Series comparison

-[PULL 00/16] riscv-to-apply queue
+[PULL 00/15] riscv-to-apply queue
-The following changes since commit c95bd5ff1660883d15ad6e0005e4c8571604f51a:
+The following changes since commit 20c1df5476e1e9b5d3f5b94f9f3ce01d21f14c46:
-  Merge remote-tracking branch 'remotes/philmd/tags/mips-fixes-20210322' into staging (2021-03-22 14:26:13 +0000)
+  Merge remote-tracking branch 'remotes/kraxel/tags/fixes-20200713-pull-request' into staging (2020-07-13 16:58:44 +0100)
 are available in the Git repository at:
-  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210322-2
+  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20200713
-for you to fetch changes up to 9a27f69bd668d9d71674407badc412ce1231c7d5:
+for you to fetch changes up to cfad709bceb629a4ebeb5d8a3acd1871b9a6436b:
-  target/riscv: Prevent lost illegal instruction exceptions (2021-03-22 21:54:40 -0400)
+  target/riscv: Fix pmp NA4 implementation (2020-07-13 17:25:37 -0700)
 ----------------------------------------------------------------
-RISC-V PR for 6.0
+This is a colection of bug fixes and small imrprovements for RISC-V.
-This PR includes:
+This includes some vector extensions fixes, a PMP bug fix, OpenTitan
- - Fix for vector CSR access
+UART bug fix and support for OpenSBI dynamic firmware.
  - Improvements to the Ibex UART device
  - PMP improvements and bug fixes
  - Hypervisor extension bug fixes
  - ramfb support for the virt machine
  - Fast read support for SST flash
  - Improvements to the microchip_pfsoc machine
 ----------------------------------------------------------------
-Alexander Wagner (1):
+Alexandre Mergnat (1):
-      hw/char: disable ibex uart receive if the buffer is full
+      target/riscv: Fix pmp NA4 implementation
-Asherah Connor (2):
+Alistair Francis (2):
-      hw/riscv: Add fw_cfg support to virt
+      hw/char: Convert the Ibex UART to use the qdev Clock model
-      hw/riscv: allow ramfb on virt
+      hw/char: Convert the Ibex UART to use the registerfields API
 Atish Patra (4):
       riscv: Unify Qemu's reset vector code path
       RISC-V: Copy the fdt in dram instead of ROM
       riscv: Add opensbi firmware dynamic support
       RISC-V: Support 64 bit start address
 Bin Meng (3):
-      hw/block: m25p80: Support fast read for SST flashes
+      MAINTAINERS: Add an entry for OpenSBI firmware
-      hw/riscv: microchip_pfsoc: Map EMMC/SD mux register
+      hw/riscv: virt: Sort the SoC memmap table entries
-      docs/system: riscv: Add documentation for 'microchip-icicle-kit' machine
+      hw/riscv: Modify MROM size to end at 0x10000
-Frank Chang (1):
+Frank Chang (4):
-      target/riscv: fix vs() to return proper error code
+      target/riscv: fix rsub gvec tcg_assert_listed_vecop assertion
       target/riscv: correct the gvec IR called in gen_vec_rsub16_i64()
       target/riscv: fix return value of do_opivx_widen()
       target/riscv: fix vill bit index in vtype register
-Georg Kotheimer (6):
+Liao Pingfang (1):
-      target/riscv: Adjust privilege level for HLV(X)/HSV instructions
+      tcg/riscv: Remove superfluous breaks
       target/riscv: Make VSTIP and VSEIP read-only in hip
       target/riscv: Use background registers also for MSTATUS_MPV
       target/riscv: Fix read and write accesses to vsip and vsie
       target/riscv: Add proper two-stage lookup exception detection
       target/riscv: Prevent lost illegal instruction exceptions
-Jim Shu (3):
+ include/hw/char/ibex_uart.h             |  79 ++++++++--------
-      target/riscv: propagate PMP permission to TLB page
+ include/hw/riscv/boot.h                 |   7 ++
-      target/riscv: add log of PMP permission checking
+ include/hw/riscv/boot_opensbi.h         |  58 ++++++++++++
-      target/riscv: flush TLB pages if PMP permission has been changed
+ target/riscv/cpu.h                      |   2 +-
  hw/char/ibex_uart.c                     | 158 ++++++++++++++++++--------------
  hw/riscv/boot.c                         | 107 +++++++++++++++++++++
  hw/riscv/sifive_u.c                     |  53 ++++++-----
  hw/riscv/spike.c                        |  59 ++++--------
  hw/riscv/virt.c                         |  63 ++++---------
  target/riscv/insn_trans/trans_rvv.inc.c |   9 +-
  target/riscv/pmp.c                      |   2 +-
  tcg/riscv/tcg-target.inc.c              |   2 -
  MAINTAINERS                             |   7 ++
 files changed, 387 insertions(+), 219 deletions(-)
  create mode 100644 include/hw/riscv/boot_opensbi.h
- docs/system/riscv/microchip-icicle-kit.rst |  89 ++++++++++++++
- docs/system/target-riscv.rst               |   1 +
- include/hw/char/ibex_uart.h                |   4 +
- include/hw/riscv/microchip_pfsoc.h         |   1 +
- include/hw/riscv/virt.h                    |   2 +
- target/riscv/cpu.h                         |   4 +
- target/riscv/pmp.h                         |   4 +-
- hw/block/m25p80.c                          |   3 +
- hw/char/ibex_uart.c                        |  23 +++-
- hw/riscv/microchip_pfsoc.c                 |   6 +
- hw/riscv/virt.c                            |  33 ++++++
- target/riscv/cpu.c                         |   1 +
- target/riscv/cpu_helper.c                  | 144 +++++++++++++++--------
- target/riscv/csr.c                         |  77 +++++++------
- target/riscv/pmp.c                         |  84 ++++++++++----
- target/riscv/translate.c                   | 179 +----------------------------
- hw/riscv/Kconfig                           |   1 +
-files changed, 367 insertions(+), 289 deletions(-)
- create mode 100644 docs/system/riscv/microchip-icicle-kit.rst

-[PULL 16/16] target/riscv: Prevent lost illegal instruction exceptions
+[PULL 01/15] MAINTAINERS: Add an entry for OpenSBI firmware
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Bin Meng <bmeng.cn@gmail.com>
-When decode_insn16() fails, we fall back to decode_RV32_64C() for
+List me as the maintainer for OpenSBI firmware related files.
 further compressed instruction decoding. However, prior to this change,
 we did not raise an illegal instruction exception, if decode_RV32_64C()
 fails to decode the instruction. This means that we skipped illegal
 compressed instructions instead of raising an illegal instruction
 exception.
-Instead of patching decode_RV32_64C(), we can just remove it,
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-as it is dead code since f330433b363 anyway.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-Id: <1593177220-28143-1-git-send-email-bmeng.cn@gmail.com>
 Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210322121609.3097928-1-georg.kotheimer@kernkonzept.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/translate.c | 179 +--------------------------------------
+ MAINTAINERS | 7 +++++++
-file changed, 1 insertion(+), 178 deletions(-)
+file changed, 7 insertions(+)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/MAINTAINERS
-+++ b/target/riscv/translate.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+@@ -XXX,XX +XXX,XX @@ F: hw/i386/intel_iommu.c
-     CPUState *cs;
+ F: hw/i386/intel_iommu_internal.h
- } DisasContext;
+ F: include/hw/i386/intel_iommu.h
--#ifdef TARGET_RISCV64
++OpenSBI Firmware
--/* convert riscv funct3 to qemu memop for load/store */
++M: Bin Meng <bmeng.cn@gmail.com>
--static const int tcg_memop_lookup[8] = {
++S: Supported
--    [0 ... 7] = -1,
++F: pc-bios/opensbi-*
--    [0] = MO_SB,
++F: .gitlab-ci.d/opensbi.yml
--    [1] = MO_TESW,
++F: .gitlab-ci.d/opensbi/
--    [2] = MO_TESL,
++
--    [3] = MO_TEQ,
+ Usermode Emulation
--    [4] = MO_UB,
+ ------------------
--    [5] = MO_TEUW,
+ Overall usermode emulation
 -    [6] = MO_TEUL,
 -};
 -#endif
 -
  #ifdef TARGET_RISCV64
  #define CASE_OP_32_64(X) case X: case glue(X, W)
  #else
@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
      ctx->base.is_jmp = DISAS_NORETURN;
  }
 -#ifdef TARGET_RISCV64
 -static void gen_load_c(DisasContext *ctx, uint32_t opc, int rd, int rs1,
 -        target_long imm)
 -{
 -    TCGv t0 = tcg_temp_new();
 -    TCGv t1 = tcg_temp_new();
 -    gen_get_gpr(t0, rs1);
 -    tcg_gen_addi_tl(t0, t0, imm);
 -    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
 -
 -    if (memop < 0) {
 -        gen_exception_illegal(ctx);
 -        return;
 -    }
 -
 -    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, memop);
 -    gen_set_gpr(rd, t1);
 -    tcg_temp_free(t0);
 -    tcg_temp_free(t1);
 -}
 -
 -static void gen_store_c(DisasContext *ctx, uint32_t opc, int rs1, int rs2,
 -        target_long imm)
 -{
 -    TCGv t0 = tcg_temp_new();
 -    TCGv dat = tcg_temp_new();
 -    gen_get_gpr(t0, rs1);
 -    tcg_gen_addi_tl(t0, t0, imm);
 -    gen_get_gpr(dat, rs2);
 -    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
 -
 -    if (memop < 0) {
 -        gen_exception_illegal(ctx);
 -        return;
 -    }
 -
 -    tcg_gen_qemu_st_tl(dat, t0, ctx->mem_idx, memop);
 -    tcg_temp_free(t0);
 -    tcg_temp_free(dat);
 -}
 -#endif
 -
  #ifndef CONFIG_USER_ONLY
  /* The states of mstatus_fs are:
   * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
  static inline void mark_fs_dirty(DisasContext *ctx) { }
  #endif
 -#if !defined(TARGET_RISCV64)
 -static void gen_fp_load(DisasContext *ctx, uint32_t opc, int rd,
 -        int rs1, target_long imm)
 -{
 -    TCGv t0;
 -
 -    if (ctx->mstatus_fs == 0) {
 -        gen_exception_illegal(ctx);
 -        return;
 -    }
 -
 -    t0 = tcg_temp_new();
 -    gen_get_gpr(t0, rs1);
 -    tcg_gen_addi_tl(t0, t0, imm);
 -
 -    switch (opc) {
 -    case OPC_RISC_FLW:
 -        if (!has_ext(ctx, RVF)) {
 -            goto do_illegal;
 -        }
 -        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEUL);
 -        /* RISC-V requires NaN-boxing of narrower width floating point values */
 -        tcg_gen_ori_i64(cpu_fpr[rd], cpu_fpr[rd], 0xffffffff00000000ULL);
 -        break;
 -    case OPC_RISC_FLD:
 -        if (!has_ext(ctx, RVD)) {
 -            goto do_illegal;
 -        }
 -        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEQ);
 -        break;
 -    do_illegal:
 -    default:
 -        gen_exception_illegal(ctx);
 -        break;
 -    }
 -    tcg_temp_free(t0);
 -
 -    mark_fs_dirty(ctx);
 -}
 -
 -static void gen_fp_store(DisasContext *ctx, uint32_t opc, int rs1,
 -        int rs2, target_long imm)
 -{
 -    TCGv t0;
 -
 -    if (ctx->mstatus_fs == 0) {
 -        gen_exception_illegal(ctx);
 -        return;
 -    }
 -
 -    t0 = tcg_temp_new();
 -    gen_get_gpr(t0, rs1);
 -    tcg_gen_addi_tl(t0, t0, imm);
 -
 -    switch (opc) {
 -    case OPC_RISC_FSW:
 -        if (!has_ext(ctx, RVF)) {
 -            goto do_illegal;
 -        }
 -        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEUL);
 -        break;
 -    case OPC_RISC_FSD:
 -        if (!has_ext(ctx, RVD)) {
 -            goto do_illegal;
 -        }
 -        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEQ);
 -        break;
 -    do_illegal:
 -    default:
 -        gen_exception_illegal(ctx);
 -        break;
 -    }
 -
 -    tcg_temp_free(t0);
 -}
 -#endif
 -
  static void gen_set_rm(DisasContext *ctx, int rm)
  {
      TCGv_i32 t0;
@@ -XXX,XX +XXX,XX @@ static void gen_set_rm(DisasContext *ctx, int rm)
      tcg_temp_free_i32(t0);
  }
 -static void decode_RV32_64C0(DisasContext *ctx, uint16_t opcode)
 -{
 -    uint8_t funct3 = extract16(opcode, 13, 3);
 -    uint8_t rd_rs2 = GET_C_RS2S(opcode);
 -    uint8_t rs1s = GET_C_RS1S(opcode);
 -
 -    switch (funct3) {
 -    case 3:
 -#if defined(TARGET_RISCV64)
 -        /* C.LD(RV64/128) -> ld rd', offset[7:3](rs1')*/
 -        gen_load_c(ctx, OPC_RISC_LD, rd_rs2, rs1s,
 -                 GET_C_LD_IMM(opcode));
 -#else
 -        /* C.FLW (RV32) -> flw rd', offset[6:2](rs1')*/
 -        gen_fp_load(ctx, OPC_RISC_FLW, rd_rs2, rs1s,
 -                    GET_C_LW_IMM(opcode));
 -#endif
 -        break;
 -    case 7:
 -#if defined(TARGET_RISCV64)
 -        /* C.SD (RV64/128) -> sd rs2', offset[7:3](rs1')*/
 -        gen_store_c(ctx, OPC_RISC_SD, rs1s, rd_rs2,
 -                  GET_C_LD_IMM(opcode));
 -#else
 -        /* C.FSW (RV32) -> fsw rs2', offset[6:2](rs1')*/
 -        gen_fp_store(ctx, OPC_RISC_FSW, rs1s, rd_rs2,
 -                     GET_C_LW_IMM(opcode));
 -#endif
 -        break;
 -    }
 -}
 -
 -static void decode_RV32_64C(DisasContext *ctx, uint16_t opcode)
 -{
 -    uint8_t op = extract16(opcode, 0, 2);
 -
 -    switch (op) {
 -    case 0:
 -        decode_RV32_64C0(ctx, opcode);
 -        break;
 -    }
 -}
 -
  static int ex_plus_1(DisasContext *ctx, int nf)
  {
      return nf + 1;
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
          } else {
              ctx->pc_succ_insn = ctx->base.pc_next + 2;
              if (!decode_insn16(ctx, opcode)) {
 -                /* fall back to old decoder */
 -                decode_RV32_64C(ctx, opcode);
 +                gen_exception_illegal(ctx);
              }
          }
      } else {
 --
-.30.1
+.27.0

-[PULL 15/16] docs/system: riscv: Add documentation for 'microchip-icicle-kit' machine
+[PULL 02/15] hw/riscv: virt: Sort the SoC memmap table entries
 From: Bin Meng <bin.meng@windriver.com>
-This adds the documentation to describe what is supported for the
+Adjust the PCIe memory maps to follow the order.
 'microchip-icicle-kit' machine, and how to boot the machine in QEMU.
 Signed-off-by: Bin Meng <bin.meng@windriver.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210322075248.136255-2-bmeng.cn@gmail.com
+Message-Id: <1593746511-19517-1-git-send-email-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- docs/system/riscv/microchip-icicle-kit.rst | 89 ++++++++++++++++++++++
+ hw/riscv/virt.c | 6 +++---
- docs/system/target-riscv.rst               |  1 +
+file changed, 3 insertions(+), 3 deletions(-)
 files changed, 90 insertions(+)
  create mode 100644 docs/system/riscv/microchip-icicle-kit.rst
-diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/system/riscv/microchip-icicle-kit.rst
@@ -XXX,XX +XXX,XX @@
 +Microchip PolarFire SoC Icicle Kit (``microchip-icicle-kit``)
 +=============================================================
 +
 +Microchip PolarFire SoC Icicle Kit integrates a PolarFire SoC, with one
 +SiFive's E51 plus four U54 cores and many on-chip peripherals and an FPGA.
 +
 +For more details about Microchip PolarFire SoC, please see:
 +https://www.microsemi.com/product-directory/soc-fpgas/5498-polarfire-soc-fpga
 +
 +The Icicle Kit board information can be found here:
 +https://www.microsemi.com/existing-parts/parts/152514
 +
 +Supported devices
 +-----------------
 +
 +The ``microchip-icicle-kit`` machine supports the following devices:
 +
 + * 1 E51 core
 + * 4 U54 cores
 + * Core Level Interruptor (CLINT)
 + * Platform-Level Interrupt Controller (PLIC)
 + * L2 Loosely Integrated Memory (L2-LIM)
 + * DDR memory controller
 + * 5 MMUARTs
 + * 1 DMA controller
 + * 2 GEM Ethernet controllers
 + * 1 SDHC storage controller
 +
 +Boot options
 +------------
 +
 +The ``microchip-icicle-kit`` machine can start using the standard -bios
 +functionality for loading its BIOS image, aka Hart Software Services (HSS_).
 +HSS loads the second stage bootloader U-Boot from an SD card. It does not
 +support direct kernel loading via the -kernel option. One has to load kernel
 +from U-Boot.
 +
 +The memory is set to 1537 MiB by default which is the minimum required high
 +memory size by HSS. A sanity check on ram size is performed in the machine
 +init routine to prompt user to increase the RAM size to > 1537 MiB when less
 +than 1537 MiB ram is detected.
 +
 +Boot the machine
 +----------------
 +
 +HSS 2020.12 release is tested at the time of writing. To build an HSS image
 +that can be booted by the ``microchip-icicle-kit`` machine, type the following
 +in the HSS source tree:
 +
 +.. code-block:: bash
 +
 +  $ export CROSS_COMPILE=riscv64-linux-
 +  $ cp boards/mpfs-icicle-kit-es/def_config .config
 +  $ make BOARD=mpfs-icicle-kit-es
 +
 +Download the official SD card image released by Microchip and prepare it for
 +QEMU usage:
 +
 +.. code-block:: bash
 +
 +  $ wget ftp://ftpsoc.microsemi.com/outgoing/core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
 +  $ gunzip core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
 +  $ qemu-img resize core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic 4G
 +
 +Then we can boot the machine by:
 +
 +.. code-block:: bash
 +
 +  $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 \
 +      -bios path/to/hss.bin -sd path/to/sdcard.img \
 +      -nic user,model=cadence_gem \
 +      -nic tap,ifname=tap,model=cadence_gem,script=no \
 +      -display none -serial stdio \
 +      -chardev socket,id=serial1,path=serial1.sock,server=on,wait=on \
 +      -serial chardev:serial1
 +
 +With above command line, current terminal session will be used for the first
 +serial port. Open another terminal window, and use `minicom` to connect the
 +second serial port.
 +
 +.. code-block:: bash
 +
 +  $ minicom -D unix\#serial1.sock
 +
 +HSS output is on the first serial port (stdio) and U-Boot outputs on the
 +second serial port. U-Boot will automatically load the Linux kernel from
 +the SD card image.
 +
 +.. _HSS: https://github.com/polarfire-soc/hart-software-services
 diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/target-riscv.rst
+--- a/hw/riscv/virt.c
-+++ b/docs/system/target-riscv.rst
++++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
+@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
- .. toctree::
+     [VIRT_TEST] =        {   0x100000,        0x1000 },
-    :maxdepth: 1
+     [VIRT_RTC] =         {   0x101000,        0x1000 },
+     [VIRT_CLINT] =       {  0x2000000,       0x10000 },
-+   riscv/microchip-icicle-kit
++    [VIRT_PCIE_PIO] =    {  0x3000000,       0x10000 },
-    riscv/sifive_u
+     [VIRT_PLIC] =        {  0xc000000,     0x4000000 },
+     [VIRT_UART0] =       { 0x10000000,         0x100 },
- RISC-V CPU features
+     [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
      [VIRT_FLASH] =       { 0x20000000,     0x4000000 },
 -    [VIRT_DRAM] =        { 0x80000000,           0x0 },
 -    [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
 -    [VIRT_PCIE_PIO] =    { 0x03000000,    0x00010000 },
      [VIRT_PCIE_ECAM] =   { 0x30000000,    0x10000000 },
 +    [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
 +    [VIRT_DRAM] =        { 0x80000000,           0x0 },
  };
  #define VIRT_FLASH_SECTOR_SIZE (256 * KiB)
 --
-.30.1
+.27.0

-[PULL 10/16] hw/riscv: allow ramfb on virt
+[PULL 03/15] riscv: Unify Qemu's reset vector code path
-From: Asherah Connor <ashe@kivikakk.ee>
+From: Atish Patra <atish.patra@wdc.com>
-Allow ramfb on virt.  This lets `-device ramfb' work.
+Currently, all riscv machines except sifive_u have identical reset vector
+code implementations with memory addresses being different for all machines.
-Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
+They can be easily combined into a single function in common code.
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
 Move it to common function and let all the machines use the common function.
 Signed-off-by: Atish Patra <atish.patra@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210318235041.17175-3-ashe@kivikakk.ee
+Reviewed-by: Bin Meng <bin.meng@windriver.com>
 Tested-by: Bin Meng <bin.meng@windriver.com>
 Message-Id: <20200701183949.398134-2-atish.patra@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 3 +++
+ include/hw/riscv/boot.h |  2 ++
-file changed, 3 insertions(+)
+ hw/riscv/boot.c         | 46 +++++++++++++++++++++++++++++++++++++++++
+ hw/riscv/sifive_u.c     |  1 -
  hw/riscv/spike.c        | 41 +++---------------------------------
  hw/riscv/virt.c         | 40 +++--------------------------------
 files changed, 54 insertions(+), 76 deletions(-)
 diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/riscv/boot.h
 +++ b/include/hw/riscv/boot.h
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_kernel(const char *kernel_filename,
                                 symbol_fn_t sym_cb);
  hwaddr riscv_load_initrd(const char *filename, uint64_t mem_size,
                           uint64_t kernel_entry, hwaddr *start);
 +void riscv_setup_rom_reset_vec(hwaddr saddr, hwaddr rom_base,
 +                               hwaddr rom_size, void *fdt);
  #endif /* RISCV_BOOT_H */
 diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/boot.c
 +++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/loader.h"
  #include "hw/riscv/boot.h"
  #include "elf.h"
 +#include "sysemu/device_tree.h"
  #include "sysemu/qtest.h"
 +#include <libfdt.h>
 +
  #if defined(TARGET_RISCV32)
  # define KERNEL_BOOT_ADDRESS 0x80400000
  #else
@@ -XXX,XX +XXX,XX @@ hwaddr riscv_load_initrd(const char *filename, uint64_t mem_size,
      return *start + size;
  }
 +
 +void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
 +                               hwaddr rom_size, void *fdt)
 +{
 +    int i;
 +
 +    /* reset vector */
 +    uint32_t reset_vec[8] = {
 +        0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(dtb) */
 +        0x02028593,                  /*     addi   a1, t0, %pcrel_lo(1b) */
 +        0xf1402573,                  /*     csrr   a0, mhartid  */
 +#if defined(TARGET_RISCV32)
 +        0x0182a283,                  /*     lw     t0, 24(t0) */
 +#elif defined(TARGET_RISCV64)
 +        0x0182b283,                  /*     ld     t0, 24(t0) */
 +#endif
 +        0x00028067,                  /*     jr     t0 */
 +        0x00000000,
 +        start_addr,                  /* start: .dword */
 +        0x00000000,
 +                                     /* dtb: */
 +    };
 +
 +    /* copy in the reset vector in little_endian byte order */
 +    for (i = 0; i < sizeof(reset_vec) >> 2; i++) {
 +        reset_vec[i] = cpu_to_le32(reset_vec[i]);
 +    }
 +    rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
 +                          rom_base, &address_space_memory);
 +
 +    /* copy in the device tree */
 +    if (fdt_pack(fdt) || fdt_totalsize(fdt) >
 +        rom_size - sizeof(reset_vec)) {
 +        error_report("not enough space to store device-tree");
 +        exit(1);
 +    }
 +    qemu_fdt_dumpdtb(fdt, fdt_totalsize(fdt));
 +    rom_add_blob_fixed_as("mrom.fdt", fdt, fdt_totalsize(fdt),
 +                           rom_base + sizeof(reset_vec),
 +                           &address_space_memory);
 +
 +    return;
 +}
 diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_u.c
 +++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/device_tree.h"
  #include "sysemu/runstate.h"
  #include "sysemu/sysemu.h"
 -#include "exec/address-spaces.h"
  #include <libfdt.h>
 diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/spike.c
 +++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/device_tree.h"
  #include "sysemu/qtest.h"
  #include "sysemu/sysemu.h"
 -#include "exec/address-spaces.h"
 -
 -#include <libfdt.h>
  #if defined(TARGET_RISCV32)
  # define BIOS_FILENAME "opensbi-riscv32-spike-fw_jump.elf"
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      MemoryRegion *system_memory = get_system_memory();
      MemoryRegion *main_mem = g_new(MemoryRegion, 1);
      MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
 -    int i;
      unsigned int smp_cpus = machine->smp.cpus;
      /* Initialize SOC */
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
          }
      }
 -    /* reset vector */
 -    uint32_t reset_vec[8] = {
 -        0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(dtb) */
 -        0x02028593,                  /*     addi   a1, t0, %pcrel_lo(1b) */
 -        0xf1402573,                  /*     csrr   a0, mhartid  */
 -#if defined(TARGET_RISCV32)
 -        0x0182a283,                  /*     lw     t0, 24(t0) */
 -#elif defined(TARGET_RISCV64)
 -        0x0182b283,                  /*     ld     t0, 24(t0) */
 -#endif
 -        0x00028067,                  /*     jr     t0 */
 -        0x00000000,
 -        memmap[SPIKE_DRAM].base,     /* start: .dword DRAM_BASE */
 -        0x00000000,
 -                                     /* dtb: */
 -    };
 -
 -    /* copy in the reset vector in little_endian byte order */
 -    for (i = 0; i < sizeof(reset_vec) >> 2; i++) {
 -        reset_vec[i] = cpu_to_le32(reset_vec[i]);
 -    }
 -    rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
 -                          memmap[SPIKE_MROM].base, &address_space_memory);
 -
 -    /* copy in the device tree */
 -    if (fdt_pack(s->fdt) || fdt_totalsize(s->fdt) >
 -            memmap[SPIKE_MROM].size - sizeof(reset_vec)) {
 -        error_report("not enough space to store device-tree");
 -        exit(1);
 -    }
 -    qemu_fdt_dumpdtb(s->fdt, fdt_totalsize(s->fdt));
 -    rom_add_blob_fixed_as("mrom.fdt", s->fdt, fdt_totalsize(s->fdt),
 -                          memmap[SPIKE_MROM].base + sizeof(reset_vec),
 -                          &address_space_memory);
 +    /* load the reset vector */
 +    riscv_setup_rom_reset_vec(memmap[SPIKE_DRAM].base, memmap[SPIKE_MROM].base,
 +                              memmap[SPIKE_MROM].size, s->fdt);
      /* initialize HTIF using symbols found in load_kernel */
      htif_mm_init(system_memory, mask_rom, &s->soc.harts[0].env, serial_hd(0));
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
 @@ -XXX,XX +XXX,XX @@
+ #include "sysemu/arch_init.h"
+ #include "sysemu/device_tree.h"
  #include "sysemu/sysemu.h"
+-#include "exec/address-spaces.h"
  #include "hw/pci/pci.h"
  #include "hw/pci-host/gpex.h"
-+#include "hw/display/ramfb.h"
+-#include <libfdt.h>
- static const MemMapEntry virt_memmap[] = {
+-
-     [VIRT_DEBUG] =       {        0x0,         0x100 },
+ #if defined(TARGET_RISCV32)
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+ # define BIOS_FILENAME "opensbi-riscv32-virt-fw_jump.bin"
-     mc->cpu_index_to_instance_props = riscv_numa_cpu_index_to_props;
+ #else
-     mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
-     mc->numa_mem_supported = true;
+         start_addr = virt_memmap[VIRT_FLASH].base;
-+
+     }
-+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
- }
+-    /* reset vector */
+-    uint32_t reset_vec[8] = {
- static const TypeInfo virt_machine_typeinfo = {
+-        0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(dtb) */
 -        0x02028593,                  /*     addi   a1, t0, %pcrel_lo(1b) */
 -        0xf1402573,                  /*     csrr   a0, mhartid  */
 -#if defined(TARGET_RISCV32)
 -        0x0182a283,                  /*     lw     t0, 24(t0) */
 -#elif defined(TARGET_RISCV64)
 -        0x0182b283,                  /*     ld     t0, 24(t0) */
 -#endif
 -        0x00028067,                  /*     jr     t0 */
 -        0x00000000,
 -        start_addr,                  /* start: .dword */
 -        0x00000000,
 -                                     /* dtb: */
 -    };
 -
 -    /* copy in the reset vector in little_endian byte order */
 -    for (i = 0; i < sizeof(reset_vec) >> 2; i++) {
 -        reset_vec[i] = cpu_to_le32(reset_vec[i]);
 -    }
 -    rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
 -                          memmap[VIRT_MROM].base, &address_space_memory);
 -
 -    /* copy in the device tree */
 -    if (fdt_pack(s->fdt) || fdt_totalsize(s->fdt) >
 -            memmap[VIRT_MROM].size - sizeof(reset_vec)) {
 -        error_report("not enough space to store device-tree");
 -        exit(1);
 -    }
 -    qemu_fdt_dumpdtb(s->fdt, fdt_totalsize(s->fdt));
 -    rom_add_blob_fixed_as("mrom.fdt", s->fdt, fdt_totalsize(s->fdt),
 -                          memmap[VIRT_MROM].base + sizeof(reset_vec),
 -                          &address_space_memory);
 +    /* load the reset vector */
 +    riscv_setup_rom_reset_vec(start_addr, virt_memmap[VIRT_MROM].base,
 +                              virt_memmap[VIRT_MROM].size, s->fdt);
      /* create PLIC hart topology configuration string */
      plic_hart_config_len = (strlen(VIRT_PLIC_HART_CONFIG) + 1) * smp_cpus;
 --
-.30.1
+.27.0

-[PULL 09/16] hw/riscv: Add fw_cfg support to virt
+[PULL 04/15] RISC-V: Copy the fdt in dram instead of ROM
-From: Asherah Connor <ashe@kivikakk.ee>
+From: Atish Patra <atish.patra@wdc.com>
-Provides fw_cfg for the virt machine on riscv.  This enables
+Currently, the fdt is copied to the ROM after the reset vector. The firmware
-using e.g.  ramfb later.
+has to copy it to DRAM. Instead of this, directly copy the device tree to a
+pre-computed dram address. The device tree load address should be as far as
-Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
+possible from kernel and initrd images. That's why it is kept at the end of
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+the DRAM or 4GB whichever is lesser.
 Signed-off-by: Atish Patra <atish.patra@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210318235041.17175-2-ashe@kivikakk.ee
+Reviewed-by: Bin Meng <bin.meng@windriver.com>
 Tested-by: Bin Meng <bin.meng@windriver.com>
 Message-Id: <20200701183949.398134-3-atish.patra@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h |  2 ++
+ include/hw/riscv/boot.h |  4 +++-
- hw/riscv/virt.c         | 30 ++++++++++++++++++++++++++++++
+ hw/riscv/boot.c         | 53 +++++++++++++++++++++++++++++------------
- hw/riscv/Kconfig        |  1 +
+ hw/riscv/sifive_u.c     | 28 ++++++++++------------
-files changed, 33 insertions(+)
+ hw/riscv/spike.c        |  7 +++++-
+ hw/riscv/virt.c         |  7 +++++-
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
+files changed, 66 insertions(+), 33 deletions(-)
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
+diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
-+++ b/include/hw/riscv/virt.h
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
+--- a/include/hw/riscv/boot.h
-     RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
++++ b/include/hw/riscv/boot.h
-     DeviceState *plic[VIRT_SOCKETS_MAX];
+@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_kernel(const char *kernel_filename,
-     PFlashCFI01 *flash[2];
+                                symbol_fn_t sym_cb);
-+    FWCfgState *fw_cfg;
+ hwaddr riscv_load_initrd(const char *filename, uint64_t mem_size,
+                          uint64_t kernel_entry, hwaddr *start);
-     int fdt_size;
++uint32_t riscv_load_fdt(hwaddr dram_start, uint64_t dram_size, void *fdt);
- };
+ void riscv_setup_rom_reset_vec(hwaddr saddr, hwaddr rom_base,
-@@ -XXX,XX +XXX,XX @@ enum {
+-                               hwaddr rom_size, void *fdt);
-     VIRT_PLIC,
++                               hwaddr rom_size,
-     VIRT_UART0,
++                               uint32_t fdt_load_addr, void *fdt);
-     VIRT_VIRTIO,
-+    VIRT_FW_CFG,
+ #endif /* RISCV_BOOT_H */
-     VIRT_FLASH,
+diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
-     VIRT_DRAM,
+index XXXXXXX..XXXXXXX 100644
-     VIRT_PCIE_MMIO,
+--- a/hw/riscv/boot.c
 +++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ hwaddr riscv_load_initrd(const char *filename, uint64_t mem_size,
      return *start + size;
  }
 +uint32_t riscv_load_fdt(hwaddr dram_base, uint64_t mem_size, void *fdt)
 +{
 +    uint32_t temp, fdt_addr;
 +    hwaddr dram_end = dram_base + mem_size;
 +    int fdtsize = fdt_totalsize(fdt);
 +
 +    if (fdtsize <= 0) {
 +        error_report("invalid device-tree");
 +        exit(1);
 +    }
 +
 +    /*
 +     * We should put fdt as far as possible to avoid kernel/initrd overwriting
 +     * its content. But it should be addressable by 32 bit system as well.
 +     * Thus, put it at an aligned address that less than fdt size from end of
 +     * dram or 4GB whichever is lesser.
 +     */
 +    temp = MIN(dram_end, 4096 * MiB);
 +    fdt_addr = QEMU_ALIGN_DOWN(temp - fdtsize, 2 * MiB);
 +
 +    fdt_pack(fdt);
 +    /* copy in the device tree */
 +    qemu_fdt_dumpdtb(fdt, fdtsize);
 +
 +    rom_add_blob_fixed_as("fdt", fdt, fdtsize, fdt_addr,
 +                          &address_space_memory);
 +
 +    return fdt_addr;
 +}
 +
  void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
 -                               hwaddr rom_size, void *fdt)
 +                               hwaddr rom_size,
 +                               uint32_t fdt_load_addr, void *fdt)
  {
      int i;
      /* reset vector */
 -    uint32_t reset_vec[8] = {
 +    uint32_t reset_vec[10] = {
 x00000297,                  /* 1:  auipc  t0, %pcrel_hi(dtb) */
 -        0x02028593,                  /*     addi   a1, t0, %pcrel_lo(1b) */
 xf1402573,                  /*     csrr   a0, mhartid  */
  #if defined(TARGET_RISCV32)
 +        0x0202a583,                  /*     lw     a1, 32(t0) */
 x0182a283,                  /*     lw     t0, 24(t0) */
  #elif defined(TARGET_RISCV64)
 +        0x0202b583,                  /*     ld     a1, 32(t0) */
 x0182b283,                  /*     ld     t0, 24(t0) */
  #endif
 x00028067,                  /*     jr     t0 */
 x00000000,
          start_addr,                  /* start: .dword */
 +        0x00000000,
 +        fdt_load_addr,               /* fdt_laddr: .dword */
 x00000000,
                                       /* dtb: */
      };
      /* copy in the reset vector in little_endian byte order */
 -    for (i = 0; i < sizeof(reset_vec) >> 2; i++) {
 +    for (i = 0; i < ARRAY_SIZE(reset_vec); i++) {
          reset_vec[i] = cpu_to_le32(reset_vec[i]);
      }
      rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
                            rom_base, &address_space_memory);
 -    /* copy in the device tree */
 -    if (fdt_pack(fdt) || fdt_totalsize(fdt) >
 -        rom_size - sizeof(reset_vec)) {
 -        error_report("not enough space to store device-tree");
 -        exit(1);
 -    }
 -    qemu_fdt_dumpdtb(fdt, fdt_totalsize(fdt));
 -    rom_add_blob_fixed_as("mrom.fdt", fdt, fdt_totalsize(fdt),
 -                           rom_base + sizeof(reset_vec),
 -                           &address_space_memory);
 -
      return;
  }
 diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_u.c
 +++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
      MemoryRegion *flash0 = g_new(MemoryRegion, 1);
      target_ulong start_addr = memmap[SIFIVE_U_DRAM].base;
      int i;
 +    uint32_t fdt_load_addr;
      /* Initialize SoC */
      object_initialize_child(OBJECT(machine), "soc", &s->soc, TYPE_RISCV_U_SOC);
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
          }
      }
 +    /* Compute the fdt load address in dram */
 +    fdt_load_addr = riscv_load_fdt(memmap[SIFIVE_U_DRAM].base,
 +                                   machine->ram_size, s->fdt);
 +
      /* reset vector */
 -    uint32_t reset_vec[8] = {
 +    uint32_t reset_vec[11] = {
          s->msel,                       /* MSEL pin state */
 x00000297,                    /* 1:  auipc  t0, %pcrel_hi(dtb) */
 -        0x01c28593,                    /*     addi   a1, t0, %pcrel_lo(1b) */
 xf1402573,                    /*     csrr   a0, mhartid  */
  #if defined(TARGET_RISCV32)
 +        0x0202a583,                    /*     lw     a1, 32(t0) */
 x0182a283,                    /*     lw     t0, 24(t0) */
  #elif defined(TARGET_RISCV64)
 -        0x0182e283,                    /*     lwu    t0, 24(t0) */
 +        0x0202b583,                    /*     ld     a1, 32(t0) */
 +        0x0182b283,                    /*     ld     t0, 24(t0) */
  #endif
 x00028067,                    /*     jr     t0 */
 x00000000,
          start_addr,                    /* start: .dword */
 +        0x00000000,
 +        fdt_load_addr,                 /* fdt_laddr: .dword */
 +        0x00000000,
                                         /* dtb: */
      };
      /* copy in the reset vector in little_endian byte order */
 -    for (i = 0; i < sizeof(reset_vec) >> 2; i++) {
 +    for (i = 0; i < ARRAY_SIZE(reset_vec); i++) {
          reset_vec[i] = cpu_to_le32(reset_vec[i]);
      }
      rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
                            memmap[SIFIVE_U_MROM].base, &address_space_memory);
 -
 -    /* copy in the device tree */
 -    if (fdt_pack(s->fdt) || fdt_totalsize(s->fdt) >
 -            memmap[SIFIVE_U_MROM].size - sizeof(reset_vec)) {
 -        error_report("not enough space to store device-tree");
 -        exit(1);
 -    }
 -    qemu_fdt_dumpdtb(s->fdt, fdt_totalsize(s->fdt));
 -    rom_add_blob_fixed_as("mrom.fdt", s->fdt, fdt_totalsize(s->fdt),
 -                          memmap[SIFIVE_U_MROM].base + sizeof(reset_vec),
 -                          &address_space_memory);
  }
  static bool sifive_u_machine_get_start_in_flash(Object *obj, Error **errp)
 diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/spike.c
 +++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      MemoryRegion *main_mem = g_new(MemoryRegion, 1);
      MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
      unsigned int smp_cpus = machine->smp.cpus;
 +    uint32_t fdt_load_addr;
      /* Initialize SOC */
      object_initialize_child(OBJECT(machine), "soc", &s->soc,
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
          }
      }
 +    /* Compute the fdt load address in dram */
 +    fdt_load_addr = riscv_load_fdt(memmap[SPIKE_DRAM].base,
 +                                   machine->ram_size, s->fdt);
      /* load the reset vector */
      riscv_setup_rom_reset_vec(memmap[SPIKE_DRAM].base, memmap[SPIKE_MROM].base,
 -                              memmap[SPIKE_MROM].size, s->fdt);
 +                              memmap[SPIKE_MROM].size,
 +                              fdt_load_addr, s->fdt);
      /* initialize HTIF using symbols found in load_kernel */
      htif_mm_init(system_memory, mask_rom, &s->soc.harts[0].env, serial_hd(0));
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
-     [VIRT_PLIC] =        {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
+     char *plic_hart_config;
-     [VIRT_UART0] =       { 0x10000000,         0x100 },
+     size_t plic_hart_config_len;
-     [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
+     target_ulong start_addr = memmap[VIRT_DRAM].base;
-+    [VIRT_FW_CFG] =      { 0x10100000,          0x18 },
++    uint32_t fdt_load_addr;
-     [VIRT_FLASH] =       { 0x20000000,     0x4000000 },
+     int i;
-     [VIRT_PCIE_ECAM] =   { 0x30000000,    0x10000000 },
+     unsigned int smp_cpus = machine->smp.cpus;
-     [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
      return dev;
  }
 +static FWCfgState *create_fw_cfg(const MachineState *mc)
 +{
 +    hwaddr base = virt_memmap[VIRT_FW_CFG].base;
 +    hwaddr size = virt_memmap[VIRT_FW_CFG].size;
 +    FWCfgState *fw_cfg;
 +    char *nodename;
 +
 +    fw_cfg = fw_cfg_init_mem_wide(base + 8, base, 8, base + 16,
 +                                  &address_space_memory);
 +    fw_cfg_add_i16(fw_cfg, FW_CFG_NB_CPUS, (uint16_t)mc->smp.cpus);
 +
 +    nodename = g_strdup_printf("/fw-cfg@%" PRIx64, base);
 +    qemu_fdt_add_subnode(mc->fdt, nodename);
 +    qemu_fdt_setprop_string(mc->fdt, nodename,
 +                            "compatible", "qemu,fw-cfg-mmio");
 +    qemu_fdt_setprop_sized_cells(mc->fdt, nodename, "reg",
 +                                 2, base, 2, size);
 +    qemu_fdt_setprop(mc->fdt, nodename, "dma-coherent", NULL, 0);
 +    g_free(nodename);
 +    return fw_cfg;
 +}
 +
  static void virt_machine_init(MachineState *machine)
  {
      const MemMapEntry *memmap = virt_memmap;
 @@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
          start_addr = virt_memmap[VIRT_FLASH].base;
      }
-+    /*
++    /* Compute the fdt load address in dram */
-+     * Init fw_cfg.  Must be done before riscv_load_fdt, otherwise the device
++    fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
-+     * tree cannot be altered and we get FDT_ERR_NOSPACE.
++                                   machine->ram_size, s->fdt);
-+     */
+     /* load the reset vector */
-+    s->fw_cfg = create_fw_cfg(machine);
+     riscv_setup_rom_reset_vec(start_addr, virt_memmap[VIRT_MROM].base,
-+    rom_set_fw(s->fw_cfg);
+-                              virt_memmap[VIRT_MROM].size, s->fdt);
-+
++                              virt_memmap[VIRT_MROM].size,
-     /* Compute the fdt load address in dram */
++                              fdt_load_addr, s->fdt);
-     fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
-                                    machine->ram_size, machine->fdt);
+     /* create PLIC hart topology configuration string */
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
+     plic_hart_config_len = (strlen(VIRT_PLIC_HART_CONFIG) + 1) * smp_cpus;
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      select SIFIVE_PLIC
      select SIFIVE_TEST
      select VIRTIO_MMIO
 +    select FW_CFG_DMA
  config SIFIVE_E
      bool
 --
-.30.1
+.27.0

-[PULL 03/16] target/riscv: propagate PMP permission to TLB page
+[PULL 05/15] riscv: Add opensbi firmware dynamic support
-From: Jim Shu <cwshu@andestech.com>
+From: Atish Patra <atish.patra@wdc.com>
-Currently, PMP permission checking of TLB page is bypassed if TLB hits
+OpenSBI is the default firmware in Qemu and has various firmware loading
-Fix it by propagating PMP permission to TLB page permission.
+options. Currently, qemu loader uses fw_jump which has a compile time
+pre-defined address where fdt & kernel image must reside. This puts a
-PMP permission checking also use MMU-style API to change TLB permission
+constraint on image size of the Linux kernel depending on the fdt location
-and size.
+and available memory. However, fw_dynamic allows the loader to specify
+the next stage location (i.e. Linux kernel/U-Boot) in memory and other
-Signed-off-by: Jim Shu <cwshu@andestech.com>
+configurable boot options available in OpenSBI.
 Add support for OpenSBI dynamic firmware loading support. This doesn't
 break existing setup and fw_jump will continue to work as it is. Any
 other firmware will continue to work without any issues as long as it
 doesn't expect anything specific from loader in "a2" register.
 Signed-off-by: Atish Patra <atish.patra@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 1613916082-19528-2-git-send-email-cwshu@andestech.com
+Reviewed-by: Bin Meng <bin.meng@windriver.com>
 Tested-by: Bin Meng <bin.meng@windriver.com>
 Message-Id: <20200701183949.398134-4-atish.patra@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/pmp.h        |  4 +-
+ include/hw/riscv/boot.h         |  5 ++-
- target/riscv/cpu_helper.c | 84 +++++++++++++++++++++++++++++----------
+ include/hw/riscv/boot_opensbi.h | 58 +++++++++++++++++++++++++++++++++
- target/riscv/pmp.c        | 80 +++++++++++++++++++++++++++----------
+ hw/riscv/boot.c                 | 42 +++++++++++++++++++++---
-files changed, 125 insertions(+), 43 deletions(-)
+ hw/riscv/sifive_u.c             | 20 +++++++++---
+ hw/riscv/spike.c                | 13 ++++++--
-diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
+ hw/riscv/virt.c                 | 12 +++++--
-index XXXXXXX..XXXXXXX 100644
+files changed, 134 insertions(+), 16 deletions(-)
---- a/target/riscv/pmp.h
+ create mode 100644 include/hw/riscv/boot_opensbi.h
-+++ b/target/riscv/pmp.h
-@@ -XXX,XX +XXX,XX @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
+diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
-     target_ulong val);
+index XXXXXXX..XXXXXXX 100644
- target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
+--- a/include/hw/riscv/boot.h
- bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
++++ b/include/hw/riscv/boot.h
--    target_ulong size, pmp_priv_t priv, target_ulong mode);
+@@ -XXX,XX +XXX,XX @@ hwaddr riscv_load_initrd(const char *filename, uint64_t mem_size,
-+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
+                          uint64_t kernel_entry, hwaddr *start);
-+    target_ulong mode);
+ uint32_t riscv_load_fdt(hwaddr dram_start, uint64_t dram_size, void *fdt);
- bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
+ void riscv_setup_rom_reset_vec(hwaddr saddr, hwaddr rom_base,
-                          target_ulong *tlb_size);
+-                               hwaddr rom_size,
- void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
++                               hwaddr rom_size, uint64_t kernel_entry,
- void pmp_update_rule_nums(CPURISCVState *env);
+                                uint32_t fdt_load_addr, void *fdt);
- uint32_t pmp_get_num_rules(CPURISCVState *env);
++void riscv_rom_copy_firmware_info(hwaddr rom_base, hwaddr rom_size,
-+int pmp_priv_to_page_prot(pmp_priv_t pmp_priv);
++                                  uint32_t reset_vec_size,
++                                  uint64_t kernel_entry);
  #endif /* RISCV_BOOT_H */
 diff --git a/include/hw/riscv/boot_opensbi.h b/include/hw/riscv/boot_opensbi.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/riscv/boot_opensbi.h
@@ -XXX,XX +XXX,XX @@
 +/* SPDX-License-Identifier: BSD-2-Clause */
 +/*
 + * Copyright (c) 2019 Western Digital Corporation or its affiliates.
 + *
 + * Based on include/sbi/{fw_dynamic.h,sbi_scratch.h} from the OpenSBI project.
 + */
 +#ifndef OPENSBI_H
 +#define OPENSBI_H
 +
 +/** Expected value of info magic ('OSBI' ascii string in hex) */
 +#define FW_DYNAMIC_INFO_MAGIC_VALUE     0x4942534f
 +
 +/** Maximum supported info version */
 +#define FW_DYNAMIC_INFO_VERSION         0x2
 +
 +/** Possible next mode values */
 +#define FW_DYNAMIC_INFO_NEXT_MODE_U     0x0
 +#define FW_DYNAMIC_INFO_NEXT_MODE_S     0x1
 +#define FW_DYNAMIC_INFO_NEXT_MODE_M     0x3
 +
 +enum sbi_scratch_options {
 +    /** Disable prints during boot */
 +    SBI_SCRATCH_NO_BOOT_PRINTS = (1 << 0),
 +    /** Enable runtime debug prints */
 +    SBI_SCRATCH_DEBUG_PRINTS = (1 << 1),
 +};
 +
 +/** Representation dynamic info passed by previous booting stage */
 +struct fw_dynamic_info {
 +    /** Info magic */
 +    target_long magic;
 +    /** Info version */
 +    target_long version;
 +    /** Next booting stage address */
 +    target_long next_addr;
 +    /** Next booting stage mode */
 +    target_long next_mode;
 +    /** Options for OpenSBI library */
 +    target_long options;
 +    /**
 +     * Preferred boot HART id
 +     *
 +     * It is possible that the previous booting stage uses same link
 +     * address as the FW_DYNAMIC firmware. In this case, the relocation
 +     * lottery mechanism can potentially overwrite the previous booting
 +     * stage while other HARTs are still running in the previous booting
 +     * stage leading to boot-time crash. To avoid this boot-time crash,
 +     * the previous booting stage can specify last HART that will jump
 +     * to the FW_DYNAMIC firmware as the preferred boot HART.
 +     *
 +     * To avoid specifying a preferred boot HART, the previous booting
 +     * stage can set it to -1UL which will force the FW_DYNAMIC firmware
 +     * to use the relocation lottery mechanism.
 +     */
 +    target_long boot_hart;
 +};
 +
 +#endif
 diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/boot.c
 +++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/boards.h"
  #include "hw/loader.h"
  #include "hw/riscv/boot.h"
 +#include "hw/riscv/boot_opensbi.h"
  #include "elf.h"
  #include "sysemu/device_tree.h"
  #include "sysemu/qtest.h"
@@ -XXX,XX +XXX,XX @@
  #if defined(TARGET_RISCV32)
  # define KERNEL_BOOT_ADDRESS 0x80400000
 +#define fw_dynamic_info_data(__val)     cpu_to_le32(__val)
  #else
  # define KERNEL_BOOT_ADDRESS 0x80200000
 +#define fw_dynamic_info_data(__val)     cpu_to_le64(__val)
  #endif
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
+ void riscv_find_and_load_firmware(MachineState *machine,
---- a/target/riscv/cpu_helper.c
+@@ -XXX,XX +XXX,XX @@ uint32_t riscv_load_fdt(hwaddr dram_base, uint64_t mem_size, void *fdt)
-+++ b/target/riscv/cpu_helper.c
+     return fdt_addr;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
      env->load_res = -1;
  }
-+/*
++void riscv_rom_copy_firmware_info(hwaddr rom_base, hwaddr rom_size,
-+ * get_physical_address_pmp - check PMP permission for this physical address
++                              uint32_t reset_vec_size, uint64_t kernel_entry)
 + *
 + * Match the PMP region and check permission for this physical address and it's
 + * TLB page. Returns 0 if the permission checking was successful
 + *
 + * @env: CPURISCVState
 + * @prot: The returned protection attributes
 + * @tlb_size: TLB page size containing addr. It could be modified after PMP
 + *            permission checking. NULL if not set TLB page for addr.
 + * @addr: The physical address to be checked permission
 + * @access_type: The type of MMU access
 + * @mode: Indicates current privilege level.
 + */
 +static int get_physical_address_pmp(CPURISCVState *env, int *prot,
 +                                    target_ulong *tlb_size, hwaddr addr,
 +                                    int size, MMUAccessType access_type,
 +                                    int mode)
 +{
-+    pmp_priv_t pmp_priv;
++    struct fw_dynamic_info dinfo;
-+    target_ulong tlb_size_pmp = 0;
++    size_t dinfo_len;
 +
-+    if (!riscv_feature(env, RISCV_FEATURE_PMP)) {
++    dinfo.magic = fw_dynamic_info_data(FW_DYNAMIC_INFO_MAGIC_VALUE);
-+        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
++    dinfo.version = fw_dynamic_info_data(FW_DYNAMIC_INFO_VERSION);
-+        return TRANSLATE_SUCCESS;
++    dinfo.next_mode = fw_dynamic_info_data(FW_DYNAMIC_INFO_NEXT_MODE_S);
 +    dinfo.next_addr = fw_dynamic_info_data(kernel_entry);
 +    dinfo.options = 0;
 +    dinfo.boot_hart = 0;
 +    dinfo_len = sizeof(dinfo);
 +
 +    /**
 +     * copy the dynamic firmware info. This information is specific to
 +     * OpenSBI but doesn't break any other firmware as long as they don't
 +     * expect any certain value in "a2" register.
 +     */
 +    if (dinfo_len > (rom_size - reset_vec_size)) {
 +        error_report("not enough space to store dynamic firmware info");
 +        exit(1);
 +    }
 +
-+    if (!pmp_hart_has_privs(env, addr, size, 1 << access_type, &pmp_priv,
++    rom_add_blob_fixed_as("mrom.finfo", &dinfo, dinfo_len,
-+                            mode)) {
++                           rom_base + reset_vec_size,
-+        *prot = 0;
++                           &address_space_memory);
 +        return TRANSLATE_PMP_FAIL;
 +    }
 +
 +    *prot = pmp_priv_to_page_prot(pmp_priv);
 +    if (tlb_size != NULL) {
 +        if (pmp_is_range_in_tlb(env, addr & ~(*tlb_size - 1), &tlb_size_pmp)) {
 +            *tlb_size = tlb_size_pmp;
 +        }
 +    }
 +
 +    return TRANSLATE_SUCCESS;
 +}
 +
- /* get_physical_address - get the physical address for this virtual address
+ void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
-  *
+-                               hwaddr rom_size,
-  * Do a page table walk to obtain the physical address corresponding to a
++                               hwaddr rom_size, uint64_t kernel_entry,
-@@ -XXX,XX +XXX,XX @@ restart:
+                                uint32_t fdt_load_addr, void *fdt)
-             pte_addr = base + idx * ptesize;
+ {
      int i;
      /* reset vector */
      uint32_t reset_vec[10] = {
 -        0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(dtb) */
 +        0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(fw_dyn) */
 +        0x02828613,                  /*     addi   a2, t0, %pcrel_lo(1b) */
 xf1402573,                  /*     csrr   a0, mhartid  */
  #if defined(TARGET_RISCV32)
 x0202a583,                  /*     lw     a1, 32(t0) */
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
 x0182b283,                  /*     ld     t0, 24(t0) */
  #endif
 x00028067,                  /*     jr     t0 */
 -        0x00000000,
          start_addr,                  /* start: .dword */
 x00000000,
          fdt_load_addr,               /* fdt_laddr: .dword */
 x00000000,
 -                                     /* dtb: */
 +                                     /* fw_dyn: */
      };
      /* copy in the reset vector in little_endian byte order */
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
      }
      rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
                            rom_base, &address_space_memory);
 +    riscv_rom_copy_firmware_info(rom_base, rom_size, sizeof(reset_vec),
 +                                 kernel_entry);
      return;
  }
 diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_u.c
 +++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
      target_ulong start_addr = memmap[SIFIVE_U_DRAM].base;
      int i;
      uint32_t fdt_load_addr;
 +    uint64_t kernel_entry;
      /* Initialize SoC */
      object_initialize_child(OBJECT(machine), "soc", &s->soc, TYPE_RISCV_U_SOC);
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
      riscv_find_and_load_firmware(machine, BIOS_FILENAME, start_addr, NULL);
      if (machine->kernel_filename) {
 -        uint64_t kernel_entry = riscv_load_kernel(machine->kernel_filename,
 -                                                  NULL);
 +        kernel_entry = riscv_load_kernel(machine->kernel_filename, NULL);
          if (machine->initrd_filename) {
              hwaddr start;
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
              qemu_fdt_setprop_cell(s->fdt, "/chosen", "linux,initrd-end",
                                    end);
          }
++    } else {
--        if (riscv_feature(env, RISCV_FEATURE_PMP) &&
++       /*
--            !pmp_hart_has_privs(env, pte_addr, sizeof(target_ulong),
++        * If dynamic firmware is used, it doesn't know where is the next mode
--            1 << MMU_DATA_LOAD, PRV_S)) {
++        * if kernel argument is not set.
-+        int pmp_prot;
++        */
-+        int pmp_ret = get_physical_address_pmp(env, &pmp_prot, NULL, pte_addr,
++        kernel_entry = 0;
-+                                               sizeof(target_ulong),
+     }
-+                                               MMU_DATA_LOAD, PRV_S);
-+        if (pmp_ret != TRANSLATE_SUCCESS) {
+     /* Compute the fdt load address in dram */
-             return TRANSLATE_PMP_FAIL;
+@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
      /* reset vector */
      uint32_t reset_vec[11] = {
          s->msel,                       /* MSEL pin state */
 -        0x00000297,                    /* 1:  auipc  t0, %pcrel_hi(dtb) */
 +        0x00000297,                    /* 1:  auipc  t0, %pcrel_hi(fw_dyn) */
 +        0x02828613,                    /*     addi   a2, t0, %pcrel_lo(1b) */
 xf1402573,                    /*     csrr   a0, mhartid  */
  #if defined(TARGET_RISCV32)
 x0202a583,                    /*     lw     a1, 32(t0) */
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
 x0182b283,                    /*     ld     t0, 24(t0) */
  #endif
 x00028067,                    /*     jr     t0 */
 -        0x00000000,
          start_addr,                    /* start: .dword */
 x00000000,
          fdt_load_addr,                 /* fdt_laddr: .dword */
 x00000000,
 -                                       /* dtb: */
 +                                       /* fw_dyn: */
      };
      /* copy in the reset vector in little_endian byte order */
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
      }
      rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
                            memmap[SIFIVE_U_MROM].base, &address_space_memory);
 +
 +    riscv_rom_copy_firmware_info(memmap[SIFIVE_U_MROM].base,
 +                                 memmap[SIFIVE_U_MROM].size,
 +                                 sizeof(reset_vec), kernel_entry);
  }
  static bool sifive_u_machine_get_start_in_flash(Object *obj, Error **errp)
 diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/spike.c
 +++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
      unsigned int smp_cpus = machine->smp.cpus;
      uint32_t fdt_load_addr;
 +    uint64_t kernel_entry;
      /* Initialize SOC */
      object_initialize_child(OBJECT(machine), "soc", &s->soc,
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
                                   htif_symbol_callback);
      if (machine->kernel_filename) {
 -        uint64_t kernel_entry = riscv_load_kernel(machine->kernel_filename,
 -                                                  htif_symbol_callback);
 +        kernel_entry = riscv_load_kernel(machine->kernel_filename,
 +                                         htif_symbol_callback);
          if (machine->initrd_filename) {
              hwaddr start;
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
              qemu_fdt_setprop_cell(s->fdt, "/chosen", "linux,initrd-end",
                                    end);
          }
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
- #ifndef CONFIG_USER_ONLY
-     vaddr im_address;
-     hwaddr pa = 0;
--    int prot, prot2;
-+    int prot, prot2, prot_pmp;
-     bool pmp_violation = false;
-     bool first_stage_error = true;
-     bool two_stage_lookup = false;
-     int ret = TRANSLATE_FAIL;
-     int mode = mmu_idx;
--    target_ulong tlb_size = 0;
-+    /* default TLB page size */
-+    target_ulong tlb_size = TARGET_PAGE_SIZE;
-     env->guest_phys_fault_addr = 0;
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-             prot &= prot2;
--            if (riscv_feature(env, RISCV_FEATURE_PMP) &&
--                (ret == TRANSLATE_SUCCESS) &&
--                !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
--                ret = TRANSLATE_PMP_FAIL;
-+            if (ret == TRANSLATE_SUCCESS) {
-+                ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
-+                                               size, access_type, mode);
-+                prot &= prot_pmp;
-             }
-             if (ret != TRANSLATE_SUCCESS) {
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-                       "%s address=%" VADDR_PRIx " ret %d physical "
-                       TARGET_FMT_plx " prot %d\n",
-                       __func__, address, ret, pa, prot);
--    }
--    if (riscv_feature(env, RISCV_FEATURE_PMP) &&
--        (ret == TRANSLATE_SUCCESS) &&
--        !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
--        ret = TRANSLATE_PMP_FAIL;
-+        if (ret == TRANSLATE_SUCCESS) {
-+            ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
-+                                           size, access_type, mode);
-+            prot &= prot_pmp;
-+        }
-     }
-+
-     if (ret == TRANSLATE_PMP_FAIL) {
-         pmp_violation = true;
-     }
-     if (ret == TRANSLATE_SUCCESS) {
--        if (pmp_is_range_in_tlb(env, pa & TARGET_PAGE_MASK, &tlb_size)) {
--            tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
--                         prot, mmu_idx, tlb_size);
--        } else {
--            tlb_set_page(cs, address & TARGET_PAGE_MASK, pa & TARGET_PAGE_MASK,
--                         prot, mmu_idx, TARGET_PAGE_SIZE);
--        }
-+        tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
-+                     prot, mmu_idx, tlb_size);
-         return true;
-     } else if (probe) {
-         return false;
-diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmp.c
-+++ b/target/riscv/pmp.c
-@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
-     return result;
- }
-+/*
-+ * Check if the address has required RWX privs when no PMP entry is matched.
-+ */
-+static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
-+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
-+    target_ulong mode)
-+{
-+    bool ret;
-+
-+    if ((!riscv_feature(env, RISCV_FEATURE_PMP)) || (mode == PRV_M)) {
-+        /*
-+         * Privileged spec v1.10 states if HW doesn't implement any PMP entry
-+         * or no PMP entry matches an M-Mode access, the access succeeds.
-+         */
-+        ret = true;
-+        *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 +    } else {
-+        /*
++       /*
-+         * Other modes are not allowed to succeed if they don't * match a rule,
++        * If dynamic firmware is used, it doesn't know where is the next mode
-+         * but there are rules. We've checked for no rule earlier in this
++        * if kernel argument is not set.
-+         * function.
++        */
-+         */
++        kernel_entry = 0;
-+        ret = false;
+     }
-+        *allowed_privs = 0;
-+    }
+     /* Compute the fdt load address in dram */
-+
+@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
-+    return ret;
+                                    machine->ram_size, s->fdt);
-+}
+     /* load the reset vector */
-+
+     riscv_setup_rom_reset_vec(memmap[SPIKE_DRAM].base, memmap[SPIKE_MROM].base,
+-                              memmap[SPIKE_MROM].size,
- /*
++                              memmap[SPIKE_MROM].size, kernel_entry,
-  * Public Interface
+                               fdt_load_addr, s->fdt);
-@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
-  * Check if the address has required RWX privs to complete desired operation
+     /* initialize HTIF using symbols found in load_kernel */
-  */
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
- bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+index XXXXXXX..XXXXXXX 100644
--    target_ulong size, pmp_priv_t privs, target_ulong mode)
+--- a/hw/riscv/virt.c
-+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
++++ b/hw/riscv/virt.c
-+    target_ulong mode)
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
- {
+     size_t plic_hart_config_len;
-     int i = 0;
+     target_ulong start_addr = memmap[VIRT_DRAM].base;
-     int ret = -1;
+     uint32_t fdt_load_addr;
-     int pmp_size = 0;
++    uint64_t kernel_entry;
-     target_ulong s = 0;
+     int i;
-     target_ulong e = 0;
+     unsigned int smp_cpus = machine->smp.cpus;
--    pmp_priv_t allowed_privs = 0;
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
-     /* Short cut if no rules */
+                                  memmap[VIRT_DRAM].base, NULL);
-     if (0 == pmp_get_num_rules(env)) {
--        return (env->priv == PRV_M) ? true : false;
+     if (machine->kernel_filename) {
-+        return pmp_hart_has_privs_default(env, addr, size, privs,
+-        uint64_t kernel_entry = riscv_load_kernel(machine->kernel_filename,
-+                                          allowed_privs, mode);
+-                                                  NULL);
-     }
++        kernel_entry = riscv_load_kernel(machine->kernel_filename, NULL);
-     if (size == 0) {
+         if (machine->initrd_filename) {
-@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+             hwaddr start;
-          * check
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
-          */
+             qemu_fdt_setprop_cell(s->fdt, "/chosen", "linux,initrd-end",
-         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
+                                   end);
 -            allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 +            *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
              if ((mode != PRV_M) || pmp_is_locked(env, i)) {
 -                allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
 +                *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
              }
 -            if ((privs & allowed_privs) == privs) {
 -                ret = 1;
 -                break;
 -            } else {
 -                ret = 0;
 -                break;
 -            }
 +            ret = ((privs & *allowed_privs) == privs);
 +            break;
          }
-     }
++    } else {
++       /*
-     /* No rule matched */
++        * If dynamic firmware is used, it doesn't know where is the next mode
-     if (ret == -1) {
++        * if kernel argument is not set.
--        if (mode == PRV_M) {
++        */
--            ret = 1; /* Privileged spec v1.10 states if no PMP entry matches an
++        kernel_entry = 0;
--                      * M-Mode access, the access succeeds */
+     }
--        } else {
--            ret = 0; /* Other modes are not allowed to succeed if they don't
+     if (drive_get(IF_PFLASH, 0, 0)) {
--                      * match a rule, but there are rules.  We've checked for
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
--                      * no rule earlier in this function. */
+                                    machine->ram_size, s->fdt);
--        }
+     /* load the reset vector */
-+        return pmp_hart_has_privs_default(env, addr, size, privs,
+     riscv_setup_rom_reset_vec(start_addr, virt_memmap[VIRT_MROM].base,
-+                                          allowed_privs, mode);
+-                              virt_memmap[VIRT_MROM].size,
-     }
++                              virt_memmap[VIRT_MROM].size, kernel_entry,
+                               fdt_load_addr, s->fdt);
-     return ret == 1 ? true : false;
- }
+     /* create PLIC hart topology configuration string */
 -
  /*
   * Handle a write to a pmpcfg CSP
   */
@@ -XXX,XX +XXX,XX @@ bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
      return false;
  }
 +
 +/*
 + * Convert PMP privilege to TLB page privilege.
 + */
 +int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
 +{
 +    int prot = 0;
 +
 +    if (pmp_priv & PMP_READ) {
 +        prot |= PAGE_READ;
 +    }
 +    if (pmp_priv & PMP_WRITE) {
 +        prot |= PAGE_WRITE;
 +    }
 +    if (pmp_priv & PMP_EXEC) {
 +        prot |= PAGE_EXEC;
 +    }
 +
 +    return prot;
 +}
 --
-.30.1
+.27.0

-[PULL 14/16] hw/riscv: microchip_pfsoc: Map EMMC/SD mux register
+[PULL 06/15] RISC-V: Support 64 bit start address
-From: Bin Meng <bin.meng@windriver.com>
+From: Atish Patra <atish.patra@wdc.com>
-Since HSS commit c20a89f8dcac, the Icicle Kit reference design has
+Even though the start address in ROM code is declared as a 64 bit address
-been updated to use a register mapped at 0x4f000000 instead of a
+for RV64, it can't be used as upper bits are set to zero in ROM code.
 GPIO to control whether eMMC or SD card is to be used. With this
 support the same HSS image can be used for both eMMC and SD card
 boot flow, while previously two different board configurations were
 used. This is undocumented but one can take a look at the HSS code
 HSS_MMCInit() in services/mmc/mmc_api.c.
-With this commit, HSS image built from 2020.12 release boots again.
+Update the ROM code correctly to reflect the 64bit value.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Signed-off-by: Atish Patra <atish.patra@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Bin Meng <bin.meng@windriver.com>
-Message-id: 20210322075248.136255-1-bmeng.cn@gmail.com
+Tested-by: Bin Meng <bin.meng@windriver.com>
 Message-Id: <20200701183949.398134-5-atish.patra@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/microchip_pfsoc.h | 1 +
+ hw/riscv/boot.c     | 6 +++++-
- hw/riscv/microchip_pfsoc.c         | 6 ++++++
+ hw/riscv/sifive_u.c | 6 +++++-
-files changed, 7 insertions(+)
+files changed, 10 insertions(+), 2 deletions(-)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
+--- a/hw/riscv/boot.c
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/hw/riscv/boot.c
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
-     MICROCHIP_PFSOC_ENVM_DATA,
+                                uint32_t fdt_load_addr, void *fdt)
-     MICROCHIP_PFSOC_QSPI_XIP,
+ {
-     MICROCHIP_PFSOC_IOSCB,
+     int i;
-+    MICROCHIP_PFSOC_EMMC_SD_MUX,
++    uint32_t start_addr_hi32 = 0x00000000;
-     MICROCHIP_PFSOC_DRAM_LO,
-     MICROCHIP_PFSOC_DRAM_LO_ALIAS,
++    #if defined(TARGET_RISCV64)
-     MICROCHIP_PFSOC_DRAM_HI,
++    start_addr_hi32 = start_addr >> 32;
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
++    #endif
      /* reset vector */
      uint32_t reset_vec[10] = {
 x00000297,                  /* 1:  auipc  t0, %pcrel_hi(fw_dyn) */
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
  #endif
 x00028067,                  /*     jr     t0 */
          start_addr,                  /* start: .dword */
 -        0x00000000,
 +        start_addr_hi32,
          fdt_load_addr,               /* fdt_laddr: .dword */
 x00000000,
                                       /* fw_dyn: */
 diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/microchip_pfsoc.c
+--- a/hw/riscv/sifive_u.c
-+++ b/hw/riscv/microchip_pfsoc.c
++++ b/hw/riscv/sifive_u.c
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
+@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
-     [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
+     MemoryRegion *main_mem = g_new(MemoryRegion, 1);
-     [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,  0x1000000 },
+     MemoryRegion *flash0 = g_new(MemoryRegion, 1);
-     [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000, 0x10000000 },
+     target_ulong start_addr = memmap[SIFIVE_U_DRAM].base;
-+    [MICROCHIP_PFSOC_EMMC_SD_MUX] =     { 0x4f000000,        0x4 },
++    uint32_t start_addr_hi32 = 0x00000000;
-     [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000, 0x40000000 },
+     int i;
-     [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000, 0x40000000 },
+     uint32_t fdt_load_addr;
-     [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,        0x0 },
+     uint64_t kernel_entry;
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
-     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ioscb), 0,
+     /* Compute the fdt load address in dram */
-                     memmap[MICROCHIP_PFSOC_IOSCB].base);
+     fdt_load_addr = riscv_load_fdt(memmap[SIFIVE_U_DRAM].base,
+                                    machine->ram_size, s->fdt);
-+    /* eMMC/SD mux */
++    #if defined(TARGET_RISCV64)
-+    create_unimplemented_device("microchip.pfsoc.emmc_sd_mux",
++    start_addr_hi32 = start_addr >> 32;
-+        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].base,
++    #endif
-+        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].size);
-+
+     /* reset vector */
-     /* QSPI Flash */
+     uint32_t reset_vec[11] = {
-     memory_region_init_rom(qspi_xip_mem, OBJECT(dev),
+@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
-                            "microchip.pfsoc.qspi_xip",
+ #endif
 x00028067,                    /*     jr     t0 */
          start_addr,                    /* start: .dword */
 -        0x00000000,
 +        start_addr_hi32,
          fdt_load_addr,                 /* fdt_laddr: .dword */
 x00000000,
                                         /* fw_dyn: */
 --
-.30.1
+.27.0

-[PULL 13/16] hw/block: m25p80: Support fast read for SST flashes
+[PULL 07/15] hw/riscv: Modify MROM size to end at 0x10000
 From: Bin Meng <bin.meng@windriver.com>
-Per SST25VF016B datasheet [1], SST flash requires a dummy byte after
+At present the size of Mask ROM for sifive_u / spike / virt machines
-the address bytes. Note only SPI mode is supported by SST flashes.
+is set to 0x11000, which ends at an unusual address. This changes the
+size to 0xf000 so that it ends at 0x10000.
 [1] http://ww1.microchip.com/downloads/en/devicedoc/s71271_04.pdf
 Signed-off-by: Bin Meng <bin.meng@windriver.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20210306060152.7250-1-bmeng.cn@gmail.com
+Message-Id: <1594289144-24723-1-git-send-email-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/block/m25p80.c | 3 +++
+ hw/riscv/sifive_u.c | 2 +-
-file changed, 3 insertions(+)
+ hw/riscv/spike.c    | 2 +-
  hw/riscv/virt.c     | 2 +-
 files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
+diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/hw/riscv/sifive_u.c
-+++ b/hw/block/m25p80.c
++++ b/hw/riscv/sifive_u.c
-@@ -XXX,XX +XXX,XX @@ static void decode_fast_read_cmd(Flash *s)
+@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
-     s->needed_bytes = get_addr_length(s);
+     hwaddr size;
-     switch (get_man(s)) {
+ } sifive_u_memmap[] = {
-     /* Dummy cycles - modeled with bytes writes instead of bits */
+     [SIFIVE_U_DEBUG] =    {        0x0,      0x100 },
-+    case MAN_SST:
+-    [SIFIVE_U_MROM] =     {     0x1000,    0x11000 },
-+        s->needed_bytes += 1;
++    [SIFIVE_U_MROM] =     {     0x1000,     0xf000 },
-+        break;
+     [SIFIVE_U_CLINT] =    {  0x2000000,    0x10000 },
-     case MAN_WINBOND:
+     [SIFIVE_U_L2LIM] =    {  0x8000000,  0x2000000 },
-         s->needed_bytes += 8;
+     [SIFIVE_U_PLIC] =     {  0xc000000,  0x4000000 },
-         break;
+diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/spike.c
 +++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
      hwaddr base;
      hwaddr size;
  } spike_memmap[] = {
 -    [SPIKE_MROM] =     {     0x1000,    0x11000 },
 +    [SPIKE_MROM] =     {     0x1000,     0xf000 },
      [SPIKE_CLINT] =    {  0x2000000,    0x10000 },
      [SPIKE_DRAM] =     { 0x80000000,        0x0 },
  };
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
      hwaddr size;
  } virt_memmap[] = {
      [VIRT_DEBUG] =       {        0x0,         0x100 },
 -    [VIRT_MROM] =        {     0x1000,       0x11000 },
 +    [VIRT_MROM] =        {     0x1000,        0xf000 },
      [VIRT_TEST] =        {   0x100000,        0x1000 },
      [VIRT_RTC] =         {   0x101000,        0x1000 },
      [VIRT_CLINT] =       {  0x2000000,       0x10000 },
 --
-.30.1
+.27.0

-[PULL 07/16] target/riscv: Make VSTIP and VSEIP read-only in hip
+[PULL 08/15] target/riscv: fix rsub gvec tcg_assert_listed_vecop assertion
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Frank Chang <frank.chang@sifive.com>
-Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+gvec should provide vecop_list to avoid:
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+"tcg_tcg_assert_listed_vecop: code should not be reached bug" assertion.
-Message-id: 20210311094902.1377593-1-georg.kotheimer@kernkonzept.com
 Signed-off-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-Id: <20200710104920.13550-2-frank.chang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 7 ++++---
+ target/riscv/insn_trans/trans_rvv.inc.c | 5 +++++
-file changed, 4 insertions(+), 3 deletions(-)
+file changed, 5 insertions(+)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+diff --git a/target/riscv/insn_trans/trans_rvv.inc.c b/target/riscv/insn_trans/trans_rvv.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/target/riscv/insn_trans/trans_rvv.inc.c
-+++ b/target/riscv/csr.c
++++ b/target/riscv/insn_trans/trans_rvv.inc.c
-@@ -XXX,XX +XXX,XX @@ static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
+@@ -XXX,XX +XXX,XX @@ static void gen_rsub_vec(unsigned vece, TCGv_vec r, TCGv_vec a, TCGv_vec b)
-     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
+ static void tcg_gen_gvec_rsubs(unsigned vece, uint32_t dofs, uint32_t aofs,
-     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_SD;
+                                TCGv_i64 c, uint32_t oprsz, uint32_t maxsz)
  static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
 -static const target_ulong hip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
 +static const target_ulong hip_writable_mask = MIP_VSSIP;
 +static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
  static const target_ulong vsip_writable_mask = MIP_VSSIP;
  static const char valid_vm_1_10_32[16] = {
@@ -XXX,XX +XXX,XX @@ static int rmw_hvip(CPURISCVState *env, int csrno, target_ulong *ret_value,
                     target_ulong new_value, target_ulong write_mask)
  {
-     int ret = rmw_mip(env, 0, ret_value, new_value,
++    static const TCGOpcode vecop_list[] = { INDEX_op_sub_vec, 0 };
--                      write_mask & hip_writable_mask);
+     static const GVecGen2s rsub_op[4] = {
-+                      write_mask & hvip_writable_mask);
+         { .fni8 = gen_vec_rsub8_i64,
+           .fniv = gen_rsub_vec,
--    *ret_value &= hip_writable_mask;
+           .fno = gen_helper_vec_rsubs8,
-+    *ret_value &= hvip_writable_mask;
++          .opt_opc = vecop_list,
+           .vece = MO_8 },
-     return ret;
+         { .fni8 = gen_vec_rsub16_i64,
- }
+           .fniv = gen_rsub_vec,
            .fno = gen_helper_vec_rsubs16,
 +          .opt_opc = vecop_list,
            .vece = MO_16 },
          { .fni4 = gen_rsub_i32,
            .fniv = gen_rsub_vec,
            .fno = gen_helper_vec_rsubs32,
 +          .opt_opc = vecop_list,
            .vece = MO_32 },
          { .fni8 = gen_rsub_i64,
            .fniv = gen_rsub_vec,
            .fno = gen_helper_vec_rsubs64,
 +          .opt_opc = vecop_list,
            .prefer_i64 = TCG_TARGET_REG_BITS == 64,
            .vece = MO_64 },
      };
 --
-.30.1
+.27.0

-[PULL 08/16] target/riscv: Use background registers also for MSTATUS_MPV
+[PULL 09/15] target/riscv: correct the gvec IR called in gen_vec_rsub16_i64()
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Frank Chang <frank.chang@sifive.com>
-The current condition for the use of background registers only
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-considers the hypervisor load and store instructions,
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-but not accesses from M mode via MSTATUS_MPRV+MPV.
+Message-Id: <20200710104920.13550-3-frank.chang@sifive.com>
 Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20210311103036.1401073-1-georg.kotheimer@kernkonzept.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 2 +-
+ target/riscv/insn_trans/trans_rvv.inc.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/target/riscv/insn_trans/trans_rvv.inc.c b/target/riscv/insn_trans/trans_rvv.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/insn_trans/trans_rvv.inc.c
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/insn_trans/trans_rvv.inc.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
+@@ -XXX,XX +XXX,XX @@ static void gen_vec_rsub8_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
-      * was called. Background registers will be used if the guest has
-      * forced a two stage translation to be on (in HS or M mode).
+ static void gen_vec_rsub16_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b)
-      */
+ {
--    if (!riscv_cpu_virt_enabled(env) && riscv_cpu_two_stage_lookup(mmu_idx)) {
+-    tcg_gen_vec_sub8_i64(d, b, a);
-+    if (!riscv_cpu_virt_enabled(env) && two_stage) {
++    tcg_gen_vec_sub16_i64(d, b, a);
-         use_background = true;
+ }
-     }
+ static void gen_rsub_i32(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 --
-.30.1
+.27.0

-[PULL 01/16] target/riscv: fix vs() to return proper error code
+[PULL 10/15] target/riscv: fix return value of do_opivx_widen()
 From: Frank Chang <frank.chang@sifive.com>
-vs() should return -RISCV_EXCP_ILLEGAL_INST instead of -1 if rvv feature
+do_opivx_widen() should return false if check function returns false.
 is not enabled.
 If -1 is returned, exception will be raised and cs->exception_index will
 be set to the negative return value. The exception will then be treated
 as an instruction access fault instead of illegal instruction fault.
 Signed-off-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20200710104920.13550-4-frank.chang@sifive.com>
 Message-id: 20210223065935.20208-1-frank.chang@sifive.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 2 +-
+ target/riscv/insn_trans/trans_rvv.inc.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+diff --git a/target/riscv/insn_trans/trans_rvv.inc.c b/target/riscv/insn_trans/trans_rvv.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/target/riscv/insn_trans/trans_rvv.inc.c
-+++ b/target/riscv/csr.c
++++ b/target/riscv/insn_trans/trans_rvv.inc.c
-@@ -XXX,XX +XXX,XX @@ static int vs(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static bool do_opivx_widen(DisasContext *s, arg_rmrr *a,
-     if (env->misa & RVV) {
+     if (opivx_widen_check(s, a)) {
-         return 0;
+         return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, fn, s);
      }
--    return -1;
+-    return true;
-+    return -RISCV_EXCP_ILLEGAL_INST;
++    return false;
  }
- static int ctr(CPURISCVState *env, int csrno)
+ #define GEN_OPIVX_WIDEN_TRANS(NAME) \
 --
-.30.1
+.27.0

-[PULL 12/16] target/riscv: Add proper two-stage lookup exception detection
+[PULL 11/15] target/riscv: fix vill bit index in vtype register
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Frank Chang <frank.chang@sifive.com>
-The current two-stage lookup detection in riscv_cpu_do_interrupt falls
+vill bit is at vtype[XLEN-1].
 short of its purpose, as all it checks is whether two-stage address
 translation either via the hypervisor-load store instructions or the
 MPRV feature would be allowed.
-What we really need instead is whether two-stage address translation was
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-active when the exception was raised. However, in riscv_cpu_do_interrupt
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-we do not have the information to reliably detect this. Therefore, when
+Message-Id: <20200710104920.13550-5-frank.chang@sifive.com>
 we raise a memory fault exception we have to record whether two-stage
 address translation is active.
 Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20210319141459.1196741-1-georg.kotheimer@kernkonzept.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        |  4 ++++
+ target/riscv/cpu.h | 2 +-
- target/riscv/cpu.c        |  1 +
+file changed, 1 insertion(+), 1 deletion(-)
  target/riscv/cpu_helper.c | 21 ++++++++-------------
 files changed, 13 insertions(+), 13 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
+@@ -XXX,XX +XXX,XX @@ FIELD(VTYPE, VLMUL, 0, 2)
-     target_ulong satp_hs;
+ FIELD(VTYPE, VSEW, 2, 3)
-     uint64_t mstatus_hs;
+ FIELD(VTYPE, VEDIV, 5, 2)
+ FIELD(VTYPE, RESERVED, 7, sizeof(target_ulong) * 8 - 9)
-+    /* Signals whether the current exception occurred with two-stage address
+-FIELD(VTYPE, VILL, sizeof(target_ulong) * 8 - 2, 1)
-+       translation active. */
++FIELD(VTYPE, VILL, sizeof(target_ulong) * 8 - 1, 1)
-+    bool two_stage_lookup;
-+
+ struct CPURISCVState {
-     target_ulong scounteren;
+     target_ulong gpr[32];
      target_ulong mcounteren;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
      env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
      env->mcause = 0;
      env->pc = env->resetvec;
 +    env->two_stage_lookup = false;
  #endif
      cs->exception_index = EXCP_NONE;
      env->load_res = -1;
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
          g_assert_not_reached();
      }
      env->badaddr = address;
 +    env->two_stage_lookup = two_stage;
  }
  hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
      }
      env->badaddr = addr;
 +    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
 +                            riscv_cpu_two_stage_lookup(mmu_idx);
      riscv_raise_exception(&cpu->env, cs->exception_index, retaddr);
  }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
          g_assert_not_reached();
      }
      env->badaddr = addr;
 +    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
 +                            riscv_cpu_two_stage_lookup(mmu_idx);
      riscv_raise_exception(env, cs->exception_index, retaddr);
  }
  #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
          /* handle the trap in S-mode */
          if (riscv_has_ext(env, RVH)) {
              target_ulong hdeleg = async ? env->hideleg : env->hedeleg;
 -            bool two_stage_lookup = false;
 -            if (env->priv == PRV_M ||
 -                (env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
 -                (env->priv == PRV_U && !riscv_cpu_virt_enabled(env) &&
 -                    get_field(env->hstatus, HSTATUS_HU))) {
 -                    two_stage_lookup = true;
 -            }
 -
 -            if ((riscv_cpu_virt_enabled(env) || two_stage_lookup) && write_tval) {
 +            if (env->two_stage_lookup && write_tval) {
                  /*
                   * If we are writing a guest virtual address to stval, set
                   * this to 1. If we are trapping to VS we will set this to 0
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                  riscv_cpu_set_force_hs_excep(env, 0);
              } else {
                  /* Trap into HS mode */
 -                if (!two_stage_lookup) {
 -                    env->hstatus = set_field(env->hstatus, HSTATUS_SPV,
 -                                             riscv_cpu_virt_enabled(env));
 -                }
 +                env->hstatus = set_field(env->hstatus, HSTATUS_SPV, false);
                  htval = env->guest_phys_fault_addr;
              }
          }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
       * RISC-V ISA Specification.
       */
 +    env->two_stage_lookup = false;
  #endif
      cs->exception_index = EXCP_NONE; /* mark handled to qemu */
  }
 --
-.30.1
+.27.0

-[PULL 11/16] target/riscv: Fix read and write accesses to vsip and vsie
+[PULL 12/15] hw/char: Convert the Ibex UART to use the qdev Clock model
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+Conver the Ibex UART to use the recently added qdev-clock functions.
-The previous implementation was broken in many ways:
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
- - Used mideleg instead of hideleg to mask accesses
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
- - Used MIP_VSSIP instead of VS_MODE_INTERRUPTS to mask writes to vsie
+Message-id: b0136fad870a29049959ec161c1217b967d7e19d.1594332223.git.alistair.francis@wdc.com
- - Did not shift between S bits and VS bits (VSEIP <-> SEIP, ...)
+Message-Id: <b0136fad870a29049959ec161c1217b967d7e19d.1594332223.git.alistair.francis@wdc.com>
 ---
  include/hw/char/ibex_uart.h |  3 +++
  hw/char/ibex_uart.c         | 30 +++++++++++++++++++++++++++---
 files changed, 30 insertions(+), 3 deletions(-)
-Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+diff --git a/include/hw/char/ibex_uart.h b/include/hw/char/ibex_uart.h
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20210311094738.1376795-1-georg.kotheimer@kernkonzept.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/csr.c | 68 +++++++++++++++++++++++-----------------------
 file changed, 34 insertions(+), 34 deletions(-)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/include/hw/char/ibex_uart.h
-+++ b/target/riscv/csr.c
++++ b/include/hw/char/ibex_uart.h
-@@ -XXX,XX +XXX,XX @@ static int write_sstatus(CPURISCVState *env, int csrno, target_ulong val)
+@@ -XXX,XX +XXX,XX @@
-     return write_mstatus(env, CSR_MSTATUS, newval);
+ #define IBEX_UART_TIMEOUT_CTRL 0x2c
  #define IBEX_UART_TX_FIFO_SIZE 16
 +#define IBEX_UART_CLOCK 50000000 /* 50MHz clock */
  #define TYPE_IBEX_UART "ibex-uart"
  #define IBEX_UART(obj) \
@@ -XXX,XX +XXX,XX @@ typedef struct {
      uint32_t uart_val;
      uint32_t uart_timeout_ctrl;
 +    Clock *f_clk;
 +
      CharBackend chr;
      qemu_irq tx_watermark;
      qemu_irq rx_watermark;
 diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/ibex_uart.c
 +++ b/hw/char/ibex_uart.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "hw/char/ibex_uart.h"
  #include "hw/irq.h"
 +#include "hw/qdev-clock.h"
  #include "hw/qdev-properties.h"
  #include "migration/vmstate.h"
  #include "qemu/log.h"
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_reset(DeviceState *dev)
      ibex_uart_update_irqs(s);
  }
-+static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
++static uint64_t ibex_uart_get_baud(IbexUartState *s)
 +{
-+    /* Shift the VS bits to their S bit location in vsie */
++    uint64_t baud;
-+    *val = (env->mie & env->hideleg & VS_MODE_INTERRUPTS) >> 1;
++
-+    return 0;
++    baud = ((s->uart_ctrl & UART_CTRL_NCO) >> 16);
 +    baud *= clock_get_hz(s->f_clk);
 +    baud >>= 20;
 +
 +    return baud;
 +}
 +
- static int read_sie(CPURISCVState *env, int csrno, target_ulong *val)
+ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
                                         unsigned int size)
  {
-     if (riscv_cpu_virt_enabled(env)) {
+@@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr,
--        /* Tell the guest the VS bits, shifted to the S bit locations */
+                           "%s: UART_CTRL_RXBLVL is not supported\n", __func__);
--        *val = (env->mie & env->mideleg & VS_MODE_INTERRUPTS) >> 1;
+         }
-+        read_vsie(env, CSR_VSIE, val);
+         if (value & UART_CTRL_NCO) {
-     } else {
+-            uint64_t baud = ((value & UART_CTRL_NCO) >> 16);
-         *val = env->mie & env->mideleg;
+-            baud *= 1000;
 -            baud >>= 20;
 +            uint64_t baud = ibex_uart_get_baud(s);
              s->char_tx_time = (NANOSECONDS_PER_SECOND / baud) * 10;
          }
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr,
      }
-     return 0;
  }
--static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
++static void ibex_uart_clk_update(void *opaque)
 +static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
  {
 -    target_ulong newval;
 +    /* Shift the S bits to their VS bit location in mie */
 +    target_ulong newval = (env->mie & ~VS_MODE_INTERRUPTS) |
 +                          ((val << 1) & env->hideleg & VS_MODE_INTERRUPTS);
 +    return write_mie(env, CSR_MIE, newval);
 +}
 +static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
 +{
-     if (riscv_cpu_virt_enabled(env)) {
++    IbexUartState *s = opaque;
--        /* Shift the guests S bits to VS */
++
--        newval = (env->mie & ~VS_MODE_INTERRUPTS) |
++    /* recompute uart's speed on clock change */
--                 ((val << 1) & VS_MODE_INTERRUPTS);
++    uint64_t baud = ibex_uart_get_baud(s);
-+        write_vsie(env, CSR_VSIE, val);
++
-     } else {
++    s->char_tx_time = (NANOSECONDS_PER_SECOND / baud) * 10;
 -        newval = (env->mie & ~S_MODE_INTERRUPTS) | (val & S_MODE_INTERRUPTS);
 +        target_ulong newval = (env->mie & ~S_MODE_INTERRUPTS) |
 +                              (val & S_MODE_INTERRUPTS);
 +        write_mie(env, CSR_MIE, newval);
      }
 -    return write_mie(env, CSR_MIE, newval);
 +    return 0;
  }
  static int read_stvec(CPURISCVState *env, int csrno, target_ulong *val)
@@ -XXX,XX +XXX,XX @@ static int write_sbadaddr(CPURISCVState *env, int csrno, target_ulong val)
      return 0;
  }
 +static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
 +                    target_ulong new_value, target_ulong write_mask)
 +{
 +    /* Shift the S bits to their VS bit location in mip */
 +    int ret = rmw_mip(env, 0, ret_value, new_value << 1,
 +                      (write_mask << 1) & vsip_writable_mask & env->hideleg);
 +    *ret_value &= VS_MODE_INTERRUPTS;
 +    /* Shift the VS bits to their S bit location in vsip */
 +    *ret_value >>= 1;
 +    return ret;
 +}
 +
- static int rmw_sip(CPURISCVState *env, int csrno, target_ulong *ret_value,
+ static void fifo_trigger_update(void *opaque)
                     target_ulong new_value, target_ulong write_mask)
  {
-     int ret;
+     IbexUartState *s = opaque;
+@@ -XXX,XX +XXX,XX @@ static void ibex_uart_init(Object *obj)
      if (riscv_cpu_virt_enabled(env)) {
 -        /* Shift the new values to line up with the VS bits */
 -        ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value << 1,
 -                      (write_mask & sip_writable_mask) << 1 & env->mideleg);
 -        ret &= vsip_writable_mask;
 -        ret >>= 1;
 +        ret = rmw_vsip(env, CSR_VSIP, ret_value, new_value, write_mask);
      } else {
          ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value,
                        write_mask & env->mideleg & sip_writable_mask);
@@ -XXX,XX +XXX,XX @@ static int write_vsstatus(CPURISCVState *env, int csrno, target_ulong val)
      return 0;
  }
 -static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
 -                    target_ulong new_value, target_ulong write_mask)
 -{
 -    int ret = rmw_mip(env, 0, ret_value, new_value,
 -                      write_mask & env->mideleg & vsip_writable_mask);
 -    return ret;
 -}
 -
 -static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
 -{
 -    *val = env->mie & env->mideleg & VS_MODE_INTERRUPTS;
 -    return 0;
 -}
 -
 -static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
 -{
 -    target_ulong newval = (env->mie & ~env->mideleg) | (val & env->mideleg & MIP_VSSIP);
 -    return write_mie(env, CSR_MIE, newval);
 -}
 -
  static int read_vstvec(CPURISCVState *env, int csrno, target_ulong *val)
  {
-     *val = env->vstvec;
+     IbexUartState *s = IBEX_UART(obj);
 +    s->f_clk = qdev_init_clock_in(DEVICE(obj), "f_clock",
 +                                  ibex_uart_clk_update, s);
 +    clock_set_hz(s->f_clk, IBEX_UART_CLOCK);
 +
      sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->tx_watermark);
      sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->rx_watermark);
      sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->tx_empty);
 --
-.30.1
+.27.0

-[PULL 02/16] hw/char: disable ibex uart receive if the buffer is full
+[PULL 13/15] hw/char: Convert the Ibex UART to use the registerfields API
-From: Alexander Wagner <alexander.wagner@ulal.de>
-Not disabling the UART leads to QEMU overwriting the UART receive buffer with
-the newest received byte. The rx_level variable is added to allow the use of
-the existing OpenTitan driver libraries.
-Signed-off-by: Alexander Wagner <alexander.wagner@ulal.de>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210309152130.13038-1-alexander.wagner@ulal.de
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 06372c9cdeec715077899e71c858d9f0a2a3395b.1594332223.git.alistair.francis@wdc.com
+Message-Id: <06372c9cdeec715077899e71c858d9f0a2a3395b.1594332223.git.alistair.francis@wdc.com>
 ---
- include/hw/char/ibex_uart.h |  4 ++++
+ include/hw/char/ibex_uart.h |  76 ++++++++++-----------
- hw/char/ibex_uart.c         | 23 ++++++++++++++++++-----
+ hw/char/ibex_uart.c         | 130 ++++++++++++++++++------------------
-files changed, 22 insertions(+), 5 deletions(-)
+files changed, 100 insertions(+), 106 deletions(-)
 diff --git a/include/hw/char/ibex_uart.h b/include/hw/char/ibex_uart.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/char/ibex_uart.h
 +++ b/include/hw/char/ibex_uart.h
-@@ -XXX,XX +XXX,XX @@ REG32(FIFO_CTRL, 0x1c)
+@@ -XXX,XX +XXX,XX @@
-     FIELD(FIFO_CTRL, RXILVL, 2, 3)
+ #define HW_IBEX_UART_H
-     FIELD(FIFO_CTRL, TXILVL, 5, 2)
- REG32(FIFO_STATUS, 0x20)
+ #include "hw/sysbus.h"
-+    FIELD(FIFO_STATUS, TXLVL, 0, 5)
++#include "hw/registerfields.h"
-+    FIELD(FIFO_STATUS, RXLVL, 16, 5)
+ #include "chardev/char-fe.h"
- REG32(OVRD, 0x24)
+ #include "qemu/timer.h"
- REG32(VAL, 0x28)
- REG32(TIMEOUT_CTRL, 0x2c)
+-#define IBEX_UART_INTR_STATE   0x00
-@@ -XXX,XX +XXX,XX @@ struct IbexUartState {
+-    #define INTR_STATE_TX_WATERMARK (1 << 0)
-     uint8_t tx_fifo[IBEX_UART_TX_FIFO_SIZE];
+-    #define INTR_STATE_RX_WATERMARK (1 << 1)
-     uint32_t tx_level;
+-    #define INTR_STATE_TX_EMPTY     (1 << 2)
+-    #define INTR_STATE_RX_OVERFLOW  (1 << 3)
-+    uint32_t rx_level;
+-#define IBEX_UART_INTR_ENABLE  0x04
-+
+-#define IBEX_UART_INTR_TEST    0x08
-     QEMUTimer *fifo_trigger_handle;
+-
-     uint64_t char_tx_time;
+-#define IBEX_UART_CTRL         0x0c
+-    #define UART_CTRL_TX_ENABLE     (1 << 0)
 -    #define UART_CTRL_RX_ENABLE     (1 << 1)
 -    #define UART_CTRL_NF            (1 << 2)
 -    #define UART_CTRL_SLPBK         (1 << 4)
 -    #define UART_CTRL_LLPBK         (1 << 5)
 -    #define UART_CTRL_PARITY_EN     (1 << 6)
 -    #define UART_CTRL_PARITY_ODD    (1 << 7)
 -    #define UART_CTRL_RXBLVL        (3 << 8)
 -    #define UART_CTRL_NCO           (0xFFFF << 16)
 -
 -#define IBEX_UART_STATUS       0x10
 -    #define UART_STATUS_TXFULL  (1 << 0)
 -    #define UART_STATUS_RXFULL  (1 << 1)
 -    #define UART_STATUS_TXEMPTY (1 << 2)
 -    #define UART_STATUS_RXIDLE  (1 << 4)
 -    #define UART_STATUS_RXEMPTY (1 << 5)
 -
 -#define IBEX_UART_RDATA        0x14
 -#define IBEX_UART_WDATA        0x18
 -
 -#define IBEX_UART_FIFO_CTRL    0x1c
 -    #define FIFO_CTRL_RXRST          (1 << 0)
 -    #define FIFO_CTRL_TXRST          (1 << 1)
 -    #define FIFO_CTRL_RXILVL         (7 << 2)
 -    #define FIFO_CTRL_RXILVL_SHIFT   (2)
 -    #define FIFO_CTRL_TXILVL         (3 << 5)
 -    #define FIFO_CTRL_TXILVL_SHIFT   (5)
 -
 -#define IBEX_UART_FIFO_STATUS  0x20
 -#define IBEX_UART_OVRD         0x24
 -#define IBEX_UART_VAL          0x28
 -#define IBEX_UART_TIMEOUT_CTRL 0x2c
 +REG32(INTR_STATE, 0x00)
 +    FIELD(INTR_STATE, TX_WATERMARK, 0, 1)
 +    FIELD(INTR_STATE, RX_WATERMARK, 1, 1)
 +    FIELD(INTR_STATE, TX_EMPTY, 2, 1)
 +    FIELD(INTR_STATE, RX_OVERFLOW, 3, 1)
 +REG32(INTR_ENABLE, 0x04)
 +REG32(INTR_TEST, 0x08)
 +REG32(CTRL, 0x0C)
 +    FIELD(CTRL, TX_ENABLE, 0, 1)
 +    FIELD(CTRL, RX_ENABLE, 1, 1)
 +    FIELD(CTRL, NF, 2, 1)
 +    FIELD(CTRL, SLPBK, 4, 1)
 +    FIELD(CTRL, LLPBK, 5, 1)
 +    FIELD(CTRL, PARITY_EN, 6, 1)
 +    FIELD(CTRL, PARITY_ODD, 7, 1)
 +    FIELD(CTRL, RXBLVL, 8, 2)
 +    FIELD(CTRL, NCO, 16, 16)
 +REG32(STATUS, 0x10)
 +    FIELD(STATUS, TXFULL, 0, 1)
 +    FIELD(STATUS, RXFULL, 1, 1)
 +    FIELD(STATUS, TXEMPTY, 2, 1)
 +    FIELD(STATUS, RXIDLE, 4, 1)
 +    FIELD(STATUS, RXEMPTY, 5, 1)
 +REG32(RDATA, 0x14)
 +REG32(WDATA, 0x18)
 +REG32(FIFO_CTRL, 0x1c)
 +    FIELD(FIFO_CTRL, RXRST, 0, 1)
 +    FIELD(FIFO_CTRL, TXRST, 1, 1)
 +    FIELD(FIFO_CTRL, RXILVL, 2, 3)
 +    FIELD(FIFO_CTRL, TXILVL, 5, 2)
 +REG32(FIFO_STATUS, 0x20)
 +REG32(OVRD, 0x24)
 +REG32(VAL, 0x28)
 +REG32(TIMEOUT_CTRL, 0x2c)
  #define IBEX_UART_TX_FIFO_SIZE 16
  #define IBEX_UART_CLOCK 50000000 /* 50MHz clock */
 diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/ibex_uart.c
 +++ b/hw/char/ibex_uart.c
+@@ -XXX,XX +XXX,XX @@
+ static void ibex_uart_update_irqs(IbexUartState *s)
+ {
+-    if (s->uart_intr_state & s->uart_intr_enable & INTR_STATE_TX_WATERMARK) {
++    if (s->uart_intr_state & s->uart_intr_enable & R_INTR_STATE_TX_WATERMARK_MASK) {
+         qemu_set_irq(s->tx_watermark, 1);
+     } else {
+         qemu_set_irq(s->tx_watermark, 0);
+     }
+-    if (s->uart_intr_state & s->uart_intr_enable & INTR_STATE_RX_WATERMARK) {
++    if (s->uart_intr_state & s->uart_intr_enable & R_INTR_STATE_RX_WATERMARK_MASK) {
+         qemu_set_irq(s->rx_watermark, 1);
+     } else {
+         qemu_set_irq(s->rx_watermark, 0);
+     }
+-    if (s->uart_intr_state & s->uart_intr_enable & INTR_STATE_TX_EMPTY) {
++    if (s->uart_intr_state & s->uart_intr_enable & R_INTR_STATE_TX_EMPTY_MASK) {
+         qemu_set_irq(s->tx_empty, 1);
+     } else {
+         qemu_set_irq(s->tx_empty, 0);
+     }
+-    if (s->uart_intr_state & s->uart_intr_enable & INTR_STATE_RX_OVERFLOW) {
++    if (s->uart_intr_state & s->uart_intr_enable & R_INTR_STATE_RX_OVERFLOW_MASK) {
+         qemu_set_irq(s->rx_overflow, 1);
+     } else {
+         qemu_set_irq(s->rx_overflow, 0);
 @@ -XXX,XX +XXX,XX @@ static int ibex_uart_can_receive(void *opaque)
  {
      IbexUartState *s = opaque;
--    if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
+-    if (s->uart_ctrl & UART_CTRL_RX_ENABLE) {
-+    if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK)
++    if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
 +           && !(s->uart_status & R_STATUS_RXFULL_MASK)) {
          return 1;
      }
-@@ -XXX,XX +XXX,XX @@ static void ibex_uart_receive(void *opaque, const uint8_t *buf, int size)
+@@ -XXX,XX +XXX,XX @@ static int ibex_uart_can_receive(void *opaque)
+ static void ibex_uart_receive(void *opaque, const uint8_t *buf, int size)
-     s->uart_status &= ~R_STATUS_RXIDLE_MASK;
+ {
-     s->uart_status &= ~R_STATUS_RXEMPTY_MASK;
+     IbexUartState *s = opaque;
-+    /* The RXFULL is set after receiving a single byte
+-    uint8_t rx_fifo_level = (s->uart_fifo_ctrl & FIFO_CTRL_RXILVL)
-+     * as the FIFO buffers are not yet implemented.
+-                            >> FIFO_CTRL_RXILVL_SHIFT;
-+     */
++    uint8_t rx_fifo_level = (s->uart_fifo_ctrl & R_FIFO_CTRL_RXILVL_MASK)
-+    s->uart_status |= R_STATUS_RXFULL_MASK;
++                            >> R_FIFO_CTRL_RXILVL_SHIFT;
-+    s->rx_level += 1;
      s->uart_rdata = *buf;
 -    s->uart_status &= ~UART_STATUS_RXIDLE;
 -    s->uart_status &= ~UART_STATUS_RXEMPTY;
 +    s->uart_status &= ~R_STATUS_RXIDLE_MASK;
 +    s->uart_status &= ~R_STATUS_RXEMPTY_MASK;
      if (size > rx_fifo_level) {
-         s->uart_intr_state |= R_INTR_STATE_RX_WATERMARK_MASK;
+-        s->uart_intr_state |= INTR_STATE_RX_WATERMARK;
-@@ -XXX,XX +XXX,XX @@ static void ibex_uart_reset(DeviceState *dev)
++        s->uart_intr_state |= R_INTR_STATE_RX_WATERMARK_MASK;
-     s->uart_timeout_ctrl = 0x00000000;
+     }
-     s->tx_level = 0;
+     ibex_uart_update_irqs(s);
-+    s->rx_level = 0;
+@@ -XXX,XX +XXX,XX @@ static gboolean ibex_uart_xmit(GIOChannel *chan, GIOCondition cond,
+                                void *opaque)
-     s->char_tx_time = (NANOSECONDS_PER_SECOND / 230400) * 10;
+ {
      IbexUartState *s = opaque;
 -    uint8_t tx_fifo_level = (s->uart_fifo_ctrl & FIFO_CTRL_TXILVL)
 -                            >> FIFO_CTRL_TXILVL_SHIFT;
 +    uint8_t tx_fifo_level = (s->uart_fifo_ctrl & R_FIFO_CTRL_TXILVL_MASK)
 +                            >> R_FIFO_CTRL_TXILVL_SHIFT;
      int ret;
      /* instant drain the fifo when there's no back-end */
@@ -XXX,XX +XXX,XX @@ static gboolean ibex_uart_xmit(GIOChannel *chan, GIOCondition cond,
      }
      if (!s->tx_level) {
 -        s->uart_status &= ~UART_STATUS_TXFULL;
 -        s->uart_status |= UART_STATUS_TXEMPTY;
 -        s->uart_intr_state |= INTR_STATE_TX_EMPTY;
 -        s->uart_intr_state &= ~INTR_STATE_TX_WATERMARK;
 +        s->uart_status &= ~R_STATUS_TXFULL_MASK;
 +        s->uart_status |= R_STATUS_TXEMPTY_MASK;
 +        s->uart_intr_state |= R_INTR_STATE_TX_EMPTY_MASK;
 +        s->uart_intr_state &= ~R_INTR_STATE_TX_WATERMARK_MASK;
          ibex_uart_update_irqs(s);
          return FALSE;
      }
@@ -XXX,XX +XXX,XX @@ static gboolean ibex_uart_xmit(GIOChannel *chan, GIOCondition cond,
      /* Clear the TX Full bit */
      if (s->tx_level != IBEX_UART_TX_FIFO_SIZE) {
 -        s->uart_status &= ~UART_STATUS_TXFULL;
 +        s->uart_status &= ~R_STATUS_TXFULL_MASK;
      }
      /* Disable the TX_WATERMARK IRQ */
      if (s->tx_level < tx_fifo_level) {
 -        s->uart_intr_state &= ~INTR_STATE_TX_WATERMARK;
 +        s->uart_intr_state &= ~R_INTR_STATE_TX_WATERMARK_MASK;
      }
      /* Set TX empty */
      if (s->tx_level == 0) {
 -        s->uart_status |= UART_STATUS_TXEMPTY;
 -        s->uart_intr_state |= INTR_STATE_TX_EMPTY;
 +        s->uart_status |= R_STATUS_TXEMPTY_MASK;
 +        s->uart_intr_state |= R_INTR_STATE_TX_EMPTY_MASK;
      }
      ibex_uart_update_irqs(s);
@@ -XXX,XX +XXX,XX @@ static void uart_write_tx_fifo(IbexUartState *s, const uint8_t *buf,
                                 int size)
  {
      uint64_t current_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 -    uint8_t tx_fifo_level = (s->uart_fifo_ctrl & FIFO_CTRL_TXILVL)
 -                            >> FIFO_CTRL_TXILVL_SHIFT;
 +    uint8_t tx_fifo_level = (s->uart_fifo_ctrl & R_FIFO_CTRL_TXILVL_MASK)
 +                            >> R_FIFO_CTRL_TXILVL_SHIFT;
      if (size > IBEX_UART_TX_FIFO_SIZE - s->tx_level) {
          size = IBEX_UART_TX_FIFO_SIZE - s->tx_level;
@@ -XXX,XX +XXX,XX @@ static void uart_write_tx_fifo(IbexUartState *s, const uint8_t *buf,
      s->tx_level += size;
      if (s->tx_level > 0) {
 -        s->uart_status &= ~UART_STATUS_TXEMPTY;
 +        s->uart_status &= ~R_STATUS_TXEMPTY_MASK;
      }
      if (s->tx_level >= tx_fifo_level) {
 -        s->uart_intr_state |= INTR_STATE_TX_WATERMARK;
 +        s->uart_intr_state |= R_INTR_STATE_TX_WATERMARK_MASK;
          ibex_uart_update_irqs(s);
      }
      if (s->tx_level == IBEX_UART_TX_FIFO_SIZE) {
 -        s->uart_status |= UART_STATUS_TXFULL;
 +        s->uart_status |= R_STATUS_TXFULL_MASK;
      }
      timer_mod(s->fifo_trigger_handle, current_time +
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_get_baud(IbexUartState *s)
  {
      uint64_t baud;
 -    baud = ((s->uart_ctrl & UART_CTRL_NCO) >> 16);
 +    baud = ((s->uart_ctrl & R_CTRL_NCO_MASK) >> 16);
      baud *= clock_get_hz(s->f_clk);
      baud >>= 20;
 @@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
+     IbexUartState *s = opaque;
-     case R_RDATA:
+     uint64_t retvalue = 0;
 -    switch (addr) {
 -    case IBEX_UART_INTR_STATE:
 +    switch (addr >> 2) {
 +    case R_INTR_STATE:
          retvalue = s->uart_intr_state;
          break;
 -    case IBEX_UART_INTR_ENABLE:
 +    case R_INTR_ENABLE:
          retvalue = s->uart_intr_enable;
          break;
 -    case IBEX_UART_INTR_TEST:
 +    case R_INTR_TEST:
          qemu_log_mask(LOG_GUEST_ERROR,
                        "%s: wdata is write only\n", __func__);
          break;
 -    case IBEX_UART_CTRL:
 +    case R_CTRL:
          retvalue = s->uart_ctrl;
          break;
 -    case IBEX_UART_STATUS:
 +    case R_STATUS:
          retvalue = s->uart_status;
          break;
 -    case IBEX_UART_RDATA:
 +    case R_RDATA:
          retvalue = s->uart_rdata;
--        if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
+-        if (s->uart_ctrl & UART_CTRL_RX_ENABLE) {
-+        if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) && (s->rx_level > 0)) {
++        if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
              qemu_chr_fe_accept_input(&s->chr);
--            s->uart_status |= R_STATUS_RXIDLE_MASK;
+-            s->uart_status |= UART_STATUS_RXIDLE;
--            s->uart_status |= R_STATUS_RXEMPTY_MASK;
+-            s->uart_status |= UART_STATUS_RXEMPTY;
-+            s->rx_level -= 1;
++            s->uart_status |= R_STATUS_RXIDLE_MASK;
-+            s->uart_status &= ~R_STATUS_RXFULL_MASK;
++            s->uart_status |= R_STATUS_RXEMPTY_MASK;
-+            if (s->rx_level == 0) {
+         }
-+                s->uart_status |= R_STATUS_RXIDLE_MASK;
+         break;
-+                s->uart_status |= R_STATUS_RXEMPTY_MASK;
+-    case IBEX_UART_WDATA:
-+            }
++    case R_WDATA:
-         }
+         qemu_log_mask(LOG_GUEST_ERROR,
-         break;
+                       "%s: wdata is write only\n", __func__);
-     case R_WDATA:
+         break;
 -    case IBEX_UART_FIFO_CTRL:
 +    case R_FIFO_CTRL:
          retvalue = s->uart_fifo_ctrl;
          break;
 -    case IBEX_UART_FIFO_STATUS:
 +    case R_FIFO_STATUS:
          retvalue = s->uart_fifo_status;
          retvalue |= s->tx_level & 0x1F;
 @@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
-     case R_FIFO_STATUS:
+                       "%s: RX fifos are not supported\n", __func__);
-         retvalue = s->uart_fifo_status;
+         break;
--        retvalue |= s->tx_level & 0x1F;
+-    case IBEX_UART_OVRD:
-+        retvalue |= (s->rx_level & 0x1F) << R_FIFO_STATUS_RXLVL_SHIFT;
++    case R_OVRD:
-+        retvalue |= (s->tx_level & 0x1F) << R_FIFO_STATUS_TXLVL_SHIFT;
+         retvalue = s->uart_ovrd;
          qemu_log_mask(LOG_UNIMP,
-                       "%s: RX fifos are not supported\n", __func__);
+                       "%s: ovrd is not supported\n", __func__);
          break;
 -    case IBEX_UART_VAL:
 +    case R_VAL:
          retvalue = s->uart_val;
          qemu_log_mask(LOG_UNIMP,
                        "%s: val is not supported\n", __func__);
          break;
 -    case IBEX_UART_TIMEOUT_CTRL:
 +    case R_TIMEOUT_CTRL:
          retvalue = s->uart_timeout_ctrl;
          qemu_log_mask(LOG_UNIMP,
                        "%s: timeout_ctrl is not supported\n", __func__);
 @@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr,
+     IbexUartState *s = opaque;
+     uint32_t value = val64;
+-    switch (addr) {
+-    case IBEX_UART_INTR_STATE:
++    switch (addr >> 2) {
++    case R_INTR_STATE:
+         /* Write 1 clear */
+         s->uart_intr_state &= ~value;
+         ibex_uart_update_irqs(s);
+         break;
+-    case IBEX_UART_INTR_ENABLE:
++    case R_INTR_ENABLE:
+         s->uart_intr_enable = value;
+         ibex_uart_update_irqs(s);
+         break;
+-    case IBEX_UART_INTR_TEST:
++    case R_INTR_TEST:
+         s->uart_intr_state |= value;
+         ibex_uart_update_irqs(s);
+         break;
+-    case IBEX_UART_CTRL:
++    case R_CTRL:
+         s->uart_ctrl = value;
+-        if (value & UART_CTRL_NF) {
++        if (value & R_CTRL_NF_MASK) {
+             qemu_log_mask(LOG_UNIMP,
+                           "%s: UART_CTRL_NF is not supported\n", __func__);
+         }
+-        if (value & UART_CTRL_SLPBK) {
++        if (value & R_CTRL_SLPBK_MASK) {
+             qemu_log_mask(LOG_UNIMP,
+                           "%s: UART_CTRL_SLPBK is not supported\n", __func__);
+         }
+-        if (value & UART_CTRL_LLPBK) {
++        if (value & R_CTRL_LLPBK_MASK) {
+             qemu_log_mask(LOG_UNIMP,
+                           "%s: UART_CTRL_LLPBK is not supported\n", __func__);
+         }
+-        if (value & UART_CTRL_PARITY_EN) {
++        if (value & R_CTRL_PARITY_EN_MASK) {
+             qemu_log_mask(LOG_UNIMP,
+                           "%s: UART_CTRL_PARITY_EN is not supported\n",
+                           __func__);
+         }
+-        if (value & UART_CTRL_PARITY_ODD) {
++        if (value & R_CTRL_PARITY_ODD_MASK) {
+             qemu_log_mask(LOG_UNIMP,
+                           "%s: UART_CTRL_PARITY_ODD is not supported\n",
+                           __func__);
+         }
+-        if (value & UART_CTRL_RXBLVL) {
++        if (value & R_CTRL_RXBLVL_MASK) {
+             qemu_log_mask(LOG_UNIMP,
+                           "%s: UART_CTRL_RXBLVL is not supported\n", __func__);
+         }
+-        if (value & UART_CTRL_NCO) {
++        if (value & R_CTRL_NCO_MASK) {
+             uint64_t baud = ibex_uart_get_baud(s);
+             s->char_tx_time = (NANOSECONDS_PER_SECOND / baud) * 10;
+         }
+         break;
+-    case IBEX_UART_STATUS:
++    case R_STATUS:
+         qemu_log_mask(LOG_GUEST_ERROR,
+                       "%s: status is read only\n", __func__);
+         break;
+-    case IBEX_UART_RDATA:
++    case R_RDATA:
+         qemu_log_mask(LOG_GUEST_ERROR,
+                       "%s: rdata is read only\n", __func__);
+         break;
+-    case IBEX_UART_WDATA:
++    case R_WDATA:
+         uart_write_tx_fifo(s, (uint8_t *) &value, 1);
+         break;
+-    case IBEX_UART_FIFO_CTRL:
++    case R_FIFO_CTRL:
          s->uart_fifo_ctrl = value;
-         if (value & R_FIFO_CTRL_RXRST_MASK) {
+-        if (value & FIFO_CTRL_RXRST) {
-+            s->rx_level = 0;
++        if (value & R_FIFO_CTRL_RXRST_MASK) {
              qemu_log_mask(LOG_UNIMP,
                            "%s: RX fifos are not supported\n", __func__);
          }
+-        if (value & FIFO_CTRL_TXRST) {
++        if (value & R_FIFO_CTRL_TXRST_MASK) {
+             s->tx_level = 0;
+         }
+         break;
+-    case IBEX_UART_FIFO_STATUS:
++    case R_FIFO_STATUS:
+         qemu_log_mask(LOG_GUEST_ERROR,
+                       "%s: fifo_status is read only\n", __func__);
+         break;
+-    case IBEX_UART_OVRD:
++    case R_OVRD:
+         s->uart_ovrd = value;
+         qemu_log_mask(LOG_UNIMP,
+                       "%s: ovrd is not supported\n", __func__);
+         break;
+-    case IBEX_UART_VAL:
++    case R_VAL:
+         qemu_log_mask(LOG_GUEST_ERROR,
+                       "%s: val is read only\n", __func__);
+         break;
+-    case IBEX_UART_TIMEOUT_CTRL:
++    case R_TIMEOUT_CTRL:
+         s->uart_timeout_ctrl = value;
+         qemu_log_mask(LOG_UNIMP,
+                       "%s: timeout_ctrl is not supported\n", __func__);
+@@ -XXX,XX +XXX,XX @@ static void fifo_trigger_update(void *opaque)
+ {
+     IbexUartState *s = opaque;
+-    if (s->uart_ctrl & UART_CTRL_TX_ENABLE) {
++    if (s->uart_ctrl & R_CTRL_TX_ENABLE_MASK) {
+         ibex_uart_xmit(NULL, G_IO_OUT, s);
+     }
+ }
 --
-.30.1
+.27.0

-[PULL 04/16] target/riscv: add log of PMP permission checking
+[PULL 14/15] tcg/riscv: Remove superfluous breaks
-From: Jim Shu <cwshu@andestech.com>
+From: Liao Pingfang <liao.pingfang@zte.com.cn>
-Like MMU translation, add qemu log of PMP permission checking for
+Remove superfluous breaks, as there is a "return" before them.
 debugging.
-Signed-off-by: Jim Shu <cwshu@andestech.com>
+Signed-off-by: Liao Pingfang <liao.pingfang@zte.com.cn>
 Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 1613916082-19528-3-git-send-email-cwshu@andestech.com
+Message-Id: <1594600421-22942-1-git-send-email-wang.yi59@zte.com.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 12 ++++++++++++
+ tcg/riscv/tcg-target.inc.c | 2 --
-file changed, 12 insertions(+)
+file changed, 2 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/tcg/riscv/tcg-target.inc.c b/tcg/riscv/tcg-target.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/tcg/riscv/tcg-target.inc.c
-+++ b/target/riscv/cpu_helper.c
++++ b/tcg/riscv/tcg-target.inc.c
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
-             if (ret == TRANSLATE_SUCCESS) {
+         break;
-                 ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
+     case R_RISCV_JAL:
-                                                size, access_type, mode);
+         return reloc_jimm20(code_ptr, (tcg_insn_unit *)value);
-+
+-        break;
-+                qemu_log_mask(CPU_LOG_MMU,
+     case R_RISCV_CALL:
-+                              "%s PMP address=" TARGET_FMT_plx " ret %d prot"
+         return reloc_call(code_ptr, (tcg_insn_unit *)value);
-+                              " %d tlb_size " TARGET_FMT_lu "\n",
+-        break;
-+                              __func__, pa, ret, prot_pmp, tlb_size);
+     default:
-+
+         tcg_abort();
                  prot &= prot_pmp;
              }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
          if (ret == TRANSLATE_SUCCESS) {
              ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
                                             size, access_type, mode);
 +
 +            qemu_log_mask(CPU_LOG_MMU,
 +                          "%s PMP address=" TARGET_FMT_plx " ret %d prot"
 +                          " %d tlb_size " TARGET_FMT_lu "\n",
 +                          __func__, pa, ret, prot_pmp, tlb_size);
 +
              prot &= prot_pmp;
          }
      }
 --
-.30.1
+.27.0

-[PULL 05/16] target/riscv: flush TLB pages if PMP permission has been changed
+[PULL 15/15] target/riscv: Fix pmp NA4 implementation
-From: Jim Shu <cwshu@andestech.com>
+From: Alexandre Mergnat <amergnat@baylibre.com>
-If PMP permission of any address has been changed by updating PMP entry,
+The end address calculation for NA4 mode is wrong because the address
-flush all TLB pages to prevent from getting old permission.
+used isn't shifted.
-Signed-off-by: Jim Shu <cwshu@andestech.com>
+It doesn't watch 4 bytes but a huge range because the end address
 calculation is wrong.
 The solution is to use the shifted address calculated for start address
 variable.
 Modifications are tested on Zephyr OS userspace test suite which works
 for other RISC-V boards (E31 and E34 core).
 Signed-off-by: Alexandre Mergnat <amergnat@baylibre.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 1613916082-19528-4-git-send-email-cwshu@andestech.com
+Message-id: 20200706084550.24117-1-amergnat@baylibre.com
 Message-Id: <20200706084550.24117-1-amergnat@baylibre.com>
 [ Changes by AF:
  - Improve the commit title and message
 ]
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/pmp.c | 4 ++++
+ target/riscv/pmp.c | 2 +-
-file changed, 4 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.c
 +++ b/target/riscv/pmp.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
- #include "qapi/error.h"
- #include "cpu.h"
+     case PMP_AMATCH_NA4:
- #include "trace.h"
+         sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
-+#include "exec/exec-all.h"
+-        ea = (this_addr + 4u) - 1u;
++        ea = (sa + 4u) - 1u;
- static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
+         break;
-     uint8_t val);
-@@ -XXX,XX +XXX,XX @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
+     case PMP_AMATCH_NAPOT:
          cfg_val = (val >> 8 * i)  & 0xff;
          pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
      }
 +
 +    /* If PMP permission of any addr has been changed, flush TLB pages. */
 +    tlb_flush(env_cpu(env));
  }
 --
-.30.1
+.27.0

-[PULL 06/16] target/riscv: Adjust privilege level for HLV(X)/HSV instructions
+Deleted patch
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
-According to the specification the "field SPVP of hstatus controls the
-privilege level of the access" for the hypervisor virtual-machine load
-and store instructions HLV, HLVX and HSV.
-Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210311103005.1400718-1-georg.kotheimer@kernkonzept.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu_helper.c | 25 ++++++++++++++-----------
-file changed, 14 insertions(+), 11 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-         use_background = true;
-     }
--    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
-+    /* MPRV does not affect the virtual-machine load/store
-+       instructions, HLV, HLVX, and HSV. */
-+    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
-+        mode = get_field(env->hstatus, HSTATUS_SPVP);
-+    } else if (mode == PRV_M && access_type != MMU_INST_FETCH) {
-         if (get_field(env->mstatus, MSTATUS_MPRV)) {
-             mode = get_field(env->mstatus, MSTATUS_MPP);
-         }
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-     qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n",
-                   __func__, address, access_type, mmu_idx);
--    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
--        if (get_field(env->mstatus, MSTATUS_MPRV)) {
--            mode = get_field(env->mstatus, MSTATUS_MPP);
-+    /* MPRV does not affect the virtual-machine load/store
-+       instructions, HLV, HLVX, and HSV. */
-+    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
-+        mode = get_field(env->hstatus, HSTATUS_SPVP);
-+    } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
-+               get_field(env->mstatus, MSTATUS_MPRV)) {
-+        mode = get_field(env->mstatus, MSTATUS_MPP);
-+        if (riscv_has_ext(env, RVH) && get_field(env->mstatus, MSTATUS_MPV)) {
-+            two_stage_lookup = true;
-         }
-     }
--    if (riscv_has_ext(env, RVH) && env->priv == PRV_M &&
--        access_type != MMU_INST_FETCH &&
--        get_field(env->mstatus, MSTATUS_MPRV) &&
--        get_field(env->mstatus, MSTATUS_MPV)) {
--        two_stage_lookup = true;
--    }
--
-     if (riscv_cpu_virt_enabled(env) ||
-         ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
-          access_type != MMU_INST_FETCH)) {
---
-.30.1

The following changes since commit c95bd5ff1660883d15ad6e0005e4c8571604f51a:

Merge remote-tracking branch 'remotes/philmd/tags/mips-fixes-20210322' into staging (2021-03-22 14:26:13 +0000)

are available in the Git repository at:

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210322-2

for you to fetch changes up to 9a27f69bd668d9d71674407badc412ce1231c7d5:

target/riscv: Prevent lost illegal instruction exceptions (2021-03-22 21:54:40 -0400)

----------------------------------------------------------------
RISC-V PR for 6.0

This PR includes:
 - Fix for vector CSR access
 - Improvements to the Ibex UART device
 - PMP improvements and bug fixes
 - Hypervisor extension bug fixes
 - ramfb support for the virt machine
 - Fast read support for SST flash
 - Improvements to the microchip_pfsoc machine

----------------------------------------------------------------
Alexander Wagner (1):
      hw/char: disable ibex uart receive if the buffer is full

Asherah Connor (2):
      hw/riscv: Add fw_cfg support to virt
      hw/riscv: allow ramfb on virt

Bin Meng (3):
      hw/block: m25p80: Support fast read for SST flashes
      hw/riscv: microchip_pfsoc: Map EMMC/SD mux register
      docs/system: riscv: Add documentation for 'microchip-icicle-kit' machine

Frank Chang (1):
      target/riscv: fix vs() to return proper error code

Georg Kotheimer (6):
      target/riscv: Adjust privilege level for HLV(X)/HSV instructions
      target/riscv: Make VSTIP and VSEIP read-only in hip
      target/riscv: Use background registers also for MSTATUS_MPV
      target/riscv: Fix read and write accesses to vsip and vsie
      target/riscv: Add proper two-stage lookup exception detection
      target/riscv: Prevent lost illegal instruction exceptions

Jim Shu (3):
      target/riscv: propagate PMP permission to TLB page
      target/riscv: add log of PMP permission checking
      target/riscv: flush TLB pages if PMP permission has been changed

From: Frank Chang <frank.chang@sifive.com>

vs() should return -RISCV_EXCP_ILLEGAL_INST instead of -1 if rvv feature
is not enabled.

If -1 is returned, exception will be raised and cs->exception_index will
be set to the negative return value. The exception will then be treated
as an instruction access fault instead of illegal instruction fault.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210223065935.20208-1-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int vs(CPURISCVState *env, int csrno)
     if (env->misa & RVV) {
         return 0;
     }
-    return -1;
+    return -RISCV_EXCP_ILLEGAL_INST;
 }
 
 static int ctr(CPURISCVState *env, int csrno)
-- 
2.30.1

From: Alexander Wagner <alexander.wagner@ulal.de>

Not disabling the UART leads to QEMU overwriting the UART receive buffer with
the newest received byte. The rx_level variable is added to allow the use of
the existing OpenTitan driver libraries.

Signed-off-by: Alexander Wagner <alexander.wagner@ulal.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210309152130.13038-1-alexander.wagner@ulal.de
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/char/ibex_uart.h |  4 ++++
 hw/char/ibex_uart.c         | 23 ++++++++++++++++++-----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/include/hw/char/ibex_uart.h b/include/hw/char/ibex_uart.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/ibex_uart.h
+++ b/include/hw/char/ibex_uart.h
@@ -XXX,XX +XXX,XX @@ REG32(FIFO_CTRL, 0x1c)
     FIELD(FIFO_CTRL, RXILVL, 2, 3)
     FIELD(FIFO_CTRL, TXILVL, 5, 2)
 REG32(FIFO_STATUS, 0x20)
+    FIELD(FIFO_STATUS, TXLVL, 0, 5)
+    FIELD(FIFO_STATUS, RXLVL, 16, 5)
 REG32(OVRD, 0x24)
 REG32(VAL, 0x28)
 REG32(TIMEOUT_CTRL, 0x2c)
@@ -XXX,XX +XXX,XX @@ struct IbexUartState {
     uint8_t tx_fifo[IBEX_UART_TX_FIFO_SIZE];
     uint32_t tx_level;
 
+    uint32_t rx_level;
+
     QEMUTimer *fifo_trigger_handle;
     uint64_t char_tx_time;
 
diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/ibex_uart.c
+++ b/hw/char/ibex_uart.c
@@ -XXX,XX +XXX,XX @@ static int ibex_uart_can_receive(void *opaque)
 {
     IbexUartState *s = opaque;
 
-    if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
+    if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK)
+           && !(s->uart_status & R_STATUS_RXFULL_MASK)) {
         return 1;
     }
 
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_receive(void *opaque, const uint8_t *buf, int size)
 
     s->uart_status &= ~R_STATUS_RXIDLE_MASK;
     s->uart_status &= ~R_STATUS_RXEMPTY_MASK;
+    /* The RXFULL is set after receiving a single byte
+     * as the FIFO buffers are not yet implemented.
+     */
+    s->uart_status |= R_STATUS_RXFULL_MASK;
+    s->rx_level += 1;
 
     if (size > rx_fifo_level) {
         s->uart_intr_state |= R_INTR_STATE_RX_WATERMARK_MASK;
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_reset(DeviceState *dev)
     s->uart_timeout_ctrl = 0x00000000;
 
     s->tx_level = 0;
+    s->rx_level = 0;
 
     s->char_tx_time = (NANOSECONDS_PER_SECOND / 230400) * 10;
 
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
 
     case R_RDATA:
         retvalue = s->uart_rdata;
-        if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
+        if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) && (s->rx_level > 0)) {
             qemu_chr_fe_accept_input(&s->chr);
 
-            s->uart_status |= R_STATUS_RXIDLE_MASK;
-            s->uart_status |= R_STATUS_RXEMPTY_MASK;
+            s->rx_level -= 1;
+            s->uart_status &= ~R_STATUS_RXFULL_MASK;
+            if (s->rx_level == 0) {
+                s->uart_status |= R_STATUS_RXIDLE_MASK;
+                s->uart_status |= R_STATUS_RXEMPTY_MASK;
+            }
         }
         break;
     case R_WDATA:
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
     case R_FIFO_STATUS:
         retvalue = s->uart_fifo_status;
 
-        retvalue |= s->tx_level & 0x1F;
+        retvalue |= (s->rx_level & 0x1F) << R_FIFO_STATUS_RXLVL_SHIFT;
+        retvalue |= (s->tx_level & 0x1F) << R_FIFO_STATUS_TXLVL_SHIFT;
 
         qemu_log_mask(LOG_UNIMP,
                       "%s: RX fifos are not supported\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr,
         s->uart_fifo_ctrl = value;
 
         if (value & R_FIFO_CTRL_RXRST_MASK) {
+            s->rx_level = 0;
             qemu_log_mask(LOG_UNIMP,
                           "%s: RX fifos are not supported\n", __func__);
         }
-- 
2.30.1

From: Jim Shu <cwshu@andestech.com>

Currently, PMP permission checking of TLB page is bypassed if TLB hits
Fix it by propagating PMP permission to TLB page permission.

PMP permission checking also use MMU-style API to change TLB permission
and size.

Signed-off-by: Jim Shu <cwshu@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1613916082-19528-2-git-send-email-cwshu@andestech.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.h        |  4 +-
 target/riscv/cpu_helper.c | 84 +++++++++++++++++++++++++++++----------
 target/riscv/pmp.c        | 80 +++++++++++++++++++++++++++----------
 3 files changed, 125 insertions(+), 43 deletions(-)

diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -XXX,XX +XXX,XX @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
     target_ulong val);
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-    target_ulong size, pmp_priv_t priv, target_ulong mode);
+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
+    target_ulong mode);
 bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
                          target_ulong *tlb_size);
 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
 void pmp_update_rule_nums(CPURISCVState *env);
 uint32_t pmp_get_num_rules(CPURISCVState *env);
+int pmp_priv_to_page_prot(pmp_priv_t pmp_priv);
 
 #endif
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
     env->load_res = -1;
 }
 
+/*
+ * get_physical_address_pmp - check PMP permission for this physical address
+ *
+ * Match the PMP region and check permission for this physical address and it's
+ * TLB page. Returns 0 if the permission checking was successful
+ *
+ * @env: CPURISCVState
+ * @prot: The returned protection attributes
+ * @tlb_size: TLB page size containing addr. It could be modified after PMP
+ *            permission checking. NULL if not set TLB page for addr.
+ * @addr: The physical address to be checked permission
+ * @access_type: The type of MMU access
+ * @mode: Indicates current privilege level.
+ */
+static int get_physical_address_pmp(CPURISCVState *env, int *prot,
+                                    target_ulong *tlb_size, hwaddr addr,
+                                    int size, MMUAccessType access_type,
+                                    int mode)
+{
+    pmp_priv_t pmp_priv;
+    target_ulong tlb_size_pmp = 0;
+
+    if (!riscv_feature(env, RISCV_FEATURE_PMP)) {
+        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+        return TRANSLATE_SUCCESS;
+    }
+
+    if (!pmp_hart_has_privs(env, addr, size, 1 << access_type, &pmp_priv,
+                            mode)) {
+        *prot = 0;
+        return TRANSLATE_PMP_FAIL;
+    }
+
+    *prot = pmp_priv_to_page_prot(pmp_priv);
+    if (tlb_size != NULL) {
+        if (pmp_is_range_in_tlb(env, addr & ~(*tlb_size - 1), &tlb_size_pmp)) {
+            *tlb_size = tlb_size_pmp;
+        }
+    }
+
+    return TRANSLATE_SUCCESS;
+}
+
 /* get_physical_address - get the physical address for this virtual address
  *
  * Do a page table walk to obtain the physical address corresponding to a
@@ -XXX,XX +XXX,XX @@ restart:
             pte_addr = base + idx * ptesize;
         }
 
-        if (riscv_feature(env, RISCV_FEATURE_PMP) &&
-            !pmp_hart_has_privs(env, pte_addr, sizeof(target_ulong),
-            1 << MMU_DATA_LOAD, PRV_S)) {
+        int pmp_prot;
+        int pmp_ret = get_physical_address_pmp(env, &pmp_prot, NULL, pte_addr,
+                                               sizeof(target_ulong),
+                                               MMU_DATA_LOAD, PRV_S);
+        if (pmp_ret != TRANSLATE_SUCCESS) {
             return TRANSLATE_PMP_FAIL;
         }
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 #ifndef CONFIG_USER_ONLY
     vaddr im_address;
     hwaddr pa = 0;
-    int prot, prot2;
+    int prot, prot2, prot_pmp;
     bool pmp_violation = false;
     bool first_stage_error = true;
     bool two_stage_lookup = false;
     int ret = TRANSLATE_FAIL;
     int mode = mmu_idx;
-    target_ulong tlb_size = 0;
+    /* default TLB page size */
+    target_ulong tlb_size = TARGET_PAGE_SIZE;
 
     env->guest_phys_fault_addr = 0;
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 
             prot &= prot2;
 
-            if (riscv_feature(env, RISCV_FEATURE_PMP) &&
-                (ret == TRANSLATE_SUCCESS) &&
-                !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
-                ret = TRANSLATE_PMP_FAIL;
+            if (ret == TRANSLATE_SUCCESS) {
+                ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
+                                               size, access_type, mode);
+                prot &= prot_pmp;
             }
 
             if (ret != TRANSLATE_SUCCESS) {
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                       "%s address=%" VADDR_PRIx " ret %d physical "
                       TARGET_FMT_plx " prot %d\n",
                       __func__, address, ret, pa, prot);
-    }
 
-    if (riscv_feature(env, RISCV_FEATURE_PMP) &&
-        (ret == TRANSLATE_SUCCESS) &&
-        !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
-        ret = TRANSLATE_PMP_FAIL;
+        if (ret == TRANSLATE_SUCCESS) {
+            ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
+                                           size, access_type, mode);
+            prot &= prot_pmp;
+        }
     }
+
     if (ret == TRANSLATE_PMP_FAIL) {
         pmp_violation = true;
     }
 
     if (ret == TRANSLATE_SUCCESS) {
-        if (pmp_is_range_in_tlb(env, pa & TARGET_PAGE_MASK, &tlb_size)) {
-            tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
-                         prot, mmu_idx, tlb_size);
-        } else {
-            tlb_set_page(cs, address & TARGET_PAGE_MASK, pa & TARGET_PAGE_MASK,
-                         prot, mmu_idx, TARGET_PAGE_SIZE);
-        }
+        tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
+                     prot, mmu_idx, tlb_size);
         return true;
     } else if (probe) {
         return false;
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
     return result;
 }
 
+/*
+ * Check if the address has required RWX privs when no PMP entry is matched.
+ */
+static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
+    target_ulong mode)
+{
+    bool ret;
+
+    if ((!riscv_feature(env, RISCV_FEATURE_PMP)) || (mode == PRV_M)) {
+        /*
+         * Privileged spec v1.10 states if HW doesn't implement any PMP entry
+         * or no PMP entry matches an M-Mode access, the access succeeds.
+         */
+        ret = true;
+        *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
+    } else {
+        /*
+         * Other modes are not allowed to succeed if they don't * match a rule,
+         * but there are rules. We've checked for no rule earlier in this
+         * function.
+         */
+        ret = false;
+        *allowed_privs = 0;
+    }
+
+    return ret;
+}
+
 
 /*
  * Public Interface
@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
  * Check if the address has required RWX privs to complete desired operation
  */
 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-    target_ulong size, pmp_priv_t privs, target_ulong mode)
+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
+    target_ulong mode)
 {
     int i = 0;
     int ret = -1;
     int pmp_size = 0;
     target_ulong s = 0;
     target_ulong e = 0;
-    pmp_priv_t allowed_privs = 0;
 
     /* Short cut if no rules */
     if (0 == pmp_get_num_rules(env)) {
-        return (env->priv == PRV_M) ? true : false;
+        return pmp_hart_has_privs_default(env, addr, size, privs,
+                                          allowed_privs, mode);
     }
 
     if (size == 0) {
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
          * check
          */
         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
-            allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
+            *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
             if ((mode != PRV_M) || pmp_is_locked(env, i)) {
-                allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
+                *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
             }
 
-            if ((privs & allowed_privs) == privs) {
-                ret = 1;
-                break;
-            } else {
-                ret = 0;
-                break;
-            }
+            ret = ((privs & *allowed_privs) == privs);
+            break;
         }
     }
 
     /* No rule matched */
     if (ret == -1) {
-        if (mode == PRV_M) {
-            ret = 1; /* Privileged spec v1.10 states if no PMP entry matches an
-                      * M-Mode access, the access succeeds */
-        } else {
-            ret = 0; /* Other modes are not allowed to succeed if they don't
-                      * match a rule, but there are rules.  We've checked for
-                      * no rule earlier in this function. */
-        }
+        return pmp_hart_has_privs_default(env, addr, size, privs,
+                                          allowed_privs, mode);
     }
 
     return ret == 1 ? true : false;
 }
 
-
 /*
  * Handle a write to a pmpcfg CSP
  */
@@ -XXX,XX +XXX,XX @@ bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
 
     return false;
 }
+
+/*
+ * Convert PMP privilege to TLB page privilege.
+ */
+int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
+{
+    int prot = 0;
+
+    if (pmp_priv & PMP_READ) {
+        prot |= PAGE_READ;
+    }
+    if (pmp_priv & PMP_WRITE) {
+        prot |= PAGE_WRITE;
+    }
+    if (pmp_priv & PMP_EXEC) {
+        prot |= PAGE_EXEC;
+    }
+
+    return prot;
+}
-- 
2.30.1

From: Jim Shu <cwshu@andestech.com>

Like MMU translation, add qemu log of PMP permission checking for
debugging.

Signed-off-by: Jim Shu <cwshu@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1613916082-19528-3-git-send-email-cwshu@andestech.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
             if (ret == TRANSLATE_SUCCESS) {
                 ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
                                                size, access_type, mode);
+
+                qemu_log_mask(CPU_LOG_MMU,
+                              "%s PMP address=" TARGET_FMT_plx " ret %d prot"
+                              " %d tlb_size " TARGET_FMT_lu "\n",
+                              __func__, pa, ret, prot_pmp, tlb_size);
+
                 prot &= prot_pmp;
             }
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         if (ret == TRANSLATE_SUCCESS) {
             ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
                                            size, access_type, mode);
+
+            qemu_log_mask(CPU_LOG_MMU,
+                          "%s PMP address=" TARGET_FMT_plx " ret %d prot"
+                          " %d tlb_size " TARGET_FMT_lu "\n",
+                          __func__, pa, ret, prot_pmp, tlb_size);
+
             prot &= prot_pmp;
         }
     }
-- 
2.30.1

From: Jim Shu <cwshu@andestech.com>

If PMP permission of any address has been changed by updating PMP entry,
flush all TLB pages to prevent from getting old permission.

Signed-off-by: Jim Shu <cwshu@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1613916082-19528-4-git-send-email-cwshu@andestech.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "cpu.h"
 #include "trace.h"
+#include "exec/exec-all.h"
 
 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
     uint8_t val);
@@ -XXX,XX +XXX,XX @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
         cfg_val = (val >> 8 * i)  & 0xff;
         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
     }
+
+    /* If PMP permission of any addr has been changed, flush TLB pages. */
+    tlb_flush(env_cpu(env));
 }
 
 
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

According to the specification the "field SPVP of hstatus controls the
privilege level of the access" for the hypervisor virtual-machine load
and store instructions HLV, HLVX and HSV.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311103005.1400718-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         use_background = true;
     }
 
-    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
+    /* MPRV does not affect the virtual-machine load/store
+       instructions, HLV, HLVX, and HSV. */
+    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
+        mode = get_field(env->hstatus, HSTATUS_SPVP);
+    } else if (mode == PRV_M && access_type != MMU_INST_FETCH) {
         if (get_field(env->mstatus, MSTATUS_MPRV)) {
             mode = get_field(env->mstatus, MSTATUS_MPP);
         }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n",
                   __func__, address, access_type, mmu_idx);
 
-    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
-        if (get_field(env->mstatus, MSTATUS_MPRV)) {
-            mode = get_field(env->mstatus, MSTATUS_MPP);
+    /* MPRV does not affect the virtual-machine load/store
+       instructions, HLV, HLVX, and HSV. */
+    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
+        mode = get_field(env->hstatus, HSTATUS_SPVP);
+    } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
+               get_field(env->mstatus, MSTATUS_MPRV)) {
+        mode = get_field(env->mstatus, MSTATUS_MPP);
+        if (riscv_has_ext(env, RVH) && get_field(env->mstatus, MSTATUS_MPV)) {
+            two_stage_lookup = true;
         }
     }
 
-    if (riscv_has_ext(env, RVH) && env->priv == PRV_M &&
-        access_type != MMU_INST_FETCH &&
-        get_field(env->mstatus, MSTATUS_MPRV) &&
-        get_field(env->mstatus, MSTATUS_MPV)) {
-        two_stage_lookup = true;
-    }
-
     if (riscv_cpu_virt_enabled(env) ||
         ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
          access_type != MMU_INST_FETCH)) {
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311094902.1377593-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_SD;
 static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
-static const target_ulong hip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
+static const target_ulong hip_writable_mask = MIP_VSSIP;
+static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
 static const target_ulong vsip_writable_mask = MIP_VSSIP;
 
 static const char valid_vm_1_10_32[16] = {
@@ -XXX,XX +XXX,XX @@ static int rmw_hvip(CPURISCVState *env, int csrno, target_ulong *ret_value,
                    target_ulong new_value, target_ulong write_mask)
 {
     int ret = rmw_mip(env, 0, ret_value, new_value,
-                      write_mask & hip_writable_mask);
+                      write_mask & hvip_writable_mask);
 
-    *ret_value &= hip_writable_mask;
+    *ret_value &= hvip_writable_mask;
 
     return ret;
 }
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

The current condition for the use of background registers only
considers the hypervisor load and store instructions,
but not accesses from M mode via MSTATUS_MPRV+MPV.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311103036.1401073-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: Asherah Connor <ashe@kivikakk.ee>

Provides fw_cfg for the virt machine on riscv.  This enables
using e.g.  ramfb later.

Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210318235041.17175-2-ashe@kivikakk.ee
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h |  2 ++
 hw/riscv/virt.c         | 30 ++++++++++++++++++++++++++++++
 hw/riscv/Kconfig        |  1 +
 3 files changed, 33 insertions(+)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
     RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
     DeviceState *plic[VIRT_SOCKETS_MAX];
     PFlashCFI01 *flash[2];
+    FWCfgState *fw_cfg;
 
     int fdt_size;
 };
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_PLIC,
     VIRT_UART0,
     VIRT_VIRTIO,
+    VIRT_FW_CFG,
     VIRT_FLASH,
     VIRT_DRAM,
     VIRT_PCIE_MMIO,
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
     [VIRT_PLIC] =        {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
     [VIRT_UART0] =       { 0x10000000,         0x100 },
     [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
+    [VIRT_FW_CFG] =      { 0x10100000,          0x18 },
     [VIRT_FLASH] =       { 0x20000000,     0x4000000 },
     [VIRT_PCIE_ECAM] =   { 0x30000000,    0x10000000 },
     [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
     return dev;
 }
 
+static FWCfgState *create_fw_cfg(const MachineState *mc)
+{
+    hwaddr base = virt_memmap[VIRT_FW_CFG].base;
+    hwaddr size = virt_memmap[VIRT_FW_CFG].size;
+    FWCfgState *fw_cfg;
+    char *nodename;
+
+    fw_cfg = fw_cfg_init_mem_wide(base + 8, base, 8, base + 16,
+                                  &address_space_memory);
+    fw_cfg_add_i16(fw_cfg, FW_CFG_NB_CPUS, (uint16_t)mc->smp.cpus);
+
+    nodename = g_strdup_printf("/fw-cfg@%" PRIx64, base);
+    qemu_fdt_add_subnode(mc->fdt, nodename);
+    qemu_fdt_setprop_string(mc->fdt, nodename,
+                            "compatible", "qemu,fw-cfg-mmio");
+    qemu_fdt_setprop_sized_cells(mc->fdt, nodename, "reg",
+                                 2, base, 2, size);
+    qemu_fdt_setprop(mc->fdt, nodename, "dma-coherent", NULL, 0);
+    g_free(nodename);
+    return fw_cfg;
+}
+
 static void virt_machine_init(MachineState *machine)
 {
     const MemMapEntry *memmap = virt_memmap;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         start_addr = virt_memmap[VIRT_FLASH].base;
     }
 
+    /*
+     * Init fw_cfg.  Must be done before riscv_load_fdt, otherwise the device
+     * tree cannot be altered and we get FDT_ERR_NOSPACE.
+     */
+    s->fw_cfg = create_fw_cfg(machine);
+    rom_set_fw(s->fw_cfg);
+
     /* Compute the fdt load address in dram */
     fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
                                    machine->ram_size, machine->fdt);
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select SIFIVE_PLIC
     select SIFIVE_TEST
     select VIRTIO_MMIO
+    select FW_CFG_DMA
 
 config SIFIVE_E
     bool
-- 
2.30.1

From: Asherah Connor <ashe@kivikakk.ee>

Allow ramfb on virt.  This lets `-device ramfb' work.

Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210318235041.17175-3-ashe@kivikakk.ee
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/pci/pci.h"
 #include "hw/pci-host/gpex.h"
+#include "hw/display/ramfb.h"
 
 static const MemMapEntry virt_memmap[] = {
     [VIRT_DEBUG] =       {        0x0,         0x100 },
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     mc->cpu_index_to_instance_props = riscv_numa_cpu_index_to_props;
     mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
     mc->numa_mem_supported = true;
+
+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
 }
 
 static const TypeInfo virt_machine_typeinfo = {
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

The previous implementation was broken in many ways:
 - Used mideleg instead of hideleg to mask accesses
 - Used MIP_VSSIP instead of VS_MODE_INTERRUPTS to mask writes to vsie
 - Did not shift between S bits and VS bits (VSEIP <-> SEIP, ...)

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311094738.1376795-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 68 +++++++++++++++++++++++-----------------------
 1 file changed, 34 insertions(+), 34 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int write_sstatus(CPURISCVState *env, int csrno, target_ulong val)
     return write_mstatus(env, CSR_MSTATUS, newval);
 }
 
+static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
+{
+    /* Shift the VS bits to their S bit location in vsie */
+    *val = (env->mie & env->hideleg & VS_MODE_INTERRUPTS) >> 1;
+    return 0;
+}
+
 static int read_sie(CPURISCVState *env, int csrno, target_ulong *val)
 {
     if (riscv_cpu_virt_enabled(env)) {
-        /* Tell the guest the VS bits, shifted to the S bit locations */
-        *val = (env->mie & env->mideleg & VS_MODE_INTERRUPTS) >> 1;
+        read_vsie(env, CSR_VSIE, val);
     } else {
         *val = env->mie & env->mideleg;
     }
     return 0;
 }
 
-static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
+static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
 {
-    target_ulong newval;
+    /* Shift the S bits to their VS bit location in mie */
+    target_ulong newval = (env->mie & ~VS_MODE_INTERRUPTS) |
+                          ((val << 1) & env->hideleg & VS_MODE_INTERRUPTS);
+    return write_mie(env, CSR_MIE, newval);
+}
 
+static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
+{
     if (riscv_cpu_virt_enabled(env)) {
-        /* Shift the guests S bits to VS */
-        newval = (env->mie & ~VS_MODE_INTERRUPTS) |
-                 ((val << 1) & VS_MODE_INTERRUPTS);
+        write_vsie(env, CSR_VSIE, val);
     } else {
-        newval = (env->mie & ~S_MODE_INTERRUPTS) | (val & S_MODE_INTERRUPTS);
+        target_ulong newval = (env->mie & ~S_MODE_INTERRUPTS) |
+                              (val & S_MODE_INTERRUPTS);
+        write_mie(env, CSR_MIE, newval);
     }
 
-    return write_mie(env, CSR_MIE, newval);
+    return 0;
 }
 
 static int read_stvec(CPURISCVState *env, int csrno, target_ulong *val)
@@ -XXX,XX +XXX,XX @@ static int write_sbadaddr(CPURISCVState *env, int csrno, target_ulong val)
     return 0;
 }
 
+static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
+                    target_ulong new_value, target_ulong write_mask)
+{
+    /* Shift the S bits to their VS bit location in mip */
+    int ret = rmw_mip(env, 0, ret_value, new_value << 1,
+                      (write_mask << 1) & vsip_writable_mask & env->hideleg);
+    *ret_value &= VS_MODE_INTERRUPTS;
+    /* Shift the VS bits to their S bit location in vsip */
+    *ret_value >>= 1;
+    return ret;
+}
+
 static int rmw_sip(CPURISCVState *env, int csrno, target_ulong *ret_value,
                    target_ulong new_value, target_ulong write_mask)
 {
     int ret;
 
     if (riscv_cpu_virt_enabled(env)) {
-        /* Shift the new values to line up with the VS bits */
-        ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value << 1,
-                      (write_mask & sip_writable_mask) << 1 & env->mideleg);
-        ret &= vsip_writable_mask;
-        ret >>= 1;
+        ret = rmw_vsip(env, CSR_VSIP, ret_value, new_value, write_mask);
     } else {
         ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value,
                       write_mask & env->mideleg & sip_writable_mask);
@@ -XXX,XX +XXX,XX @@ static int write_vsstatus(CPURISCVState *env, int csrno, target_ulong val)
     return 0;
 }
 
-static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
-                    target_ulong new_value, target_ulong write_mask)
-{
-    int ret = rmw_mip(env, 0, ret_value, new_value,
-                      write_mask & env->mideleg & vsip_writable_mask);
-    return ret;
-}
-
-static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
-{
-    *val = env->mie & env->mideleg & VS_MODE_INTERRUPTS;
-    return 0;
-}
-
-static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
-{
-    target_ulong newval = (env->mie & ~env->mideleg) | (val & env->mideleg & MIP_VSSIP);
-    return write_mie(env, CSR_MIE, newval);
-}
-
 static int read_vstvec(CPURISCVState *env, int csrno, target_ulong *val)
 {
     *val = env->vstvec;
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

The current two-stage lookup detection in riscv_cpu_do_interrupt falls
short of its purpose, as all it checks is whether two-stage address
translation either via the hypervisor-load store instructions or the
MPRV feature would be allowed.

What we really need instead is whether two-stage address translation was
active when the exception was raised. However, in riscv_cpu_do_interrupt
we do not have the information to reliably detect this. Therefore, when
we raise a memory fault exception we have to record whether two-stage
address translation is active.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210319141459.1196741-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  4 ++++
 target/riscv/cpu.c        |  1 +
 target/riscv/cpu_helper.c | 21 ++++++++-------------
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
     target_ulong satp_hs;
     uint64_t mstatus_hs;
 
+    /* Signals whether the current exception occurred with two-stage address
+       translation active. */
+    bool two_stage_lookup;
+
     target_ulong scounteren;
     target_ulong mcounteren;
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
     env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
     env->mcause = 0;
     env->pc = env->resetvec;
+    env->two_stage_lookup = false;
 #endif
     cs->exception_index = EXCP_NONE;
     env->load_res = -1;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
         g_assert_not_reached();
     }
     env->badaddr = address;
+    env->two_stage_lookup = two_stage;
 }
 
 hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     }
 
     env->badaddr = addr;
+    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
+                            riscv_cpu_two_stage_lookup(mmu_idx);
     riscv_raise_exception(&cpu->env, cs->exception_index, retaddr);
 }
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
         g_assert_not_reached();
     }
     env->badaddr = addr;
+    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
+                            riscv_cpu_two_stage_lookup(mmu_idx);
     riscv_raise_exception(env, cs->exception_index, retaddr);
 }
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         /* handle the trap in S-mode */
         if (riscv_has_ext(env, RVH)) {
             target_ulong hdeleg = async ? env->hideleg : env->hedeleg;
-            bool two_stage_lookup = false;
 
-            if (env->priv == PRV_M ||
-                (env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
-                (env->priv == PRV_U && !riscv_cpu_virt_enabled(env) &&
-                    get_field(env->hstatus, HSTATUS_HU))) {
-                    two_stage_lookup = true;
-            }
-
-            if ((riscv_cpu_virt_enabled(env) || two_stage_lookup) && write_tval) {
+            if (env->two_stage_lookup && write_tval) {
                 /*
                  * If we are writing a guest virtual address to stval, set
                  * this to 1. If we are trapping to VS we will set this to 0
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                 riscv_cpu_set_force_hs_excep(env, 0);
             } else {
                 /* Trap into HS mode */
-                if (!two_stage_lookup) {
-                    env->hstatus = set_field(env->hstatus, HSTATUS_SPV,
-                                             riscv_cpu_virt_enabled(env));
-                }
+                env->hstatus = set_field(env->hstatus, HSTATUS_SPV, false);
                 htval = env->guest_phys_fault_addr;
             }
         }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      * RISC-V ISA Specification.
      */
 
+    env->two_stage_lookup = false;
 #endif
     cs->exception_index = EXCP_NONE; /* mark handled to qemu */
 }
-- 
2.30.1

From: Bin Meng <bin.meng@windriver.com>

Per SST25VF016B datasheet [1], SST flash requires a dummy byte after
the address bytes. Note only SPI mode is supported by SST flashes.

[1] http://ww1.microchip.com/downloads/en/devicedoc/s71271_04.pdf

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210306060152.7250-1-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/block/m25p80.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@ static void decode_fast_read_cmd(Flash *s)
     s->needed_bytes = get_addr_length(s);
     switch (get_man(s)) {
     /* Dummy cycles - modeled with bytes writes instead of bits */
+    case MAN_SST:
+        s->needed_bytes += 1;
+        break;
     case MAN_WINBOND:
         s->needed_bytes += 8;
         break;
-- 
2.30.1

From: Bin Meng <bin.meng@windriver.com>

Since HSS commit c20a89f8dcac, the Icicle Kit reference design has
been updated to use a register mapped at 0x4f000000 instead of a
GPIO to control whether eMMC or SD card is to be used. With this
support the same HSS image can be used for both eMMC and SD card
boot flow, while previously two different board configurations were
used. This is undocumented but one can take a look at the HSS code
HSS_MMCInit() in services/mmc/mmc_api.c.

With this commit, HSS image built from 2020.12 release boots again.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210322075248.136255-1-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h | 1 +
 hw/riscv/microchip_pfsoc.c         | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_ENVM_DATA,
     MICROCHIP_PFSOC_QSPI_XIP,
     MICROCHIP_PFSOC_IOSCB,
+    MICROCHIP_PFSOC_EMMC_SD_MUX,
     MICROCHIP_PFSOC_DRAM_LO,
     MICROCHIP_PFSOC_DRAM_LO_ALIAS,
     MICROCHIP_PFSOC_DRAM_HI,
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
     [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
     [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,  0x1000000 },
     [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000, 0x10000000 },
+    [MICROCHIP_PFSOC_EMMC_SD_MUX] =     { 0x4f000000,        0x4 },
     [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000, 0x40000000 },
     [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000, 0x40000000 },
     [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,        0x0 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ioscb), 0,
                     memmap[MICROCHIP_PFSOC_IOSCB].base);
 
+    /* eMMC/SD mux */
+    create_unimplemented_device("microchip.pfsoc.emmc_sd_mux",
+        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].base,
+        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].size);
+
     /* QSPI Flash */
     memory_region_init_rom(qspi_xip_mem, OBJECT(dev),
                            "microchip.pfsoc.qspi_xip",
-- 
2.30.1

From: Bin Meng <bin.meng@windriver.com>

This adds the documentation to describe what is supported for the
'microchip-icicle-kit' machine, and how to boot the machine in QEMU.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210322075248.136255-2-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/microchip-icicle-kit.rst | 89 ++++++++++++++++++++++
 docs/system/target-riscv.rst               |  1 +
 2 files changed, 90 insertions(+)
 create mode 100644 docs/system/riscv/microchip-icicle-kit.rst

diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/riscv/microchip-icicle-kit.rst
@@ -XXX,XX +XXX,XX @@
+Microchip PolarFire SoC Icicle Kit (``microchip-icicle-kit``)
+=============================================================
+
+Microchip PolarFire SoC Icicle Kit integrates a PolarFire SoC, with one
+SiFive's E51 plus four U54 cores and many on-chip peripherals and an FPGA.
+
+For more details about Microchip PolarFire SoC, please see:
+https://www.microsemi.com/product-directory/soc-fpgas/5498-polarfire-soc-fpga
+
+The Icicle Kit board information can be found here:
+https://www.microsemi.com/existing-parts/parts/152514
+
+Supported devices
+-----------------
+
+The ``microchip-icicle-kit`` machine supports the following devices:
+
+ * 1 E51 core
+ * 4 U54 cores
+ * Core Level Interruptor (CLINT)
+ * Platform-Level Interrupt Controller (PLIC)
+ * L2 Loosely Integrated Memory (L2-LIM)
+ * DDR memory controller
+ * 5 MMUARTs
+ * 1 DMA controller
+ * 2 GEM Ethernet controllers
+ * 1 SDHC storage controller
+
+Boot options
+------------
+
+The ``microchip-icicle-kit`` machine can start using the standard -bios
+functionality for loading its BIOS image, aka Hart Software Services (HSS_).
+HSS loads the second stage bootloader U-Boot from an SD card. It does not
+support direct kernel loading via the -kernel option. One has to load kernel
+from U-Boot.
+
+The memory is set to 1537 MiB by default which is the minimum required high
+memory size by HSS. A sanity check on ram size is performed in the machine
+init routine to prompt user to increase the RAM size to > 1537 MiB when less
+than 1537 MiB ram is detected.
+
+Boot the machine
+----------------
+
+HSS 2020.12 release is tested at the time of writing. To build an HSS image
+that can be booted by the ``microchip-icicle-kit`` machine, type the following
+in the HSS source tree:
+
+.. code-block:: bash
+
+  $ export CROSS_COMPILE=riscv64-linux-
+  $ cp boards/mpfs-icicle-kit-es/def_config .config
+  $ make BOARD=mpfs-icicle-kit-es
+
+Download the official SD card image released by Microchip and prepare it for
+QEMU usage:
+
+.. code-block:: bash
+
+  $ wget ftp://ftpsoc.microsemi.com/outgoing/core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
+  $ gunzip core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
+  $ qemu-img resize core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic 4G
+
+Then we can boot the machine by:
+
+.. code-block:: bash
+
+  $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 \
+      -bios path/to/hss.bin -sd path/to/sdcard.img \
+      -nic user,model=cadence_gem \
+      -nic tap,ifname=tap,model=cadence_gem,script=no \
+      -display none -serial stdio \
+      -chardev socket,id=serial1,path=serial1.sock,server=on,wait=on \
+      -serial chardev:serial1
+
+With above command line, current terminal session will be used for the first
+serial port. Open another terminal window, and use `minicom` to connect the
+second serial port.
+
+.. code-block:: bash
+
+  $ minicom -D unix\#serial1.sock
+
+HSS output is on the first serial port (stdio) and U-Boot outputs on the
+second serial port. U-Boot will automatically load the Linux kernel from
+the SD card image.
+
+.. _HSS: https://github.com/polarfire-soc/hart-software-services
diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-riscv.rst
+++ b/docs/system/target-riscv.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
 .. toctree::
    :maxdepth: 1
 
+   riscv/microchip-icicle-kit
    riscv/sifive_u
 
 RISC-V CPU features
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

When decode_insn16() fails, we fall back to decode_RV32_64C() for
further compressed instruction decoding. However, prior to this change,
we did not raise an illegal instruction exception, if decode_RV32_64C()
fails to decode the instruction. This means that we skipped illegal
compressed instructions instead of raising an illegal instruction
exception.

Instead of patching decode_RV32_64C(), we can just remove it,
as it is dead code since f330433b363 anyway.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210322121609.3097928-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c | 179 +--------------------------------------
 1 file changed, 1 insertion(+), 178 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     CPUState *cs;
 } DisasContext;
 
-#ifdef TARGET_RISCV64
-/* convert riscv funct3 to qemu memop for load/store */
-static const int tcg_memop_lookup[8] = {
-    [0 ... 7] = -1,
-    [0] = MO_SB,
-    [1] = MO_TESW,
-    [2] = MO_TESL,
-    [3] = MO_TEQ,
-    [4] = MO_UB,
-    [5] = MO_TEUW,
-    [6] = MO_TEUL,
-};
-#endif
-
 #ifdef TARGET_RISCV64
 #define CASE_OP_32_64(X) case X: case glue(X, W)
 #else
@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
-#ifdef TARGET_RISCV64
-static void gen_load_c(DisasContext *ctx, uint32_t opc, int rd, int rs1,
-        target_long imm)
-{
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
-
-    if (memop < 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, memop);
-    gen_set_gpr(rd, t1);
-    tcg_temp_free(t0);
-    tcg_temp_free(t1);
-}
-
-static void gen_store_c(DisasContext *ctx, uint32_t opc, int rs1, int rs2,
-        target_long imm)
-{
-    TCGv t0 = tcg_temp_new();
-    TCGv dat = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-    gen_get_gpr(dat, rs2);
-    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
-
-    if (memop < 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    tcg_gen_qemu_st_tl(dat, t0, ctx->mem_idx, memop);
-    tcg_temp_free(t0);
-    tcg_temp_free(dat);
-}
-#endif
-
 #ifndef CONFIG_USER_ONLY
 /* The states of mstatus_fs are:
  * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
 static inline void mark_fs_dirty(DisasContext *ctx) { }
 #endif
 
-#if !defined(TARGET_RISCV64)
-static void gen_fp_load(DisasContext *ctx, uint32_t opc, int rd,
-        int rs1, target_long imm)
-{
-    TCGv t0;
-
-    if (ctx->mstatus_fs == 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    t0 = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-
-    switch (opc) {
-    case OPC_RISC_FLW:
-        if (!has_ext(ctx, RVF)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEUL);
-        /* RISC-V requires NaN-boxing of narrower width floating point values */
-        tcg_gen_ori_i64(cpu_fpr[rd], cpu_fpr[rd], 0xffffffff00000000ULL);
-        break;
-    case OPC_RISC_FLD:
-        if (!has_ext(ctx, RVD)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEQ);
-        break;
-    do_illegal:
-    default:
-        gen_exception_illegal(ctx);
-        break;
-    }
-    tcg_temp_free(t0);
-
-    mark_fs_dirty(ctx);
-}
-
-static void gen_fp_store(DisasContext *ctx, uint32_t opc, int rs1,
-        int rs2, target_long imm)
-{
-    TCGv t0;
-
-    if (ctx->mstatus_fs == 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    t0 = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-
-    switch (opc) {
-    case OPC_RISC_FSW:
-        if (!has_ext(ctx, RVF)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEUL);
-        break;
-    case OPC_RISC_FSD:
-        if (!has_ext(ctx, RVD)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEQ);
-        break;
-    do_illegal:
-    default:
-        gen_exception_illegal(ctx);
-        break;
-    }
-
-    tcg_temp_free(t0);
-}
-#endif
-
 static void gen_set_rm(DisasContext *ctx, int rm)
 {
     TCGv_i32 t0;
@@ -XXX,XX +XXX,XX @@ static void gen_set_rm(DisasContext *ctx, int rm)
     tcg_temp_free_i32(t0);
 }
 
-static void decode_RV32_64C0(DisasContext *ctx, uint16_t opcode)
-{
-    uint8_t funct3 = extract16(opcode, 13, 3);
-    uint8_t rd_rs2 = GET_C_RS2S(opcode);
-    uint8_t rs1s = GET_C_RS1S(opcode);
-
-    switch (funct3) {
-    case 3:
-#if defined(TARGET_RISCV64)
-        /* C.LD(RV64/128) -> ld rd', offset[7:3](rs1')*/
-        gen_load_c(ctx, OPC_RISC_LD, rd_rs2, rs1s,
-                 GET_C_LD_IMM(opcode));
-#else
-        /* C.FLW (RV32) -> flw rd', offset[6:2](rs1')*/
-        gen_fp_load(ctx, OPC_RISC_FLW, rd_rs2, rs1s,
-                    GET_C_LW_IMM(opcode));
-#endif
-        break;
-    case 7:
-#if defined(TARGET_RISCV64)
-        /* C.SD (RV64/128) -> sd rs2', offset[7:3](rs1')*/
-        gen_store_c(ctx, OPC_RISC_SD, rs1s, rd_rs2,
-                  GET_C_LD_IMM(opcode));
-#else
-        /* C.FSW (RV32) -> fsw rs2', offset[6:2](rs1')*/
-        gen_fp_store(ctx, OPC_RISC_FSW, rs1s, rd_rs2,
-                     GET_C_LW_IMM(opcode));
-#endif
-        break;
-    }
-}
-
-static void decode_RV32_64C(DisasContext *ctx, uint16_t opcode)
-{
-    uint8_t op = extract16(opcode, 0, 2);
-
-    switch (op) {
-    case 0:
-        decode_RV32_64C0(ctx, opcode);
-        break;
-    }
-}
-
 static int ex_plus_1(DisasContext *ctx, int nf)
 {
     return nf + 1;
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
         } else {
             ctx->pc_succ_insn = ctx->base.pc_next + 2;
             if (!decode_insn16(ctx, opcode)) {
-                /* fall back to old decoder */
-                decode_RV32_64C(ctx, opcode);
+                gen_exception_illegal(ctx);
             }
         }
     } else {
-- 
2.30.1

The following changes since commit 20c1df5476e1e9b5d3f5b94f9f3ce01d21f14c46:

Merge remote-tracking branch 'remotes/kraxel/tags/fixes-20200713-pull-request' into staging (2020-07-13 16:58:44 +0100)

are available in the Git repository at:

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20200713

for you to fetch changes up to cfad709bceb629a4ebeb5d8a3acd1871b9a6436b:

target/riscv: Fix pmp NA4 implementation (2020-07-13 17:25:37 -0700)

----------------------------------------------------------------
This is a colection of bug fixes and small imrprovements for RISC-V.

This includes some vector extensions fixes, a PMP bug fix, OpenTitan
UART bug fix and support for OpenSBI dynamic firmware.

----------------------------------------------------------------
Alexandre Mergnat (1):
      target/riscv: Fix pmp NA4 implementation

Alistair Francis (2):
      hw/char: Convert the Ibex UART to use the qdev Clock model
      hw/char: Convert the Ibex UART to use the registerfields API

Atish Patra (4):
      riscv: Unify Qemu's reset vector code path
      RISC-V: Copy the fdt in dram instead of ROM
      riscv: Add opensbi firmware dynamic support
      RISC-V: Support 64 bit start address

Bin Meng (3):
      MAINTAINERS: Add an entry for OpenSBI firmware
      hw/riscv: virt: Sort the SoC memmap table entries
      hw/riscv: Modify MROM size to end at 0x10000

Frank Chang (4):
      target/riscv: fix rsub gvec tcg_assert_listed_vecop assertion
      target/riscv: correct the gvec IR called in gen_vec_rsub16_i64()
      target/riscv: fix return value of do_opivx_widen()
      target/riscv: fix vill bit index in vtype register

Liao Pingfang (1):
      tcg/riscv: Remove superfluous breaks

From: Bin Meng <bin.meng@windriver.com>

Adjust the PCIe memory maps to follow the order.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1593746511-19517-1-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
     [VIRT_TEST] =        {   0x100000,        0x1000 },
     [VIRT_RTC] =         {   0x101000,        0x1000 },
     [VIRT_CLINT] =       {  0x2000000,       0x10000 },
+    [VIRT_PCIE_PIO] =    {  0x3000000,       0x10000 },
     [VIRT_PLIC] =        {  0xc000000,     0x4000000 },
     [VIRT_UART0] =       { 0x10000000,         0x100 },
     [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
     [VIRT_FLASH] =       { 0x20000000,     0x4000000 },
-    [VIRT_DRAM] =        { 0x80000000,           0x0 },
-    [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
-    [VIRT_PCIE_PIO] =    { 0x03000000,    0x00010000 },
     [VIRT_PCIE_ECAM] =   { 0x30000000,    0x10000000 },
+    [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
+    [VIRT_DRAM] =        { 0x80000000,           0x0 },
 };
 
 #define VIRT_FLASH_SECTOR_SIZE (256 * KiB)
-- 
2.27.0

From: Atish Patra <atish.patra@wdc.com>

Currently, all riscv machines except sifive_u have identical reset vector
code implementations with memory addresses being different for all machines.
They can be easily combined into a single function in common code.

Move it to common function and let all the machines use the common function.

Signed-off-by: Atish Patra <atish.patra@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bin.meng@windriver.com>
Tested-by: Bin Meng <bin.meng@windriver.com>
Message-Id: <20200701183949.398134-2-atish.patra@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/boot.h |  2 ++
 hw/riscv/boot.c         | 46 +++++++++++++++++++++++++++++++++++++++++
 hw/riscv/sifive_u.c     |  1 -
 hw/riscv/spike.c        | 41 +++---------------------------------
 hw/riscv/virt.c         | 40 +++--------------------------------
 5 files changed, 54 insertions(+), 76 deletions(-)

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_kernel(const char *kernel_filename,
                                symbol_fn_t sym_cb);
 hwaddr riscv_load_initrd(const char *filename, uint64_t mem_size,
                          uint64_t kernel_entry, hwaddr *start);
+void riscv_setup_rom_reset_vec(hwaddr saddr, hwaddr rom_base,
+                               hwaddr rom_size, void *fdt);
 
 #endif /* RISCV_BOOT_H */
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/loader.h"
 #include "hw/riscv/boot.h"
 #include "elf.h"
+#include "sysemu/device_tree.h"
 #include "sysemu/qtest.h"
 
+#include <libfdt.h>
+
 #if defined(TARGET_RISCV32)
 # define KERNEL_BOOT_ADDRESS 0x80400000
 #else
@@ -XXX,XX +XXX,XX @@ hwaddr riscv_load_initrd(const char *filename, uint64_t mem_size,
 
     return *start + size;
 }
+
+void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
+                               hwaddr rom_size, void *fdt)
+{
+    int i;
+
+    /* reset vector */
+    uint32_t reset_vec[8] = {
+        0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(dtb) */
+        0x02028593,                  /*     addi   a1, t0, %pcrel_lo(1b) */
+        0xf1402573,                  /*     csrr   a0, mhartid  */
+#if defined(TARGET_RISCV32)
+        0x0182a283,                  /*     lw     t0, 24(t0) */
+#elif defined(TARGET_RISCV64)
+        0x0182b283,                  /*     ld     t0, 24(t0) */
+#endif
+        0x00028067,                  /*     jr     t0 */
+        0x00000000,
+        start_addr,                  /* start: .dword */
+        0x00000000,
+                                     /* dtb: */
+    };
+
+    /* copy in the reset vector in little_endian byte order */
+    for (i = 0; i < sizeof(reset_vec) >> 2; i++) {
+        reset_vec[i] = cpu_to_le32(reset_vec[i]);
+    }
+    rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
+                          rom_base, &address_space_memory);
+
+    /* copy in the device tree */
+    if (fdt_pack(fdt) || fdt_totalsize(fdt) >
+        rom_size - sizeof(reset_vec)) {
+        error_report("not enough space to store device-tree");
+        exit(1);
+    }
+    qemu_fdt_dumpdtb(fdt, fdt_totalsize(fdt));
+    rom_add_blob_fixed_as("mrom.fdt", fdt, fdt_totalsize(fdt),
+                           rom_base + sizeof(reset_vec),
+                           &address_space_memory);
+
+    return;
+}
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/device_tree.h"
 #include "sysemu/runstate.h"
 #include "sysemu/sysemu.h"
-#include "exec/address-spaces.h"
 
 #include <libfdt.h>
 
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/device_tree.h"
 #include "sysemu/qtest.h"
 #include "sysemu/sysemu.h"
-#include "exec/address-spaces.h"
-
-#include <libfdt.h>
 
 #if defined(TARGET_RISCV32)
 # define BIOS_FILENAME "opensbi-riscv32-spike-fw_jump.elf"
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *main_mem = g_new(MemoryRegion, 1);
     MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
-    int i;
     unsigned int smp_cpus = machine->smp.cpus;
 
     /* Initialize SOC */
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
         }
     }
 
-    /* reset vector */
-    uint32_t reset_vec[8] = {
-        0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(dtb) */
-        0x02028593,                  /*     addi   a1, t0, %pcrel_lo(1b) */
-        0xf1402573,                  /*     csrr   a0, mhartid  */
-#if defined(TARGET_RISCV32)
-        0x0182a283,                  /*     lw     t0, 24(t0) */
-#elif defined(TARGET_RISCV64)
-        0x0182b283,                  /*     ld     t0, 24(t0) */
-#endif
-        0x00028067,                  /*     jr     t0 */
-        0x00000000,
-        memmap[SPIKE_DRAM].base,     /* start: .dword DRAM_BASE */
-        0x00000000,
-                                     /* dtb: */
-    };
-
-    /* copy in the reset vector in little_endian byte order */
-    for (i = 0; i < sizeof(reset_vec) >> 2; i++) {
-        reset_vec[i] = cpu_to_le32(reset_vec[i]);
-    }
-    rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
-                          memmap[SPIKE_MROM].base, &address_space_memory);
-
-    /* copy in the device tree */
-    if (fdt_pack(s->fdt) || fdt_totalsize(s->fdt) >
-            memmap[SPIKE_MROM].size - sizeof(reset_vec)) {
-        error_report("not enough space to store device-tree");
-        exit(1);
-    }
-    qemu_fdt_dumpdtb(s->fdt, fdt_totalsize(s->fdt));
-    rom_add_blob_fixed_as("mrom.fdt", s->fdt, fdt_totalsize(s->fdt),
-                          memmap[SPIKE_MROM].base + sizeof(reset_vec),
-                          &address_space_memory);
+    /* load the reset vector */
+    riscv_setup_rom_reset_vec(memmap[SPIKE_DRAM].base, memmap[SPIKE_MROM].base,
+                              memmap[SPIKE_MROM].size, s->fdt);
 
     /* initialize HTIF using symbols found in load_kernel */
     htif_mm_init(system_memory, mask_rom, &s->soc.harts[0].env, serial_hd(0));
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/arch_init.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
-#include "exec/address-spaces.h"
 #include "hw/pci/pci.h"
 #include "hw/pci-host/gpex.h"
 
-#include <libfdt.h>
-
 #if defined(TARGET_RISCV32)
 # define BIOS_FILENAME "opensbi-riscv32-virt-fw_jump.bin"
 #else
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         start_addr = virt_memmap[VIRT_FLASH].base;
     }
 
-    /* reset vector */
-    uint32_t reset_vec[8] = {
-        0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(dtb) */
-        0x02028593,                  /*     addi   a1, t0, %pcrel_lo(1b) */
-        0xf1402573,                  /*     csrr   a0, mhartid  */
-#if defined(TARGET_RISCV32)
-        0x0182a283,                  /*     lw     t0, 24(t0) */
-#elif defined(TARGET_RISCV64)
-        0x0182b283,                  /*     ld     t0, 24(t0) */
-#endif
-        0x00028067,                  /*     jr     t0 */
-        0x00000000,
-        start_addr,                  /* start: .dword */
-        0x00000000,
-                                     /* dtb: */
-    };
-
-    /* copy in the reset vector in little_endian byte order */
-    for (i = 0; i < sizeof(reset_vec) >> 2; i++) {
-        reset_vec[i] = cpu_to_le32(reset_vec[i]);
-    }
-    rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
-                          memmap[VIRT_MROM].base, &address_space_memory);
-
-    /* copy in the device tree */
-    if (fdt_pack(s->fdt) || fdt_totalsize(s->fdt) >
-            memmap[VIRT_MROM].size - sizeof(reset_vec)) {
-        error_report("not enough space to store device-tree");
-        exit(1);
-    }
-    qemu_fdt_dumpdtb(s->fdt, fdt_totalsize(s->fdt));
-    rom_add_blob_fixed_as("mrom.fdt", s->fdt, fdt_totalsize(s->fdt),
-                          memmap[VIRT_MROM].base + sizeof(reset_vec),
-                          &address_space_memory);
+    /* load the reset vector */
+    riscv_setup_rom_reset_vec(start_addr, virt_memmap[VIRT_MROM].base,
+                              virt_memmap[VIRT_MROM].size, s->fdt);
 
     /* create PLIC hart topology configuration string */
     plic_hart_config_len = (strlen(VIRT_PLIC_HART_CONFIG) + 1) * smp_cpus;
-- 
2.27.0

From: Atish Patra <atish.patra@wdc.com>

Currently, the fdt is copied to the ROM after the reset vector. The firmware
has to copy it to DRAM. Instead of this, directly copy the device tree to a
pre-computed dram address. The device tree load address should be as far as
possible from kernel and initrd images. That's why it is kept at the end of
the DRAM or 4GB whichever is lesser.

Signed-off-by: Atish Patra <atish.patra@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bin.meng@windriver.com>
Tested-by: Bin Meng <bin.meng@windriver.com>
Message-Id: <20200701183949.398134-3-atish.patra@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/boot.h |  4 +++-
 hw/riscv/boot.c         | 53 +++++++++++++++++++++++++++++------------
 hw/riscv/sifive_u.c     | 28 ++++++++++------------
 hw/riscv/spike.c        |  7 +++++-
 hw/riscv/virt.c         |  7 +++++-
 5 files changed, 66 insertions(+), 33 deletions(-)

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_load_kernel(const char *kernel_filename,
                                symbol_fn_t sym_cb);
 hwaddr riscv_load_initrd(const char *filename, uint64_t mem_size,
                          uint64_t kernel_entry, hwaddr *start);
+uint32_t riscv_load_fdt(hwaddr dram_start, uint64_t dram_size, void *fdt);
 void riscv_setup_rom_reset_vec(hwaddr saddr, hwaddr rom_base,
-                               hwaddr rom_size, void *fdt);
+                               hwaddr rom_size,
+                               uint32_t fdt_load_addr, void *fdt);
 
 #endif /* RISCV_BOOT_H */
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ hwaddr riscv_load_initrd(const char *filename, uint64_t mem_size,
     return *start + size;
 }
 
+uint32_t riscv_load_fdt(hwaddr dram_base, uint64_t mem_size, void *fdt)
+{
+    uint32_t temp, fdt_addr;
+    hwaddr dram_end = dram_base + mem_size;
+    int fdtsize = fdt_totalsize(fdt);
+
+    if (fdtsize <= 0) {
+        error_report("invalid device-tree");
+        exit(1);
+    }
+
+    /*
+     * We should put fdt as far as possible to avoid kernel/initrd overwriting
+     * its content. But it should be addressable by 32 bit system as well.
+     * Thus, put it at an aligned address that less than fdt size from end of
+     * dram or 4GB whichever is lesser.
+     */
+    temp = MIN(dram_end, 4096 * MiB);
+    fdt_addr = QEMU_ALIGN_DOWN(temp - fdtsize, 2 * MiB);
+
+    fdt_pack(fdt);
+    /* copy in the device tree */
+    qemu_fdt_dumpdtb(fdt, fdtsize);
+
+    rom_add_blob_fixed_as("fdt", fdt, fdtsize, fdt_addr,
+                          &address_space_memory);
+
+    return fdt_addr;
+}
+
 void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
-                               hwaddr rom_size, void *fdt)
+                               hwaddr rom_size,
+                               uint32_t fdt_load_addr, void *fdt)
 {
     int i;
 
     /* reset vector */
-    uint32_t reset_vec[8] = {
+    uint32_t reset_vec[10] = {
         0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(dtb) */
-        0x02028593,                  /*     addi   a1, t0, %pcrel_lo(1b) */
         0xf1402573,                  /*     csrr   a0, mhartid  */
 #if defined(TARGET_RISCV32)
+        0x0202a583,                  /*     lw     a1, 32(t0) */
         0x0182a283,                  /*     lw     t0, 24(t0) */
 #elif defined(TARGET_RISCV64)
+        0x0202b583,                  /*     ld     a1, 32(t0) */
         0x0182b283,                  /*     ld     t0, 24(t0) */
 #endif
         0x00028067,                  /*     jr     t0 */
         0x00000000,
         start_addr,                  /* start: .dword */
+        0x00000000,
+        fdt_load_addr,               /* fdt_laddr: .dword */
         0x00000000,
                                      /* dtb: */
     };
 
     /* copy in the reset vector in little_endian byte order */
-    for (i = 0; i < sizeof(reset_vec) >> 2; i++) {
+    for (i = 0; i < ARRAY_SIZE(reset_vec); i++) {
         reset_vec[i] = cpu_to_le32(reset_vec[i]);
     }
     rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
                           rom_base, &address_space_memory);
 
-    /* copy in the device tree */
-    if (fdt_pack(fdt) || fdt_totalsize(fdt) >
-        rom_size - sizeof(reset_vec)) {
-        error_report("not enough space to store device-tree");
-        exit(1);
-    }
-    qemu_fdt_dumpdtb(fdt, fdt_totalsize(fdt));
-    rom_add_blob_fixed_as("mrom.fdt", fdt, fdt_totalsize(fdt),
-                           rom_base + sizeof(reset_vec),
-                           &address_space_memory);
-
     return;
 }
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
     MemoryRegion *flash0 = g_new(MemoryRegion, 1);
     target_ulong start_addr = memmap[SIFIVE_U_DRAM].base;
     int i;
+    uint32_t fdt_load_addr;
 
     /* Initialize SoC */
     object_initialize_child(OBJECT(machine), "soc", &s->soc, TYPE_RISCV_U_SOC);
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
         }
     }
 
+    /* Compute the fdt load address in dram */
+    fdt_load_addr = riscv_load_fdt(memmap[SIFIVE_U_DRAM].base,
+                                   machine->ram_size, s->fdt);
+
     /* reset vector */
-    uint32_t reset_vec[8] = {
+    uint32_t reset_vec[11] = {
         s->msel,                       /* MSEL pin state */
         0x00000297,                    /* 1:  auipc  t0, %pcrel_hi(dtb) */
-        0x01c28593,                    /*     addi   a1, t0, %pcrel_lo(1b) */
         0xf1402573,                    /*     csrr   a0, mhartid  */
 #if defined(TARGET_RISCV32)
+        0x0202a583,                    /*     lw     a1, 32(t0) */
         0x0182a283,                    /*     lw     t0, 24(t0) */
 #elif defined(TARGET_RISCV64)
-        0x0182e283,                    /*     lwu    t0, 24(t0) */
+        0x0202b583,                    /*     ld     a1, 32(t0) */
+        0x0182b283,                    /*     ld     t0, 24(t0) */
 #endif
         0x00028067,                    /*     jr     t0 */
         0x00000000,
         start_addr,                    /* start: .dword */
+        0x00000000,
+        fdt_load_addr,                 /* fdt_laddr: .dword */
+        0x00000000,
                                        /* dtb: */
     };
 
     /* copy in the reset vector in little_endian byte order */
-    for (i = 0; i < sizeof(reset_vec) >> 2; i++) {
+    for (i = 0; i < ARRAY_SIZE(reset_vec); i++) {
         reset_vec[i] = cpu_to_le32(reset_vec[i]);
     }
     rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
                           memmap[SIFIVE_U_MROM].base, &address_space_memory);
-
-    /* copy in the device tree */
-    if (fdt_pack(s->fdt) || fdt_totalsize(s->fdt) >
-            memmap[SIFIVE_U_MROM].size - sizeof(reset_vec)) {
-        error_report("not enough space to store device-tree");
-        exit(1);
-    }
-    qemu_fdt_dumpdtb(s->fdt, fdt_totalsize(s->fdt));
-    rom_add_blob_fixed_as("mrom.fdt", s->fdt, fdt_totalsize(s->fdt),
-                          memmap[SIFIVE_U_MROM].base + sizeof(reset_vec),
-                          &address_space_memory);
 }
 
 static bool sifive_u_machine_get_start_in_flash(Object *obj, Error **errp)
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
     MemoryRegion *main_mem = g_new(MemoryRegion, 1);
     MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
     unsigned int smp_cpus = machine->smp.cpus;
+    uint32_t fdt_load_addr;
 
     /* Initialize SOC */
     object_initialize_child(OBJECT(machine), "soc", &s->soc,
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
         }
     }
 
+    /* Compute the fdt load address in dram */
+    fdt_load_addr = riscv_load_fdt(memmap[SPIKE_DRAM].base,
+                                   machine->ram_size, s->fdt);
     /* load the reset vector */
     riscv_setup_rom_reset_vec(memmap[SPIKE_DRAM].base, memmap[SPIKE_MROM].base,
-                              memmap[SPIKE_MROM].size, s->fdt);
+                              memmap[SPIKE_MROM].size,
+                              fdt_load_addr, s->fdt);
 
     /* initialize HTIF using symbols found in load_kernel */
     htif_mm_init(system_memory, mask_rom, &s->soc.harts[0].env, serial_hd(0));
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
     char *plic_hart_config;
     size_t plic_hart_config_len;
     target_ulong start_addr = memmap[VIRT_DRAM].base;
+    uint32_t fdt_load_addr;
     int i;
     unsigned int smp_cpus = machine->smp.cpus;
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         start_addr = virt_memmap[VIRT_FLASH].base;
     }
 
+    /* Compute the fdt load address in dram */
+    fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
+                                   machine->ram_size, s->fdt);
     /* load the reset vector */
     riscv_setup_rom_reset_vec(start_addr, virt_memmap[VIRT_MROM].base,
-                              virt_memmap[VIRT_MROM].size, s->fdt);
+                              virt_memmap[VIRT_MROM].size,
+                              fdt_load_addr, s->fdt);
 
     /* create PLIC hart topology configuration string */
     plic_hart_config_len = (strlen(VIRT_PLIC_HART_CONFIG) + 1) * smp_cpus;
-- 
2.27.0

From: Atish Patra <atish.patra@wdc.com>

OpenSBI is the default firmware in Qemu and has various firmware loading
options. Currently, qemu loader uses fw_jump which has a compile time
pre-defined address where fdt & kernel image must reside. This puts a
constraint on image size of the Linux kernel depending on the fdt location
and available memory. However, fw_dynamic allows the loader to specify
the next stage location (i.e. Linux kernel/U-Boot) in memory and other
configurable boot options available in OpenSBI.

Add support for OpenSBI dynamic firmware loading support. This doesn't
break existing setup and fw_jump will continue to work as it is. Any
other firmware will continue to work without any issues as long as it
doesn't expect anything specific from loader in "a2" register.

Signed-off-by: Atish Patra <atish.patra@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bin.meng@windriver.com>
Tested-by: Bin Meng <bin.meng@windriver.com>
Message-Id: <20200701183949.398134-4-atish.patra@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/boot.h         |  5 ++-
 include/hw/riscv/boot_opensbi.h | 58 +++++++++++++++++++++++++++++++++
 hw/riscv/boot.c                 | 42 +++++++++++++++++++++---
 hw/riscv/sifive_u.c             | 20 +++++++++---
 hw/riscv/spike.c                | 13 ++++++--
 hw/riscv/virt.c                 | 12 +++++--
 6 files changed, 134 insertions(+), 16 deletions(-)
 create mode 100644 include/hw/riscv/boot_opensbi.h

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -XXX,XX +XXX,XX @@ hwaddr riscv_load_initrd(const char *filename, uint64_t mem_size,
                          uint64_t kernel_entry, hwaddr *start);
 uint32_t riscv_load_fdt(hwaddr dram_start, uint64_t dram_size, void *fdt);
 void riscv_setup_rom_reset_vec(hwaddr saddr, hwaddr rom_base,
-                               hwaddr rom_size,
+                               hwaddr rom_size, uint64_t kernel_entry,
                                uint32_t fdt_load_addr, void *fdt);
+void riscv_rom_copy_firmware_info(hwaddr rom_base, hwaddr rom_size,
+                                  uint32_t reset_vec_size,
+                                  uint64_t kernel_entry);
 
 #endif /* RISCV_BOOT_H */
diff --git a/include/hw/riscv/boot_opensbi.h b/include/hw/riscv/boot_opensbi.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/riscv/boot_opensbi.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * Copyright (c) 2019 Western Digital Corporation or its affiliates.
+ *
+ * Based on include/sbi/{fw_dynamic.h,sbi_scratch.h} from the OpenSBI project.
+ */
+#ifndef OPENSBI_H
+#define OPENSBI_H
+
+/** Expected value of info magic ('OSBI' ascii string in hex) */
+#define FW_DYNAMIC_INFO_MAGIC_VALUE     0x4942534f
+
+/** Maximum supported info version */
+#define FW_DYNAMIC_INFO_VERSION         0x2
+
+/** Possible next mode values */
+#define FW_DYNAMIC_INFO_NEXT_MODE_U     0x0
+#define FW_DYNAMIC_INFO_NEXT_MODE_S     0x1
+#define FW_DYNAMIC_INFO_NEXT_MODE_M     0x3
+
+enum sbi_scratch_options {
+    /** Disable prints during boot */
+    SBI_SCRATCH_NO_BOOT_PRINTS = (1 << 0),
+    /** Enable runtime debug prints */
+    SBI_SCRATCH_DEBUG_PRINTS = (1 << 1),
+};
+
+/** Representation dynamic info passed by previous booting stage */
+struct fw_dynamic_info {
+    /** Info magic */
+    target_long magic;
+    /** Info version */
+    target_long version;
+    /** Next booting stage address */
+    target_long next_addr;
+    /** Next booting stage mode */
+    target_long next_mode;
+    /** Options for OpenSBI library */
+    target_long options;
+    /**
+     * Preferred boot HART id
+     *
+     * It is possible that the previous booting stage uses same link
+     * address as the FW_DYNAMIC firmware. In this case, the relocation
+     * lottery mechanism can potentially overwrite the previous booting
+     * stage while other HARTs are still running in the previous booting
+     * stage leading to boot-time crash. To avoid this boot-time crash,
+     * the previous booting stage can specify last HART that will jump
+     * to the FW_DYNAMIC firmware as the preferred boot HART.
+     *
+     * To avoid specifying a preferred boot HART, the previous booting
+     * stage can set it to -1UL which will force the FW_DYNAMIC firmware
+     * to use the relocation lottery mechanism.
+     */
+    target_long boot_hart;
+};
+
+#endif
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "hw/loader.h"
 #include "hw/riscv/boot.h"
+#include "hw/riscv/boot_opensbi.h"
 #include "elf.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/qtest.h"
@@ -XXX,XX +XXX,XX @@
 
 #if defined(TARGET_RISCV32)
 # define KERNEL_BOOT_ADDRESS 0x80400000
+#define fw_dynamic_info_data(__val)     cpu_to_le32(__val)
 #else
 # define KERNEL_BOOT_ADDRESS 0x80200000
+#define fw_dynamic_info_data(__val)     cpu_to_le64(__val)
 #endif
 
 void riscv_find_and_load_firmware(MachineState *machine,
@@ -XXX,XX +XXX,XX @@ uint32_t riscv_load_fdt(hwaddr dram_base, uint64_t mem_size, void *fdt)
     return fdt_addr;
 }
 
+void riscv_rom_copy_firmware_info(hwaddr rom_base, hwaddr rom_size,
+                              uint32_t reset_vec_size, uint64_t kernel_entry)
+{
+    struct fw_dynamic_info dinfo;
+    size_t dinfo_len;
+
+    dinfo.magic = fw_dynamic_info_data(FW_DYNAMIC_INFO_MAGIC_VALUE);
+    dinfo.version = fw_dynamic_info_data(FW_DYNAMIC_INFO_VERSION);
+    dinfo.next_mode = fw_dynamic_info_data(FW_DYNAMIC_INFO_NEXT_MODE_S);
+    dinfo.next_addr = fw_dynamic_info_data(kernel_entry);
+    dinfo.options = 0;
+    dinfo.boot_hart = 0;
+    dinfo_len = sizeof(dinfo);
+
+    /**
+     * copy the dynamic firmware info. This information is specific to
+     * OpenSBI but doesn't break any other firmware as long as they don't
+     * expect any certain value in "a2" register.
+     */
+    if (dinfo_len > (rom_size - reset_vec_size)) {
+        error_report("not enough space to store dynamic firmware info");
+        exit(1);
+    }
+
+    rom_add_blob_fixed_as("mrom.finfo", &dinfo, dinfo_len,
+                           rom_base + reset_vec_size,
+                           &address_space_memory);
+}
+
 void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
-                               hwaddr rom_size,
+                               hwaddr rom_size, uint64_t kernel_entry,
                                uint32_t fdt_load_addr, void *fdt)
 {
     int i;
 
     /* reset vector */
     uint32_t reset_vec[10] = {
-        0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(dtb) */
+        0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(fw_dyn) */
+        0x02828613,                  /*     addi   a2, t0, %pcrel_lo(1b) */
         0xf1402573,                  /*     csrr   a0, mhartid  */
 #if defined(TARGET_RISCV32)
         0x0202a583,                  /*     lw     a1, 32(t0) */
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
         0x0182b283,                  /*     ld     t0, 24(t0) */
 #endif
         0x00028067,                  /*     jr     t0 */
-        0x00000000,
         start_addr,                  /* start: .dword */
         0x00000000,
         fdt_load_addr,               /* fdt_laddr: .dword */
         0x00000000,
-                                     /* dtb: */
+                                     /* fw_dyn: */
     };
 
     /* copy in the reset vector in little_endian byte order */
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
     }
     rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
                           rom_base, &address_space_memory);
+    riscv_rom_copy_firmware_info(rom_base, rom_size, sizeof(reset_vec),
+                                 kernel_entry);
 
     return;
 }
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
     target_ulong start_addr = memmap[SIFIVE_U_DRAM].base;
     int i;
     uint32_t fdt_load_addr;
+    uint64_t kernel_entry;
 
     /* Initialize SoC */
     object_initialize_child(OBJECT(machine), "soc", &s->soc, TYPE_RISCV_U_SOC);
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
     riscv_find_and_load_firmware(machine, BIOS_FILENAME, start_addr, NULL);
 
     if (machine->kernel_filename) {
-        uint64_t kernel_entry = riscv_load_kernel(machine->kernel_filename,
-                                                  NULL);
+        kernel_entry = riscv_load_kernel(machine->kernel_filename, NULL);
 
         if (machine->initrd_filename) {
             hwaddr start;
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
             qemu_fdt_setprop_cell(s->fdt, "/chosen", "linux,initrd-end",
                                   end);
         }
+    } else {
+       /*
+        * If dynamic firmware is used, it doesn't know where is the next mode
+        * if kernel argument is not set.
+        */
+        kernel_entry = 0;
     }
 
     /* Compute the fdt load address in dram */
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
     /* reset vector */
     uint32_t reset_vec[11] = {
         s->msel,                       /* MSEL pin state */
-        0x00000297,                    /* 1:  auipc  t0, %pcrel_hi(dtb) */
+        0x00000297,                    /* 1:  auipc  t0, %pcrel_hi(fw_dyn) */
+        0x02828613,                    /*     addi   a2, t0, %pcrel_lo(1b) */
         0xf1402573,                    /*     csrr   a0, mhartid  */
 #if defined(TARGET_RISCV32)
         0x0202a583,                    /*     lw     a1, 32(t0) */
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
         0x0182b283,                    /*     ld     t0, 24(t0) */
 #endif
         0x00028067,                    /*     jr     t0 */
-        0x00000000,
         start_addr,                    /* start: .dword */
         0x00000000,
         fdt_load_addr,                 /* fdt_laddr: .dword */
         0x00000000,
-                                       /* dtb: */
+                                       /* fw_dyn: */
     };
 
     /* copy in the reset vector in little_endian byte order */
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
     }
     rom_add_blob_fixed_as("mrom.reset", reset_vec, sizeof(reset_vec),
                           memmap[SIFIVE_U_MROM].base, &address_space_memory);
+
+    riscv_rom_copy_firmware_info(memmap[SIFIVE_U_MROM].base,
+                                 memmap[SIFIVE_U_MROM].size,
+                                 sizeof(reset_vec), kernel_entry);
 }
 
 static bool sifive_u_machine_get_start_in_flash(Object *obj, Error **errp)
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
     MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
     unsigned int smp_cpus = machine->smp.cpus;
     uint32_t fdt_load_addr;
+    uint64_t kernel_entry;
 
     /* Initialize SOC */
     object_initialize_child(OBJECT(machine), "soc", &s->soc,
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
                                  htif_symbol_callback);
 
     if (machine->kernel_filename) {
-        uint64_t kernel_entry = riscv_load_kernel(machine->kernel_filename,
-                                                  htif_symbol_callback);
+        kernel_entry = riscv_load_kernel(machine->kernel_filename,
+                                         htif_symbol_callback);
 
         if (machine->initrd_filename) {
             hwaddr start;
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
             qemu_fdt_setprop_cell(s->fdt, "/chosen", "linux,initrd-end",
                                   end);
         }
+    } else {
+       /*
+        * If dynamic firmware is used, it doesn't know where is the next mode
+        * if kernel argument is not set.
+        */
+        kernel_entry = 0;
     }
 
     /* Compute the fdt load address in dram */
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
                                    machine->ram_size, s->fdt);
     /* load the reset vector */
     riscv_setup_rom_reset_vec(memmap[SPIKE_DRAM].base, memmap[SPIKE_MROM].base,
-                              memmap[SPIKE_MROM].size,
+                              memmap[SPIKE_MROM].size, kernel_entry,
                               fdt_load_addr, s->fdt);
 
     /* initialize HTIF using symbols found in load_kernel */
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
     size_t plic_hart_config_len;
     target_ulong start_addr = memmap[VIRT_DRAM].base;
     uint32_t fdt_load_addr;
+    uint64_t kernel_entry;
     int i;
     unsigned int smp_cpus = machine->smp.cpus;
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                                  memmap[VIRT_DRAM].base, NULL);
 
     if (machine->kernel_filename) {
-        uint64_t kernel_entry = riscv_load_kernel(machine->kernel_filename,
-                                                  NULL);
+        kernel_entry = riscv_load_kernel(machine->kernel_filename, NULL);
 
         if (machine->initrd_filename) {
             hwaddr start;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
             qemu_fdt_setprop_cell(s->fdt, "/chosen", "linux,initrd-end",
                                   end);
         }
+    } else {
+       /*
+        * If dynamic firmware is used, it doesn't know where is the next mode
+        * if kernel argument is not set.
+        */
+        kernel_entry = 0;
     }
 
     if (drive_get(IF_PFLASH, 0, 0)) {
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                                    machine->ram_size, s->fdt);
     /* load the reset vector */
     riscv_setup_rom_reset_vec(start_addr, virt_memmap[VIRT_MROM].base,
-                              virt_memmap[VIRT_MROM].size,
+                              virt_memmap[VIRT_MROM].size, kernel_entry,
                               fdt_load_addr, s->fdt);
 
     /* create PLIC hart topology configuration string */
-- 
2.27.0

From: Atish Patra <atish.patra@wdc.com>

Even though the start address in ROM code is declared as a 64 bit address
for RV64, it can't be used as upper bits are set to zero in ROM code.

Update the ROM code correctly to reflect the 64bit value.

Signed-off-by: Atish Patra <atish.patra@wdc.com>
Reviewed-by: Bin Meng <bin.meng@windriver.com>
Tested-by: Bin Meng <bin.meng@windriver.com>
Message-Id: <20200701183949.398134-5-atish.patra@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/boot.c     | 6 +++++-
 hw/riscv/sifive_u.c | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
                                uint32_t fdt_load_addr, void *fdt)
 {
     int i;
+    uint32_t start_addr_hi32 = 0x00000000;
 
+    #if defined(TARGET_RISCV64)
+    start_addr_hi32 = start_addr >> 32;
+    #endif
     /* reset vector */
     uint32_t reset_vec[10] = {
         0x00000297,                  /* 1:  auipc  t0, %pcrel_hi(fw_dyn) */
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(hwaddr start_addr, hwaddr rom_base,
 #endif
         0x00028067,                  /*     jr     t0 */
         start_addr,                  /* start: .dword */
-        0x00000000,
+        start_addr_hi32,
         fdt_load_addr,               /* fdt_laddr: .dword */
         0x00000000,
                                      /* fw_dyn: */
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
     MemoryRegion *main_mem = g_new(MemoryRegion, 1);
     MemoryRegion *flash0 = g_new(MemoryRegion, 1);
     target_ulong start_addr = memmap[SIFIVE_U_DRAM].base;
+    uint32_t start_addr_hi32 = 0x00000000;
     int i;
     uint32_t fdt_load_addr;
     uint64_t kernel_entry;
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
     /* Compute the fdt load address in dram */
     fdt_load_addr = riscv_load_fdt(memmap[SIFIVE_U_DRAM].base,
                                    machine->ram_size, s->fdt);
+    #if defined(TARGET_RISCV64)
+    start_addr_hi32 = start_addr >> 32;
+    #endif
 
     /* reset vector */
     uint32_t reset_vec[11] = {
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
 #endif
         0x00028067,                    /*     jr     t0 */
         start_addr,                    /* start: .dword */
-        0x00000000,
+        start_addr_hi32,
         fdt_load_addr,                 /* fdt_laddr: .dword */
         0x00000000,
                                        /* fw_dyn: */
-- 
2.27.0

From: Bin Meng <bin.meng@windriver.com>

At present the size of Mask ROM for sifive_u / spike / virt machines
is set to 0x11000, which ends at an unusual address. This changes the
size to 0xf000 so that it ends at 0x10000.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <1594289144-24723-1-git-send-email-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/sifive_u.c | 2 +-
 hw/riscv/spike.c    | 2 +-
 hw/riscv/virt.c     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
     hwaddr size;
 } sifive_u_memmap[] = {
     [SIFIVE_U_DEBUG] =    {        0x0,      0x100 },
-    [SIFIVE_U_MROM] =     {     0x1000,    0x11000 },
+    [SIFIVE_U_MROM] =     {     0x1000,     0xf000 },
     [SIFIVE_U_CLINT] =    {  0x2000000,    0x10000 },
     [SIFIVE_U_L2LIM] =    {  0x8000000,  0x2000000 },
     [SIFIVE_U_PLIC] =     {  0xc000000,  0x4000000 },
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
     hwaddr base;
     hwaddr size;
 } spike_memmap[] = {
-    [SPIKE_MROM] =     {     0x1000,    0x11000 },
+    [SPIKE_MROM] =     {     0x1000,     0xf000 },
     [SPIKE_CLINT] =    {  0x2000000,    0x10000 },
     [SPIKE_DRAM] =     { 0x80000000,        0x0 },
 };
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static const struct MemmapEntry {
     hwaddr size;
 } virt_memmap[] = {
     [VIRT_DEBUG] =       {        0x0,         0x100 },
-    [VIRT_MROM] =        {     0x1000,       0x11000 },
+    [VIRT_MROM] =        {     0x1000,        0xf000 },
     [VIRT_TEST] =        {   0x100000,        0x1000 },
     [VIRT_RTC] =         {   0x101000,        0x1000 },
     [VIRT_CLINT] =       {  0x2000000,       0x10000 },
-- 
2.27.0

From: Frank Chang <frank.chang@sifive.com>

gvec should provide vecop_list to avoid:
"tcg_tcg_assert_listed_vecop: code should not be reached bug" assertion.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20200710104920.13550-2-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.inc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/riscv/insn_trans/trans_rvv.inc.c b/target/riscv/insn_trans/trans_rvv.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.inc.c
+++ b/target/riscv/insn_trans/trans_rvv.inc.c
@@ -XXX,XX +XXX,XX @@ static void gen_rsub_vec(unsigned vece, TCGv_vec r, TCGv_vec a, TCGv_vec b)
 static void tcg_gen_gvec_rsubs(unsigned vece, uint32_t dofs, uint32_t aofs,
                                TCGv_i64 c, uint32_t oprsz, uint32_t maxsz)
 {
+    static const TCGOpcode vecop_list[] = { INDEX_op_sub_vec, 0 };
     static const GVecGen2s rsub_op[4] = {
         { .fni8 = gen_vec_rsub8_i64,
           .fniv = gen_rsub_vec,
           .fno = gen_helper_vec_rsubs8,
+          .opt_opc = vecop_list,
           .vece = MO_8 },
         { .fni8 = gen_vec_rsub16_i64,
           .fniv = gen_rsub_vec,
           .fno = gen_helper_vec_rsubs16,
+          .opt_opc = vecop_list,
           .vece = MO_16 },
         { .fni4 = gen_rsub_i32,
           .fniv = gen_rsub_vec,
           .fno = gen_helper_vec_rsubs32,
+          .opt_opc = vecop_list,
           .vece = MO_32 },
         { .fni8 = gen_rsub_i64,
           .fniv = gen_rsub_vec,
           .fno = gen_helper_vec_rsubs64,
+          .opt_opc = vecop_list,
           .prefer_i64 = TCG_TARGET_REG_BITS == 64,
           .vece = MO_64 },
     };
-- 
2.27.0

Conver the Ibex UART to use the recently added qdev-clock functions.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: b0136fad870a29049959ec161c1217b967d7e19d.1594332223.git.alistair.francis@wdc.com
Message-Id: <b0136fad870a29049959ec161c1217b967d7e19d.1594332223.git.alistair.francis@wdc.com>
---
 include/hw/char/ibex_uart.h |  3 +++
 hw/char/ibex_uart.c         | 30 +++++++++++++++++++++++++++---
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/include/hw/char/ibex_uart.h b/include/hw/char/ibex_uart.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/ibex_uart.h
+++ b/include/hw/char/ibex_uart.h
@@ -XXX,XX +XXX,XX @@
 #define IBEX_UART_TIMEOUT_CTRL 0x2c
 
 #define IBEX_UART_TX_FIFO_SIZE 16
+#define IBEX_UART_CLOCK 50000000 /* 50MHz clock */
 
 #define TYPE_IBEX_UART "ibex-uart"
 #define IBEX_UART(obj) \
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint32_t uart_val;
     uint32_t uart_timeout_ctrl;
 
+    Clock *f_clk;
+
     CharBackend chr;
     qemu_irq tx_watermark;
     qemu_irq rx_watermark;
diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/ibex_uart.c
+++ b/hw/char/ibex_uart.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/char/ibex_uart.h"
 #include "hw/irq.h"
+#include "hw/qdev-clock.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
 #include "qemu/log.h"
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_reset(DeviceState *dev)
     ibex_uart_update_irqs(s);
 }
 
+static uint64_t ibex_uart_get_baud(IbexUartState *s)
+{
+    uint64_t baud;
+
+    baud = ((s->uart_ctrl & UART_CTRL_NCO) >> 16);
+    baud *= clock_get_hz(s->f_clk);
+    baud >>= 20;
+
+    return baud;
+}
+
 static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
                                        unsigned int size)
 {
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr,
                           "%s: UART_CTRL_RXBLVL is not supported\n", __func__);
         }
         if (value & UART_CTRL_NCO) {
-            uint64_t baud = ((value & UART_CTRL_NCO) >> 16);
-            baud *= 1000;
-            baud >>= 20;
+            uint64_t baud = ibex_uart_get_baud(s);
 
             s->char_tx_time = (NANOSECONDS_PER_SECOND / baud) * 10;
         }
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr,
     }
 }
 
+static void ibex_uart_clk_update(void *opaque)
+{
+    IbexUartState *s = opaque;
+
+    /* recompute uart's speed on clock change */
+    uint64_t baud = ibex_uart_get_baud(s);
+
+    s->char_tx_time = (NANOSECONDS_PER_SECOND / baud) * 10;
+}
+
 static void fifo_trigger_update(void *opaque)
 {
     IbexUartState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_init(Object *obj)
 {
     IbexUartState *s = IBEX_UART(obj);
 
+    s->f_clk = qdev_init_clock_in(DEVICE(obj), "f_clock",
+                                  ibex_uart_clk_update, s);
+    clock_set_hz(s->f_clk, IBEX_UART_CLOCK);
+
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->tx_watermark);
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->rx_watermark);
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->tx_empty);
-- 
2.27.0

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 06372c9cdeec715077899e71c858d9f0a2a3395b.1594332223.git.alistair.francis@wdc.com
Message-Id: <06372c9cdeec715077899e71c858d9f0a2a3395b.1594332223.git.alistair.francis@wdc.com>
---
 include/hw/char/ibex_uart.h |  76 ++++++++++-----------
 hw/char/ibex_uart.c         | 130 ++++++++++++++++++------------------
 2 files changed, 100 insertions(+), 106 deletions(-)

diff --git a/include/hw/char/ibex_uart.h b/include/hw/char/ibex_uart.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/ibex_uart.h
+++ b/include/hw/char/ibex_uart.h
@@ -XXX,XX +XXX,XX @@
 #define HW_IBEX_UART_H
 
 #include "hw/sysbus.h"
+#include "hw/registerfields.h"
 #include "chardev/char-fe.h"
 #include "qemu/timer.h"
 
-#define IBEX_UART_INTR_STATE   0x00
-    #define INTR_STATE_TX_WATERMARK (1 << 0)
-    #define INTR_STATE_RX_WATERMARK (1 << 1)
-    #define INTR_STATE_TX_EMPTY     (1 << 2)
-    #define INTR_STATE_RX_OVERFLOW  (1 << 3)
-#define IBEX_UART_INTR_ENABLE  0x04
-#define IBEX_UART_INTR_TEST    0x08
-
-#define IBEX_UART_CTRL         0x0c
-    #define UART_CTRL_TX_ENABLE     (1 << 0)
-    #define UART_CTRL_RX_ENABLE     (1 << 1)
-    #define UART_CTRL_NF            (1 << 2)
-    #define UART_CTRL_SLPBK         (1 << 4)
-    #define UART_CTRL_LLPBK         (1 << 5)
-    #define UART_CTRL_PARITY_EN     (1 << 6)
-    #define UART_CTRL_PARITY_ODD    (1 << 7)
-    #define UART_CTRL_RXBLVL        (3 << 8)
-    #define UART_CTRL_NCO           (0xFFFF << 16)
-
-#define IBEX_UART_STATUS       0x10
-    #define UART_STATUS_TXFULL  (1 << 0)
-    #define UART_STATUS_RXFULL  (1 << 1)
-    #define UART_STATUS_TXEMPTY (1 << 2)
-    #define UART_STATUS_RXIDLE  (1 << 4)
-    #define UART_STATUS_RXEMPTY (1 << 5)
-
-#define IBEX_UART_RDATA        0x14
-#define IBEX_UART_WDATA        0x18
-
-#define IBEX_UART_FIFO_CTRL    0x1c
-    #define FIFO_CTRL_RXRST          (1 << 0)
-    #define FIFO_CTRL_TXRST          (1 << 1)
-    #define FIFO_CTRL_RXILVL         (7 << 2)
-    #define FIFO_CTRL_RXILVL_SHIFT   (2)
-    #define FIFO_CTRL_TXILVL         (3 << 5)
-    #define FIFO_CTRL_TXILVL_SHIFT   (5)
-
-#define IBEX_UART_FIFO_STATUS  0x20
-#define IBEX_UART_OVRD         0x24
-#define IBEX_UART_VAL          0x28
-#define IBEX_UART_TIMEOUT_CTRL 0x2c
+REG32(INTR_STATE, 0x00)
+    FIELD(INTR_STATE, TX_WATERMARK, 0, 1)
+    FIELD(INTR_STATE, RX_WATERMARK, 1, 1)
+    FIELD(INTR_STATE, TX_EMPTY, 2, 1)
+    FIELD(INTR_STATE, RX_OVERFLOW, 3, 1)
+REG32(INTR_ENABLE, 0x04)
+REG32(INTR_TEST, 0x08)
+REG32(CTRL, 0x0C)
+    FIELD(CTRL, TX_ENABLE, 0, 1)
+    FIELD(CTRL, RX_ENABLE, 1, 1)
+    FIELD(CTRL, NF, 2, 1)
+    FIELD(CTRL, SLPBK, 4, 1)
+    FIELD(CTRL, LLPBK, 5, 1)
+    FIELD(CTRL, PARITY_EN, 6, 1)
+    FIELD(CTRL, PARITY_ODD, 7, 1)
+    FIELD(CTRL, RXBLVL, 8, 2)
+    FIELD(CTRL, NCO, 16, 16)
+REG32(STATUS, 0x10)
+    FIELD(STATUS, TXFULL, 0, 1)
+    FIELD(STATUS, RXFULL, 1, 1)
+    FIELD(STATUS, TXEMPTY, 2, 1)
+    FIELD(STATUS, RXIDLE, 4, 1)
+    FIELD(STATUS, RXEMPTY, 5, 1)
+REG32(RDATA, 0x14)
+REG32(WDATA, 0x18)
+REG32(FIFO_CTRL, 0x1c)
+    FIELD(FIFO_CTRL, RXRST, 0, 1)
+    FIELD(FIFO_CTRL, TXRST, 1, 1)
+    FIELD(FIFO_CTRL, RXILVL, 2, 3)
+    FIELD(FIFO_CTRL, TXILVL, 5, 2)
+REG32(FIFO_STATUS, 0x20)
+REG32(OVRD, 0x24)
+REG32(VAL, 0x28)
+REG32(TIMEOUT_CTRL, 0x2c)
 
 #define IBEX_UART_TX_FIFO_SIZE 16
 #define IBEX_UART_CLOCK 50000000 /* 50MHz clock */
diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/ibex_uart.c
+++ b/hw/char/ibex_uart.c
@@ -XXX,XX +XXX,XX @@
 
 static void ibex_uart_update_irqs(IbexUartState *s)
 {
-    if (s->uart_intr_state & s->uart_intr_enable & INTR_STATE_TX_WATERMARK) {
+    if (s->uart_intr_state & s->uart_intr_enable & R_INTR_STATE_TX_WATERMARK_MASK) {
         qemu_set_irq(s->tx_watermark, 1);
     } else {
         qemu_set_irq(s->tx_watermark, 0);
     }
 
-    if (s->uart_intr_state & s->uart_intr_enable & INTR_STATE_RX_WATERMARK) {
+    if (s->uart_intr_state & s->uart_intr_enable & R_INTR_STATE_RX_WATERMARK_MASK) {
         qemu_set_irq(s->rx_watermark, 1);
     } else {
         qemu_set_irq(s->rx_watermark, 0);
     }
 
-    if (s->uart_intr_state & s->uart_intr_enable & INTR_STATE_TX_EMPTY) {
+    if (s->uart_intr_state & s->uart_intr_enable & R_INTR_STATE_TX_EMPTY_MASK) {
         qemu_set_irq(s->tx_empty, 1);
     } else {
         qemu_set_irq(s->tx_empty, 0);
     }
 
-    if (s->uart_intr_state & s->uart_intr_enable & INTR_STATE_RX_OVERFLOW) {
+    if (s->uart_intr_state & s->uart_intr_enable & R_INTR_STATE_RX_OVERFLOW_MASK) {
         qemu_set_irq(s->rx_overflow, 1);
     } else {
         qemu_set_irq(s->rx_overflow, 0);
@@ -XXX,XX +XXX,XX @@ static int ibex_uart_can_receive(void *opaque)
 {
     IbexUartState *s = opaque;
 
-    if (s->uart_ctrl & UART_CTRL_RX_ENABLE) {
+    if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
         return 1;
     }
 
@@ -XXX,XX +XXX,XX @@ static int ibex_uart_can_receive(void *opaque)
 static void ibex_uart_receive(void *opaque, const uint8_t *buf, int size)
 {
     IbexUartState *s = opaque;
-    uint8_t rx_fifo_level = (s->uart_fifo_ctrl & FIFO_CTRL_RXILVL)
-                            >> FIFO_CTRL_RXILVL_SHIFT;
+    uint8_t rx_fifo_level = (s->uart_fifo_ctrl & R_FIFO_CTRL_RXILVL_MASK)
+                            >> R_FIFO_CTRL_RXILVL_SHIFT;
 
     s->uart_rdata = *buf;
 
-    s->uart_status &= ~UART_STATUS_RXIDLE;
-    s->uart_status &= ~UART_STATUS_RXEMPTY;
+    s->uart_status &= ~R_STATUS_RXIDLE_MASK;
+    s->uart_status &= ~R_STATUS_RXEMPTY_MASK;
 
     if (size > rx_fifo_level) {
-        s->uart_intr_state |= INTR_STATE_RX_WATERMARK;
+        s->uart_intr_state |= R_INTR_STATE_RX_WATERMARK_MASK;
     }
 
     ibex_uart_update_irqs(s);
@@ -XXX,XX +XXX,XX @@ static gboolean ibex_uart_xmit(GIOChannel *chan, GIOCondition cond,
                                void *opaque)
 {
     IbexUartState *s = opaque;
-    uint8_t tx_fifo_level = (s->uart_fifo_ctrl & FIFO_CTRL_TXILVL)
-                            >> FIFO_CTRL_TXILVL_SHIFT;
+    uint8_t tx_fifo_level = (s->uart_fifo_ctrl & R_FIFO_CTRL_TXILVL_MASK)
+                            >> R_FIFO_CTRL_TXILVL_SHIFT;
     int ret;
 
     /* instant drain the fifo when there's no back-end */
@@ -XXX,XX +XXX,XX @@ static gboolean ibex_uart_xmit(GIOChannel *chan, GIOCondition cond,
     }
 
     if (!s->tx_level) {
-        s->uart_status &= ~UART_STATUS_TXFULL;
-        s->uart_status |= UART_STATUS_TXEMPTY;
-        s->uart_intr_state |= INTR_STATE_TX_EMPTY;
-        s->uart_intr_state &= ~INTR_STATE_TX_WATERMARK;
+        s->uart_status &= ~R_STATUS_TXFULL_MASK;
+        s->uart_status |= R_STATUS_TXEMPTY_MASK;
+        s->uart_intr_state |= R_INTR_STATE_TX_EMPTY_MASK;
+        s->uart_intr_state &= ~R_INTR_STATE_TX_WATERMARK_MASK;
         ibex_uart_update_irqs(s);
         return FALSE;
     }
@@ -XXX,XX +XXX,XX @@ static gboolean ibex_uart_xmit(GIOChannel *chan, GIOCondition cond,
 
     /* Clear the TX Full bit */
     if (s->tx_level != IBEX_UART_TX_FIFO_SIZE) {
-        s->uart_status &= ~UART_STATUS_TXFULL;
+        s->uart_status &= ~R_STATUS_TXFULL_MASK;
     }
 
     /* Disable the TX_WATERMARK IRQ */
     if (s->tx_level < tx_fifo_level) {
-        s->uart_intr_state &= ~INTR_STATE_TX_WATERMARK;
+        s->uart_intr_state &= ~R_INTR_STATE_TX_WATERMARK_MASK;
     }
 
     /* Set TX empty */
     if (s->tx_level == 0) {
-        s->uart_status |= UART_STATUS_TXEMPTY;
-        s->uart_intr_state |= INTR_STATE_TX_EMPTY;
+        s->uart_status |= R_STATUS_TXEMPTY_MASK;
+        s->uart_intr_state |= R_INTR_STATE_TX_EMPTY_MASK;
     }
 
     ibex_uart_update_irqs(s);
@@ -XXX,XX +XXX,XX @@ static void uart_write_tx_fifo(IbexUartState *s, const uint8_t *buf,
                                int size)
 {
     uint64_t current_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-    uint8_t tx_fifo_level = (s->uart_fifo_ctrl & FIFO_CTRL_TXILVL)
-                            >> FIFO_CTRL_TXILVL_SHIFT;
+    uint8_t tx_fifo_level = (s->uart_fifo_ctrl & R_FIFO_CTRL_TXILVL_MASK)
+                            >> R_FIFO_CTRL_TXILVL_SHIFT;
 
     if (size > IBEX_UART_TX_FIFO_SIZE - s->tx_level) {
         size = IBEX_UART_TX_FIFO_SIZE - s->tx_level;
@@ -XXX,XX +XXX,XX @@ static void uart_write_tx_fifo(IbexUartState *s, const uint8_t *buf,
     s->tx_level += size;
 
     if (s->tx_level > 0) {
-        s->uart_status &= ~UART_STATUS_TXEMPTY;
+        s->uart_status &= ~R_STATUS_TXEMPTY_MASK;
     }
 
     if (s->tx_level >= tx_fifo_level) {
-        s->uart_intr_state |= INTR_STATE_TX_WATERMARK;
+        s->uart_intr_state |= R_INTR_STATE_TX_WATERMARK_MASK;
         ibex_uart_update_irqs(s);
     }
 
     if (s->tx_level == IBEX_UART_TX_FIFO_SIZE) {
-        s->uart_status |= UART_STATUS_TXFULL;
+        s->uart_status |= R_STATUS_TXFULL_MASK;
     }
 
     timer_mod(s->fifo_trigger_handle, current_time +
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_get_baud(IbexUartState *s)
 {
     uint64_t baud;
 
-    baud = ((s->uart_ctrl & UART_CTRL_NCO) >> 16);
+    baud = ((s->uart_ctrl & R_CTRL_NCO_MASK) >> 16);
     baud *= clock_get_hz(s->f_clk);
     baud >>= 20;
 
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
     IbexUartState *s = opaque;
     uint64_t retvalue = 0;
 
-    switch (addr) {
-    case IBEX_UART_INTR_STATE:
+    switch (addr >> 2) {
+    case R_INTR_STATE:
         retvalue = s->uart_intr_state;
         break;
-    case IBEX_UART_INTR_ENABLE:
+    case R_INTR_ENABLE:
         retvalue = s->uart_intr_enable;
         break;
-    case IBEX_UART_INTR_TEST:
+    case R_INTR_TEST:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: wdata is write only\n", __func__);
         break;
 
-    case IBEX_UART_CTRL:
+    case R_CTRL:
         retvalue = s->uart_ctrl;
         break;
-    case IBEX_UART_STATUS:
+    case R_STATUS:
         retvalue = s->uart_status;
         break;
 
-    case IBEX_UART_RDATA:
+    case R_RDATA:
         retvalue = s->uart_rdata;
-        if (s->uart_ctrl & UART_CTRL_RX_ENABLE) {
+        if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
             qemu_chr_fe_accept_input(&s->chr);
 
-            s->uart_status |= UART_STATUS_RXIDLE;
-            s->uart_status |= UART_STATUS_RXEMPTY;
+            s->uart_status |= R_STATUS_RXIDLE_MASK;
+            s->uart_status |= R_STATUS_RXEMPTY_MASK;
         }
         break;
-    case IBEX_UART_WDATA:
+    case R_WDATA:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: wdata is write only\n", __func__);
         break;
 
-    case IBEX_UART_FIFO_CTRL:
+    case R_FIFO_CTRL:
         retvalue = s->uart_fifo_ctrl;
         break;
-    case IBEX_UART_FIFO_STATUS:
+    case R_FIFO_STATUS:
         retvalue = s->uart_fifo_status;
 
         retvalue |= s->tx_level & 0x1F;
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
                       "%s: RX fifos are not supported\n", __func__);
         break;
 
-    case IBEX_UART_OVRD:
+    case R_OVRD:
         retvalue = s->uart_ovrd;
         qemu_log_mask(LOG_UNIMP,
                       "%s: ovrd is not supported\n", __func__);
         break;
-    case IBEX_UART_VAL:
+    case R_VAL:
         retvalue = s->uart_val;
         qemu_log_mask(LOG_UNIMP,
                       "%s: val is not supported\n", __func__);
         break;
-    case IBEX_UART_TIMEOUT_CTRL:
+    case R_TIMEOUT_CTRL:
         retvalue = s->uart_timeout_ctrl;
         qemu_log_mask(LOG_UNIMP,
                       "%s: timeout_ctrl is not supported\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr,
     IbexUartState *s = opaque;
     uint32_t value = val64;
 
-    switch (addr) {
-    case IBEX_UART_INTR_STATE:
+    switch (addr >> 2) {
+    case R_INTR_STATE:
         /* Write 1 clear */
         s->uart_intr_state &= ~value;
         ibex_uart_update_irqs(s);
         break;
-    case IBEX_UART_INTR_ENABLE:
+    case R_INTR_ENABLE:
         s->uart_intr_enable = value;
         ibex_uart_update_irqs(s);
         break;
-    case IBEX_UART_INTR_TEST:
+    case R_INTR_TEST:
         s->uart_intr_state |= value;
         ibex_uart_update_irqs(s);
         break;
 
-    case IBEX_UART_CTRL:
+    case R_CTRL:
         s->uart_ctrl = value;
 
-        if (value & UART_CTRL_NF) {
+        if (value & R_CTRL_NF_MASK) {
             qemu_log_mask(LOG_UNIMP,
                           "%s: UART_CTRL_NF is not supported\n", __func__);
         }
-        if (value & UART_CTRL_SLPBK) {
+        if (value & R_CTRL_SLPBK_MASK) {
             qemu_log_mask(LOG_UNIMP,
                           "%s: UART_CTRL_SLPBK is not supported\n", __func__);
         }
-        if (value & UART_CTRL_LLPBK) {
+        if (value & R_CTRL_LLPBK_MASK) {
             qemu_log_mask(LOG_UNIMP,
                           "%s: UART_CTRL_LLPBK is not supported\n", __func__);
         }
-        if (value & UART_CTRL_PARITY_EN) {
+        if (value & R_CTRL_PARITY_EN_MASK) {
             qemu_log_mask(LOG_UNIMP,
                           "%s: UART_CTRL_PARITY_EN is not supported\n",
                           __func__);
         }
-        if (value & UART_CTRL_PARITY_ODD) {
+        if (value & R_CTRL_PARITY_ODD_MASK) {
             qemu_log_mask(LOG_UNIMP,
                           "%s: UART_CTRL_PARITY_ODD is not supported\n",
                           __func__);
         }
-        if (value & UART_CTRL_RXBLVL) {
+        if (value & R_CTRL_RXBLVL_MASK) {
             qemu_log_mask(LOG_UNIMP,
                           "%s: UART_CTRL_RXBLVL is not supported\n", __func__);
         }
-        if (value & UART_CTRL_NCO) {
+        if (value & R_CTRL_NCO_MASK) {
             uint64_t baud = ibex_uart_get_baud(s);
 
             s->char_tx_time = (NANOSECONDS_PER_SECOND / baud) * 10;
         }
         break;
-    case IBEX_UART_STATUS:
+    case R_STATUS:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: status is read only\n", __func__);
         break;
 
-    case IBEX_UART_RDATA:
+    case R_RDATA:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: rdata is read only\n", __func__);
         break;
-    case IBEX_UART_WDATA:
+    case R_WDATA:
         uart_write_tx_fifo(s, (uint8_t *) &value, 1);
         break;
 
-    case IBEX_UART_FIFO_CTRL:
+    case R_FIFO_CTRL:
         s->uart_fifo_ctrl = value;
 
-        if (value & FIFO_CTRL_RXRST) {
+        if (value & R_FIFO_CTRL_RXRST_MASK) {
             qemu_log_mask(LOG_UNIMP,
                           "%s: RX fifos are not supported\n", __func__);
         }
-        if (value & FIFO_CTRL_TXRST) {
+        if (value & R_FIFO_CTRL_TXRST_MASK) {
             s->tx_level = 0;
         }
         break;
-    case IBEX_UART_FIFO_STATUS:
+    case R_FIFO_STATUS:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: fifo_status is read only\n", __func__);
         break;
 
-    case IBEX_UART_OVRD:
+    case R_OVRD:
         s->uart_ovrd = value;
         qemu_log_mask(LOG_UNIMP,
                       "%s: ovrd is not supported\n", __func__);
         break;
-    case IBEX_UART_VAL:
+    case R_VAL:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: val is read only\n", __func__);
         break;
-    case IBEX_UART_TIMEOUT_CTRL:
+    case R_TIMEOUT_CTRL:
         s->uart_timeout_ctrl = value;
         qemu_log_mask(LOG_UNIMP,
                       "%s: timeout_ctrl is not supported\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void fifo_trigger_update(void *opaque)
 {
     IbexUartState *s = opaque;
 
-    if (s->uart_ctrl & UART_CTRL_TX_ENABLE) {
+    if (s->uart_ctrl & R_CTRL_TX_ENABLE_MASK) {
         ibex_uart_xmit(NULL, G_IO_OUT, s);
     }
 }
-- 
2.27.0

From: Liao Pingfang <liao.pingfang@zte.com.cn>

Remove superfluous breaks, as there is a "return" before them.

Signed-off-by: Liao Pingfang <liao.pingfang@zte.com.cn>
Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <1594600421-22942-1-git-send-email-wang.yi59@zte.com.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tcg/riscv/tcg-target.inc.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/tcg/riscv/tcg-target.inc.c b/tcg/riscv/tcg-target.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.inc.c
+++ b/tcg/riscv/tcg-target.inc.c
@@ -XXX,XX +XXX,XX @@ static bool patch_reloc(tcg_insn_unit *code_ptr, int type,
         break;
     case R_RISCV_JAL:
         return reloc_jimm20(code_ptr, (tcg_insn_unit *)value);
-        break;
     case R_RISCV_CALL:
         return reloc_call(code_ptr, (tcg_insn_unit *)value);
-        break;
     default:
         tcg_abort();
     }
-- 
2.27.0

From: Alexandre Mergnat <amergnat@baylibre.com>

The end address calculation for NA4 mode is wrong because the address
used isn't shifted.

It doesn't watch 4 bytes but a huge range because the end address
calculation is wrong.

The solution is to use the shifted address calculated for start address
variable.

Modifications are tested on Zephyr OS userspace test suite which works
for other RISC-V boards (E31 and E34 core).

Signed-off-by: Alexandre Mergnat <amergnat@baylibre.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200706084550.24117-1-amergnat@baylibre.com
Message-Id: <20200706084550.24117-1-amergnat@baylibre.com>
[ Changes by AF:
 - Improve the commit title and message
]
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
 
     case PMP_AMATCH_NA4:
         sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
-        ea = (this_addr + 4u) - 1u;
+        ea = (sa + 4u) - 1u;
         break;
 
     case PMP_AMATCH_NAPOT:
-- 
2.27.0