_set_rm(ctx, RISCV_FRM_DYN);
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, ctx->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, ctx->vta);
+        data = FIELD_DP32(data, VDATA, VMA, ctx->vma);
+        return opfvf_trans(a->rd, a->rs1, a->rs2, data,
+                           gen_helper_vfwmaccbf16_vf, ctx);
+    }
+
+    return false;
+}
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230615063302.102409-6-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+    ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
     ISA_EXT_DATA_ENTRY(zfinx, PRIV_VERSION_1_12_0, ext_zfinx),
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
+    ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
+    ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvfh", RISCVCPU, cfg.ext_zvfh, false),
     DEFINE_PROP_BOOL("x-zvfhmin", RISCVCPU, cfg.ext_zvfhmin, false),
 
+    DEFINE_PROP_BOOL("x-zfbfmin", RISCVCPU, cfg.ext_zfbfmin, false),
+    DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
+    DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
+
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.40.1

From: Jason Chien <jason.chien@sifive.com>

The privileged spec states:
For a memory access made to support VS-stage address translation (such as
to read/write a VS-level page table), permissions are checked as though
for a load or store, not for the original access type. However, any
exception is always reported for the original access type (instruction,
load, or store/AMO).

The current implementation converts the access type to LOAD if implicit
G-stage translation fails which results in only reporting "Load guest-page
fault". This commit removes the convertion of access type, so the reported
exception conforms to the spec.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230627074915.7686-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         if (ret == TRANSLATE_G_STAGE_FAIL) {
             first_stage_error = false;
             two_stage_indirect_error = true;
-            access_type = MMU_DATA_LOAD;
         }
 
         qemu_log_mask(CPU_LOG_MMU,
-- 
2.40.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230703071759.86775-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_cm_jalt = 788,
     rv_op_czero_eqz = 789,
     rv_op_czero_nez = 790,
+    rv_op_fcvt_bf16_s = 791,
+    rv_op_fcvt_s_bf16 = 792,
+    rv_op_vfncvtbf16_f_f_w = 793,
+    rv_op_vfwcvtbf16_f_f_v = 794,
+    rv_op_vfwmaccbf16_vv = 795,
+    rv_op_vfwmaccbf16_vf = 796,
+    rv_op_flh = 797,
+    rv_op_fsh = 798,
+    rv_op_fmv_h_x = 799,
+    rv_op_fmv_x_h = 800,
 } rv_op;
 
 /* register names */
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
     { "cm.jalt", rv_codec_zcmt_jt, rv_fmt_zcmt_index, NULL, 0 },
     { "czero.eqz", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
     { "czero.nez", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fcvt.bf16.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fcvt.s.bf16", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "vfncvtbf16.f.f.w", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwcvtbf16.f.f.v", rv_codec_v_r, rv_fmt_vd_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwmaccbf16.vv", rv_codec_v_r, rv_fmt_vd_vs1_vs2_vm, NULL, 0, 0, 0 },
+    { "vfwmaccbf16.vf", rv_codec_v_r, rv_fmt_vd_fs1_vs2_vm, NULL, 0, 0, 0 },
+    { "flh", rv_codec_i, rv_fmt_frd_offset_rs1, NULL, 0, 0, 0 },
+    { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
+    { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
+    { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
 };
 
 /* CSR names */
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_vloxei8_v; break;
                 }
                 break;
+            case 1: op = rv_op_flh; break;
             case 2: op = rv_op_flw; break;
             case 3: op = rv_op_fld; break;
             case 4: op = rv_op_flq; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_vsoxei8_v; break;
                 }
                 break;
+            case 1: op = rv_op_fsh; break;
             case 2: op = rv_op_fsw; break;
             case 3: op = rv_op_fsd; break;
             case 4: op = rv_op_fsq; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 1: op = rv_op_fcvt_s_d; break;
                 case 3: op = rv_op_fcvt_s_q; break;
+                case 6: op = rv_op_fcvt_s_bf16; break;
                 }
                 break;
             case 33:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 3: op = rv_op_fcvt_d_q; break;
                 }
                 break;
+            case 34:
+                switch (((inst >> 20) & 0b11111)) {
+                case 8: op = rv_op_fcvt_bf16_s; break;
+                }
+                break;
             case 35:
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_q_s; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 1: op = rv_op_fclass_d; break;
                 }
                 break;
+            case 114:
+                switch (((inst >> 17) & 0b11111000) |
+                        ((inst >> 12) & 0b00000111)) {
+                case 0: op = rv_op_fmv_x_h; break;
+                }
+                break;
             case 115:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fmv_d_x; break;
                 }
                 break;
+            case 122:
+                switch (((inst >> 17) & 0b11111000) |
+                        ((inst >> 12) & 0b00000111)) {
+                case 0: op = rv_op_fmv_h_x; break;
+                }
+                break;
             case 123:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                     case 10: op = rv_op_vfwcvt_f_xu_v; break;
                     case 11: op = rv_op_vfwcvt_f_x_v; break;
                     case 12: op = rv_op_vfwcvt_f_f_v; break;
+                    case 13: op = rv_op_vfwcvtbf16_f_f_v; break;
                     case 14: op = rv_op_vfwcvt_rtz_xu_f_v; break;
                     case 15: op = rv_op_vfwcvt_rtz_x_f_v; break;
                     case 16: op = rv_op_vfncvt_xu_f_w; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                     case 21: op = rv_op_vfncvt_rod_f_f_w; break;
                     case 22: op = rv_op_vfncvt_rtz_xu_f_w; break;
                     case 23: op = rv_op_vfncvt_rtz_x_f_w; break;
+                    case 29: op = rv_op_vfncvtbf16_f_f_w; break;
                     }
                     break;
                 case 19:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 52: op = rv_op_vfwadd_wv; break;
                 case 54: op = rv_op_vfwsub_wv; break;
                 case 56: op = rv_op_vfwmul_vv; break;
+                case 59: op = rv_op_vfwmaccbf16_vv; break;
                 case 60: op = rv_op_vfwmacc_vv; break;
                 case 61: op = rv_op_vfwnmacc_vv; break;
                 case 62: op = rv_op_vfwmsac_vv; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 52: op = rv_op_vfwadd_wf; break;
                 case 54: op = rv_op_vfwsub_wf; break;
                 case 56: op = rv_op_vfwmul_vf; break;
+                case 59: op = rv_op_vfwmaccbf16_vf; break;
                 case 60: op = rv_op_vfwmacc_vf; break;
                 case 61: op = rv_op_vfwnmacc_vf; break;
                 case 62: op = rv_op_vfwmsac_vf; break;
-- 
2.40.1

From: "yang.zhang" <yang.zhang@hexintek.com>

Should set/get riscv all reg timer,i.e, time/compare/frequency/state.

Signed-off-by: Yang Zhang <yang.zhang@hexintek.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1688
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230707032306.4606-1-gaoshanliukou@163.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
 
 #define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
     do { \
-        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, time), &reg); \
+        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
         if (ret) { \
             abort(); \
         } \
-- 
2.40.1

From: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>

fdt_load_addr was previously declared as uint32_t which doe not match
with the return type of riscv_compute_fdt_addr().

This patch modifies the fdt_load_addr type from a uint32_t to a uint64_t
to match the riscv_compute_fdt_addr() return type.

This fixes calculating the fdt address when DRAM is mapped to higher
64-bit address.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Lakshmi Bai Raja Subramanian <lakshmi.bai.rajasubramanian@bodhicomputing.com>
[ Change by AF:
 - Cleanup commit title and message
]
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <168872495192.6334.3845988291412774261-1@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
     target_ulong start_addr = memmap[VIRT_DRAM].base;
     target_ulong firmware_end_addr, kernel_start_addr;
     const char *firmware_name = riscv_default_firmware_name(&s->soc[0]);
-    uint32_t fdt_load_addr;
+    uint64_t fdt_load_addr;
     uint64_t kernel_entry = 0;
     BlockBackend *pflash_blk0;
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

As it is today it's not possible to use '-cpu host' if the RISC-V host
has RVH enabled. This is the resulting error:

$ ./qemu/build/qemu-system-riscv64 \
    -machine virt,accel=kvm -m 2G -smp 1 \
    -nographic -snapshot -kernel ./guest_imgs/Image  \
    -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
    -append "earlycon=sbi root=/dev/ram rw" \
    -cpu host
qemu-system-riscv64: H extension requires priv spec 1.12.0

This happens because we're checking for priv spec for all CPUs, and
since we're not setting  env->priv_ver for the 'host' CPU, it's being
default to zero (i.e. PRIV_SPEC_1_10_0).

In reality env->priv_ver does not make sense when running with the KVM
'host' CPU. It's used to gate certain CSRs/extensions during translation
to make them unavailable if the hart declares an older spec version. It
doesn't have any other use. E.g. OpenSBI version 1.2 retrieves the spec
checking if the CSR_MCOUNTEREN, CSR_MCOUNTINHIBIT and CSR_MENVCFG CSRs
are available [1].

'priv_ver' is just one example. We're doing a lot of feature validation
and setup during riscv_cpu_realize() that it doesn't apply to KVM CPUs.
Validating the feature set for those CPUs is a KVM problem that should
be handled in KVM specific code.

The new riscv_cpu_realize_tcg() helper contains all validation logic that
are applicable to TCG CPUs only. riscv_cpu_realize() verifies if we're
running TCG and, if it's the case, proceed with the usual TCG realize()
logic.

[1] lib/sbi/sbi_hart.c, hart_detect_features()

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 35 +++++++++++++++++++++++++----------
 1 file changed, 25 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "fpu/softfloat-helpers.h"
 #include "sysemu/kvm.h"
+#include "sysemu/tcg.h"
 #include "kvm_riscv.h"
 #include "tcg/tcg.h"
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
     }
 }
 
-static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
 {
-    CPUState *cs = CPU(dev);
     RISCVCPU *cpu = RISCV_CPU(dev);
     CPURISCVState *env = &cpu->env;
-    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
     Error *local_err = NULL;
 
-    cpu_exec_realizefn(cs, &local_err);
-    if (local_err != NULL) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
     riscv_cpu_validate_misa_mxl(cpu, &local_err);
     if (local_err != NULL) {
         error_propagate(errp, local_err);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
     }
 
 #ifndef CONFIG_USER_ONLY
-    cs->tcg_cflags |= CF_PCREL;
+    CPU(dev)->tcg_cflags |= CF_PCREL;
 
     if (cpu->cfg.ext_sstc) {
         riscv_timer_init(cpu);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         }
      }
 #endif
+}
+
+static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+{
+    CPUState *cs = CPU(dev);
+    RISCVCPU *cpu = RISCV_CPU(dev);
+    RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
+    Error *local_err = NULL;
+
+    cpu_exec_realizefn(cs, &local_err);
+    if (local_err != NULL) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    if (tcg_enabled()) {
+        riscv_cpu_realize_tcg(dev, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
 
     riscv_cpu_finalize_features(cpu, &local_err);
     if (local_err != NULL) {
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The absence of a satp mode in riscv_host_cpu_init() is causing the
following error:

$ ./qemu/build/qemu-system-riscv64  -machine virt,accel=kvm \
    -m 2G -smp 1  -nographic -snapshot \
    -kernel ./guest_imgs/Image \
    -initrd ./guest_imgs/rootfs_kvm_riscv64.img \
    -append "earlycon=sbi root=/dev/ram rw" \
    -cpu host
**
ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should not be
reached
Bail out! ERROR:../target/riscv/cpu.c:320:satp_mode_str: code should
not be reached
Aborted

The error is triggered from create_fdt_socket_cpus() in hw/riscv/virt.c.
It's trying to get satp_mode_str for a NULL cpu->cfg.satp_mode.map.

For this KVM cpu we would need to inherit the satp supported modes
from the RISC-V host. At this moment this is not possible because the
KVM driver does not support it. And even when it does we can't just let
this broken for every other older kernel.

Since mmu-type is not a required node, according to [1], skip the
'mmu-type' FDT node if there's no satp_mode set. We'll revisit this
logic when we can get satp information from KVM.

[1] https://github.com/torvalds/linux/blob/master/Documentation/devicetree/bindings/riscv/cpus.yaml

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230706101738.460804-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
             s->soc[socket].hartid_base + cpu);
         qemu_fdt_add_subnode(ms->fdt, cpu_name);
 
-        satp_mode_max = satp_mode_max_from_map(
-            s->soc[socket].harts[cpu].cfg.satp_mode.map);
-        sv_name = g_strdup_printf("riscv,%s",
-                                  satp_mode_str(satp_mode_max, is_32_bit));
-        qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
-        g_free(sv_name);
-
+        if (cpu_ptr->cfg.satp_mode.supported != 0) {
+            satp_mode_max = satp_mode_max_from_map(cpu_ptr->cfg.satp_mode.map);
+            sv_name = g_strdup_printf("riscv,%s",
+                                      satp_mode_str(satp_mode_max, is_32_bit));
+            qemu_fdt_setprop_string(ms->fdt, cpu_name, "mmu-type", sv_name);
+            g_free(sv_name);
+        }
 
         name = riscv_isa_string(cpu_ptr);
         qemu_fdt_setprop_string(ms->fdt, cpu_name, "riscv,isa", name);
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're going to change the handling of mvendorid/marchid/mimpid by the
KVM driver. Since these are always present in all CPUs let's put the
same validation for everyone.

It doesn't make sense to allow 'mvendorid' to be different than it
is already set in named (vendor) CPUs. Generic (dynamic) CPUs can have
any 'mvendorid' they want.

Change 'mvendorid' to be a class property created via
'object_class_property_add', instead of using the DEFINE_PROP_UINT32()
macro. This allow us to define a custom setter for it that will verify,
for named CPUs, if mvendorid is different than it is already set by the
CPU. This is the error thrown for the 'veyron-v1' CPU if 'mvendorid' is
set to an invalid value:

$ qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mvendorid=2
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mvendorid=2:
    Unable to change veyron-v1-riscv-cpu mvendorid (0x61f)

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
 static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
-    DEFINE_PROP_UINT32("mvendorid", RISCVCPU, cfg.mvendorid, 0),
     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
     DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
 
@@ -XXX,XX +XXX,XX @@ static const struct TCGCPUOps riscv_tcg_ops = {
 #endif /* !CONFIG_USER_ONLY */
 };
 
+static bool riscv_cpu_is_dynamic(Object *cpu_obj)
+{
+    return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
+}
+
+static void cpu_set_mvendorid(Object *obj, Visitor *v, const char *name,
+                              void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint32_t prev_val = cpu->cfg.mvendorid;
+    uint32_t value;
+
+    if (!visit_type_uint32(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s mvendorid (0x%x)",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    cpu->cfg.mvendorid = value;
+}
+
+static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
+                              void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.mvendorid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
     cc->tcg_ops = &riscv_tcg_ops;
 
+    object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
+                              cpu_set_mvendorid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Following the same logic used with 'mvendorid' let's also restrict
'mimpid' for named CPUs. Generic CPUs keep setting the value freely.

Note that we're getting rid of the default RISCV_CPU_MARCHID value. The
reason is that this is not a good default since it's dynamic, changing
with with every QEMU version, regardless of whether the actual
implementation of the CPU changed from one QEMU version to the other.
Named CPU should set it to a meaningful value instead and generic CPUs
can set whatever they want.

This is the error thrown for an invalid 'mimpid' value for the veyron-v1
CPU:

$ ./qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,mimpid=2
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.mimpid=2:
    Unable to change veyron-v1-riscv-cpu mimpid (0x111)

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
                              (QEMU_VERSION_MINOR << 8)  | \
                              (QEMU_VERSION_MICRO))
-#define RISCV_CPU_MIMPID    RISCV_CPU_MARCHID
 
 static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
 
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
-    DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
 
 #ifndef CONFIG_USER_ONLY
     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
@@ -XXX,XX +XXX,XX @@ static void cpu_get_mvendorid(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
+static void cpu_set_mimpid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint64_t prev_val = cpu->cfg.mimpid;
+    uint64_t value;
+
+    if (!visit_type_uint64(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s mimpid (0x%" PRIu64 ")",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    cpu->cfg.mimpid = value;
+}
+
+static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.mimpid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     object_class_property_add(c, "mvendorid", "uint32", cpu_get_mvendorid,
                               cpu_set_mvendorid, NULL, NULL);
 
+    object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
+                              cpu_set_mimpid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

'marchid' shouldn't be set to a different value as previously set for
named CPUs.

For all other CPUs it shouldn't be freely set either - the spec requires
that 'marchid' can't have the MSB (most significant bit) set and every
other bit set to zero, i.e. 0x80000000 is an invalid 'marchid' value for
32 bit CPUs.

As with 'mimpid', setting a default value based on the current QEMU
version is not a good idea because it implies that the CPU
implementation changes from one QEMU version to the other. Named CPUs
should set 'marchid' to a meaningful value instead, and generic CPUs can
set to any valid value.

For the 'veyron-v1' CPU this is the error thrown if 'marchid' is set to
a different val:

$ ./build/qemu-system-riscv64 -M virt -nographic -cpu veyron-v1,marchid=0x80000000
qemu-system-riscv64: can't apply global veyron-v1-riscv-cpu.marchid=0x80000000:
    Unable to change veyron-v1-riscv-cpu marchid (0x8000000000010000)

And, for generics CPUs, this is the error when trying to set to an
invalid val:

$ ./build/qemu-system-riscv64 -M virt -nographic -cpu rv64,marchid=0x8000000000000000
qemu-system-riscv64: can't apply global rv64-riscv-cpu.marchid=0x8000000000000000:
    Unable to set marchid with MSB (64) bit set and the remaining bits zero

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 60 ++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 53 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "tcg/tcg.h"
 
 /* RISC-V CPU definitions */
-
-#define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
-                             (QEMU_VERSION_MINOR << 8)  | \
-                             (QEMU_VERSION_MICRO))
-
 static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
 
 struct isa_ext_data {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
 static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
 
-    DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
-
 #ifndef CONFIG_USER_ONLY
     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
 #endif
@@ -XXX,XX +XXX,XX @@ static void cpu_get_mimpid(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
+static void cpu_set_marchid(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint64_t prev_val = cpu->cfg.marchid;
+    uint64_t value, invalid_val;
+    uint32_t mxlen = 0;
+
+    if (!visit_type_uint64(v, name, &value, errp)) {
+        return;
+    }
+
+    if (!dynamic_cpu && prev_val != value) {
+        error_setg(errp, "Unable to change %s marchid (0x%" PRIu64 ")",
+                   object_get_typename(obj), prev_val);
+        return;
+    }
+
+    switch (riscv_cpu_mxl(&cpu->env)) {
+    case MXL_RV32:
+        mxlen = 32;
+        break;
+    case MXL_RV64:
+    case MXL_RV128:
+        mxlen = 64;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    invalid_val = 1LL << (mxlen - 1);
+
+    if (value == invalid_val) {
+        error_setg(errp, "Unable to set marchid with MSB (%u) bit set "
+                         "and the remaining bits zero", mxlen);
+        return;
+    }
+
+    cpu->cfg.marchid = value;
+}
+
+static void cpu_get_marchid(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+{
+    bool value = RISCV_CPU(obj)->cfg.marchid;
+
+    visit_type_bool(v, name, &value, errp);
+}
+
 static void riscv_cpu_class_init(ObjectClass *c, void *data)
 {
     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     object_class_property_add(c, "mimpid", "uint64", cpu_get_mimpid,
                               cpu_set_mimpid, NULL, NULL);
 
+    object_class_property_add(c, "marchid", "uint64", cpu_get_marchid,
+                              cpu_set_marchid, NULL, NULL);
+
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Certain validations, such as the validations done for the machine IDs
(mvendorid/marchid/mimpid), are done before starting the CPU.
Non-dynamic (named) CPUs tries to match user input with a preset
default. As it is today we can't prefetch a KVM default for these cases
because we're only able to read/write KVM regs after the vcpu is
spinning.

Our target/arm friends use a concept called "scratch CPU", which
consists of creating a vcpu for doing queries and validations and so on,
which is discarded shortly after use [1]. This is a suitable solution
for what we need so let's implement it in target/riscv as well.

kvm_riscv_init_machine_ids() will be used to do any pre-launch setup for
KVM CPUs, via riscv_cpu_add_user_properties(). The function will create
a KVM scratch CPU, fetch KVM regs that work as default values for user
properties, and then discard the scratch CPU afterwards.

We're starting by initializing 'mvendorid'. This concept will be used to
init other KVM specific properties in the next patches as well.

[1] target/arm/kvm.c, kvm_arm_create_scratch_host_vcpu()

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h |  1 +
 target/riscv/cpu.c       |  6 +++
 target/riscv/kvm.c       | 85 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 92 insertions(+)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@
 #ifndef QEMU_KVM_RISCV_H
 #define QEMU_KVM_RISCV_H
 
+void kvm_riscv_init_user_properties(Object *cpu_obj);
 void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
 void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
     Property *prop;
     DeviceState *dev = DEVICE(obj);
 
+#ifndef CONFIG_USER_ONLY
+    if (kvm_enabled()) {
+        kvm_riscv_init_user_properties(obj);
+    }
+#endif
+
     riscv_cpu_add_misa_properties(obj);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_put_regs_timer(CPUState *cs)
     env->kvm_timer_dirty = false;
 }
 
+typedef struct KVMScratchCPU {
+    int kvmfd;
+    int vmfd;
+    int cpufd;
+} KVMScratchCPU;
+
+/*
+ * Heavily inspired by kvm_arm_create_scratch_host_vcpu()
+ * from target/arm/kvm.c.
+ */
+static bool kvm_riscv_create_scratch_vcpu(KVMScratchCPU *scratch)
+{
+    int kvmfd = -1, vmfd = -1, cpufd = -1;
+
+    kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
+    if (kvmfd < 0) {
+        goto err;
+    }
+    do {
+        vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
+    } while (vmfd == -1 && errno == EINTR);
+    if (vmfd < 0) {
+        goto err;
+    }
+    cpufd = ioctl(vmfd, KVM_CREATE_VCPU, 0);
+    if (cpufd < 0) {
+        goto err;
+    }
+
+    scratch->kvmfd =  kvmfd;
+    scratch->vmfd = vmfd;
+    scratch->cpufd = cpufd;
+
+    return true;
+
+ err:
+    if (cpufd >= 0) {
+        close(cpufd);
+    }
+    if (vmfd >= 0) {
+        close(vmfd);
+    }
+    if (kvmfd >= 0) {
+        close(kvmfd);
+    }
+
+    return false;
+}
+
+static void kvm_riscv_destroy_scratch_vcpu(KVMScratchCPU *scratch)
+{
+    close(scratch->cpufd);
+    close(scratch->vmfd);
+    close(scratch->kvmfd);
+}
+
+static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    reg.addr = (uint64_t)&cpu->cfg.mvendorid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve mvendorid from host, error %d", ret);
+    }
+}
+
+void kvm_riscv_init_user_properties(Object *cpu_obj)
+{
+    RISCVCPU *cpu = RISCV_CPU(cpu_obj);
+    KVMScratchCPU kvmcpu;
+
+    if (!kvm_riscv_create_scratch_vcpu(&kvmcpu)) {
+        return;
+    }
+
+    kvm_riscv_init_machine_ids(cpu, &kvmcpu);
+
+    kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
+}
+
 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
     KVM_CAP_LAST_INFO
 };
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Allow 'marchid' and 'mimpid' to also be initialized in
kvm_riscv_init_machine_ids().

After this change, the handling of mvendorid/marchid/mimpid for the
'host' CPU type will be equal to what we already have for TCG named
CPUs, i.e. the user is not able to set these values to a different val
than the one that is already preset.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     if (ret != 0) {
         error_report("Unable to retrieve mvendorid from host, error %d", ret);
     }
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(marchid));
+    reg.addr = (uint64_t)&cpu->cfg.marchid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve marchid from host, error %d", ret);
+    }
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(mimpid));
+    reg.addr = (uint64_t)&cpu->cfg.mimpid;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to retrieve mimpid from host, error %d", ret);
+    }
 }
 
 void kvm_riscv_init_user_properties(Object *cpu_obj)
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

After changing user validation for mvendorid/marchid/mimpid to guarantee
that the value is validated on user input time, coupled with the work in
fetching KVM default values for them by using a scratch CPU, we're
certain that the values in cpu->cfg.(mvendorid|marchid|mimpid) are
already good to be written back to KVM.

There's no need to write the values back for 'host' type CPUs since the
values can't be changed, so let's do that just for generic CPUs.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arch_init_irq_routing(KVMState *s)
 {
 }
 
+static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t id;
+    int ret;
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(mvendorid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mvendorid);
+    if (ret != 0) {
+        return ret;
+    }
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(marchid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.marchid);
+    if (ret != 0) {
+        return ret;
+    }
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(mimpid));
+    ret = kvm_set_one_reg(cs, id, &cpu->cfg.mimpid);
+
+    return ret;
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
     }
     env->misa_ext = isa;
 
+    if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
+        ret = kvm_vcpu_set_machine_ids(cpu, cs);
+    }
+
     return ret;
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

At this moment we're retrieving env->misa_ext during
kvm_arch_init_cpu(), leaving env->misa_ext_mask behind.

We want to set env->misa_ext_mask, and we want to set it as early as
possible. The reason is that we're going to use it in the validation
process of the KVM MISA properties we're going to add next. Setting it
during arch_init_cpu() is too late for user validation.

Move the code to a new helper that is going to be called during init()
time, via kvm_riscv_init_user_properties(), like we're already doing for
the machine ID properties. Set both misa_ext and misa_ext_mask to the
same value retrieved by the 'isa' config reg.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-11-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 34 +++++++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_machine_ids(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     }
 }
 
+static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
+                                         KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              KVM_REG_RISCV_CONFIG_REG(isa));
+    reg.addr = (uint64_t)&env->misa_ext_mask;
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+
+    if (ret) {
+        error_report("Unable to fetch ISA register from KVM, "
+                     "error %d", ret);
+        kvm_riscv_destroy_scratch_vcpu(kvmcpu);
+        exit(EXIT_FAILURE);
+    }
+
+    env->misa_ext = env->misa_ext_mask;
+}
+
 void kvm_riscv_init_user_properties(Object *cpu_obj)
 {
     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
     }
 
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
+    kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
 
     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 }
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
-    target_ulong isa;
     RISCVCPU *cpu = RISCV_CPU(cs);
-    CPURISCVState *env = &cpu->env;
-    uint64_t id;
 
     qemu_add_vm_change_state_handler(kvm_riscv_vm_state_change, cs);
 
-    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                          KVM_REG_RISCV_CONFIG_REG(isa));
-    ret = kvm_get_one_reg(cs, id, &isa);
-    if (ret) {
-        return ret;
-    }
-    env->misa_ext = isa;
-
     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
         ret = kvm_vcpu_set_machine_ids(cpu, cs);
     }
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Next patch will add KVM specific user properties for both MISA and
multi-letter extensions. For MISA extensions we want to make use of what
is already available in misa_ext_cfgs[] to avoid code repetition.

misa_ext_info_arr[] array will hold name and description for each MISA
extension that misa_ext_cfgs[] is declaring. We'll then use this new
array in KVM code to avoid duplicating strings. Two getters were added
to allow KVM to retrieve the 'name' and 'description' for each MISA
property.

There's nothing holding us back from doing the same with multi-letter
extensions. For now doing just with MISA extensions is enough.

It is worth documenting that even using the __bultin_ctz() directive to
populate the misa_ext_info_arr[] we are forced to assign 'name' and
'description' during runtime in riscv_cpu_add_misa_properties(). The
reason is that some Gitlab runners ('clang-user' and 'tsan-build') will
throw errors like this if we fetch 'name' and 'description' from the
array in the MISA_CFG() macro:

../target/riscv/cpu.c:1624:5: error: initializer element is not a
                              compile-time constant
    MISA_CFG(RVA, true),
    ^~~~~~~~~~~~~~~~~~~
../target/riscv/cpu.c:1619:53: note: expanded from macro 'MISA_CFG'
    {.name = misa_ext_info_arr[MISA_INFO_IDX(_bit)].name, \
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~

gcc and others compilers/builders were fine with that change. We can't
ignore failures in the Gitlab pipeline though, so code was changed to
make every runner happy.

As a side effect, misa_ext_cfg[] is no longer a 'const' array because
it must be set during runtime.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-12-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |   7 ++-
 target/riscv/cpu.c | 110 +++++++++++++++++++++++++++++++++------------
 2 files changed, 88 insertions(+), 29 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@
 
 #define RV(x) ((target_ulong)1 << (x - 'A'))
 
-/* Consider updating misa_ext_cfgs[] when adding new MISA bits here */
+/*
+ * Consider updating misa_ext_info_arr[] and misa_ext_cfgs[]
+ * when adding new MISA bits here.
+ */
 #define RVI RV('I')
 #define RVE RV('E') /* E and I are mutually exclusive */
 #define RVM RV('M')
@@ -XXX,XX +XXX,XX @@
 #define RVJ RV('J')
 #define RVG RV('G')
 
+const char *riscv_get_misa_ext_name(uint32_t bit);
+const char *riscv_get_misa_ext_description(uint32_t bit);
 
 /* Privileged specification version */
 enum {
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
     visit_type_bool(v, name, &value, errp);
 }
 
-static const RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
-    {.name = "a", .description = "Atomic instructions",
-     .misa_bit = RVA, .enabled = true},
-    {.name = "c", .description = "Compressed instructions",
-     .misa_bit = RVC, .enabled = true},
-    {.name = "d", .description = "Double-precision float point",
-     .misa_bit = RVD, .enabled = true},
-    {.name = "f", .description = "Single-precision float point",
-     .misa_bit = RVF, .enabled = true},
-    {.name = "i", .description = "Base integer instruction set",
-     .misa_bit = RVI, .enabled = true},
-    {.name = "e", .description = "Base integer instruction set (embedded)",
-     .misa_bit = RVE, .enabled = false},
-    {.name = "m", .description = "Integer multiplication and division",
-     .misa_bit = RVM, .enabled = true},
-    {.name = "s", .description = "Supervisor-level instructions",
-     .misa_bit = RVS, .enabled = true},
-    {.name = "u", .description = "User-level instructions",
-     .misa_bit = RVU, .enabled = true},
-    {.name = "h", .description = "Hypervisor",
-     .misa_bit = RVH, .enabled = true},
-    {.name = "x-j", .description = "Dynamic translated languages",
-     .misa_bit = RVJ, .enabled = false},
-    {.name = "v", .description = "Vector operations",
-     .misa_bit = RVV, .enabled = false},
-    {.name = "g", .description = "General purpose (IMAFD_Zicsr_Zifencei)",
-     .misa_bit = RVG, .enabled = false},
+typedef struct misa_ext_info {
+    const char *name;
+    const char *description;
+} MISAExtInfo;
+
+#define MISA_INFO_IDX(_bit) \
+    __builtin_ctz(_bit)
+
+#define MISA_EXT_INFO(_bit, _propname, _descr) \
+    [MISA_INFO_IDX(_bit)] = {.name = _propname, .description = _descr}
+
+static const MISAExtInfo misa_ext_info_arr[] = {
+    MISA_EXT_INFO(RVA, "a", "Atomic instructions"),
+    MISA_EXT_INFO(RVC, "c", "Compressed instructions"),
+    MISA_EXT_INFO(RVD, "d", "Double-precision float point"),
+    MISA_EXT_INFO(RVF, "f", "Single-precision float point"),
+    MISA_EXT_INFO(RVI, "i", "Base integer instruction set"),
+    MISA_EXT_INFO(RVE, "e", "Base integer instruction set (embedded)"),
+    MISA_EXT_INFO(RVM, "m", "Integer multiplication and division"),
+    MISA_EXT_INFO(RVS, "s", "Supervisor-level instructions"),
+    MISA_EXT_INFO(RVU, "u", "User-level instructions"),
+    MISA_EXT_INFO(RVH, "h", "Hypervisor"),
+    MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
+    MISA_EXT_INFO(RVV, "v", "Vector operations"),
+    MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
+};
+
+static int riscv_validate_misa_info_idx(uint32_t bit)
+{
+    int idx;
+
+    /*
+     * Our lowest valid input (RVA) is 1 and
+     * __builtin_ctz() is UB with zero.
+     */
+    g_assert(bit != 0);
+    idx = MISA_INFO_IDX(bit);
+
+    g_assert(idx < ARRAY_SIZE(misa_ext_info_arr));
+    return idx;
+}
+
+const char *riscv_get_misa_ext_name(uint32_t bit)
+{
+    int idx = riscv_validate_misa_info_idx(bit);
+    const char *val = misa_ext_info_arr[idx].name;
+
+    g_assert(val != NULL);
+    return val;
+}
+
+const char *riscv_get_misa_ext_description(uint32_t bit)
+{
+    int idx = riscv_validate_misa_info_idx(bit);
+    const char *val = misa_ext_info_arr[idx].description;
+
+    g_assert(val != NULL);
+    return val;
+}
+
+#define MISA_CFG(_bit, _enabled) \
+    {.misa_bit = _bit, .enabled = _enabled}
+
+static RISCVCPUMisaExtConfig misa_ext_cfgs[] = {
+    MISA_CFG(RVA, true),
+    MISA_CFG(RVC, true),
+    MISA_CFG(RVD, true),
+    MISA_CFG(RVF, true),
+    MISA_CFG(RVI, true),
+    MISA_CFG(RVE, false),
+    MISA_CFG(RVM, true),
+    MISA_CFG(RVS, true),
+    MISA_CFG(RVU, true),
+    MISA_CFG(RVH, true),
+    MISA_CFG(RVJ, false),
+    MISA_CFG(RVV, false),
+    MISA_CFG(RVG, false),
 };
 
 static void riscv_cpu_add_misa_properties(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
     int i;
 
     for (i = 0; i < ARRAY_SIZE(misa_ext_cfgs); i++) {
-        const RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+        RISCVCPUMisaExtConfig *misa_cfg = &misa_ext_cfgs[i];
+        int bit = misa_cfg->misa_bit;
+
+        misa_cfg->name = riscv_get_misa_ext_name(bit);
+        misa_cfg->description = riscv_get_misa_ext_description(bit);
 
         object_property_add(cpu_obj, misa_cfg->name, "bool",
                             cpu_get_misa_ext_cfg,
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Using all TCG user properties in KVM is tricky. First because KVM
supports only a small subset of what TCG provides, so most of the
cpu->cfg flags do nothing for KVM.

Second, and more important, we don't have a way of telling if any given
value is an user input or not. For TCG this has a small impact since we
just validating everything and error out if needed. But for KVM it would
be good to know if a given value was set by the user or if it's a value
already provided by KVM. Otherwise we don't know how to handle failed
kvm_set_one_regs() when writing the configurations back.

These characteristics make it overly complicated to use the same user
facing flags for both KVM and TCG. A simpler approach is to create KVM
specific properties that have specialized logic, forking KVM and TCG use
cases for those cases only. Fully separating KVM/TCG properties is
unneeded at this point - in fact we want the user experience to be as
equal as possible, regardless of the acceleration chosen.

We'll start this fork with the MISA properties, adding the MISA bits
that the KVM driver currently supports. A new KVMCPUConfig type is
introduced. It'll hold general information about an extension. For MISA
extensions we're going to use the newly created getters of
misa_ext_infos[] to populate their name and description. 'offset' holds
the MISA bit (RVA, RVC, ...). We're calling it 'offset' instead of
'misa_bit' because this same KVMCPUConfig struct will be used to
multi-letter extensions later on.

This new type also holds a 'user_set' flag. This flag will be set when
the user set an option that's different than what is already configured
in the host, requiring KVM intervention to write the regs back during
kvm_arch_init_vcpu(). Similar mechanics will be implemented for
multi-letter extensions as well.

There is no need to duplicate more code than necessary, so we're going
to use the existing kvm_riscv_init_user_properties() to add the KVM
specific properties. Any code that is adding a TCG user prop is then
changed slightly to verify first if there's a KVM prop with the same
name already added.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-13-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c |  5 +++
 target/riscv/kvm.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_misa_properties(Object *cpu_obj)
         misa_cfg->name = riscv_get_misa_ext_name(bit);
         misa_cfg->description = riscv_get_misa_ext_description(bit);
 
+        /* Check if KVM already created the property */
+        if (object_property_find(cpu_obj, misa_cfg->name)) {
+            continue;
+        }
+
         object_property_add(cpu_obj, misa_cfg->name, "bool",
                             cpu_get_misa_ext_cfg,
                             cpu_set_misa_ext_cfg,
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include <linux/kvm.h>
 
 #include "qemu/timer.h"
+#include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
+#include "qapi/visitor.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "sysemu/kvm_int.h"
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
         } \
     } while (0)
 
+typedef struct KVMCPUConfig {
+    const char *name;
+    const char *description;
+    target_ulong offset;
+    int kvm_reg_id;
+    bool user_set;
+} KVMCPUConfig;
+
+#define KVM_MISA_CFG(_bit, _reg_id) \
+    {.offset = _bit, .kvm_reg_id = _reg_id}
+
+/* KVM ISA extensions */
+static KVMCPUConfig kvm_misa_ext_cfgs[] = {
+    KVM_MISA_CFG(RVA, KVM_RISCV_ISA_EXT_A),
+    KVM_MISA_CFG(RVC, KVM_RISCV_ISA_EXT_C),
+    KVM_MISA_CFG(RVD, KVM_RISCV_ISA_EXT_D),
+    KVM_MISA_CFG(RVF, KVM_RISCV_ISA_EXT_F),
+    KVM_MISA_CFG(RVH, KVM_RISCV_ISA_EXT_H),
+    KVM_MISA_CFG(RVI, KVM_RISCV_ISA_EXT_I),
+    KVM_MISA_CFG(RVM, KVM_RISCV_ISA_EXT_M),
+};
+
+static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
+                                     const char *name,
+                                     void *opaque, Error **errp)
+{
+    KVMCPUConfig *misa_ext_cfg = opaque;
+    target_ulong misa_bit = misa_ext_cfg->offset;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    CPURISCVState *env = &cpu->env;
+    bool value, host_bit;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    host_bit = env->misa_ext_mask & misa_bit;
+
+    if (value == host_bit) {
+        return;
+    }
+
+    if (!value) {
+        misa_ext_cfg->user_set = true;
+        return;
+    }
+
+    /*
+     * Forbid users to enable extensions that aren't
+     * available in the hart.
+     */
+    error_setg(errp, "Enabling MISA bit '%s' is not allowed: it's not "
+               "enabled in the host", misa_ext_cfg->name);
+}
+
+static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
+        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
+        int bit = misa_cfg->offset;
+
+        misa_cfg->name = riscv_get_misa_ext_name(bit);
+        misa_cfg->description = riscv_get_misa_ext_description(bit);
+
+        object_property_add(cpu_obj, misa_cfg->name, "bool",
+                            NULL,
+                            kvm_cpu_set_misa_ext_cfg,
+                            NULL, misa_cfg);
+        object_property_set_description(cpu_obj, misa_cfg->name,
+                                        misa_cfg->description);
+    }
+}
+
 static int kvm_riscv_get_regs_core(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
         return;
     }
 
+    kvm_riscv_add_cpu_user_properties(cpu_obj);
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Our design philosophy with KVM properties can be resumed in two main
decisions based on KVM interface availability and what the user wants to
do:

- if the user disables an extension that the host KVM module doesn't
know about (i.e. it doesn't implement the kvm_get_one_reg() interface),
keep booting the CPU. This will avoid users having to deal with issues
with older KVM versions while disabling features they don't care;

- for any other case we're going to error out immediately. If the user
wants to enable a feature that KVM doesn't know about this a problem that
is worth aborting - the user must know that the feature wasn't enabled
in the hart. Likewise, if KVM knows about the extension, the user wants
to enable/disable it, and we fail to do it so, that's also a problem we
can't shrug it off.

In the case of MISA bits we won't even try enabling bits that aren't
already available in the host. The ioctl() is so likely to fail that
it's not worth trying. This check is already done in the previous patch,
in kvm_cpu_set_misa_ext_cfg(), thus we don't need to worry about it now.

In kvm_riscv_update_cpu_misa_ext() we'll go through every potential user
option and do as follows:

- if the user didn't set the property or set to the same value of the
host, do nothing;

- Disable the given extension in KVM. Error out if anything goes wrong.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-14-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_misa_ext_cfg(Object *obj, Visitor *v,
                "enabled in the host", misa_ext_cfg->name);
 }
 
+static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t id, reg;
+    int i, ret;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_misa_ext_cfgs); i++) {
+        KVMCPUConfig *misa_cfg = &kvm_misa_ext_cfgs[i];
+        target_ulong misa_bit = misa_cfg->offset;
+
+        if (!misa_cfg->user_set) {
+            continue;
+        }
+
+        /* If we're here we're going to disable the MISA bit */
+        reg = 0;
+        id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
+                              misa_cfg->kvm_reg_id);
+        ret = kvm_set_one_reg(cs, id, &reg);
+        if (ret != 0) {
+            /*
+             * We're not checking for -EINVAL because if the bit is about
+             * to be disabled, it means that it was already enabled by
+             * KVM. We determined that by fetching the 'isa' register
+             * during init() time. Any error at this point is worth
+             * aborting.
+             */
+            error_report("Unable to set KVM reg %s, error %d",
+                         misa_cfg->name, ret);
+            exit(EXIT_FAILURE);
+        }
+        env->misa_ext &= ~misa_bit;
+    }
+}
+
 static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
 
     if (!object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST)) {
         ret = kvm_vcpu_set_machine_ids(cpu, cs);
+        if (ret != 0) {
+            return ret;
+        }
     }
 
+    kvm_riscv_update_cpu_misa_ext(cpu, cs);
+
     return ret;
 }
 
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Let's add KVM user properties for the multi-letter extensions that KVM
currently supports: zicbom, zicboz, zihintpause, zbb, ssaia, sstc,
svinval and svpbmt.

As with MISA extensions, we're using the KVMCPUConfig type to hold
information about the state of each extension. However, multi-letter
extensions have more cases to cover than MISA extensions, so we're
adding an extra 'supported' flag as well. This flag will reflect if a
given extension is supported by KVM, i.e. KVM knows how to handle it.
This is determined during KVM extension discovery in
kvm_riscv_init_multiext_cfg(), where we test for EINVAL errors. Any
other error will cause an abort.

The use of the 'user_set' is similar to what we already do with MISA
extensions: the flag set only if the user is changing the extension
state.

The 'supported' flag will be used later on to make an exception for
users that are disabling multi-letter extensions that are unknown to
KVM.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-Id: <20230706101738.460804-15-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c |   8 +++
 target/riscv/kvm.c | 119 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 127 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
     riscv_cpu_add_misa_properties(obj);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
+#ifndef CONFIG_USER_ONLY
+        if (kvm_enabled()) {
+            /* Check if KVM created the property already */
+            if (object_property_find(obj, prop->name)) {
+                continue;
+            }
+        }
+#endif
         qdev_property_add_static(dev, prop);
     }
 
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ typedef struct KVMCPUConfig {
     target_ulong offset;
     int kvm_reg_id;
     bool user_set;
+    bool supported;
 } KVMCPUConfig;
 
 #define KVM_MISA_CFG(_bit, _reg_id) \
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
     }
 }
 
+#define CPUCFG(_prop) offsetof(struct RISCVCPUConfig, _prop)
+
+#define KVM_EXT_CFG(_name, _prop, _reg_id) \
+    {.name = _name, .offset = CPUCFG(_prop), \
+     .kvm_reg_id = _reg_id}
+
+static KVMCPUConfig kvm_multi_ext_cfgs[] = {
+    KVM_EXT_CFG("zicbom", ext_icbom, KVM_RISCV_ISA_EXT_ZICBOM),
+    KVM_EXT_CFG("zicboz", ext_icboz, KVM_RISCV_ISA_EXT_ZICBOZ),
+    KVM_EXT_CFG("zihintpause", ext_zihintpause, KVM_RISCV_ISA_EXT_ZIHINTPAUSE),
+    KVM_EXT_CFG("zbb", ext_zbb, KVM_RISCV_ISA_EXT_ZBB),
+    KVM_EXT_CFG("ssaia", ext_ssaia, KVM_RISCV_ISA_EXT_SSAIA),
+    KVM_EXT_CFG("sstc", ext_sstc, KVM_RISCV_ISA_EXT_SSTC),
+    KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
+    KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
+};
+
+static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
+                            uint32_t val)
+{
+    int cpu_cfg_offset = multi_ext->offset;
+    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+
+    *ext_enabled = val;
+}
+
+static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
+                                KVMCPUConfig *multi_ext)
+{
+    int cpu_cfg_offset = multi_ext->offset;
+    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+
+    return *ext_enabled;
+}
+
+static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
+                                      const char *name,
+                                      void *opaque, Error **errp)
+{
+    KVMCPUConfig *multi_ext_cfg = opaque;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    bool value, host_val;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    host_val = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
+
+    /*
+     * Ignore if the user is setting the same value
+     * as the host.
+     */
+    if (value == host_val) {
+        return;
+    }
+
+    if (!multi_ext_cfg->supported) {
+        /*
+         * Error out if the user is trying to enable an
+         * extension that KVM doesn't support. Ignore
+         * option otherwise.
+         */
+        if (value) {
+            error_setg(errp, "KVM does not support disabling extension %s",
+                       multi_ext_cfg->name);
+        }
+
+        return;
+    }
+
+    multi_ext_cfg->user_set = true;
+    kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
+}
+
 static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
         object_property_set_description(cpu_obj, misa_cfg->name,
                                         misa_cfg->description);
     }
+
+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
+        KVMCPUConfig *multi_cfg = &kvm_multi_ext_cfgs[i];
+
+        object_property_add(cpu_obj, multi_cfg->name, "bool",
+                            NULL,
+                            kvm_cpu_set_multi_ext_cfg,
+                            NULL, multi_cfg);
+    }
 }
 
 static int kvm_riscv_get_regs_core(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
     env->misa_ext = env->misa_ext_mask;
 }
 
+static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
+{
+    CPURISCVState *env = &cpu->env;
+    uint64_t val;
+    int i, ret;
+
+    for (i = 0; i < ARRAY_SIZE(kvm_multi_ext_cfgs); i++) {
+        KVMCPUConfig *multi_ext_cfg = &kvm_multi_ext_cfgs[i];
+        struct kvm_one_reg reg;
+
+        reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_ISA_EXT,
+                                  multi_ext_cfg->kvm_reg_id);
+        reg.addr = (uint64_t)&val;
+        ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+        if (ret != 0) {
+            if (errno == EINVAL) {
+                /* Silently default to 'false' if KVM does not support it. */
+                multi_ext_cfg->supported = false;
+                val = false;
+            } else {
+                error_report("Unable to read ISA_EXT KVM register %s, "
+                             "error %d", multi_ext_cfg->name, ret);
+                kvm_riscv_destroy_scratch_vcpu(kvmcpu);
+                exit(EXIT_FAILURE);
+            }
+        } else {
+            multi_ext_cfg->supported = true;
+        }
+
+        kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
+    }
+}
+
 void kvm_riscv_init_user_properties(Object *cpu_obj)
 {
     RISCVCPU *cpu = RISCV_CPU(cpu_obj);
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_init_user_properties(Object *cpu_obj)
     kvm_riscv_add_cpu_user_properties(cpu_obj);
     kvm_riscv_init_machine_ids(cpu, &kvmcpu);
     kvm_riscv_init_misa_ext_mask(cpu, &kvmcpu);
+    kvm_riscv_init_multiext_cfg(cpu, &kvmcpu);
 
     kvm_riscv_destroy_scratch_vcpu(&kvmcpu);
 }
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

riscv_cpu_add_user_properties() ended up with an excess of "#ifndef
CONFIG_USER_ONLY" blocks after changes that added KVM properties
handling.

KVM specific properties are required to be created earlier than their
TCG counterparts, but the remaining props can be created at any order.
Move riscv_add_satp_mode_properties() to the start of the function,
inside the !CONFIG_USER_ONLY block already present there, to remove the
last ifndef block.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-16-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
     DeviceState *dev = DEVICE(obj);
 
 #ifndef CONFIG_USER_ONLY
+    riscv_add_satp_mode_properties(obj);
+
     if (kvm_enabled()) {
         kvm_riscv_init_user_properties(obj);
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
 #endif
         qdev_property_add_static(dev, prop);
     }
-
-#ifndef CONFIG_USER_ONLY
-    riscv_add_satp_mode_properties(obj);
-#endif
 }
 
 static Property riscv_cpu_properties[] = {
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

riscv_isa_string_ext() is being used by riscv_isa_string(), which is
then used by boards to retrieve the 'riscv,isa' string to be written in
the FDT. All this happens after riscv_cpu_realize(), meaning that we're
already past riscv_cpu_validate_set_extensions() and, more important,
riscv_cpu_disable_priv_spec_isa_exts().

This means that all extensions that needed to be disabled due to
priv_spec mismatch are already disabled. Checking this again during
riscv_isa_string_ext() is unneeded. Remove it.

As a bonus, riscv_isa_string_ext() can now be used with the 'host'
KVM-only CPU type since it doesn't have a env->priv_ver assigned and it
would fail this check for no good reason.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-17-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
     int i;
 
     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
-        if (cpu->env.priv_ver >= isa_edata_arr[i].min_version &&
-            isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
+        if (isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
             new = g_strconcat(old, "_", isa_edata_arr[i].name, NULL);
             g_free(old);
             old = new;
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

KVM-specific properties are being created inside target/riscv/kvm.c. But
at this moment we're gathering all the remaining properties from TCG and
adding them as is when running KVM. This creates a situation where
non-KVM properties are setting flags to 'true' due to its default
settings (e.g.  Zawrs). Users can also freely enable them via command
line.

This doesn't impact runtime per se because KVM doesn't care about these
flags, but code such as riscv_isa_string_ext() take those flags into
account. The result is that, for a KVM guest, setting non-KVM properties
will make them appear in the riscv,isa DT.

We want to keep the same API for both TCG and KVM and at the same time,
when running KVM, forbid non-KVM extensions to be enabled internally. We
accomplish both by changing riscv_cpu_add_user_properties() to add a
mock boolean property for every non-KVM extension in
riscv_cpu_extensions[]. Then, when running KVM, users are still free to
set extensions at will, but we'll error out if a non-KVM extension is
enabled. Setting such extension to 'false' will be ignored.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-18-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+
+#ifndef CONFIG_USER_ONLY
+static void cpu_set_cfg_unavailable(Object *obj, Visitor *v,
+                                    const char *name,
+                                    void *opaque, Error **errp)
+{
+    const char *propname = opaque;
+    bool value;
+
+    if (!visit_type_bool(v, name, &value, errp)) {
+        return;
+    }
+
+    if (value) {
+        error_setg(errp, "extension %s is not available with KVM",
+                   propname);
+    }
+}
+#endif
+
 /*
  * Add CPU properties with user-facing flags.
  *
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_add_user_properties(Object *obj)
             if (object_property_find(obj, prop->name)) {
                 continue;
             }
+
+            /*
+             * Set the default to disabled for every extension
+             * unknown to KVM and error out if the user attempts
+             * to enable any of them.
+             *
+             * We're giving a pass for non-bool properties since they're
+             * not related to the availability of extensions and can be
+             * safely ignored as is.
+             */
+            if (prop->info == &qdev_prop_bool) {
+                object_property_add(obj, prop->name, "bool",
+                                    NULL, cpu_set_cfg_unavailable,
+                                    NULL, (void *)prop->name);
+                continue;
+            }
         }
 #endif
         qdev_property_add_static(dev, prop);
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're now ready to update the multi-letter extensions status for KVM.

kvm_riscv_update_cpu_cfg_isa_ext() is called called during vcpu creation
time to verify which user options changes host defaults (via the 'user_set'
flag) and tries to write them back to KVM.

Failure to commit a change to KVM is only ignored in case KVM doesn't
know about the extension (-EINVAL error code) and the user wanted to
disable the given extension. Otherwise we're going to abort the boot
process.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-19-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

There are 2 places in which we need to get a pointer to a certain
property of the cpu->cfg struct based on property offset. Next patch
will add a couple more.

Create a helper to avoid repeating this code over and over.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-20-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
     KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
 };
 
+static void *kvmconfig_get_cfg_addr(RISCVCPU *cpu, KVMCPUConfig *kvmcfg)
+{
+    return (void *)&cpu->cfg + kvmcfg->offset;
+}
+
 static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
                             uint32_t val)
 {
-    int cpu_cfg_offset = multi_ext->offset;
-    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
 
     *ext_enabled = val;
 }
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_cfg_set(RISCVCPU *cpu, KVMCPUConfig *multi_ext,
 static uint32_t kvm_cpu_cfg_get(RISCVCPU *cpu,
                                 KVMCPUConfig *multi_ext)
 {
-    int cpu_cfg_offset = multi_ext->offset;
-    bool *ext_enabled = (void *)&cpu->cfg + cpu_cfg_offset;
+    bool *ext_enabled = kvmconfig_get_cfg_addr(cpu, multi_ext);
 
     return *ext_enabled;
 }
-- 
2.40.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

If we don't set a proper cbom_blocksize|cboz_blocksize in the FDT the
Linux Kernel will fail to detect the availability of the CBOM/CBOZ
extensions, regardless of the contents of the 'riscv,isa' DT prop.

The FDT is being written using the cpu->cfg.cbom|z_blocksize attributes,
so let's expose them as user properties like it is already done with
TCG.

This will also require us to determine proper blocksize values during
init() time since the FDT is already created during realize(). We'll
take a ride in kvm_riscv_init_multiext_cfg() to do it. Note that we
don't need to fetch both cbom and cboz blocksizes every time: check for
their parent extensions (icbom and icboz) and only read the blocksizes
if needed.

In contrast with cbom|z_blocksize properties from TCG, the user is not
able to set any value that is different from the 'host' value when
running KVM. KVM can be particularly harsh dealing with it: a ENOTSUPP
can be thrown for the mere attempt of executing kvm_set_one_reg() for
these 2 regs.

Hopefully we don't need to call kvm_set_one_reg() for these regs.
We'll check if the user input matches the host value in
kvm_cpu_set_cbomz_blksize(), the set() accessor for both blocksize
properties. We'll fail fast since it's already known to not be
supported.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230706101738.460804-21-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_cpu_set_multi_ext_cfg(Object *obj, Visitor *v,
     kvm_cpu_cfg_set(cpu, multi_ext_cfg, value);
 }
 
+static KVMCPUConfig kvm_cbom_blocksize = {
+    .name = "cbom_blocksize",
+    .offset = CPUCFG(cbom_blocksize),
+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicbom_block_size)
+};
+
+static KVMCPUConfig kvm_cboz_blocksize = {
+    .name = "cboz_blocksize",
+    .offset = CPUCFG(cboz_blocksize),
+    .kvm_reg_id = KVM_REG_RISCV_CONFIG_REG(zicboz_block_size)
+};
+
+static void kvm_cpu_set_cbomz_blksize(Object *obj, Visitor *v,
+                                      const char *name,
+                                      void *opaque, Error **errp)
+{
+    KVMCPUConfig *cbomz_cfg = opaque;
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint16_t value, *host_val;
+
+    if (!visit_type_uint16(v, name, &value, errp)) {
+        return;
+    }
+
+    host_val = kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
+
+    if (value != *host_val) {
+        error_report("Unable to set %s to a different value than "
+                     "the host (%u)",
+                     cbomz_cfg->name, *host_val);
+        exit(EXIT_FAILURE);
+    }
+
+    cbomz_cfg->user_set = true;
+}
+
 static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_add_cpu_user_properties(Object *cpu_obj)
                             kvm_cpu_set_multi_ext_cfg,
                             NULL, multi_cfg);
     }
+
+    object_property_add(cpu_obj, "cbom_blocksize", "uint16",
+                        NULL, kvm_cpu_set_cbomz_blksize,
+                        NULL, &kvm_cbom_blocksize);
+
+    object_property_add(cpu_obj, "cboz_blocksize", "uint16",
+                        NULL, kvm_cpu_set_cbomz_blksize,
+                        NULL, &kvm_cboz_blocksize);
 }
 
 static int kvm_riscv_get_regs_core(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_misa_ext_mask(RISCVCPU *cpu,
     env->misa_ext = env->misa_ext_mask;
 }
 
+static void kvm_riscv_read_cbomz_blksize(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
+                                         KVMCPUConfig *cbomz_cfg)
+{
+    CPURISCVState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    int ret;
+
+    reg.id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                              cbomz_cfg->kvm_reg_id);
+    reg.addr = (uint64_t)kvmconfig_get_cfg_addr(cpu, cbomz_cfg);
+    ret = ioctl(kvmcpu->cpufd, KVM_GET_ONE_REG, &reg);
+    if (ret != 0) {
+        error_report("Unable to read KVM reg %s, error %d",
+                     cbomz_cfg->name, ret);
+        exit(EXIT_FAILURE);
+    }
+}
+
 static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
 
         kvm_cpu_cfg_set(cpu, multi_ext_cfg, val);
     }
+
+    if (cpu->cfg.ext_icbom) {
+        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cbom_blocksize);
+    }
+
+    if (cpu->cfg.ext_icboz) {
+        kvm_riscv_read_cbomz_blksize(cpu, kvmcpu, &kvm_cboz_blocksize);
+    }
 }
 
 void kvm_riscv_init_user_properties(Object *cpu_obj)
-- 
2.40.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

This patch introduces the RISC-V Zfa extension, which introduces
additional floating-point instructions:
* fli (load-immediate) with pre-defined immediates
* fminm/fmaxm (like fmin/fmax but with different NaN behaviour)
* fround/froundmx (round to integer)
* fcvtmod.w.d (Modular Convert-to-Integer)
* fmv* to access high bits of float register bigger than XLEN
* Quiet comparison instructions (fleq/fltq)

Zfa defines its instructions in combination with the following extensions:
* single-precision floating-point (F)
* double-precision floating-point (D)
* quad-precision floating-point (Q)
* half-precision floating-point (Zfh)

Since QEMU does not support the RISC-V quad-precision floating-point
ISA extension (Q), this patch does not include the instructions that
depend on this extension. All other instructions are included in this
patch.

The Zfa specification can be found here:
  https://github.com/riscv/riscv-isa-manual/blob/master/src/zfa.tex
The Zfa specifciation is frozen and is in public review since May 3, 2023:
  https://groups.google.com/a/groups.riscv.org/g/isa-dev/c/SED4ntBkabg

The patch also includes a TCG test for the fcvtmod.w.d instruction.
The test cases test for correct results and flag behaviour.
Note, that the Zfa specification requires fcvtmod's flag behaviour
to be identical to a fcvt with the same operands (which is also
tested).

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-Id: <20230710071243.282464-1-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.h                             |   3 +
 target/riscv/cpu_cfg.h                    |   1 +
 target/riscv/helper.h                     |  19 +
 target/riscv/insn32.decode                |  26 ++
 disas/riscv.c                             | 139 ++++++
 target/riscv/cpu.c                        |   8 +
 target/riscv/fpu_helper.c                 | 154 +++++++
 target/riscv/translate.c                  |   1 +
 tests/tcg/riscv64/test-fcvtmod.c          | 345 ++++++++++++++
 target/riscv/insn_trans/trans_rvzfa.c.inc | 521 ++++++++++++++++++++++
 tests/tcg/riscv64/Makefile.target         |   6 +
 11 files changed, 1223 insertions(+)
 create mode 100644 tests/tcg/riscv64/test-fcvtmod.c
 create mode 100644 target/riscv/insn_trans/trans_rvzfa.c.inc

diff --git a/disas/riscv.h b/disas/riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.h
+++ b/disas/riscv.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_codec_r_imm2,
     rv_codec_r2_immhl,
     rv_codec_r2_imm2_imm5,
+    rv_codec_fli,
 } rv_codec;
 
 /* structures */
@@ -XXX,XX +XXX,XX @@ enum {
 #define rv_fmt_rd_offset              "O\t0,o"
 #define rv_fmt_rd_rs1_rs2             "O\t0,1,2"
 #define rv_fmt_frd_rs1                "O\t3,1"
+#define rv_fmt_frd_rs1_rs2            "O\t3,1,2"
 #define rv_fmt_frd_frs1               "O\t3,4"
 #define rv_fmt_rd_frs1                "O\t0,4"
 #define rv_fmt_rd_frs1_frs2           "O\t0,4,5"
@@ -XXX,XX +XXX,XX @@ enum {
 #define rv_fmt_rd_rs1_immh_imml       "O\t0,1,i,j"
 #define rv_fmt_rd_rs1_immh_imml_addr  "O\t0,(1),i,j"
 #define rv_fmt_rd2_imm                "O\t0,2,(1),i"
+#define rv_fmt_fli                    "O\t3,h"
 
 #endif /* DISAS_RISCV_H */
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_svpbmt;
     bool ext_zdinx;
     bool ext_zawrs;
+    bool ext_zfa;
     bool ext_zfbfmin;
     bool ext_zfh;
     bool ext_zfhmin;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_s, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fsqrt_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_s, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_w_s, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_wu_s, TCG_CALL_NO_RWG, tl, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fclass_s, TCG_CALL_NO_RWG_SE, tl, env, i64)
+DEF_HELPER_FLAGS_2(fround_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_s, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Floating Point - Double Precision */
 DEF_HELPER_FLAGS_3(fadd_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_d_s, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fsqrt_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_d, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_w_d, TCG_CALL_NO_RWG, tl, env, i64)
+DEF_HELPER_FLAGS_2(fcvtmod_w_d, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_wu_d, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_l_d, TCG_CALL_NO_RWG, tl, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_lu_d, TCG_CALL_NO_RWG, tl, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_d_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_d_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_d_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
+DEF_HELPER_FLAGS_2(fround_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_d, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Bitmanip */
 DEF_HELPER_FLAGS_2(clmul, TCG_CALL_NO_RWG_SE, tl, tl, tl)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fsub_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmul_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fdiv_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmin_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fminm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_3(fmax_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(fmaxm_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 DEF_HELPER_FLAGS_2(fsqrt_h, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_3(fle_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fleq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(flt_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(fltq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_3(feq_h, TCG_CALL_NO_RWG, tl, env, i64, i64)
 DEF_HELPER_FLAGS_2(fcvt_s_h, TCG_CALL_NO_RWG, i64, env, i64)
 DEF_HELPER_FLAGS_2(fcvt_h_s, TCG_CALL_NO_RWG, i64, env, i64)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_h_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
+DEF_HELPER_FLAGS_2(fround_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
+DEF_HELPER_FLAGS_2(froundnx_h, TCG_CALL_NO_RWG_SE, i64, env, i64)
 
 /* Cache-block operations */
 DEF_HELPER_2(cbo_clean_flush, void, env, tl)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ binvi      01101. ........... 001 ..... 0010011 @sh
 bset       0010100 .......... 001 ..... 0110011 @r
 bseti      00101. ........... 001 ..... 0010011 @sh
 
+# *** Zfa Standard Extension ***
+fli_s       1111000 00001 ..... 000 ..... 1010011 @r2
+fli_d       1111001 00001 ..... 000 ..... 1010011 @r2
+fli_h       1111010 00001 ..... 000 ..... 1010011 @r2
+fminm_s     0010100 ..... ..... 010 ..... 1010011 @r
+fmaxm_s     0010100 ..... ..... 011 ..... 1010011 @r
+fminm_d     0010101 ..... ..... 010 ..... 1010011 @r
+fmaxm_d     0010101 ..... ..... 011 ..... 1010011 @r
+fminm_h     0010110 ..... ..... 010 ..... 1010011 @r
+fmaxm_h     0010110 ..... ..... 011 ..... 1010011 @r
+fround_s    0100000 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_s  0100000 00101 ..... ... ..... 1010011 @r2_rm
+fround_d    0100001 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_d  0100001 00101 ..... ... ..... 1010011 @r2_rm
+fround_h    0100010 00100 ..... ... ..... 1010011 @r2_rm
+froundnx_h  0100010 00101 ..... ... ..... 1010011 @r2_rm
+fcvtmod_w_d 1100001 01000 ..... 001 ..... 1010011 @r2
+fmvh_x_d    1110001 00001 ..... 000 ..... 1010011 @r2
+fmvp_d_x    1011001 ..... ..... 000 ..... 1010011 @r
+fleq_s      1010000 ..... ..... 100 ..... 1010011 @r
+fltq_s      1010000 ..... ..... 101 ..... 1010011 @r
+fleq_d      1010001 ..... ..... 100 ..... 1010011 @r
+fltq_d      1010001 ..... ..... 101 ..... 1010011 @r
+fleq_h      1010010 ..... ..... 100 ..... 1010011 @r
+fltq_h      1010010 ..... ..... 101 ..... 1010011 @r
+
 # *** RV32 Zfh Extension ***
 flh        ............   ..... 001 ..... 0000111 @i
 fsh        .......  ..... ..... 001 ..... 0100111 @s
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_fsh = 798,
     rv_op_fmv_h_x = 799,
     rv_op_fmv_x_h = 800,
+    rv_op_fli_s = 801,
+    rv_op_fli_d = 802,
+    rv_op_fli_q = 803,
+    rv_op_fli_h = 804,
+    rv_op_fminm_s = 805,
+    rv_op_fmaxm_s = 806,
+    rv_op_fminm_d = 807,
+    rv_op_fmaxm_d = 808,
+    rv_op_fminm_q = 809,
+    rv_op_fmaxm_q = 810,
+    rv_op_fminm_h = 811,
+    rv_op_fmaxm_h = 812,
+    rv_op_fround_s = 813,
+    rv_op_froundnx_s = 814,
+    rv_op_fround_d = 815,
+    rv_op_froundnx_d = 816,
+    rv_op_fround_q = 817,
+    rv_op_froundnx_q = 818,
+    rv_op_fround_h = 819,
+    rv_op_froundnx_h = 820,
+    rv_op_fcvtmod_w_d = 821,
+    rv_op_fmvh_x_d = 822,
+    rv_op_fmvp_d_x = 823,
+    rv_op_fmvh_x_q = 824,
+    rv_op_fmvp_q_x = 825,
+    rv_op_fleq_s = 826,
+    rv_op_fltq_s = 827,
+    rv_op_fleq_d = 828,
+    rv_op_fltq_d = 829,
+    rv_op_fleq_q = 830,
+    rv_op_fltq_q = 831,
+    rv_op_fleq_h = 832,
+    rv_op_fltq_h = 833,
 } rv_op;
 
 /* register names */
@@ -XXX,XX +XXX,XX @@ static const char rv_vreg_name_sym[32][4] = {
     "v24", "v25", "v26", "v27", "v28", "v29", "v30", "v31"
 };
 
+/* The FLI.[HSDQ] numeric constants (0.0 for symbolic constants).
+ * The constants use the hex floating-point literal representation
+ * that is printed when using the printf %a format specifier,
+ * which matches the output that is generated by the disassembler.
+ */
+static const char rv_fli_name_const[32][9] =
+{
+    "0x1p+0", "min", "0x1p-16", "0x1p-15",
+    "0x1p-8", "0x1p-7", "0x1p-4", "0x1p-3",
+    "0x1p-2", "0x1.4p-2", "0x1.8p-2", "0x1.cp-2",
+    "0x1p-1", "0x1.4p-1", "0x1.8p-1", "0x1.cp-1",
+    "0x1p+0", "0x1.4p+0", "0x1.8p+0", "0x1.cp+0",
+    "0x1p+1", "0x1.4p+1", "0x1.8p+1", "0x1p+2",
+    "0x1p+3", "0x1p+4", "0x1p+7", "0x1p+8",
+    "0x1p+15", "0x1p+16", "inf", "nan"
+};
+
 /* pseudo-instruction constraints */
 
 static const rvc_constraint rvcc_jal[] = { rvc_rd_eq_ra, rvc_end };
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
     { "fsh", rv_codec_s, rv_fmt_frs2_offset_rs1, NULL, 0, 0, 0 },
     { "fmv.h.x", rv_codec_r, rv_fmt_frd_rs1, NULL, 0, 0, 0 },
     { "fmv.x.h", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fli.s", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.d", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.q", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fli.h", rv_codec_fli, rv_fmt_fli, NULL, 0, 0, 0 },
+    { "fminm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.s", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.d", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.q", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fminm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fmaxm.h", rv_codec_r, rv_fmt_frd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fround.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.s", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.d", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.q", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fround.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "froundnx.h", rv_codec_r_m, rv_fmt_rm_frd_frs1, NULL, 0, 0, 0 },
+    { "fcvtmod.w.d", rv_codec_r_m, rv_fmt_rm_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvh.x.d", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvp.d.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fmvh.x.q", rv_codec_r, rv_fmt_rd_frs1, NULL, 0, 0, 0 },
+    { "fmvp.q.x", rv_codec_r, rv_fmt_frd_rs1_rs2, NULL, 0, 0, 0 },
+    { "fleq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.s", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.d", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.q", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fleq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
+    { "fltq.h", rv_codec_r, rv_fmt_rd_frs1_frs2, NULL, 0, 0, 0 },
 };
 
 /* CSR names */
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_s; break;
                 case 1: op = rv_op_fmax_s; break;
+                case 2: op = rv_op_fminm_s; break;
+                case 3: op = rv_op_fmaxm_s; break;
                 }
                 break;
             case 21:
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_d; break;
                 case 1: op = rv_op_fmax_d; break;
+                case 2: op = rv_op_fminm_d; break;
+                case 3: op = rv_op_fmaxm_d; break;
+                }
+                break;
+            case 22:
+                switch (((inst >> 12) & 0b111)) {
+                case 2: op = rv_op_fminm_h; break;
+                case 3: op = rv_op_fmaxm_h; break;
                 }
                 break;
             case 23:
                 switch ((inst >> 12) & 0b111) {
                 case 0: op = rv_op_fmin_q; break;
                 case 1: op = rv_op_fmax_q; break;
+                case 2: op = rv_op_fminm_q; break;
+                case 3: op = rv_op_fmaxm_q; break;
                 }
                 break;
             case 32:
                 switch ((inst >> 20) & 0b11111) {
                 case 1: op = rv_op_fcvt_s_d; break;
                 case 3: op = rv_op_fcvt_s_q; break;
+                case 4: op = rv_op_fround_s; break;
+                case 5: op = rv_op_froundnx_s; break;
                 case 6: op = rv_op_fcvt_s_bf16; break;
                 }
                 break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_d_s; break;
                 case 3: op = rv_op_fcvt_d_q; break;
+                case 4: op = rv_op_fround_d; break;
+                case 5: op = rv_op_froundnx_d; break;
                 }
                 break;
             case 34:
                 switch (((inst >> 20) & 0b11111)) {
+                case 4: op = rv_op_fround_h; break;
+                case 5: op = rv_op_froundnx_h; break;
                 case 8: op = rv_op_fcvt_bf16_s; break;
                 }
                 break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_fcvt_q_s; break;
                 case 1: op = rv_op_fcvt_q_d; break;
+                case 4: op = rv_op_fround_q; break;
+                case 5: op = rv_op_froundnx_q; break;
                 }
                 break;
             case 44:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_s; break;
                 case 1: op = rv_op_flt_s; break;
                 case 2: op = rv_op_feq_s; break;
+                case 4: op = rv_op_fleq_s; break;
+                case 5: op = rv_op_fltq_s; break;
                 }
                 break;
             case 81:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_d; break;
                 case 1: op = rv_op_flt_d; break;
                 case 2: op = rv_op_feq_d; break;
+                case 4: op = rv_op_fleq_d; break;
+                case 5: op = rv_op_fltq_d; break;
+                }
+                break;
+            case 82:
+                switch (((inst >> 12) & 0b111)) {
+                case 4: op = rv_op_fleq_h; break;
+                case 5: op = rv_op_fltq_h; break;
                 }
                 break;
             case 83:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 0: op = rv_op_fle_q; break;
                 case 1: op = rv_op_flt_q; break;
                 case 2: op = rv_op_feq_q; break;
+                case 4: op = rv_op_fleq_q; break;
+                case 5: op = rv_op_fltq_q; break;
+                }
+                break;
+            case 89:
+		switch (((inst >> 12) & 0b111)) {
+                case 0: op = rv_op_fmvp_d_x; break;
+                }
+                break;
+            case 91:
+		switch (((inst >> 12) & 0b111)) {
+                case 0: op = rv_op_fmvp_q_x; break;
                 }
                 break;
             case 96:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                 case 1: op = rv_op_fcvt_wu_d; break;
                 case 2: op = rv_op_fcvt_l_d; break;
                 case 3: op = rv_op_fcvt_lu_d; break;
+                case 8: op = rv_op_fcvtmod_w_d; break;
                 }
                 break;
             case 99:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_x_d; break;
                 case 1: op = rv_op_fclass_d; break;
+                case 8: op = rv_op_fmvh_x_d; break;
                 }
                 break;
             case 114:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_x_q; break;
                 case 1: op = rv_op_fclass_q; break;
+                case 8: op = rv_op_fmvh_x_q; break;
                 }
                 break;
             case 120:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_s_x; break;
+                case 8: op = rv_op_fli_s; break;
                 }
                 break;
             case 121:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_d_x; break;
+                case 8: op = rv_op_fli_d; break;
                 }
                 break;
             case 122:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_h_x; break;
+                case 8: op = rv_op_fli_h; break;
                 }
                 break;
             case 123:
                 switch (((inst >> 17) & 0b11111000) |
                         ((inst >> 12) & 0b00000111)) {
                 case 0: op = rv_op_fmv_q_x; break;
+                case 8: op = rv_op_fli_q; break;
                 }
                 break;
             }
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa)
         break;
     case rv_codec_zcmt_jt:
         dec->imm = operand_tbl_index(inst);
+	break;
+    case rv_codec_fli:
+        dec->rd = operand_rd(inst);
+        dec->imm = operand_rs1(inst);
         break;
     case rv_codec_r2_imm5:
         dec->rd = operand_rd(inst);
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
             append(buf, tmp, buflen);
             break;
         }
+        case 'h':
+            append(buf, rv_fli_name_const[dec->imm], buflen);
+            break;
         default:
             break;
         }
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+    ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
     set_misa(env, MXL_RV64, RVG | RVC | RVS | RVU);
     env->priv_ver = PRIV_VERSION_1_11_0;
 
+    cpu->cfg.ext_zfa = true;
     cpu->cfg.ext_zfh = true;
     cpu->cfg.mmu = true;
     cpu->cfg.ext_xtheadba = true;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    if (cpu->cfg.ext_zfa && !riscv_has_ext(env, RVF)) {
+        error_setg(errp, "Zfa extension requires F extension");
+        return;
+    }
+
     if (cpu->cfg.ext_zfh) {
         cpu->cfg.ext_zfhmin = true;
     }
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
     DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
+    DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
     DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
     DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
     DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float32_minimum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fminm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    float32 ret = float32_min(frs1, frs2, &env->fp_status);
+    return nanbox_s(env, ret);
+}
+
 uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float32_maximum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fmaxm_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    float32 ret = float32_max(frs1, frs2, &env->fp_status);
+    return nanbox_s(env, ret);
+}
+
 uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float32_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return float32_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float32_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return float32_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_s(CPURISCVState *env, uint64_t rs1)
     return fclass_s(frs1);
 }
 
+uint64_t helper_fround_s(CPURISCVState *env, uint64_t rs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+    float32 frs1 = check_nanbox_s(env, rs1);
+
+    frs1 = float32_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return nanbox_s(env, frs1);
+}
+
+uint64_t helper_froundnx_s(CPURISCVState *env, uint64_t rs1)
+{
+    float32 frs1 = check_nanbox_s(env, rs1);
+    frs1 = float32_round_to_int(frs1, &env->fp_status);
+    return nanbox_s(env, frs1);
+}
+
 uint64_t helper_fadd_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_add(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
            float64_minimum_number(frs1, frs2, &env->fp_status);
 }
 
+uint64_t helper_fminm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_min(frs1, frs2, &env->fp_status);
+}
+
 uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return env->priv_ver < PRIV_VERSION_1_11_0 ?
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
            float64_maximum_number(frs1, frs2, &env->fp_status);
 }
 
+uint64_t helper_fmaxm_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_max(frs1, frs2, &env->fp_status);
+}
+
 uint64_t helper_fcvt_s_d(CPURISCVState *env, uint64_t rs1)
 {
     return nanbox_s(env, float64_to_float32(rs1, &env->fp_status));
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
     return float64_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
+{
+    return float64_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 {
     return float64_eq_quiet(frs1, frs2, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fcvt_w_d(CPURISCVState *env, uint64_t frs1)
     return float64_to_int32(frs1, &env->fp_status);
 }
 
+uint64_t helper_fcvtmod_w_d(CPURISCVState *env, uint64_t value)
+{
+    return float64_to_int32_modulo(value, float_round_to_zero, &env->fp_status);
+}
+
 target_ulong helper_fcvt_wu_d(CPURISCVState *env, uint64_t frs1)
 {
     return (int32_t)float64_to_uint32(frs1, &env->fp_status);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_d(uint64_t frs1)
     return fclass_d(frs1);
 }
 
+uint64_t helper_fround_d(CPURISCVState *env, uint64_t frs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+
+    frs1 = float64_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return frs1;
+}
+
+uint64_t helper_froundnx_d(CPURISCVState *env, uint64_t frs1)
+{
+    return float64_round_to_int(frs1, &env->fp_status);
+}
+
 uint64_t helper_fadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float16_minimum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fminm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    float16 ret = float16_min(frs1, frs2, &env->fp_status);
+    return nanbox_h(env, ret);
+}
+
 uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
                          float16_maximum_number(frs1, frs2, &env->fp_status));
 }
 
+uint64_t helper_fmaxm_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    float16 ret = float16_max(frs1, frs2, &env->fp_status);
+    return nanbox_h(env, ret);
+}
+
 uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fle_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float16_le(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fleq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return float16_le_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
     return float16_lt(frs1, frs2, &env->fp_status);
 }
 
+target_ulong helper_fltq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
+{
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return float16_lt_quiet(frs1, frs2, &env->fp_status);
+}
+
 target_ulong helper_feq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_h(CPURISCVState *env, uint64_t rs1)
     return fclass_h(frs1);
 }
 
+uint64_t helper_fround_h(CPURISCVState *env, uint64_t rs1)
+{
+    float_status *fs = &env->fp_status;
+    uint16_t nx_old = get_float_exception_flags(fs) & float_flag_inexact;
+    float16 frs1 = check_nanbox_h(env, rs1);
+
+    frs1 = float16_round_to_int(frs1, fs);
+
+    /* Restore the original NX flag. */
+    uint16_t flags = get_float_exception_flags(fs);
+    flags &= ~float_flag_inexact;
+    flags |= nx_old;
+    set_float_exception_flags(flags, fs);
+
+    return nanbox_h(env, frs1);
+}
+
+uint64_t helper_froundnx_h(CPURISCVState *env, uint64_t rs1)
+{
+    float16 frs1 = check_nanbox_s(env, rs1);
+    frs1 = float16_round_to_int(frs1, &env->fp_status);
+    return nanbox_h(env, frs1);
+}
+
 target_ulong helper_fcvt_w_h(CPURISCVState *env, uint64_t rs1)
 {
     float16 frs1 = check_nanbox_h(env, rs1);
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvzicond.c.inc"
 #include "insn_trans/trans_rvzawrs.c.inc"
 #include "insn_trans/trans_rvzicbo.c.inc"
+#include "insn_trans/trans_rvzfa.c.inc"
 #include "insn_trans/trans_rvzfh.c.inc"
 #include "insn_trans/trans_rvk.c.inc"
 #include "insn_trans/trans_privileged.c.inc"
diff --git a/tests/tcg/riscv64/test-fcvtmod.c b/tests/tcg/riscv64/test-fcvtmod.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/riscv64/test-fcvtmod.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define FFLAG_NX_SHIFT 0 /* inexact */
+#define FFLAG_UF_SHIFT 1 /* underflow */
+#define FFLAG_OF_SHIFT 2 /* overflow */
+#define FFLAG_DZ_SHIFT 3 /* divide by zero */
+#define FFLAG_NV_SHIFT 4 /* invalid operation */
+
+#define FFLAG_NV (1UL << FFLAG_NV_SHIFT)
+#define FFLAG_DZ (1UL << FFLAG_DZ_SHIFT)
+#define FFLAG_OF (1UL << FFLAG_OF_SHIFT)
+#define FFLAG_UF (1UL << FFLAG_UF_SHIFT)
+#define FFLAG_NX (1UL << FFLAG_NX_SHIFT)
+
+typedef struct fp64_fcvt_fcvtmod_testcase {
+    const char* name;
+    union {
+        uint64_t inp_lu;
+        double inp_lf;
+    };
+    uint64_t exp_fcvt;
+    uint8_t exp_fcvt_fflags;
+    uint64_t exp_fcvtmod;
+    uint8_t exp_fcvtmod_fflags;
+} fp64_fcvt_fcvtmod_testcase_t;
+
+void print_fflags(uint8_t fflags)
+{
+    int set = 0;
+
+    if (fflags == 0) {
+        printf("-");
+        return;
+    }
+
+    if (fflags & FFLAG_NV) {
+        printf("%sFFLAG_NV", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_DZ) {
+        printf("%sFFLAG_DZ", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_OF) {
+        printf("%sFFLAG_OF", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_UF) {
+        printf("%sFFLAG_UF", set ? " | " : "");
+        set = 1;
+    }
+    if (fflags & FFLAG_NX) {
+        printf("%sFFLAG_NX", set ? " | " : "");
+        set = 1;
+    }
+}
+
+/* Clear all FP flags. */
+static inline void clear_fflags()
+{
+    __asm__ __volatile__("fsflags zero");
+}
+
+/* Read all FP flags. */
+static inline uint8_t get_fflags()
+{
+    uint64_t v;
+    __asm__ __volatile__("frflags %0" : "=r"(v));
+    return (uint8_t)v;
+}
+
+/* Move input value (without conversations) into an FP register. */
+static inline double do_fmv_d_x(uint64_t inp)
+{
+    double fpr;
+    __asm__ __volatile__("fmv.d.x %0, %1" : "=f"(fpr) : "r"(inp));
+    return fpr;
+}
+
+static inline uint64_t do_fcvt_w_d(uint64_t inp, uint8_t *fflags)
+{
+    uint64_t ret;
+    double fpr = do_fmv_d_x(inp);
+
+    clear_fflags();
+
+    __asm__ __volatile__("fcvt.w.d %0, %1, rtz" : "=r"(ret) : "f"(fpr));
+
+    *fflags = get_fflags();
+
+    return ret;
+}
+
+static inline uint64_t do_fcvtmod_w_d(uint64_t inp, uint8_t *fflags)
+{
+    uint64_t ret;
+    double fpr = do_fmv_d_x(inp);
+
+    clear_fflags();
+
+    /* fcvtmod.w.d rd, rs1, rtz = 1100001 01000 rs1 001 rd 1010011 */
+    asm(".insn r  0x53, 0x1, 0x61, %0, %1, f8" : "=r"(ret) : "f"(fpr));
+
+    *fflags = get_fflags();
+
+    return ret;
+}
+
+static const fp64_fcvt_fcvtmod_testcase_t tests[] = {
+    /* Zero (exp=0, frac=0) */
+    { .name = "+0.0",
+      .inp_lf = 0x0p0,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000000,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-0.0",
+      .inp_lf = -0x0p0,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000000,
+      .exp_fcvtmod_fflags = 0 },
+
+    /* Subnormal: exp=0 frac!=0 */
+    { .name = "Subnormal frac=1",
+      .inp_lu = 0x0000000000000001,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Subnormal frac=0xf..f",
+      .inp_lu = 0x0000ffffffffffff,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Neg subnormal frac=1",
+      .inp_lu = 0x0000000000000001,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "Neg subnormal frac=0xf..f",
+      .inp_lu = 0x8000ffffffffffff,
+      .exp_fcvt = 0x0000000000000000,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    /* Infinity: exp=0x7ff, frac=0 */
+    { .name = "+INF",
+      .inp_lu = 0x7ff0000000000000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 max */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "-INF",
+      .inp_lu = 0xfff0000000000000,
+      .exp_fcvt = 0xffffffff80000000, /* int32 min */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    /* NaN: exp=7ff, frac!=0 */
+    { .name = "canonical NaN",
+      .inp_lu = 0x7ff8000000000000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 max */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "non-canonical NaN",
+      .inp_lu = 0x7ff8000000100000,
+      .exp_fcvt = 0x000000007fffffff, /* int32 min */
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    /* Normal numbers: exp!=0, exp!=7ff */
+    { .name = "+smallest normal value",
+      .inp_lu = 0x0010000000000000,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-smallest normal value",
+      .inp_lu = 0x8010000000000000,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+0.5",
+      .inp_lf = 0x1p-1,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-0.5",
+      .inp_lf = -0x1p-1,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+value just below 1.0",
+      .inp_lu = 0x3fefffffffffffff,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-value just above -1.0",
+      .inp_lu = 0xbfefffffffffffff,
+      .exp_fcvt = 0,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+1.0",
+      .inp_lf = 0x1p0,
+      .exp_fcvt = 0x0000000000000001,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x0000000000000001,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-1.0",
+      .inp_lf = -0x1p0,
+      .exp_fcvt = 0xffffffffffffffff,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0xffffffffffffffff,
+      .exp_fcvtmod_fflags = 0 },
+
+    { .name = "+1.5",
+      .inp_lu = 0x3ff8000000000000,
+      .exp_fcvt = 1,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 1,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+    { .name = "-1.5",
+      .inp_lu = 0xbff8000000000000,
+      .exp_fcvt = 0xffffffffffffffff,
+      .exp_fcvt_fflags = FFLAG_NX,
+      .exp_fcvtmod = 0xffffffffffffffff,
+      .exp_fcvtmod_fflags = FFLAG_NX },
+
+    { .name = "+max int32 (2147483647)",
+      .inp_lu = 0x41dfffffffc00000,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0x000000007fffffff,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "+max int32 +1 (2147483648)",
+      .inp_lf = 0x1p31,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = (uint64_t)-2147483648l, /* int32 min */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "+max int32 +2 (2147483649)",
+      .inp_lu = 0x41e0000000200000,
+      .exp_fcvt = 0x000000007fffffff,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = (uint64_t)-2147483647l, /* int32 min +1 */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+
+    { .name = "-max int32 (-2147483648)",
+      .inp_lf = -0x1p31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = 0,
+      .exp_fcvtmod = 0xffffffff80000000,
+      .exp_fcvtmod_fflags = 0 },
+    { .name = "-max int32 -1 (-2147483649)",
+      .inp_lf = -0x1.00000002p+31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 2147483647, /* int32 max */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+    { .name = "-max int32 -2 (-2147483650)",
+      .inp_lf = -0x1.00000004p+31,
+      .exp_fcvt = 0xffffffff80000000,
+      .exp_fcvt_fflags = FFLAG_NV,
+      .exp_fcvtmod = 2147483646, /* int32 max -1 */
+      .exp_fcvtmod_fflags = FFLAG_NV },
+};
+
+int run_fcvtmod_tests()
+{
+    uint64_t act_fcvt;
+    uint8_t act_fcvt_fflags;
+    uint64_t act_fcvtmod;
+    uint8_t act_fcvtmod_fflags;
+
+    for (size_t i = 0; i < sizeof(tests)/sizeof(tests[0]); i++) {
+        const fp64_fcvt_fcvtmod_testcase_t *t = &tests[i];
+
+        act_fcvt = do_fcvt_w_d(t->inp_lu, &act_fcvt_fflags);
+        int fcvt_correct = act_fcvt == t->exp_fcvt &&
+                    act_fcvt_fflags == t->exp_fcvt_fflags;
+        act_fcvtmod = do_fcvtmod_w_d(t->inp_lu, &act_fcvtmod_fflags);
+        int fcvtmod_correct = act_fcvtmod == t->exp_fcvtmod &&
+                       act_fcvtmod_fflags == t->exp_fcvtmod_fflags;
+
+        if (fcvt_correct && fcvtmod_correct) {
+            continue;
+        }
+
+        printf("Test %zu (%s) failed!\n", i, t->name);
+
+        double fpr = do_fmv_d_x(t->inp_lu);
+        printf("inp_lu: 0x%016lx == %lf\n", t->inp_lu, fpr);
+        printf("inp_lf: %lf\n", t->inp_lf);
+
+        uint32_t sign = (t->inp_lu >> 63);
+        uint32_t exp = (uint32_t)(t->inp_lu >> 52) & 0x7ff;
+        uint64_t frac = t->inp_lu & 0xfffffffffffffull; /* significand */
+        int true_exp = exp - 1023;
+        int shift = true_exp - 52;
+        uint64_t true_frac = frac | 1ull << 52;
+
+        printf("sign=%d, exp=0x%03x, frac=0x%012lx\n", sign, exp, frac);
+        printf("true_exp=%d, shift=%d, true_frac=0x%016lx\n", true_exp, shift, true_frac);
+
+        if (!fcvt_correct) {
+            printf("act_fcvt: 0x%016lx == %li\n", act_fcvt, act_fcvt);
+            printf("exp_fcvt: 0x%016lx == %li\n", t->exp_fcvt, t->exp_fcvt);
+            printf("act_fcvt_fflags: "); print_fflags(act_fcvt_fflags); printf("\n");
+            printf("exp_fcvt_fflags: "); print_fflags(t->exp_fcvt_fflags); printf("\n");
+        }
+
+        if (!fcvtmod_correct) {
+            printf("act_fcvtmod: 0x%016lx == %li\n", act_fcvtmod, act_fcvtmod);
+            printf("exp_fcvtmod: 0x%016lx == %li\n", t->exp_fcvtmod, t->exp_fcvtmod);
+            printf("act_fcvtmod_fflags: "); print_fflags(act_fcvtmod_fflags); printf("\n");
+            printf("exp_fcvtmod_fflags: "); print_fflags(t->exp_fcvtmod_fflags); printf("\n");
+        }
+
+        return 1;
+    }
+
+    return 0;
+}
+
+int main()
+{
+    return run_fcvtmod_tests();
+}
diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the Zfa Standard Extension.
+ *
+ * Copyright (c) 2023 Christoph Müllner, christoph.muellner@vrull.eu
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZFA(ctx) do {     \
+    if (!ctx->cfg_ptr->ext_zfa) { \
+        return false;             \
+    }                             \
+} while (0)
+
+#define REQUIRE_ZFH(ctx) do {     \
+    if (!ctx->cfg_ptr->ext_zfh) { \
+        return false;             \
+    }                             \
+} while (0)
+
+static bool trans_fli_s(DisasContext *ctx, arg_fli_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    /* Values below are NaN-boxed to avoid a gen_nanbox_s(). */
+    static const uint64_t fli_s_table[] = {
+        0xffffffffbf800000,  /* -1.0 */
+        0xffffffff00800000,  /* minimum positive normal */
+        0xffffffff37800000,  /* 1.0 * 2^-16 */
+        0xffffffff38000000,  /* 1.0 * 2^-15 */
+        0xffffffff3b800000,  /* 1.0 * 2^-8  */
+        0xffffffff3c000000,  /* 1.0 * 2^-7  */
+        0xffffffff3d800000,  /* 1.0 * 2^-4  */
+        0xffffffff3e000000,  /* 1.0 * 2^-3  */
+        0xffffffff3e800000,  /* 0.25 */
+        0xffffffff3ea00000,  /* 0.3125 */
+        0xffffffff3ec00000,  /* 0.375 */
+        0xffffffff3ee00000,  /* 0.4375 */
+        0xffffffff3f000000,  /* 0.5 */
+        0xffffffff3f200000,  /* 0.625 */
+        0xffffffff3f400000,  /* 0.75 */
+        0xffffffff3f600000,  /* 0.875 */
+        0xffffffff3f800000,  /* 1.0 */
+        0xffffffff3fa00000,  /* 1.25 */
+        0xffffffff3fc00000,  /* 1.5 */
+        0xffffffff3fe00000,  /* 1.75 */
+        0xffffffff40000000,  /* 2.0 */
+        0xffffffff40200000,  /* 2.5 */
+        0xffffffff40400000,  /* 3 */
+        0xffffffff40800000,  /* 4 */
+        0xffffffff41000000,  /* 8 */
+        0xffffffff41800000,  /* 16 */
+        0xffffffff43000000,  /* 2^7 */
+        0xffffffff43800000,  /* 2^8 */
+        0xffffffff47000000,  /* 2^15 */
+        0xffffffff47800000,  /* 2^16 */
+        0xffffffff7f800000,  /* +inf */
+        0xffffffff7fc00000,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_s_table[a->rs1]);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fli_d(DisasContext *ctx, arg_fli_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    static const uint64_t fli_d_table[] = {
+        0xbff0000000000000,  /* -1.0 */
+        0x0010000000000000,  /* minimum positive normal */
+        0x3ef0000000000000,  /* 1.0 * 2^-16 */
+        0x3f00000000000000,  /* 1.0 * 2^-15 */
+        0x3f70000000000000,  /* 1.0 * 2^-8  */
+        0x3f80000000000000,  /* 1.0 * 2^-7  */
+        0x3fb0000000000000,  /* 1.0 * 2^-4  */
+        0x3fc0000000000000,  /* 1.0 * 2^-3  */
+        0x3fd0000000000000,  /* 0.25 */
+        0x3fd4000000000000,  /* 0.3125 */
+        0x3fd8000000000000,  /* 0.375 */
+        0x3fdc000000000000,  /* 0.4375 */
+        0x3fe0000000000000,  /* 0.5 */
+        0x3fe4000000000000,  /* 0.625 */
+        0x3fe8000000000000,  /* 0.75 */
+        0x3fec000000000000,  /* 0.875 */
+        0x3ff0000000000000,  /* 1.0 */
+        0x3ff4000000000000,  /* 1.25 */
+        0x3ff8000000000000,  /* 1.5 */
+        0x3ffc000000000000,  /* 1.75 */
+        0x4000000000000000,  /* 2.0 */
+        0x4004000000000000,  /* 2.5 */
+        0x4008000000000000,  /* 3 */
+        0x4010000000000000,  /* 4 */
+        0x4020000000000000,  /* 8 */
+        0x4030000000000000,  /* 16 */
+        0x4060000000000000,  /* 2^7 */
+        0x4070000000000000,  /* 2^8 */
+        0x40e0000000000000,  /* 2^15 */
+        0x40f0000000000000,  /* 2^16 */
+        0x7ff0000000000000,  /* +inf */
+        0x7ff8000000000000,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_d_table[a->rs1]);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fli_h(DisasContext *ctx, arg_fli_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    /* Values below are NaN-boxed to avoid a gen_nanbox_h(). */
+    static const uint64_t fli_h_table[] = {
+        0xffffffffffffbc00,  /* -1.0 */
+        0xffffffffffff0400,  /* minimum positive normal */
+        0xffffffffffff0100,  /* 1.0 * 2^-16 */
+        0xffffffffffff0200,  /* 1.0 * 2^-15 */
+        0xffffffffffff1c00,  /* 1.0 * 2^-8  */
+        0xffffffffffff2000,  /* 1.0 * 2^-7  */
+        0xffffffffffff2c00,  /* 1.0 * 2^-4  */
+        0xffffffffffff3000,  /* 1.0 * 2^-3  */
+        0xffffffffffff3400,  /* 0.25 */
+        0xffffffffffff3500,  /* 0.3125 */
+        0xffffffffffff3600,  /* 0.375 */
+        0xffffffffffff3700,  /* 0.4375 */
+        0xffffffffffff3800,  /* 0.5 */
+        0xffffffffffff3900,  /* 0.625 */
+        0xffffffffffff3a00,  /* 0.75 */
+        0xffffffffffff3b00,  /* 0.875 */
+        0xffffffffffff3c00,  /* 1.0 */
+        0xffffffffffff3d00,  /* 1.25 */
+        0xffffffffffff3e00,  /* 1.5 */
+        0xffffffffffff3f00,  /* 1.75 */
+        0xffffffffffff4000,  /* 2.0 */
+        0xffffffffffff4100,  /* 2.5 */
+        0xffffffffffff4200,  /* 3 */
+        0xffffffffffff4400,  /* 4 */
+        0xffffffffffff4800,  /* 8 */
+        0xffffffffffff4c00,  /* 16 */
+        0xffffffffffff5800,  /* 2^7 */
+        0xffffffffffff5c00,  /* 2^8 */
+        0xffffffffffff7800,  /* 2^15 */
+        0xffffffffffff7c00,  /* 2^16 */
+        0xffffffffffff7c00,  /* +inf */
+        0xffffffffffff7e00,  /* Canonical NaN */
+    };
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    tcg_gen_movi_i64(dest, fli_h_table[a->rs1]);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_s(DisasContext *ctx, arg_fminm_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fminm_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_s(DisasContext *ctx, arg_fmaxm_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fmaxm_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_d(DisasContext *ctx, arg_fminm_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+
+    gen_helper_fminm_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_d(DisasContext *ctx, arg_fmaxm_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+
+    gen_helper_fmaxm_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fminm_h(DisasContext *ctx, arg_fminm_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fminm_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fmaxm_h(DisasContext *ctx, arg_fmaxm_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fmaxm_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_s(DisasContext *ctx, arg_fround_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_s(DisasContext *ctx, arg_froundnx_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_d(DisasContext *ctx, arg_fround_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_d(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_d(DisasContext *ctx, arg_froundnx_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_d(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_fround_h(DisasContext *ctx, arg_fround_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fround_h(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+static bool trans_froundnx_h(DisasContext *ctx, arg_froundnx_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+
+    gen_set_rm(ctx, a->rm);
+    gen_helper_froundnx_h(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+bool trans_fcvtmod_w_d(DisasContext *ctx, arg_fcvtmod_w_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dst = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 t1 = tcg_temp_new_i64();
+
+    /* Rounding mode is RTZ. */
+    gen_set_rm(ctx, RISCV_FRM_RTZ);
+    gen_helper_fcvtmod_w_d(t1, cpu_env, src1);
+    tcg_gen_trunc_i64_tl(dst, t1);
+    gen_set_gpr(ctx, a->rd, dst);
+
+    return true;
+}
+
+bool trans_fmvh_x_d(DisasContext *ctx, arg_fmvh_x_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_32BIT(ctx);
+
+    TCGv dst = dest_gpr(ctx, a->rd);
+    TCGv_i64 t1 = tcg_temp_new_i64();
+    tcg_gen_sari_i64(t1, cpu_fpr[a->rs1], 32);
+    tcg_gen_trunc_i64_tl(dst, t1);
+    gen_set_gpr(ctx, a->rd, dst);
+    return true;
+}
+
+bool trans_fmvp_d_x(DisasContext *ctx, arg_fmvp_d_x *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_32BIT(ctx);
+
+    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
+    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+    tcg_gen_concat_tl_i64(cpu_fpr[a->rd], src1, src2);
+
+    mark_fs_dirty(ctx);
+    return true;
+}
+
+bool trans_fleq_s(DisasContext *ctx, arg_fleq_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fleq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_s(DisasContext *ctx, arg_fltq_s *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVF);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_EXT(ctx, RVD);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fleq_h(DisasContext *ctx, arg_fleq_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fleq_h(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+bool trans_fltq_h(DisasContext *ctx, arg_fltq_h *a)
+{
+    REQUIRE_FPU;
+    REQUIRE_ZFA(ctx);
+    REQUIRE_ZFH(ctx);
+
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fltq_h(dest, cpu_env, src1, src2);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/riscv64/Makefile.target
+++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-test-noc: QEMU_OPTS += -cpu rv64,c=false
 
 TESTS += test-aes
 run-test-aes: QEMU_OPTS += -cpu rv64,zk=on
+
+# Test for fcvtmod
+TESTS += test-fcvtmod
+test-fcvtmod: CFLAGS += -march=rv64imafdc
+test-fcvtmod: LDFLAGS += -static
+run-test-fcvtmod: QEMU_OPTS += -cpu rv64,d=true,Zfa=true
-- 
2.40.1