Series comparison

-[PULL 00/16] riscv-to-apply queue
+[PULL 00/32] riscv-to-apply queue
-The following changes since commit c95bd5ff1660883d15ad6e0005e4c8571604f51a:
+The following changes since commit a35947f15c0ee695eba3c55248ec8ac3e4e23cca:
-  Merge remote-tracking branch 'remotes/philmd/tags/mips-fixes-20210322' into staging (2021-03-22 14:26:13 +0000)
+  Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-updates-070621-2' into staging (2021-06-07 15:45:48 +0100)
 are available in the Git repository at:
-  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210322-2
+  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210608-1
-for you to fetch changes up to 9a27f69bd668d9d71674407badc412ce1231c7d5:
+for you to fetch changes up to d2c1a177b138be35cb96216baa870c3564b123e4:
-  target/riscv: Prevent lost illegal instruction exceptions (2021-03-22 21:54:40 -0400)
+  target/riscv: rvb: add b-ext version cpu option (2021-06-08 09:59:46 +1000)
 ----------------------------------------------------------------
-RISC-V PR for 6.0
+Second RISC-V PR for QEMU 6.1
-This PR includes:
+ - Update the PLIC and CLINT DT bindings
- - Fix for vector CSR access
+ - Improve documentation for RISC-V machines
- - Improvements to the Ibex UART device
+ - Support direct kernel boot for microchip_pfsoc
- - PMP improvements and bug fixes
+ - Fix WFI exception behaviour
- - Hypervisor extension bug fixes
+ - Improve CSR printing
- - ramfb support for the virt machine
+ - Initial support for the experimental Bit Manip extension
  - Fast read support for SST flash
  - Improvements to the microchip_pfsoc machine
 ----------------------------------------------------------------
-Alexander Wagner (1):
+Alistair Francis (2):
-      hw/char: disable ibex uart receive if the buffer is full
+      docs/system: Move the RISC-V -bios information to removed
       target/riscv/pmp: Add assert for ePMP operations
-Asherah Connor (2):
+Bin Meng (9):
-      hw/riscv: Add fw_cfg support to virt
+      hw/riscv: sifive_u: Switch to use qemu_fdt_setprop_string_array() helper
-      hw/riscv: allow ramfb on virt
+      hw/riscv: virt: Switch to use qemu_fdt_setprop_string_array() helper
       hw/riscv: Support the official CLINT DT bindings
       hw/riscv: Support the official PLIC DT bindings
       docs/system/riscv: Correct the indentation level of supported devices
       docs/system/riscv: sifive_u: Document '-dtb' usage
       hw/riscv: Use macros for BIOS image names
       hw/riscv: microchip_pfsoc: Support direct kernel boot
       target/riscv: Remove unnecessary riscv_*_names[] declaration
-Bin Meng (3):
+Changbin Du (1):
-      hw/block: m25p80: Support fast read for SST flashes
+      target/riscv: Dump CSR mscratch/sscratch/satp
       hw/riscv: microchip_pfsoc: Map EMMC/SD mux register
       docs/system: riscv: Add documentation for 'microchip-icicle-kit' machine
-Frank Chang (1):
+Frank Chang (6):
-      target/riscv: fix vs() to return proper error code
+      target/riscv: rvb: count bits set
       target/riscv: add gen_shifti() and gen_shiftiw() helper functions
       target/riscv: rvb: single-bit instructions
       target/riscv: rvb: generalized reverse
       target/riscv: rvb: generalized or-combine
       target/riscv: rvb: add b-ext version cpu option
-Georg Kotheimer (6):
+Jose Martins (1):
-      target/riscv: Adjust privilege level for HLV(X)/HSV instructions
+      target/riscv: fix wfi exception behavior
       target/riscv: Make VSTIP and VSEIP read-only in hip
       target/riscv: Use background registers also for MSTATUS_MPV
       target/riscv: Fix read and write accesses to vsip and vsie
       target/riscv: Add proper two-stage lookup exception detection
       target/riscv: Prevent lost illegal instruction exceptions
-Jim Shu (3):
+Kito Cheng (11):
-      target/riscv: propagate PMP permission to TLB page
+      target/riscv: reformat @sh format encoding for B-extension
-      target/riscv: add log of PMP permission checking
+      target/riscv: rvb: count leading/trailing zeros
-      target/riscv: flush TLB pages if PMP permission has been changed
+      target/riscv: rvb: logic-with-negate
       target/riscv: rvb: pack two words into one register
       target/riscv: rvb: min/max instructions
       target/riscv: rvb: sign-extend instructions
       target/riscv: rvb: shift ones
       target/riscv: rvb: rotate (left/right)
       target/riscv: rvb: address calculation
       target/riscv: rvb: add/shift with prefix zero-extend
       target/riscv: rvb: support and turn on B-extension from command line
- docs/system/riscv/microchip-icicle-kit.rst |  89 ++++++++++++++
+LIU Zhiwei (1):
- docs/system/target-riscv.rst               |   1 +
+      target/riscv: Pass the same value to oprsz and maxsz.
  include/hw/char/ibex_uart.h                |   4 +
  include/hw/riscv/microchip_pfsoc.h         |   1 +
  include/hw/riscv/virt.h                    |   2 +
  target/riscv/cpu.h                         |   4 +
  target/riscv/pmp.h                         |   4 +-
  hw/block/m25p80.c                          |   3 +
  hw/char/ibex_uart.c                        |  23 +++-
  hw/riscv/microchip_pfsoc.c                 |   6 +
  hw/riscv/virt.c                            |  33 ++++++
  target/riscv/cpu.c                         |   1 +
  target/riscv/cpu_helper.c                  | 144 +++++++++++++++--------
  target/riscv/csr.c                         |  77 +++++++------
  target/riscv/pmp.c                         |  84 ++++++++++----
  target/riscv/translate.c                   | 179 +----------------------------
  hw/riscv/Kconfig                           |   1 +
 files changed, 367 insertions(+), 289 deletions(-)
  create mode 100644 docs/system/riscv/microchip-icicle-kit.rst
+Philippe Mathieu-Daudé (1):
+      target/riscv: Do not include 'pmp.h' in user emulation
+ docs/system/deprecated.rst                 |  19 --
+ docs/system/removed-features.rst           |   5 +
+ docs/system/riscv/microchip-icicle-kit.rst |  50 +++-
+ docs/system/riscv/sifive_u.rst             |  77 +++--
+ docs/system/target-riscv.rst               |  13 +-
+ include/hw/riscv/boot.h                    |   5 +
+ target/riscv/cpu.h                         |   9 +-
+ target/riscv/cpu_bits.h                    |   1 +
+ target/riscv/helper.h                      |   6 +
+ target/riscv/insn32.decode                 |  87 +++++-
+ hw/riscv/microchip_pfsoc.c                 |  81 +++++-
+ hw/riscv/sifive_u.c                        |  24 +-
+ hw/riscv/spike.c                           |  12 +-
+ hw/riscv/virt.c                            |  25 +-
+ target/riscv/bitmanip_helper.c             |  90 ++++++
+ target/riscv/cpu.c                         |  38 ++-
+ target/riscv/op_helper.c                   |  11 +-
+ target/riscv/pmp.c                         |   4 +
+ target/riscv/translate.c                   | 306 ++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvb.c.inc    | 438 +++++++++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvi.c.inc    |  54 +---
+ target/riscv/insn_trans/trans_rvv.c.inc    |  89 +++---
+ target/riscv/meson.build                   |   1 +
+files changed, 1260 insertions(+), 185 deletions(-)
+ create mode 100644 target/riscv/bitmanip_helper.c
+ create mode 100644 target/riscv/insn_trans/trans_rvb.c.inc

-New patch
+[PULL 01/32] hw/riscv: sifive_u: Switch to use qemu_fdt_setprop_string_array() helper
+From: Bin Meng <bin.meng@windriver.com>
+Since commit 78da6a1bca22 ("device_tree: add qemu_fdt_setprop_string_array helper"),
+we can use the new helper to set the clock name for the ethernet
+controller node.
+Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20210430071302.1489082-1-bmeng.cn@gmail.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/riscv/sifive_u.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/sifive_u.c
++++ b/hw/riscv/sifive_u.c
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
+     int cpu;
+     uint32_t *cells;
+     char *nodename;
+-    char ethclk_names[] = "pclk\0hclk";
+     uint32_t plic_phandle, prci_phandle, gpio_phandle, phandle = 1;
+     uint32_t hfclk_phandle, rtcclk_phandle, phy_phandle;
++    static const char * const ethclk_names[2] = { "pclk", "hclk" };
+     if (ms->dtb) {
+         fdt = s->fdt = load_device_tree(ms->dtb, &s->fdt_size);
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
+     qemu_fdt_setprop_cell(fdt, nodename, "interrupts", SIFIVE_U_GEM_IRQ);
+     qemu_fdt_setprop_cells(fdt, nodename, "clocks",
+         prci_phandle, PRCI_CLK_GEMGXLPLL, prci_phandle, PRCI_CLK_GEMGXLPLL);
+-    qemu_fdt_setprop(fdt, nodename, "clock-names", ethclk_names,
+-        sizeof(ethclk_names));
++    qemu_fdt_setprop_string_array(fdt, nodename, "clock-names",
++        (char **)&ethclk_names, ARRAY_SIZE(ethclk_names));
+     qemu_fdt_setprop(fdt, nodename, "local-mac-address",
+         s->soc.gem.conf.macaddr.a, ETH_ALEN);
+     qemu_fdt_setprop_cell(fdt, nodename, "#address-cells", 1);
+--
+.31.1

-[PULL 10/16] hw/riscv: allow ramfb on virt
+[PULL 02/32] hw/riscv: virt: Switch to use qemu_fdt_setprop_string_array() helper
-From: Asherah Connor <ashe@kivikakk.ee>
+From: Bin Meng <bin.meng@windriver.com>
-Allow ramfb on virt.  This lets `-device ramfb' work.
+Since commit 78da6a1bca22 ("device_tree: add qemu_fdt_setprop_string_array helper"),
 we can use the new helper to set the compatible strings for the
 SiFive test device node.
-Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
+Signed-off-by: Bin Meng <bin.meng@windriver.com>
 Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210318235041.17175-3-ashe@kivikakk.ee
+Message-id: 20210430071302.1489082-2-bmeng.cn@gmail.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 3 +++
+ hw/riscv/virt.c | 7 +++++--
-file changed, 3 insertions(+)
+file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
- #include "sysemu/sysemu.h"
+         (long)memmap[VIRT_TEST].base);
- #include "hw/pci/pci.h"
+     qemu_fdt_add_subnode(fdt, name);
- #include "hw/pci-host/gpex.h"
+     {
-+#include "hw/display/ramfb.h"
+-        const char compat[] = "sifive,test1\0sifive,test0\0syscon";
+-        qemu_fdt_setprop(fdt, name, "compatible", compat, sizeof(compat));
- static const MemMapEntry virt_memmap[] = {
++        static const char * const compat[3] = {
-     [VIRT_DEBUG] =       {        0x0,         0x100 },
++            "sifive,test1", "sifive,test0", "syscon"
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
++        };
-     mc->cpu_index_to_instance_props = riscv_numa_cpu_index_to_props;
++        qemu_fdt_setprop_string_array(fdt, name, "compatible", (char **)&compat,
-     mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
++                                      ARRAY_SIZE(compat));
-     mc->numa_mem_supported = true;
+     }
-+
+     qemu_fdt_setprop_cells(fdt, name, "reg",
-+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
+x0, memmap[VIRT_TEST].base,
  }
  static const TypeInfo virt_machine_typeinfo = {
 --
-.30.1
+.31.1

-New patch
+[PULL 03/32] hw/riscv: Support the official CLINT DT bindings
+From: Bin Meng <bin.meng@windriver.com>
+Linux kernel commit a2770b57d083 ("dt-bindings: timer: Add CLINT bindings")
+adds the official DT bindings for CLINT, which uses "sifive,clint0"
+as the compatible string. "riscv,clint0" is now legacy and has to
+be kept for backward compatibility of legacy systems.
+Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20210430071302.1489082-3-bmeng.cn@gmail.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/riscv/sifive_u.c | 6 +++++-
+ hw/riscv/spike.c    | 6 +++++-
+ hw/riscv/virt.c     | 6 +++++-
+files changed, 15 insertions(+), 3 deletions(-)
+diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/sifive_u.c
++++ b/hw/riscv/sifive_u.c
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
+     uint32_t plic_phandle, prci_phandle, gpio_phandle, phandle = 1;
+     uint32_t hfclk_phandle, rtcclk_phandle, phy_phandle;
+     static const char * const ethclk_names[2] = { "pclk", "hclk" };
++    static const char * const clint_compat[2] = {
++        "sifive,clint0", "riscv,clint0"
++    };
+     if (ms->dtb) {
+         fdt = s->fdt = load_device_tree(ms->dtb, &s->fdt_size);
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
+     nodename = g_strdup_printf("/soc/clint@%lx",
+         (long)memmap[SIFIVE_U_DEV_CLINT].base);
+     qemu_fdt_add_subnode(fdt, nodename);
+-    qemu_fdt_setprop_string(fdt, nodename, "compatible", "riscv,clint0");
++    qemu_fdt_setprop_string_array(fdt, nodename, "compatible",
++        (char **)&clint_compat, ARRAY_SIZE(clint_compat));
+     qemu_fdt_setprop_cells(fdt, nodename, "reg",
+x0, memmap[SIFIVE_U_DEV_CLINT].base,
+x0, memmap[SIFIVE_U_DEV_CLINT].size);
+diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/spike.c
++++ b/hw/riscv/spike.c
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
+     uint32_t cpu_phandle, intc_phandle, phandle = 1;
+     char *name, *mem_name, *clint_name, *clust_name;
+     char *core_name, *cpu_name, *intc_name;
++    static const char * const clint_compat[2] = {
++        "sifive,clint0", "riscv,clint0"
++    };
+     fdt = s->fdt = create_device_tree(&s->fdt_size);
+     if (!fdt) {
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
+             (memmap[SPIKE_CLINT].size * socket);
+         clint_name = g_strdup_printf("/soc/clint@%lx", clint_addr);
+         qemu_fdt_add_subnode(fdt, clint_name);
+-        qemu_fdt_setprop_string(fdt, clint_name, "compatible", "riscv,clint0");
++        qemu_fdt_setprop_string_array(fdt, clint_name, "compatible",
++            (char **)&clint_compat, ARRAY_SIZE(clint_compat));
+         qemu_fdt_setprop_cells(fdt, clint_name, "reg",
+x0, clint_addr, 0x0, memmap[SPIKE_CLINT].size);
+         qemu_fdt_setprop(fdt, clint_name, "interrupts-extended",
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/virt.c
++++ b/hw/riscv/virt.c
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
+     char *name, *clint_name, *plic_name, *clust_name;
+     hwaddr flashsize = virt_memmap[VIRT_FLASH].size / 2;
+     hwaddr flashbase = virt_memmap[VIRT_FLASH].base;
++    static const char * const clint_compat[2] = {
++        "sifive,clint0", "riscv,clint0"
++    };
+     if (mc->dtb) {
+         fdt = mc->fdt = load_device_tree(mc->dtb, &s->fdt_size);
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
+             (memmap[VIRT_CLINT].size * socket);
+         clint_name = g_strdup_printf("/soc/clint@%lx", clint_addr);
+         qemu_fdt_add_subnode(fdt, clint_name);
+-        qemu_fdt_setprop_string(fdt, clint_name, "compatible", "riscv,clint0");
++        qemu_fdt_setprop_string_array(fdt, clint_name, "compatible",
++            (char **)&clint_compat, ARRAY_SIZE(clint_compat));
+         qemu_fdt_setprop_cells(fdt, clint_name, "reg",
+x0, clint_addr, 0x0, memmap[VIRT_CLINT].size);
+         qemu_fdt_setprop(fdt, clint_name, "interrupts-extended",
+--
+.31.1

-[PULL 09/16] hw/riscv: Add fw_cfg support to virt
+[PULL 04/32] hw/riscv: Support the official PLIC DT bindings
-From: Asherah Connor <ashe@kivikakk.ee>
+From: Bin Meng <bin.meng@windriver.com>
-Provides fw_cfg for the virt machine on riscv.  This enables
+The official DT bindings of PLIC uses "sifive,plic-1.0.0" as the
-using e.g.  ramfb later.
+compatible string in the upstream Linux kernel. "riscv,plic0" is
 now legacy and has to be kept for backward compatibility of legacy
 systems.
-Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
+Signed-off-by: Bin Meng <bin.meng@windriver.com>
 Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210318235041.17175-2-ashe@kivikakk.ee
+Message-id: 20210430071302.1489082-4-bmeng.cn@gmail.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h |  2 ++
+ hw/riscv/sifive_u.c | 6 +++++-
- hw/riscv/virt.c         | 30 ++++++++++++++++++++++++++++++
+ hw/riscv/virt.c     | 6 +++++-
- hw/riscv/Kconfig        |  1 +
+files changed, 10 insertions(+), 2 deletions(-)
 files changed, 33 insertions(+)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
+diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
+--- a/hw/riscv/sifive_u.c
-+++ b/include/hw/riscv/virt.h
++++ b/hw/riscv/sifive_u.c
-@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
-     RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
+     static const char * const clint_compat[2] = {
-     DeviceState *plic[VIRT_SOCKETS_MAX];
+         "sifive,clint0", "riscv,clint0"
-     PFlashCFI01 *flash[2];
+     };
-+    FWCfgState *fw_cfg;
++    static const char * const plic_compat[2] = {
++        "sifive,plic-1.0.0", "riscv,plic0"
-     int fdt_size;
++    };
- };
-@@ -XXX,XX +XXX,XX @@ enum {
+     if (ms->dtb) {
-     VIRT_PLIC,
+         fdt = s->fdt = load_device_tree(ms->dtb, &s->fdt_size);
-     VIRT_UART0,
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
-     VIRT_VIRTIO,
+         (long)memmap[SIFIVE_U_DEV_PLIC].base);
-+    VIRT_FW_CFG,
+     qemu_fdt_add_subnode(fdt, nodename);
-     VIRT_FLASH,
+     qemu_fdt_setprop_cell(fdt, nodename, "#interrupt-cells", 1);
-     VIRT_DRAM,
+-    qemu_fdt_setprop_string(fdt, nodename, "compatible", "riscv,plic0");
-     VIRT_PCIE_MMIO,
++    qemu_fdt_setprop_string_array(fdt, nodename, "compatible",
 +        (char **)&plic_compat, ARRAY_SIZE(plic_compat));
      qemu_fdt_setprop(fdt, nodename, "interrupt-controller", NULL, 0);
      qemu_fdt_setprop(fdt, nodename, "interrupts-extended",
          cells, (ms->smp.cpus * 4 - 2) * sizeof(uint32_t));
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
-     [VIRT_PLIC] =        {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
+     static const char * const clint_compat[2] = {
-     [VIRT_UART0] =       { 0x10000000,         0x100 },
+         "sifive,clint0", "riscv,clint0"
-     [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
+     };
-+    [VIRT_FW_CFG] =      { 0x10100000,          0x18 },
++    static const char * const plic_compat[2] = {
-     [VIRT_FLASH] =       { 0x20000000,     0x4000000 },
++        "sifive,plic-1.0.0", "riscv,plic0"
-     [VIRT_PCIE_ECAM] =   { 0x30000000,    0x10000000 },
++    };
-     [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
-@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
+     if (mc->dtb) {
-     return dev;
+         fdt = mc->fdt = load_device_tree(mc->dtb, &s->fdt_size);
- }
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
+             "#address-cells", FDT_PLIC_ADDR_CELLS);
-+static FWCfgState *create_fw_cfg(const MachineState *mc)
+         qemu_fdt_setprop_cell(fdt, plic_name,
-+{
+             "#interrupt-cells", FDT_PLIC_INT_CELLS);
-+    hwaddr base = virt_memmap[VIRT_FW_CFG].base;
+-        qemu_fdt_setprop_string(fdt, plic_name, "compatible", "riscv,plic0");
-+    hwaddr size = virt_memmap[VIRT_FW_CFG].size;
++        qemu_fdt_setprop_string_array(fdt, plic_name, "compatible",
-+    FWCfgState *fw_cfg;
++            (char **)&plic_compat, ARRAY_SIZE(plic_compat));
-+    char *nodename;
+         qemu_fdt_setprop(fdt, plic_name, "interrupt-controller", NULL, 0);
-+
+         qemu_fdt_setprop(fdt, plic_name, "interrupts-extended",
-+    fw_cfg = fw_cfg_init_mem_wide(base + 8, base, 8, base + 16,
+             plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
 +                                  &address_space_memory);
 +    fw_cfg_add_i16(fw_cfg, FW_CFG_NB_CPUS, (uint16_t)mc->smp.cpus);
 +
 +    nodename = g_strdup_printf("/fw-cfg@%" PRIx64, base);
 +    qemu_fdt_add_subnode(mc->fdt, nodename);
 +    qemu_fdt_setprop_string(mc->fdt, nodename,
 +                            "compatible", "qemu,fw-cfg-mmio");
 +    qemu_fdt_setprop_sized_cells(mc->fdt, nodename, "reg",
 +                                 2, base, 2, size);
 +    qemu_fdt_setprop(mc->fdt, nodename, "dma-coherent", NULL, 0);
 +    g_free(nodename);
 +    return fw_cfg;
 +}
 +
  static void virt_machine_init(MachineState *machine)
  {
      const MemMapEntry *memmap = virt_memmap;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
          start_addr = virt_memmap[VIRT_FLASH].base;
      }
 +    /*
 +     * Init fw_cfg.  Must be done before riscv_load_fdt, otherwise the device
 +     * tree cannot be altered and we get FDT_ERR_NOSPACE.
 +     */
 +    s->fw_cfg = create_fw_cfg(machine);
 +    rom_set_fw(s->fw_cfg);
 +
      /* Compute the fdt load address in dram */
      fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
                                     machine->ram_size, machine->fdt);
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      select SIFIVE_PLIC
      select SIFIVE_TEST
      select VIRTIO_MMIO
 +    select FW_CFG_DMA
  config SIFIVE_E
      bool
 --
-.30.1
+.31.1

-[PULL 13/16] hw/block: m25p80: Support fast read for SST flashes
+[PULL 05/32] docs/system/riscv: Correct the indentation level of supported devices
 From: Bin Meng <bin.meng@windriver.com>
-Per SST25VF016B datasheet [1], SST flash requires a dummy byte after
+The supported device bullet list has an additional space before each
-the address bytes. Note only SPI mode is supported by SST flashes.
+entry, which makes a wrong indentation level. Correct it.
 [1] http://ww1.microchip.com/downloads/en/devicedoc/s71271_04.pdf
 Signed-off-by: Bin Meng <bin.meng@windriver.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210306060152.7250-1-bmeng.cn@gmail.com
+Message-id: 20210430071302.1489082-5-bmeng.cn@gmail.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/block/m25p80.c | 3 +++
+ docs/system/riscv/microchip-icicle-kit.rst | 20 +++++++--------
-file changed, 3 insertions(+)
+ docs/system/riscv/sifive_u.rst             | 30 +++++++++++-----------
 files changed, 25 insertions(+), 25 deletions(-)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
+diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/docs/system/riscv/microchip-icicle-kit.rst
-+++ b/hw/block/m25p80.c
++++ b/docs/system/riscv/microchip-icicle-kit.rst
-@@ -XXX,XX +XXX,XX @@ static void decode_fast_read_cmd(Flash *s)
+@@ -XXX,XX +XXX,XX @@ Supported devices
-     s->needed_bytes = get_addr_length(s);
-     switch (get_man(s)) {
+ The ``microchip-icicle-kit`` machine supports the following devices:
-     /* Dummy cycles - modeled with bytes writes instead of bits */
-+    case MAN_SST:
+- * 1 E51 core
-+        s->needed_bytes += 1;
+- * 4 U54 cores
-+        break;
+- * Core Level Interruptor (CLINT)
-     case MAN_WINBOND:
+- * Platform-Level Interrupt Controller (PLIC)
-         s->needed_bytes += 8;
+- * L2 Loosely Integrated Memory (L2-LIM)
-         break;
+- * DDR memory controller
 - * 5 MMUARTs
 - * 1 DMA controller
 - * 2 GEM Ethernet controllers
 - * 1 SDHC storage controller
 +* 1 E51 core
 +* 4 U54 cores
 +* Core Level Interruptor (CLINT)
 +* Platform-Level Interrupt Controller (PLIC)
 +* L2 Loosely Integrated Memory (L2-LIM)
 +* DDR memory controller
 +* 5 MMUARTs
 +* 1 DMA controller
 +* 2 GEM Ethernet controllers
 +* 1 SDHC storage controller
  Boot options
  ------------
 diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/riscv/sifive_u.rst
 +++ b/docs/system/riscv/sifive_u.rst
@@ -XXX,XX +XXX,XX @@ Supported devices
  The ``sifive_u`` machine supports the following devices:
 - * 1 E51 / E31 core
 - * Up to 4 U54 / U34 cores
 - * Core Level Interruptor (CLINT)
 - * Platform-Level Interrupt Controller (PLIC)
 - * Power, Reset, Clock, Interrupt (PRCI)
 - * L2 Loosely Integrated Memory (L2-LIM)
 - * DDR memory controller
 - * 2 UARTs
 - * 1 GEM Ethernet controller
 - * 1 GPIO controller
 - * 1 One-Time Programmable (OTP) memory with stored serial number
 - * 1 DMA controller
 - * 2 QSPI controllers
 - * 1 ISSI 25WP256 flash
 - * 1 SD card in SPI mode
 +* 1 E51 / E31 core
 +* Up to 4 U54 / U34 cores
 +* Core Level Interruptor (CLINT)
 +* Platform-Level Interrupt Controller (PLIC)
 +* Power, Reset, Clock, Interrupt (PRCI)
 +* L2 Loosely Integrated Memory (L2-LIM)
 +* DDR memory controller
 +* 2 UARTs
 +* 1 GEM Ethernet controller
 +* 1 GPIO controller
 +* 1 One-Time Programmable (OTP) memory with stored serial number
 +* 1 DMA controller
 +* 2 QSPI controllers
 +* 1 ISSI 25WP256 flash
 +* 1 SD card in SPI mode
  Please note the real world HiFive Unleashed board has a fixed configuration of
 E51 core and 4 U54 core combination and the RISC-V core boots in 64-bit mode.
 --
-.30.1
+.31.1

-[PULL 15/16] docs/system: riscv: Add documentation for 'microchip-icicle-kit' machine
+[PULL 06/32] docs/system/riscv: sifive_u: Document '-dtb' usage
 From: Bin Meng <bin.meng@windriver.com>
-This adds the documentation to describe what is supported for the
+Update the 'sifive_u' machine documentation to mention the '-dtb'
-'microchip-icicle-kit' machine, and how to boot the machine in QEMU.
+option that can be used to pass a custom DTB to QEMU.
 Signed-off-by: Bin Meng <bin.meng@windriver.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210322075248.136255-2-bmeng.cn@gmail.com
+Message-id: 20210430071302.1489082-6-bmeng.cn@gmail.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- docs/system/riscv/microchip-icicle-kit.rst | 89 ++++++++++++++++++++++
+ docs/system/riscv/sifive_u.rst | 47 +++++++++++++++++++++++++++++-----
- docs/system/target-riscv.rst               |  1 +
+file changed, 41 insertions(+), 6 deletions(-)
 files changed, 90 insertions(+)
  create mode 100644 docs/system/riscv/microchip-icicle-kit.rst
-diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
+diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/docs/system/riscv/sifive_u.rst
---- /dev/null
++++ b/docs/system/riscv/sifive_u.rst
-+++ b/docs/system/riscv/microchip-icicle-kit.rst
+@@ -XXX,XX +XXX,XX @@ Hardware configuration information
-@@ -XXX,XX +XXX,XX @@
+ ----------------------------------
-+Microchip PolarFire SoC Icicle Kit (``microchip-icicle-kit``)
-+=============================================================
+ The ``sifive_u`` machine automatically generates a device tree blob ("dtb")
 -which it passes to the guest. This provides information about the addresses,
 -interrupt lines and other configuration of the various devices in the system.
 -Guest software should discover the devices that are present in the generated
 -DTB instead of using a DTB for the real hardware, as some of the devices are
 -not modeled by QEMU and trying to access these devices may cause unexpected
 -behavior.
 +which it passes to the guest, if there is no ``-dtb`` option. This provides
 +information about the addresses, interrupt lines and other configuration of
 +the various devices in the system. Guest software should discover the devices
 +that are present in the generated DTB instead of using a DTB for the real
 +hardware, as some of the devices are not modeled by QEMU and trying to access
 +these devices may cause unexpected behavior.
 +
-+Microchip PolarFire SoC Icicle Kit integrates a PolarFire SoC, with one
++If users want to provide their own DTB, they can use the ``-dtb`` option.
-+SiFive's E51 plus four U54 cores and many on-chip peripherals and an FPGA.
++These DTBs should have the following requirements:
 +
-+For more details about Microchip PolarFire SoC, please see:
++* The /cpus node should contain at least one subnode for E51 and the number
-+https://www.microsemi.com/product-directory/soc-fpgas/5498-polarfire-soc-fpga
++  of subnodes should match QEMU's ``-smp`` option
 +* The /memory reg size should match QEMU’s selected ram_size via ``-m``
 +* Should contain a node for the CLINT device with a compatible string
 +  "riscv,clint0" if using with OpenSBI BIOS images
  Boot options
  ------------
@@ -XXX,XX +XXX,XX @@ To boot the newly built Linux kernel in QEMU with the ``sifive_u`` machine:
        -initrd /path/to/rootfs.ext4 \
        -append "root=/dev/ram"
 +Alternatively, we can use a custom DTB to boot the machine by inserting a CLINT
 +node in fu540-c000.dtsi in the Linux kernel,
 +
-+The Icicle Kit board information can be found here:
++.. code-block:: none
 +https://www.microsemi.com/existing-parts/parts/152514
 +
-+Supported devices
++    clint: clint@2000000 {
-+-----------------
++        compatible = "riscv,clint0";
 +        interrupts-extended = <&cpu0_intc 3 &cpu0_intc 7
 +                               &cpu1_intc 3 &cpu1_intc 7
 +                               &cpu2_intc 3 &cpu2_intc 7
 +                               &cpu3_intc 3 &cpu3_intc 7
 +                               &cpu4_intc 3 &cpu4_intc 7>;
 +        reg = <0x00 0x2000000 0x00 0x10000>;
 +    };
 +
-+The ``microchip-icicle-kit`` machine supports the following devices:
++with the following command line options:
 +
 + * 1 E51 core
 + * 4 U54 cores
 + * Core Level Interruptor (CLINT)
 + * Platform-Level Interrupt Controller (PLIC)
 + * L2 Loosely Integrated Memory (L2-LIM)
 + * DDR memory controller
 + * 5 MMUARTs
 + * 1 DMA controller
 + * 2 GEM Ethernet controllers
 + * 1 SDHC storage controller
 +
 +Boot options
 +------------
 +
 +The ``microchip-icicle-kit`` machine can start using the standard -bios
 +functionality for loading its BIOS image, aka Hart Software Services (HSS_).
 +HSS loads the second stage bootloader U-Boot from an SD card. It does not
 +support direct kernel loading via the -kernel option. One has to load kernel
 +from U-Boot.
 +
 +The memory is set to 1537 MiB by default which is the minimum required high
 +memory size by HSS. A sanity check on ram size is performed in the machine
 +init routine to prompt user to increase the RAM size to > 1537 MiB when less
 +than 1537 MiB ram is detected.
 +
 +Boot the machine
 +----------------
 +
 +HSS 2020.12 release is tested at the time of writing. To build an HSS image
 +that can be booted by the ``microchip-icicle-kit`` machine, type the following
 +in the HSS source tree:
 +
 +.. code-block:: bash
 +
-+  $ export CROSS_COMPILE=riscv64-linux-
++  $ qemu-system-riscv64 -M sifive_u -smp 5 -m 8G \
-+  $ cp boards/mpfs-icicle-kit-es/def_config .config
++      -display none -serial stdio \
-+  $ make BOARD=mpfs-icicle-kit-es
++      -kernel arch/riscv/boot/Image \
 +      -dtb arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dtb \
 +      -initrd /path/to/rootfs.ext4 \
 +      -append "root=/dev/ram"
 +
-+Download the official SD card image released by Microchip and prepare it for
+ To build a Linux mainline kernel that can be booted by the ``sifive_u`` machine
-+QEMU usage:
+ in 32-bit mode, use the rv32_defconfig configuration. A patch is required to
-+
+ fix the 32-bit boot issue for Linux kernel v5.10.
 +.. code-block:: bash
 +
 +  $ wget ftp://ftpsoc.microsemi.com/outgoing/core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
 +  $ gunzip core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
 +  $ qemu-img resize core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic 4G
 +
 +Then we can boot the machine by:
 +
 +.. code-block:: bash
 +
 +  $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 \
 +      -bios path/to/hss.bin -sd path/to/sdcard.img \
 +      -nic user,model=cadence_gem \
 +      -nic tap,ifname=tap,model=cadence_gem,script=no \
 +      -display none -serial stdio \
 +      -chardev socket,id=serial1,path=serial1.sock,server=on,wait=on \
 +      -serial chardev:serial1
 +
 +With above command line, current terminal session will be used for the first
 +serial port. Open another terminal window, and use `minicom` to connect the
 +second serial port.
 +
 +.. code-block:: bash
 +
 +  $ minicom -D unix\#serial1.sock
 +
 +HSS output is on the first serial port (stdio) and U-Boot outputs on the
 +second serial port. U-Boot will automatically load the Linux kernel from
 +the SD card image.
 +
 +.. _HSS: https://github.com/polarfire-soc/hart-software-services
 diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/target-riscv.rst
 +++ b/docs/system/target-riscv.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
  .. toctree::
     :maxdepth: 1
 +   riscv/microchip-icicle-kit
     riscv/sifive_u
  RISC-V CPU features
 --
-.30.1
+.31.1

-[PULL 06/16] target/riscv: Adjust privilege level for HLV(X)/HSV instructions
+[PULL 07/32] hw/riscv: Use macros for BIOS image names
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Bin Meng <bin.meng@windriver.com>
-According to the specification the "field SPVP of hstatus controls the
+The OpenSBI BIOS image names are used by many RISC-V machines.
-privilege level of the access" for the hypervisor virtual-machine load
+Let's define macros for them.
 and store instructions HLV, HLVX and HSV.
-Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+Signed-off-by: Bin Meng <bin.meng@windriver.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210311103005.1400718-1-georg.kotheimer@kernkonzept.com
+Message-id: 20210430071302.1489082-7-bmeng.cn@gmail.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 25 ++++++++++++++-----------
+ include/hw/riscv/boot.h | 5 +++++
-file changed, 14 insertions(+), 11 deletions(-)
+ hw/riscv/sifive_u.c     | 6 ++----
  hw/riscv/spike.c        | 6 ++----
  hw/riscv/virt.c         | 6 ++----
 files changed, 11 insertions(+), 12 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/include/hw/riscv/boot.h
-+++ b/target/riscv/cpu_helper.c
++++ b/include/hw/riscv/boot.h
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
+@@ -XXX,XX +XXX,XX @@
-         use_background = true;
+ #include "hw/loader.h"
  #include "hw/riscv/riscv_hart.h"
 +#define RISCV32_BIOS_BIN    "opensbi-riscv32-generic-fw_dynamic.bin"
 +#define RISCV32_BIOS_ELF    "opensbi-riscv32-generic-fw_dynamic.elf"
 +#define RISCV64_BIOS_BIN    "opensbi-riscv64-generic-fw_dynamic.bin"
 +#define RISCV64_BIOS_ELF    "opensbi-riscv64-generic-fw_dynamic.elf"
 +
  bool riscv_is_32bit(RISCVHartArrayState *harts);
  target_ulong riscv_calc_kernel_start_addr(RISCVHartArrayState *harts,
 diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_u.c
 +++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
      if (riscv_is_32bit(&s->soc.u_cpus)) {
          firmware_end_addr = riscv_find_and_load_firmware(machine,
 -                                    "opensbi-riscv32-generic-fw_dynamic.bin",
 -                                    start_addr, NULL);
 +                                    RISCV32_BIOS_BIN, start_addr, NULL);
      } else {
          firmware_end_addr = riscv_find_and_load_firmware(machine,
 -                                    "opensbi-riscv64-generic-fw_dynamic.bin",
 -                                    start_addr, NULL);
 +                                    RISCV64_BIOS_BIN, start_addr, NULL);
      }
--    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
+     if (machine->kernel_filename) {
-+    /* MPRV does not affect the virtual-machine load/store
+diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
-+       instructions, HLV, HLVX, and HSV. */
+index XXXXXXX..XXXXXXX 100644
-+    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
+--- a/hw/riscv/spike.c
-+        mode = get_field(env->hstatus, HSTATUS_SPVP);
++++ b/hw/riscv/spike.c
-+    } else if (mode == PRV_M && access_type != MMU_INST_FETCH) {
+@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
-         if (get_field(env->mstatus, MSTATUS_MPRV)) {
+      */
-             mode = get_field(env->mstatus, MSTATUS_MPP);
+     if (riscv_is_32bit(&s->soc[0])) {
-         }
+         firmware_end_addr = riscv_find_and_load_firmware(machine,
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+-                                    "opensbi-riscv32-generic-fw_dynamic.elf",
-     qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n",
+-                                    memmap[SPIKE_DRAM].base,
-                   __func__, address, access_type, mmu_idx);
++                                    RISCV32_BIOS_ELF, memmap[SPIKE_DRAM].base,
+                                     htif_symbol_callback);
--    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
+     } else {
--        if (get_field(env->mstatus, MSTATUS_MPRV)) {
+         firmware_end_addr = riscv_find_and_load_firmware(machine,
--            mode = get_field(env->mstatus, MSTATUS_MPP);
+-                                    "opensbi-riscv64-generic-fw_dynamic.elf",
-+    /* MPRV does not affect the virtual-machine load/store
+-                                    memmap[SPIKE_DRAM].base,
-+       instructions, HLV, HLVX, and HSV. */
++                                    RISCV64_BIOS_ELF, memmap[SPIKE_DRAM].base,
-+    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
+                                     htif_symbol_callback);
 +        mode = get_field(env->hstatus, HSTATUS_SPVP);
 +    } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
 +               get_field(env->mstatus, MSTATUS_MPRV)) {
 +        mode = get_field(env->mstatus, MSTATUS_MPP);
 +        if (riscv_has_ext(env, RVH) && get_field(env->mstatus, MSTATUS_MPV)) {
 +            two_stage_lookup = true;
          }
      }
--    if (riscv_has_ext(env, RVH) && env->priv == PRV_M &&
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
--        access_type != MMU_INST_FETCH &&
+index XXXXXXX..XXXXXXX 100644
--        get_field(env->mstatus, MSTATUS_MPRV) &&
+--- a/hw/riscv/virt.c
--        get_field(env->mstatus, MSTATUS_MPV)) {
++++ b/hw/riscv/virt.c
--        two_stage_lookup = true;
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
--    }
--
+     if (riscv_is_32bit(&s->soc[0])) {
-     if (riscv_cpu_virt_enabled(env) ||
+         firmware_end_addr = riscv_find_and_load_firmware(machine,
-         ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
+-                                    "opensbi-riscv32-generic-fw_dynamic.bin",
-          access_type != MMU_INST_FETCH)) {
+-                                    start_addr, NULL);
 +                                    RISCV32_BIOS_BIN, start_addr, NULL);
      } else {
          firmware_end_addr = riscv_find_and_load_firmware(machine,
 -                                    "opensbi-riscv64-generic-fw_dynamic.bin",
 -                                    start_addr, NULL);
 +                                    RISCV64_BIOS_BIN, start_addr, NULL);
      }
      if (machine->kernel_filename) {
 --
-.30.1
+.31.1

-[PULL 14/16] hw/riscv: microchip_pfsoc: Map EMMC/SD mux register
+[PULL 08/32] hw/riscv: microchip_pfsoc: Support direct kernel boot
 From: Bin Meng <bin.meng@windriver.com>
-Since HSS commit c20a89f8dcac, the Icicle Kit reference design has
+At present the Microchip Icicle Kit machine only supports using
-been updated to use a register mapped at 0x4f000000 instead of a
+'-bios' to load the HSS, and does not support '-kernel' for direct
-GPIO to control whether eMMC or SD card is to be used. With this
+kernel booting just like other RISC-V machines do. One has to use
-support the same HSS image can be used for both eMMC and SD card
+U-Boot which is chain-loaded by HSS, to load a kernel for testing.
-boot flow, while previously two different board configurations were
+This is not so convenient.
-used. This is undocumented but one can take a look at the HSS code
-HSS_MMCInit() in services/mmc/mmc_api.c.
+Adding '-kernel' support together with the existing '-bios', we
+follow the following table to select which payload we execute:
-With this commit, HSS image built from 2020.12 release boots again.
   -bios |    -kernel | payload
   ------+------------+--------
       N |          N | HSS
       Y | don't care | HSS
       N |          Y | kernel
 This ensures backwards compatibility with how we used to expose
 '-bios' to users. When '-kernel' is used for direct boot, '-dtb'
 must be present to provide a valid device tree for the board,
 as we don't generate device tree.
 When direct kernel boot is used, the OpenSBI fw_dynamic BIOS image
 is used to boot a payload like U-Boot or OS kernel directly.
 Documentation is updated to describe the direct kernel boot. Note
 as of today there is still no PolarFire SoC support in the upstream
 Linux kernel hence the document does not include instructions for
 that. It will be updated in the future.
 Signed-off-by: Bin Meng <bin.meng@windriver.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210322075248.136255-1-bmeng.cn@gmail.com
+Message-id: 20210430071302.1489082-8-bmeng.cn@gmail.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/microchip_pfsoc.h | 1 +
+ docs/system/riscv/microchip-icicle-kit.rst | 30 ++++++--
- hw/riscv/microchip_pfsoc.c         | 6 ++++++
+ hw/riscv/microchip_pfsoc.c                 | 81 +++++++++++++++++++++-
-files changed, 7 insertions(+)
+files changed, 103 insertions(+), 8 deletions(-)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
+--- a/docs/system/riscv/microchip-icicle-kit.rst
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/docs/system/riscv/microchip-icicle-kit.rst
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ Boot options
-     MICROCHIP_PFSOC_ENVM_DATA,
-     MICROCHIP_PFSOC_QSPI_XIP,
+ The ``microchip-icicle-kit`` machine can start using the standard -bios
-     MICROCHIP_PFSOC_IOSCB,
+ functionality for loading its BIOS image, aka Hart Software Services (HSS_).
-+    MICROCHIP_PFSOC_EMMC_SD_MUX,
+-HSS loads the second stage bootloader U-Boot from an SD card. It does not
-     MICROCHIP_PFSOC_DRAM_LO,
+-support direct kernel loading via the -kernel option. One has to load kernel
-     MICROCHIP_PFSOC_DRAM_LO_ALIAS,
+-from U-Boot.
-     MICROCHIP_PFSOC_DRAM_HI,
++HSS loads the second stage bootloader U-Boot from an SD card. Then a kernel
 +can be loaded from U-Boot. It also supports direct kernel booting via the
 +-kernel option along with the device tree blob via -dtb. When direct kernel
 +boot is used, the OpenSBI fw_dynamic BIOS image is used to boot a payload
 +like U-Boot or OS kernel directly.
 +
 +The user provided DTB should have the following requirements:
 +
 +* The /cpus node should contain at least one subnode for E51 and the number
 +  of subnodes should match QEMU's ``-smp`` option
 +* The /memory reg size should match QEMU’s selected ram_size via ``-m``
 +* Should contain a node for the CLINT device with a compatible string
 +  "riscv,clint0"
 +
 +QEMU follows below truth table to select which payload to execute:
 +
 +=====  ========== =======
 +-bios     -kernel payload
 +=====  ========== =======
 +    N           N     HSS
 +    Y  don't care     HSS
 +    N           Y  kernel
 +=====  ========== =======
  The memory is set to 1537 MiB by default which is the minimum required high
  memory size by HSS. A sanity check on ram size is performed in the machine
  init routine to prompt user to increase the RAM size to > 1537 MiB when less
  than 1537 MiB ram is detected.
 -Boot the machine
 -----------------
 +Running HSS
 +-----------
  HSS 2020.12 release is tested at the time of writing. To build an HSS image
  that can be booted by the ``microchip-icicle-kit`` machine, type the following
 diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/microchip_pfsoc.c
 +++ b/hw/riscv/microchip_pfsoc.c
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
+@@ -XXX,XX +XXX,XX @@
-     [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
+ #include "hw/riscv/microchip_pfsoc.h"
-     [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,  0x1000000 },
+ #include "hw/intc/sifive_clint.h"
-     [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000, 0x10000000 },
+ #include "hw/intc/sifive_plic.h"
-+    [MICROCHIP_PFSOC_EMMC_SD_MUX] =     { 0x4f000000,        0x4 },
++#include "sysemu/device_tree.h"
-     [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000, 0x40000000 },
+ #include "sysemu/sysemu.h"
-     [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000, 0x40000000 },
-     [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,        0x0 },
+ /*
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
-     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ioscb), 0,
+     MemoryRegion *mem_high = g_new(MemoryRegion, 1);
-                     memmap[MICROCHIP_PFSOC_IOSCB].base);
+     MemoryRegion *mem_high_alias = g_new(MemoryRegion, 1);
+     uint64_t mem_high_size;
-+    /* eMMC/SD mux */
++    hwaddr firmware_load_addr;
-+    create_unimplemented_device("microchip.pfsoc.emmc_sd_mux",
++    const char *firmware_name;
-+        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].base,
++    bool kernel_as_payload = false;
-+        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].size);
++    target_ulong firmware_end_addr, kernel_start_addr;
-+
++    uint64_t kernel_entry;
-     /* QSPI Flash */
++    uint32_t fdt_load_addr;
-     memory_region_init_rom(qspi_xip_mem, OBJECT(dev),
+     DriveInfo *dinfo = drive_get_next(IF_SD);
-                            "microchip.pfsoc.qspi_xip",
      /* Sanity check on RAM size */
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
                                  memmap[MICROCHIP_PFSOC_DRAM_HI_ALIAS].base,
                                  mem_high_alias);
 -    /* Load the firmware */
 -    riscv_find_and_load_firmware(machine, BIOS_FILENAME, RESET_VECTOR, NULL);
 -
      /* Attach an SD card */
      if (dinfo) {
          CadenceSDHCIState *sdhci = &(s->soc.sdhci);
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
                                  &error_fatal);
          qdev_realize_and_unref(card, sdhci->bus, &error_fatal);
      }
 +
 +    /*
 +     * We follow the following table to select which payload we execute.
 +     *
 +     *  -bios |    -kernel | payload
 +     * -------+------------+--------
 +     *      N |          N | HSS
 +     *      Y | don't care | HSS
 +     *      N |          Y | kernel
 +     *
 +     * This ensures backwards compatibility with how we used to expose -bios
 +     * to users but allows them to run through direct kernel booting as well.
 +     *
 +     * When -kernel is used for direct boot, -dtb must be present to provide
 +     * a valid device tree for the board, as we don't generate device tree.
 +     */
 +
 +    if (machine->kernel_filename && machine->dtb) {
 +        int fdt_size;
 +        machine->fdt = load_device_tree(machine->dtb, &fdt_size);
 +        if (!machine->fdt) {
 +            error_report("load_device_tree() failed");
 +            exit(1);
 +        }
 +
 +        firmware_name = RISCV64_BIOS_BIN;
 +        firmware_load_addr = memmap[MICROCHIP_PFSOC_DRAM_LO].base;
 +        kernel_as_payload = true;
 +    }
 +
 +    if (!kernel_as_payload) {
 +        firmware_name = BIOS_FILENAME;
 +        firmware_load_addr = RESET_VECTOR;
 +    }
 +
 +    /* Load the firmware */
 +    firmware_end_addr = riscv_find_and_load_firmware(machine, firmware_name,
 +                                                     firmware_load_addr, NULL);
 +
 +    if (kernel_as_payload) {
 +        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc.u_cpus,
 +                                                         firmware_end_addr);
 +
 +        kernel_entry = riscv_load_kernel(machine->kernel_filename,
 +                                         kernel_start_addr, NULL);
 +
 +        if (machine->initrd_filename) {
 +            hwaddr start;
 +            hwaddr end = riscv_load_initrd(machine->initrd_filename,
 +                                           machine->ram_size, kernel_entry,
 +                                           &start);
 +            qemu_fdt_setprop_cell(machine->fdt, "/chosen",
 +                                  "linux,initrd-start", start);
 +            qemu_fdt_setprop_cell(machine->fdt, "/chosen",
 +                                  "linux,initrd-end", end);
 +        }
 +
 +        if (machine->kernel_cmdline) {
 +            qemu_fdt_setprop_string(machine->fdt, "/chosen",
 +                                    "bootargs", machine->kernel_cmdline);
 +        }
 +
 +        /* Compute the fdt load address in dram */
 +        fdt_load_addr = riscv_load_fdt(memmap[MICROCHIP_PFSOC_DRAM_LO].base,
 +                                       machine->ram_size, machine->fdt);
 +        /* Load the reset vector */
 +        riscv_setup_rom_reset_vec(machine, &s->soc.u_cpus, firmware_load_addr,
 +                                  memmap[MICROCHIP_PFSOC_ENVM_DATA].base,
 +                                  memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
 +                                  kernel_entry, fdt_load_addr, machine->fdt);
 +    }
  }
  static void microchip_icicle_kit_machine_class_init(ObjectClass *oc, void *data)
 --
-.30.1
+.31.1

-New patch
+[PULL 09/32] target/riscv: fix wfi exception behavior
+From: Jose Martins <josemartins90@gmail.com>
+The wfi exception trigger behavior should take into account user mode,
+hstatus.vtw, and the fact the an wfi might raise different types of
+exceptions depending on various factors:
+If supervisor mode is not present:
+- an illegal instruction exception should be generated if user mode
+executes and wfi instruction and mstatus.tw = 1.
+If supervisor mode is present:
+- when a wfi instruction is executed, an illegal exception should be triggered
+if either the current mode is user or the mode is supervisor and mstatus.tw is
+set.
+Plus, if the hypervisor extensions are enabled:
+- a virtual instruction exception should be raised when a wfi is executed from
+virtual-user or virtual-supervisor and hstatus.vtw is set.
+Signed-off-by: Jose Martins <josemartins90@gmail.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20210420213656.85148-1-josemartins90@gmail.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_bits.h  |  1 +
+ target/riscv/op_helper.c | 11 ++++++++---
+files changed, 9 insertions(+), 3 deletions(-)
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@
+ #define HSTATUS_HU           0x00000200
+ #define HSTATUS_VGEIN        0x0003F000
+ #define HSTATUS_VTVM         0x00100000
++#define HSTATUS_VTW          0x00200000
+ #define HSTATUS_VTSR         0x00400000
+ #define HSTATUS_VSXL         0x300000000
+diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/op_helper.c
++++ b/target/riscv/op_helper.c
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env, target_ulong cpu_pc_deb)
+ void helper_wfi(CPURISCVState *env)
+ {
+     CPUState *cs = env_cpu(env);
++    bool rvs = riscv_has_ext(env, RVS);
++    bool prv_u = env->priv == PRV_U;
++    bool prv_s = env->priv == PRV_S;
+-    if ((env->priv == PRV_S &&
+-        get_field(env->mstatus, MSTATUS_TW)) ||
+-        riscv_cpu_virt_enabled(env)) {
++    if (((prv_s || (!rvs && prv_u)) && get_field(env->mstatus, MSTATUS_TW)) ||
++        (rvs && prv_u && !riscv_cpu_virt_enabled(env))) {
++        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
++    } else if (riscv_cpu_virt_enabled(env) && (prv_u ||
++        (prv_s && get_field(env->hstatus, HSTATUS_VTW)))) {
+         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
+     } else {
+         cs->halted = 1;
+--
+.31.1

-New patch
+[PULL 10/32] docs/system: Move the RISC-V -bios information to removed
+QEMU 5.1 changed the behaviour of the default boot for the RISC-V virt
+and sifive_u machines. This patch moves that change from the
+deprecated.rst file to the removed-features.rst file and the
+target-riscv.rst.
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Message-id: 4f1c261e7f69045ab8bb8926d85fe1d35e48ea5b.1620081256.git.alistair.francis@wdc.com
+---
+ docs/system/deprecated.rst       | 19 -------------------
+ docs/system/removed-features.rst |  5 +++++
+ docs/system/target-riscv.rst     | 13 ++++++++++++-
+files changed, 17 insertions(+), 20 deletions(-)
+diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/deprecated.rst
++++ b/docs/system/deprecated.rst
+@@ -XXX,XX +XXX,XX @@ pcspk-audiodev=<name>``.
+ ``tty`` and ``parport`` are aliases that will be removed. Instead, the
+ actual backend names ``serial`` and ``parallel`` should be used.
+-RISC-V ``-bios`` (since 5.1)
+-''''''''''''''''''''''''''''
+-
+-QEMU 4.1 introduced support for the -bios option in QEMU for RISC-V for the
+-RISC-V virt machine and sifive_u machine. QEMU 4.1 had no changes to the
+-default behaviour to avoid breakages.
+-
+-QEMU 5.1 changes the default behaviour from ``-bios none`` to ``-bios default``.
+-
+-QEMU 5.1 has three options:
+- 1. ``-bios default`` - This is the current default behavior if no -bios option
+-      is included. This option will load the default OpenSBI firmware automatically.
+-      The firmware is included with the QEMU release and no user interaction is
+-      required. All a user needs to do is specify the kernel they want to boot
+-      with the -kernel option
+- 2. ``-bios none`` - QEMU will not automatically load any firmware. It is up
+-      to the user to load all the images they need.
+- 3. ``-bios <file>`` - Tells QEMU to load the specified file as the firmwrae.
+-
+ Short-form boolean options (since 6.0)
+ ''''''''''''''''''''''''''''''''''''''
+diff --git a/docs/system/removed-features.rst b/docs/system/removed-features.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/removed-features.rst
++++ b/docs/system/removed-features.rst
+@@ -XXX,XX +XXX,XX @@ devices.  Drives the board doesn't pick up can no longer be used with
+ This option was undocumented and not used in the field.
+ Use `-device usb-ccid`` instead.
++RISC-V firmware not booted by default (removed in 5.1)
++''''''''''''''''''''''''''''''''''''''''''''''''''''''
++
++QEMU 5.1 changes the default behaviour from ``-bios none`` to ``-bios default``
++for the RISC-V ``virt`` machine and ``sifive_u`` machine.
+ QEMU Machine Protocol (QMP) commands
+ ------------------------------------
+diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/target-riscv.rst
++++ b/docs/system/target-riscv.rst
+@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
+    riscv/shakti-c
+    riscv/sifive_u
+-RISC-V CPU features
++RISC-V CPU firmware
+ -------------------
++
++When using the ``sifive_u`` or ``virt`` machine there are three different
++firmware boot options:
++1. ``-bios default`` - This is the default behaviour if no -bios option
++is included. This option will load the default OpenSBI firmware automatically.
++The firmware is included with the QEMU release and no user interaction is
++required. All a user needs to do is specify the kernel they want to boot
++with the -kernel option
++2. ``-bios none`` - QEMU will not automatically load any firmware. It is up
++to the user to load all the images they need.
++3. ``-bios <file>`` - Tells QEMU to load the specified file as the firmware.
+--
+.31.1

-[PULL 08/16] target/riscv: Use background registers also for MSTATUS_MPV
+[PULL 11/32] target/riscv: Do not include 'pmp.h' in user emulation
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The current condition for the use of background registers only
+Physical Memory Protection is a system feature.
-considers the hypervisor load and store instructions,
+Avoid polluting the user-mode emulation by its definitions.
 but not accesses from M mode via MSTATUS_MPRV+MPV.
-Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210311103036.1401073-1-georg.kotheimer@kernkonzept.com
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
 Message-id: 20210516205333.696094-1-f4bug@amsat.org
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 2 +-
+ target/riscv/cpu.h | 2 ++
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 2 insertions(+)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
+@@ -XXX,XX +XXX,XX @@ enum {
-      * was called. Background registers will be used if the guest has
-      * forced a two stage translation to be on (in HS or M mode).
+ typedef struct CPURISCVState CPURISCVState;
-      */
--    if (!riscv_cpu_virt_enabled(env) && riscv_cpu_two_stage_lookup(mmu_idx)) {
++#if !defined(CONFIG_USER_ONLY)
-+    if (!riscv_cpu_virt_enabled(env) && two_stage) {
+ #include "pmp.h"
-         use_background = true;
++#endif
-     }
  #define RV_VLEN_MAX 256
 --
-.30.1
+.31.1

-New patch
+[PULL 12/32] target/riscv: Remove unnecessary riscv_*_names[] declaration
+From: Bin Meng <bmeng.cn@gmail.com>
+riscv_excp_names[] and riscv_intr_names[] are only referenced by
+target/riscv/cpu.c locally.
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20210514052435.2203156-1-bmeng.cn@gmail.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.h | 2 --
+ target/riscv/cpu.c | 4 ++--
+files changed, 2 insertions(+), 4 deletions(-)
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.h
++++ b/target/riscv/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool riscv_feature(CPURISCVState *env, int feature)
+ extern const char * const riscv_int_regnames[];
+ extern const char * const riscv_fpr_regnames[];
+-extern const char * const riscv_excp_names[];
+-extern const char * const riscv_intr_names[];
+ const char *riscv_cpu_get_trap_name(target_ulong cause, bool async);
+ void riscv_cpu_do_interrupt(CPUState *cpu);
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ const char * const riscv_fpr_regnames[] = {
+   "f30/ft10", "f31/ft11"
+ };
+-const char * const riscv_excp_names[] = {
++static const char * const riscv_excp_names[] = {
+     "misaligned_fetch",
+     "fault_fetch",
+     "illegal_instruction",
+@@ -XXX,XX +XXX,XX @@ const char * const riscv_excp_names[] = {
+     "guest_store_page_fault",
+ };
+-const char * const riscv_intr_names[] = {
++static const char * const riscv_intr_names[] = {
+     "u_software",
+     "s_software",
+     "vs_software",
+--
+.31.1

-New patch
+[PULL 13/32] target/riscv: Dump CSR mscratch/sscratch/satp
+From: Changbin Du <changbin.du@gmail.com>
+This dumps the CSR mscratch/sscratch/satp and meanwhile aligns
+the output of CSR mtval/stval.
+Signed-off-by: Changbin Du <changbin.du@gmail.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Message-id: 20210519155738.20486-1-changbin.du@gmail.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.c | 7 +++++--
+file changed, 5 insertions(+), 2 deletions(-)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
+     if (riscv_has_ext(env, RVH)) {
+         qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "vscause ", env->vscause);
+     }
+-    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mtval ", env->mtval);
+-    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "stval ", env->stval);
++    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mtval   ", env->mtval);
++    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "stval   ", env->stval);
+     if (riscv_has_ext(env, RVH)) {
+         qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "htval ", env->htval);
+         qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mtval2 ", env->mtval2);
+     }
++    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mscratch", env->mscratch);
++    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "sscratch", env->sscratch);
++    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "satp    ", env->satp);
+ #endif
+     for (i = 0; i < 32; i++) {
+--
+.31.1

-[PULL 05/16] target/riscv: flush TLB pages if PMP permission has been changed
+[PULL 14/32] target/riscv/pmp: Add assert for ePMP operations
-From: Jim Shu <cwshu@andestech.com>
+Although we construct epmp_operation in such a way that it can only be
 between 0 and 15 Coverity complains that we don't handle the other
 possible cases. To fix Coverity and make it easier for humans to read
 add a default case to the switch statement that calls
 g_assert_not_reached().
-If PMP permission of any address has been changed by updating PMP entry,
+Fixes: CID 1453108
 flush all TLB pages to prevent from getting old permission.
 Signed-off-by: Jim Shu <cwshu@andestech.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 1613916082-19528-4-git-send-email-cwshu@andestech.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+Message-id: ec5f225928eec448278c82fcb1f6805ee61dde82.1621550996.git.alistair.francis@wdc.com
 ---
  target/riscv/pmp.c | 4 ++++
 file changed, 4 insertions(+)
 diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.c
 +++ b/target/riscv/pmp.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
- #include "qapi/error.h"
+                     case 15:
- #include "cpu.h"
+                         *allowed_privs = PMP_READ;
- #include "trace.h"
+                         break;
-+#include "exec/exec-all.h"
++                    default:
++                        g_assert_not_reached();
- static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
+                     }
-     uint8_t val);
+                 } else {
-@@ -XXX,XX +XXX,XX @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
+                     switch (epmp_operation) {
-         cfg_val = (val >> 8 * i)  & 0xff;
+@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
+                     case 7:
-     }
+                         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
-+
+                         break;
-+    /* If PMP permission of any addr has been changed, flush TLB pages. */
++                    default:
-+    tlb_flush(env_cpu(env));
++                        g_assert_not_reached();
- }
+                     }
+                 }
+             }
 --
-.30.1
+.31.1

-New patch
+[PULL 15/32] target/riscv: Pass the same value to oprsz and maxsz.
+From: LIU Zhiwei <zhiwei_liu@c-sky.com>
 Since commit e2e7168a214b0ed98dc357bba96816486a289762, if oprsz
 is still zero(as we don't use this field), simd_desc will trigger an
 assert.
 Besides, tcg_gen_gvec_*_ptr calls simd_desc in it's implementation.
 Here we pass the value to maxsz and oprsz to bypass the assert.
 Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210521054816.1784297-1-zhiwei_liu@c-sky.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/insn_trans/trans_rvv.c.inc | 89 ++++++++++++++-----------
 file changed, 50 insertions(+), 39 deletions(-)
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
       * The first part is vlen in bytes, encoded in maxsz of simd_desc.
       * The second part is lmul, encoded in data of simd_desc.
       */
 -    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
      gen_get_gpr(base, rs1);
      tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
      mask = tcg_temp_new_ptr();
      base = tcg_temp_new();
      stride = tcg_temp_new();
 -    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
      gen_get_gpr(base, rs1);
      gen_get_gpr(stride, rs2);
@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
      mask = tcg_temp_new_ptr();
      index = tcg_temp_new_ptr();
      base = tcg_temp_new();
 -    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
      gen_get_gpr(base, rs1);
      tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
      dest = tcg_temp_new_ptr();
      mask = tcg_temp_new_ptr();
      base = tcg_temp_new();
 -    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
      gen_get_gpr(base, rs1);
      tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
@@ -XXX,XX +XXX,XX @@ static bool amo_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
      mask = tcg_temp_new_ptr();
      index = tcg_temp_new_ptr();
      base = tcg_temp_new();
 -    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
      gen_get_gpr(base, rs1);
      tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                             vreg_ofs(s, a->rs1), vreg_ofs(s, a->rs2),
 -                           cpu_env, 0, s->vlen / 8, data, fn);
 +                           cpu_env, s->vlen / 8, s->vlen / 8, data, fn);
      }
      gen_set_label(over);
      return true;
@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
      data = FIELD_DP32(data, VDATA, MLEN, s->mlen);
      data = FIELD_DP32(data, VDATA, VM, vm);
      data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
 -    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
      tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
      tcg_gen_addi_ptr(src2, cpu_env, vreg_ofs(s, vs2));
@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
      data = FIELD_DP32(data, VDATA, MLEN, s->mlen);
      data = FIELD_DP32(data, VDATA, VM, vm);
      data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
 -    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
      tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
      tcg_gen_addi_ptr(src2, cpu_env, vreg_ofs(s, vs2));
@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                             vreg_ofs(s, a->rs1),
                             vreg_ofs(s, a->rs2),
 -                           cpu_env, 0, s->vlen / 8,
 +                           cpu_env, s->vlen / 8, s->vlen / 8,
                             data, fn);
          gen_set_label(over);
          return true;
@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                             vreg_ofs(s, a->rs1),
                             vreg_ofs(s, a->rs2),
 -                           cpu_env, 0, s->vlen / 8, data, fn);
 +                           cpu_env, s->vlen / 8, s->vlen / 8, data, fn);
          gen_set_label(over);
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                             vreg_ofs(s, a->rs1),                    \
 -                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
 -                           s->vlen / 8, data, fns[s->sew]);        \
 +                           vreg_ofs(s, a->rs2), cpu_env,           \
 +                           s->vlen / 8, s->vlen / 8, data,         \
 +                           fns[s->sew]);                           \
          gen_set_label(over);                                       \
          return true;                                               \
      }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                             vreg_ofs(s, a->rs1),                    \
 -                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
 -                           s->vlen / 8, data, fns[s->sew]);        \
 +                           vreg_ofs(s, a->rs2), cpu_env,           \
 +                           s->vlen / 8, s->vlen / 8, data,         \
 +                           fns[s->sew]);                           \
          gen_set_label(over);                                       \
          return true;                                               \
      }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
              };
              tcg_gen_ext_tl_i64(s1_i64, s1);
 -            desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +            desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
              tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, a->rd));
              fns[s->sew](dest, s1_i64, cpu_env, desc);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
              s1 = tcg_const_i64(simm);
              dest = tcg_temp_new_ptr();
 -            desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +            desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
              tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, a->rd));
              fns[s->sew](dest, s1, cpu_env, desc);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                             vreg_ofs(s, a->rs1),                    \
 -                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
 -                           s->vlen / 8, data, fns[s->sew - 1]);    \
 +                           vreg_ofs(s, a->rs2), cpu_env,           \
 +                           s->vlen / 8, s->vlen / 8, data,         \
 +                           fns[s->sew - 1]);                       \
          gen_set_label(over);                                       \
          return true;                                               \
      }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
      dest = tcg_temp_new_ptr();
      mask = tcg_temp_new_ptr();
      src2 = tcg_temp_new_ptr();
 -    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
      tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
      tcg_gen_addi_ptr(src2, cpu_env, vreg_ofs(s, vs2));
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);           \
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),   \
                             vreg_ofs(s, a->rs1),                  \
 -                           vreg_ofs(s, a->rs2), cpu_env, 0,      \
 -                           s->vlen / 8, data, fns[s->sew - 1]);  \
 +                           vreg_ofs(s, a->rs2), cpu_env,         \
 +                           s->vlen / 8, s->vlen / 8, data,       \
 +                           fns[s->sew - 1]);                     \
          gen_set_label(over);                                     \
          return true;                                             \
      }                                                            \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                             vreg_ofs(s, a->rs1),                    \
 -                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
 -                           s->vlen / 8, data, fns[s->sew - 1]);    \
 +                           vreg_ofs(s, a->rs2), cpu_env,           \
 +                           s->vlen / 8, s->vlen / 8, data,         \
 +                           fns[s->sew - 1]);                       \
          gen_set_label(over);                                       \
          return true;                                               \
      }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
 -                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
 -                           s->vlen / 8, data, fns[s->sew - 1]);    \
 +                           vreg_ofs(s, a->rs2), cpu_env,           \
 +                           s->vlen / 8, s->vlen / 8, data,         \
 +                           fns[s->sew - 1]);                       \
          gen_set_label(over);                                       \
          return true;                                               \
      }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
              tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
              dest = tcg_temp_new_ptr();
 -            desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +            desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
              tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, a->rd));
              fns[s->sew - 1](dest, cpu_fpr[a->rs1], cpu_env, desc);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
 -                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
 -                           s->vlen / 8, data, fns[s->sew - 1]);    \
 +                           vreg_ofs(s, a->rs2), cpu_env,           \
 +                           s->vlen / 8, s->vlen / 8, data,         \
 +                           fns[s->sew - 1]);                       \
          gen_set_label(over);                                       \
          return true;                                               \
      }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
 -                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
 -                           s->vlen / 8, data, fns[s->sew - 1]);    \
 +                           vreg_ofs(s, a->rs2), cpu_env,           \
 +                           s->vlen / 8, s->vlen / 8, data,         \
 +                           fns[s->sew - 1]);                       \
          gen_set_label(over);                                       \
          return true;                                               \
      }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                             vreg_ofs(s, a->rs1),                    \
 -                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
 -                           s->vlen / 8, data, fn);                 \
 +                           vreg_ofs(s, a->rs2), cpu_env,           \
 +                           s->vlen / 8, s->vlen / 8, data, fn);    \
          gen_set_label(over);                                       \
          return true;                                               \
      }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_vmpopc_m(DisasContext *s, arg_rmr *a)
          mask = tcg_temp_new_ptr();
          src2 = tcg_temp_new_ptr();
          dst = tcg_temp_new();
 -        desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +        desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
          tcg_gen_addi_ptr(src2, cpu_env, vreg_ofs(s, a->rs2));
          tcg_gen_addi_ptr(mask, cpu_env, vreg_ofs(s, 0));
@@ -XXX,XX +XXX,XX @@ static bool trans_vmfirst_m(DisasContext *s, arg_rmr *a)
          mask = tcg_temp_new_ptr();
          src2 = tcg_temp_new_ptr();
          dst = tcg_temp_new();
 -        desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
 +        desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
          tcg_gen_addi_ptr(src2, cpu_env, vreg_ofs(s, a->rs2));
          tcg_gen_addi_ptr(mask, cpu_env, vreg_ofs(s, 0));
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd),                     \
                             vreg_ofs(s, 0), vreg_ofs(s, a->rs2),    \
 -                           cpu_env, 0, s->vlen / 8, data, fn);     \
 +                           cpu_env, s->vlen / 8, s->vlen / 8,      \
 +                           data, fn);                              \
          gen_set_label(over);                                       \
          return true;                                               \
      }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_viota_m(DisasContext *s, arg_viota_m *a)
              gen_helper_viota_m_w, gen_helper_viota_m_d,
          };
          tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
 -                           vreg_ofs(s, a->rs2), cpu_env, 0,
 -                           s->vlen / 8, data, fns[s->sew]);
 +                           vreg_ofs(s, a->rs2), cpu_env,
 +                           s->vlen / 8, s->vlen / 8, data, fns[s->sew]);
          gen_set_label(over);
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
              gen_helper_vid_v_w, gen_helper_vid_v_d,
          };
          tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
 -                           cpu_env, 0, s->vlen / 8, data, fns[s->sew]);
 +                           cpu_env, s->vlen / 8, s->vlen / 8,
 +                           data, fns[s->sew]);
          gen_set_label(over);
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_vcompress_vm(DisasContext *s, arg_r *a)
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                             vreg_ofs(s, a->rs1), vreg_ofs(s, a->rs2),
 -                           cpu_env, 0, s->vlen / 8, data, fns[s->sew]);
 +                           cpu_env, s->vlen / 8, s->vlen / 8, data,
 +                           fns[s->sew]);
          gen_set_label(over);
          return true;
      }
 --
 .31.1

-New patch
+[PULL 16/32] target/riscv: reformat @sh format encoding for B-extension
+From: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20210505160620.15723-2-frank.chang@sifive.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn32.decode | 10 +++++-----
+file changed, 5 insertions(+), 5 deletions(-)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@
+ %rd        7:5
+ %sh5       20:5
+-%sh10    20:10
++%sh7    20:7
+ %csr    20:12
+ %rm     12:3
+ %nf     29:3                     !function=ex_plus_1
+@@ -XXX,XX +XXX,XX @@
+ @u       ....................      ..... ....... &u      imm=%imm_u          %rd
+ @j       ....................      ..... ....... &j      imm=%imm_j          %rd
+-@sh      ......  ...... .....  ... ..... ....... &shift  shamt=%sh10      %rs1 %rd
++@sh      ......  ...... .....  ... ..... ....... &shift  shamt=%sh7     %rs1 %rd
+ @csr     ............   .....  ... ..... .......               %csr     %rs1 %rd
+ @atom_ld ..... aq:1 rl:1 ..... ........ ..... ....... &atomic rs2=0     %rs1 %rd
+@@ -XXX,XX +XXX,XX @@ sltiu    ............     ..... 011 ..... 0010011 @i
+ xori     ............     ..... 100 ..... 0010011 @i
+ ori      ............     ..... 110 ..... 0010011 @i
+ andi     ............     ..... 111 ..... 0010011 @i
+-slli     00.... ......    ..... 001 ..... 0010011 @sh
+-srli     00.... ......    ..... 101 ..... 0010011 @sh
+-srai     01.... ......    ..... 101 ..... 0010011 @sh
++slli     00000. ......    ..... 001 ..... 0010011 @sh
++srli     00000. ......    ..... 101 ..... 0010011 @sh
++srai     01000. ......    ..... 101 ..... 0010011 @sh
+ add      0000000 .....    ..... 000 ..... 0110011 @r
+ sub      0100000 .....    ..... 000 ..... 0110011 @r
+ sll      0000000 .....    ..... 001 ..... 0110011 @r
+--
+.31.1

-New patch
+[PULL 17/32] target/riscv: rvb: count leading/trailing zeros
+From: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20210505160620.15723-3-frank.chang@sifive.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.h                      |  1 +
+ target/riscv/insn32.decode              | 11 ++++++-
+ target/riscv/translate.c                | 38 +++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvb.c.inc | 44 +++++++++++++++++++++++++
+files changed, 93 insertions(+), 1 deletion(-)
+ create mode 100644 target/riscv/insn_trans/trans_rvb.c.inc
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.h
++++ b/target/riscv/cpu.h
+@@ -XXX,XX +XXX,XX @@
+ #define RVS RV('S')
+ #define RVU RV('U')
+ #define RVH RV('H')
++#define RVB RV('B')
+ /* S extension denotes that Supervisor mode exists, however it is possible
+    to have a core that support S mode but does not have an MMU and there
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@
+ &i    imm rs1 rd
+ &j    imm rd
+ &r    rd rs1 rs2
++&r2   rd rs1
+ &s    imm rs1 rs2
+ &u    imm rd
+ &shift     shamt rs1 rd
+@@ -XXX,XX +XXX,XX @@
+ @r4_rm   ..... ..  ..... ..... ... ..... ....... %rs3 %rs2 %rs1 %rm %rd
+ @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
+ @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
+-@r2      .......   ..... ..... ... ..... ....... %rs1 %rd
++@r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
+ @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
+ @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
+ @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
+@@ -XXX,XX +XXX,XX @@ vamomind_v      10000 . . ..... ..... 111 ..... 0101111 @r_wdvm
+ vamomaxd_v      10100 . . ..... ..... 111 ..... 0101111 @r_wdvm
+ vamominud_v     11000 . . ..... ..... 111 ..... 0101111 @r_wdvm
+ vamomaxud_v     11100 . . ..... ..... 111 ..... 0101111 @r_wdvm
++
++# *** RV32B Standard Extension ***
++clz        011000 000000 ..... 001 ..... 0010011 @r2
++ctz        011000 000001 ..... 001 ..... 0010011 @r2
++
++# *** RV64B Standard Extension (in addition to RV32B) ***
++clzw       0110000 00000 ..... 001 ..... 0011011 @r2
++ctzw       0110000 00001 ..... 001 ..... 0011011 @r2
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/translate.c
++++ b/target/riscv/translate.c
+@@ -XXX,XX +XXX,XX @@ static bool gen_arith_div_uw(DisasContext *ctx, arg_r *a,
+     return true;
+ }
++static void gen_ctzw(TCGv ret, TCGv arg1)
++{
++    tcg_gen_ori_tl(ret, arg1, (target_ulong)MAKE_64BIT_MASK(32, 32));
++    tcg_gen_ctzi_tl(ret, ret, 64);
++}
++
++static void gen_clzw(TCGv ret, TCGv arg1)
++{
++    tcg_gen_ext32u_tl(ret, arg1);
++    tcg_gen_clzi_tl(ret, ret, 64);
++    tcg_gen_subi_tl(ret, ret, 32);
++}
++
+ static bool gen_arith(DisasContext *ctx, arg_r *a,
+                       void(*func)(TCGv, TCGv, TCGv))
+ {
+@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
+     return cpu_ldl_code(env, pc);
+ }
++static void gen_ctz(TCGv ret, TCGv arg1)
++{
++    tcg_gen_ctzi_tl(ret, arg1, TARGET_LONG_BITS);
++}
++
++static void gen_clz(TCGv ret, TCGv arg1)
++{
++    tcg_gen_clzi_tl(ret, arg1, TARGET_LONG_BITS);
++}
++
++static bool gen_unary(DisasContext *ctx, arg_r2 *a,
++                      void(*func)(TCGv, TCGv))
++{
++    TCGv source = tcg_temp_new();
++
++    gen_get_gpr(source, a->rs1);
++
++    (*func)(source, source);
++
++    gen_set_gpr(a->rd, source);
++    tcg_temp_free(source);
++    return true;
++}
++
+ /* Include insn module translation function */
+ #include "insn_trans/trans_rvi.c.inc"
+ #include "insn_trans/trans_rvm.c.inc"
+@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
+ #include "insn_trans/trans_rvd.c.inc"
+ #include "insn_trans/trans_rvh.c.inc"
+ #include "insn_trans/trans_rvv.c.inc"
++#include "insn_trans/trans_rvb.c.inc"
+ #include "insn_trans/trans_privileged.c.inc"
+ /* Include the auto-generated decoder for 16 bit insn */
+diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/target/riscv/insn_trans/trans_rvb.c.inc
+@@ -XXX,XX +XXX,XX @@
++/*
++ * RISC-V translation routines for the RVB Standard Extension.
++ *
++ * Copyright (c) 2020 Kito Cheng, kito.cheng@sifive.com
++ * Copyright (c) 2020 Frank Chang, frank.chang@sifive.com
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2 or later, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License along with
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++static bool trans_clz(DisasContext *ctx, arg_clz *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_unary(ctx, a, gen_clz);
++}
++
++static bool trans_ctz(DisasContext *ctx, arg_ctz *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_unary(ctx, a, gen_ctz);
++}
++
++static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
++{
++    REQUIRE_64BIT(ctx);
++    REQUIRE_EXT(ctx, RVB);
++    return gen_unary(ctx, a, gen_clzw);
++}
++
++static bool trans_ctzw(DisasContext *ctx, arg_ctzw *a)
++{
++    REQUIRE_64BIT(ctx);
++    REQUIRE_EXT(ctx, RVB);
++    return gen_unary(ctx, a, gen_ctzw);
++}
+--
+.31.1

-[PULL 01/16] target/riscv: fix vs() to return proper error code
+[PULL 18/32] target/riscv: rvb: count bits set
 From: Frank Chang <frank.chang@sifive.com>
-vs() should return -RISCV_EXCP_ILLEGAL_INST instead of -1 if rvv feature
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
 is not enabled.
 If -1 is returned, exception will be raised and cs->exception_index will
 be set to the negative return value. The exception will then be treated
 as an instruction access fault instead of illegal instruction fault.
 Signed-off-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210223065935.20208-1-frank.chang@sifive.com
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
 Message-id: 20210505160620.15723-4-frank.chang@sifive.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 2 +-
+ target/riscv/insn32.decode              |  2 ++
-file changed, 1 insertion(+), 1 deletion(-)
+ target/riscv/translate.c                |  6 ++++++
  target/riscv/insn_trans/trans_rvb.c.inc | 13 +++++++++++++
 files changed, 21 insertions(+)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/target/riscv/insn32.decode
-+++ b/target/riscv/csr.c
++++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ static int vs(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ vamomaxud_v     11100 . . ..... ..... 111 ..... 0101111 @r_wdvm
-     if (env->misa & RVV) {
+ # *** RV32B Standard Extension ***
-         return 0;
+ clz        011000 000000 ..... 001 ..... 0010011 @r2
-     }
+ ctz        011000 000001 ..... 001 ..... 0010011 @r2
--    return -1;
++cpop       011000 000010 ..... 001 ..... 0010011 @r2
-+    return -RISCV_EXCP_ILLEGAL_INST;
  # *** RV64B Standard Extension (in addition to RV32B) ***
  clzw       0110000 00000 ..... 001 ..... 0011011 @r2
  ctzw       0110000 00001 ..... 001 ..... 0011011 @r2
 +cpopw      0110000 00010 ..... 001 ..... 0011011 @r2
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_clzw(TCGv ret, TCGv arg1)
      tcg_gen_subi_tl(ret, ret, 32);
  }
- static int ctr(CPURISCVState *env, int csrno)
++static void gen_cpopw(TCGv ret, TCGv arg1)
 +{
 +    tcg_gen_ext32u_tl(arg1, arg1);
 +    tcg_gen_ctpop_tl(ret, arg1);
 +}
 +
  static bool gen_arith(DisasContext *ctx, arg_r *a,
                        void(*func)(TCGv, TCGv, TCGv))
  {
 diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvb.c.inc
 +++ b/target/riscv/insn_trans/trans_rvb.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_ctz(DisasContext *ctx, arg_ctz *a)
      return gen_unary(ctx, a, gen_ctz);
  }
 +static bool trans_cpop(DisasContext *ctx, arg_cpop *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_unary(ctx, a, tcg_gen_ctpop_tl);
 +}
 +
  static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
  {
      REQUIRE_64BIT(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_ctzw(DisasContext *ctx, arg_ctzw *a)
      REQUIRE_EXT(ctx, RVB);
      return gen_unary(ctx, a, gen_ctzw);
  }
 +
 +static bool trans_cpopw(DisasContext *ctx, arg_cpopw *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_unary(ctx, a, gen_cpopw);
 +}
 --
-.30.1
+.31.1

-New patch
+[PULL 19/32] target/riscv: rvb: logic-with-negate
+From: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20210505160620.15723-5-frank.chang@sifive.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn32.decode              |  3 +++
+ target/riscv/insn_trans/trans_rvb.c.inc | 18 ++++++++++++++++++
+files changed, 21 insertions(+)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@ vamomaxud_v     11100 . . ..... ..... 111 ..... 0101111 @r_wdvm
+ clz        011000 000000 ..... 001 ..... 0010011 @r2
+ ctz        011000 000001 ..... 001 ..... 0010011 @r2
+ cpop       011000 000010 ..... 001 ..... 0010011 @r2
++andn       0100000 .......... 111 ..... 0110011 @r
++orn        0100000 .......... 110 ..... 0110011 @r
++xnor       0100000 .......... 100 ..... 0110011 @r
+ # *** RV64B Standard Extension (in addition to RV32B) ***
+ clzw       0110000 00000 ..... 001 ..... 0011011 @r2
+diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvb.c.inc
++++ b/target/riscv/insn_trans/trans_rvb.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool trans_cpop(DisasContext *ctx, arg_cpop *a)
+     return gen_unary(ctx, a, tcg_gen_ctpop_tl);
+ }
++static bool trans_andn(DisasContext *ctx, arg_andn *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, tcg_gen_andc_tl);
++}
++
++static bool trans_orn(DisasContext *ctx, arg_orn *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, tcg_gen_orc_tl);
++}
++
++static bool trans_xnor(DisasContext *ctx, arg_xnor *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, tcg_gen_eqv_tl);
++}
++
+ static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
+ {
+     REQUIRE_64BIT(ctx);
+--
+.31.1

-New patch
+[PULL 20/32] target/riscv: rvb: pack two words into one register
+From: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20210505160620.15723-6-frank.chang@sifive.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn32.decode              |  6 ++++
+ target/riscv/translate.c                | 40 +++++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvb.c.inc | 32 ++++++++++++++++++++
+files changed, 78 insertions(+)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@ cpop       011000 000010 ..... 001 ..... 0010011 @r2
+ andn       0100000 .......... 111 ..... 0110011 @r
+ orn        0100000 .......... 110 ..... 0110011 @r
+ xnor       0100000 .......... 100 ..... 0110011 @r
++pack       0000100 .......... 100 ..... 0110011 @r
++packu      0100100 .......... 100 ..... 0110011 @r
++packh      0000100 .......... 111 ..... 0110011 @r
+ # *** RV64B Standard Extension (in addition to RV32B) ***
+ clzw       0110000 00000 ..... 001 ..... 0011011 @r2
+ ctzw       0110000 00001 ..... 001 ..... 0011011 @r2
+ cpopw      0110000 00010 ..... 001 ..... 0011011 @r2
++
++packw      0000100 .......... 100 ..... 0111011 @r
++packuw     0100100 .......... 100 ..... 0111011 @r
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/translate.c
++++ b/target/riscv/translate.c
+@@ -XXX,XX +XXX,XX @@ static bool gen_arith_div_uw(DisasContext *ctx, arg_r *a,
+     return true;
+ }
++static void gen_pack(TCGv ret, TCGv arg1, TCGv arg2)
++{
++    tcg_gen_deposit_tl(ret, arg1, arg2,
++                       TARGET_LONG_BITS / 2,
++                       TARGET_LONG_BITS / 2);
++}
++
++static void gen_packu(TCGv ret, TCGv arg1, TCGv arg2)
++{
++    TCGv t = tcg_temp_new();
++    tcg_gen_shri_tl(t, arg1, TARGET_LONG_BITS / 2);
++    tcg_gen_deposit_tl(ret, arg2, t, 0, TARGET_LONG_BITS / 2);
++    tcg_temp_free(t);
++}
++
++static void gen_packh(TCGv ret, TCGv arg1, TCGv arg2)
++{
++    TCGv t = tcg_temp_new();
++    tcg_gen_ext8u_tl(t, arg2);
++    tcg_gen_deposit_tl(ret, arg1, t, 8, TARGET_LONG_BITS - 8);
++    tcg_temp_free(t);
++}
++
+ static void gen_ctzw(TCGv ret, TCGv arg1)
+ {
+     tcg_gen_ori_tl(ret, arg1, (target_ulong)MAKE_64BIT_MASK(32, 32));
+@@ -XXX,XX +XXX,XX @@ static void gen_cpopw(TCGv ret, TCGv arg1)
+     tcg_gen_ctpop_tl(ret, arg1);
+ }
++static void gen_packw(TCGv ret, TCGv arg1, TCGv arg2)
++{
++    TCGv t = tcg_temp_new();
++    tcg_gen_ext16s_tl(t, arg2);
++    tcg_gen_deposit_tl(ret, arg1, t, 16, 48);
++    tcg_temp_free(t);
++}
++
++static void gen_packuw(TCGv ret, TCGv arg1, TCGv arg2)
++{
++    TCGv t = tcg_temp_new();
++    tcg_gen_shri_tl(t, arg1, 16);
++    tcg_gen_deposit_tl(ret, arg2, t, 0, 16);
++    tcg_gen_ext32s_tl(ret, ret);
++    tcg_temp_free(t);
++}
++
+ static bool gen_arith(DisasContext *ctx, arg_r *a,
+                       void(*func)(TCGv, TCGv, TCGv))
+ {
+diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvb.c.inc
++++ b/target/riscv/insn_trans/trans_rvb.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool trans_xnor(DisasContext *ctx, arg_xnor *a)
+     return gen_arith(ctx, a, tcg_gen_eqv_tl);
+ }
++static bool trans_pack(DisasContext *ctx, arg_pack *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, gen_pack);
++}
++
++static bool trans_packu(DisasContext *ctx, arg_packu *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, gen_packu);
++}
++
++static bool trans_packh(DisasContext *ctx, arg_packh *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, gen_packh);
++}
++
+ static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
+ {
+     REQUIRE_64BIT(ctx);
+@@ -XXX,XX +XXX,XX @@ static bool trans_cpopw(DisasContext *ctx, arg_cpopw *a)
+     REQUIRE_EXT(ctx, RVB);
+     return gen_unary(ctx, a, gen_cpopw);
+ }
++
++static bool trans_packw(DisasContext *ctx, arg_packw *a)
++{
++    REQUIRE_64BIT(ctx);
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, gen_packw);
++}
++
++static bool trans_packuw(DisasContext *ctx, arg_packuw *a)
++{
++    REQUIRE_64BIT(ctx);
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, gen_packuw);
++}
+--
+.31.1

-New patch
+[PULL 21/32] target/riscv: rvb: min/max instructions
+From: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Message-id: 20210505160620.15723-7-frank.chang@sifive.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn32.decode              |  4 ++++
+ target/riscv/insn_trans/trans_rvb.c.inc | 24 ++++++++++++++++++++++++
+files changed, 28 insertions(+)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@ xnor       0100000 .......... 100 ..... 0110011 @r
+ pack       0000100 .......... 100 ..... 0110011 @r
+ packu      0100100 .......... 100 ..... 0110011 @r
+ packh      0000100 .......... 111 ..... 0110011 @r
++min        0000101 .......... 100 ..... 0110011 @r
++minu       0000101 .......... 101 ..... 0110011 @r
++max        0000101 .......... 110 ..... 0110011 @r
++maxu       0000101 .......... 111 ..... 0110011 @r
+ # *** RV64B Standard Extension (in addition to RV32B) ***
+ clzw       0110000 00000 ..... 001 ..... 0011011 @r2
+diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvb.c.inc
++++ b/target/riscv/insn_trans/trans_rvb.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool trans_packh(DisasContext *ctx, arg_packh *a)
+     return gen_arith(ctx, a, gen_packh);
+ }
++static bool trans_min(DisasContext *ctx, arg_min *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, tcg_gen_smin_tl);
++}
++
++static bool trans_max(DisasContext *ctx, arg_max *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, tcg_gen_smax_tl);
++}
++
++static bool trans_minu(DisasContext *ctx, arg_minu *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, tcg_gen_umin_tl);
++}
++
++static bool trans_maxu(DisasContext *ctx, arg_maxu *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_arith(ctx, a, tcg_gen_umax_tl);
++}
++
+ static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
+ {
+     REQUIRE_64BIT(ctx);
+--
+.31.1

-New patch
+[PULL 22/32] target/riscv: rvb: sign-extend instructions
+From: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Message-id: 20210505160620.15723-8-frank.chang@sifive.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn32.decode              |  3 +++
+ target/riscv/insn_trans/trans_rvb.c.inc | 12 ++++++++++++
+files changed, 15 insertions(+)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@ vamomaxud_v     11100 . . ..... ..... 111 ..... 0101111 @r_wdvm
+ clz        011000 000000 ..... 001 ..... 0010011 @r2
+ ctz        011000 000001 ..... 001 ..... 0010011 @r2
+ cpop       011000 000010 ..... 001 ..... 0010011 @r2
++sext_b     011000 000100 ..... 001 ..... 0010011 @r2
++sext_h     011000 000101 ..... 001 ..... 0010011 @r2
++
+ andn       0100000 .......... 111 ..... 0110011 @r
+ orn        0100000 .......... 110 ..... 0110011 @r
+ xnor       0100000 .......... 100 ..... 0110011 @r
+diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvb.c.inc
++++ b/target/riscv/insn_trans/trans_rvb.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool trans_maxu(DisasContext *ctx, arg_maxu *a)
+     return gen_arith(ctx, a, tcg_gen_umax_tl);
+ }
++static bool trans_sext_b(DisasContext *ctx, arg_sext_b *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_unary(ctx, a, tcg_gen_ext8s_tl);
++}
++
++static bool trans_sext_h(DisasContext *ctx, arg_sext_h *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_unary(ctx, a, tcg_gen_ext16s_tl);
++}
++
+ static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
+ {
+     REQUIRE_64BIT(ctx);
+--
+.31.1

-[PULL 16/16] target/riscv: Prevent lost illegal instruction exceptions
+[PULL 23/32] target/riscv: add gen_shifti() and gen_shiftiw() helper functions
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Frank Chang <frank.chang@sifive.com>
-When decode_insn16() fails, we fall back to decode_RV32_64C() for
+Add gen_shifti() and gen_shiftiw() helper functions to reuse the same
-further compressed instruction decoding. However, prior to this change,
+interfaces for immediate shift instructions.
 we did not raise an illegal instruction exception, if decode_RV32_64C()
 fails to decode the instruction. This means that we skipped illegal
 compressed instructions instead of raising an illegal instruction
 exception.
-Instead of patching decode_RV32_64C(), we can just remove it,
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-as it is dead code since f330433b363 anyway.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210505160620.15723-9-frank.chang@sifive.com
 Message-id: 20210322121609.3097928-1-georg.kotheimer@kernkonzept.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/translate.c | 179 +--------------------------------------
+ target/riscv/translate.c                | 39 ++++++++++++++++++
-file changed, 1 insertion(+), 178 deletions(-)
+ target/riscv/insn_trans/trans_rvi.c.inc | 54 ++-----------------------
 files changed, 43 insertions(+), 50 deletions(-)
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
-     CPUState *cs;
+     return cpu_ldl_code(env, pc);
  } DisasContext;
 -#ifdef TARGET_RISCV64
 -/* convert riscv funct3 to qemu memop for load/store */
 -static const int tcg_memop_lookup[8] = {
 -    [0 ... 7] = -1,
 -    [0] = MO_SB,
 -    [1] = MO_TESW,
 -    [2] = MO_TESL,
 -    [3] = MO_TEQ,
 -    [4] = MO_UB,
 -    [5] = MO_TEUW,
 -    [6] = MO_TEUL,
 -};
 -#endif
 -
  #ifdef TARGET_RISCV64
  #define CASE_OP_32_64(X) case X: case glue(X, W)
  #else
@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
      ctx->base.is_jmp = DISAS_NORETURN;
  }
--#ifdef TARGET_RISCV64
++static bool gen_shifti(DisasContext *ctx, arg_shift *a,
--static void gen_load_c(DisasContext *ctx, uint32_t opc, int rd, int rs1,
++                       void(*func)(TCGv, TCGv, TCGv))
--        target_long imm)
++{
--{
++    if (a->shamt >= TARGET_LONG_BITS) {
--    TCGv t0 = tcg_temp_new();
++        return false;
--    TCGv t1 = tcg_temp_new();
++    }
--    gen_get_gpr(t0, rs1);
++
--    tcg_gen_addi_tl(t0, t0, imm);
++    TCGv source1 = tcg_temp_new();
--    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
++    TCGv source2 = tcg_temp_new();
--
++
--    if (memop < 0) {
++    gen_get_gpr(source1, a->rs1);
--        gen_exception_illegal(ctx);
++
--        return;
++    tcg_gen_movi_tl(source2, a->shamt);
 +    (*func)(source1, source1, source2);
 +
 +    gen_set_gpr(a->rd, source1);
 +    tcg_temp_free(source1);
 +    tcg_temp_free(source2);
 +    return true;
 +}
 +
 +static bool gen_shiftiw(DisasContext *ctx, arg_shift *a,
 +                        void(*func)(TCGv, TCGv, TCGv))
 +{
 +    TCGv source1 = tcg_temp_new();
 +    TCGv source2 = tcg_temp_new();
 +
 +    gen_get_gpr(source1, a->rs1);
 +    tcg_gen_movi_tl(source2, a->shamt);
 +
 +    (*func)(source1, source1, source2);
 +    tcg_gen_ext32s_tl(source1, source1);
 +
 +    gen_set_gpr(a->rd, source1);
 +    tcg_temp_free(source1);
 +    tcg_temp_free(source2);
 +    return true;
 +}
 +
  static void gen_ctz(TCGv ret, TCGv arg1)
  {
      tcg_gen_ctzi_tl(ret, arg1, TARGET_LONG_BITS);
 diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvi.c.inc
 +++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_andi(DisasContext *ctx, arg_andi *a)
  }
  static bool trans_slli(DisasContext *ctx, arg_slli *a)
  {
 -    if (a->shamt >= TARGET_LONG_BITS) {
 -        return false;
 -    }
 -
--    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, memop);
+-    if (a->rd != 0) {
--    gen_set_gpr(rd, t1);
+-        TCGv t = tcg_temp_new();
--    tcg_temp_free(t0);
+-        gen_get_gpr(t, a->rs1);
 -    tcg_temp_free(t1);
 -}
 -
--static void gen_store_c(DisasContext *ctx, uint32_t opc, int rs1, int rs2,
+-        tcg_gen_shli_tl(t, t, a->shamt);
 -        target_long imm)
 -{
 -    TCGv t0 = tcg_temp_new();
 -    TCGv dat = tcg_temp_new();
 -    gen_get_gpr(t0, rs1);
 -    tcg_gen_addi_tl(t0, t0, imm);
 -    gen_get_gpr(dat, rs2);
 -    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
 -
--    if (memop < 0) {
+-        gen_set_gpr(a->rd, t);
--        gen_exception_illegal(ctx);
+-        tcg_temp_free(t);
--        return;
+-    } /* NOP otherwise */
 -    return true;
 +    return gen_shifti(ctx, a, tcg_gen_shl_tl);
  }
  static bool trans_srli(DisasContext *ctx, arg_srli *a)
  {
 -    if (a->shamt >= TARGET_LONG_BITS) {
 -        return false;
 -    }
 -
--    tcg_gen_qemu_st_tl(dat, t0, ctx->mem_idx, memop);
+-    if (a->rd != 0) {
--    tcg_temp_free(t0);
+-        TCGv t = tcg_temp_new();
--    tcg_temp_free(dat);
+-        gen_get_gpr(t, a->rs1);
 -}
 -#endif
 -
- #ifndef CONFIG_USER_ONLY
+-        tcg_gen_shri_tl(t, t, a->shamt);
- /* The states of mstatus_fs are:
+-        gen_set_gpr(a->rd, t);
-  * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
+-        tcg_temp_free(t);
-@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
+-    } /* NOP otherwise */
- static inline void mark_fs_dirty(DisasContext *ctx) { }
+-    return true;
- #endif
++    return gen_shifti(ctx, a, tcg_gen_shr_tl);
+ }
--#if !defined(TARGET_RISCV64)
--static void gen_fp_load(DisasContext *ctx, uint32_t opc, int rd,
+ static bool trans_srai(DisasContext *ctx, arg_srai *a)
--        int rs1, target_long imm)
+ {
--{
+-    if (a->shamt >= TARGET_LONG_BITS) {
--    TCGv t0;
+-        return false;
 -
 -    if (ctx->mstatus_fs == 0) {
 -        gen_exception_illegal(ctx);
 -        return;
 -    }
 -
--    t0 = tcg_temp_new();
+-    if (a->rd != 0) {
--    gen_get_gpr(t0, rs1);
+-        TCGv t = tcg_temp_new();
--    tcg_gen_addi_tl(t0, t0, imm);
+-        gen_get_gpr(t, a->rs1);
 -
--    switch (opc) {
+-        tcg_gen_sari_tl(t, t, a->shamt);
--    case OPC_RISC_FLW:
+-        gen_set_gpr(a->rd, t);
--        if (!has_ext(ctx, RVF)) {
+-        tcg_temp_free(t);
--            goto do_illegal;
+-    } /* NOP otherwise */
--        }
+-    return true;
--        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEUL);
++    return gen_shifti(ctx, a, tcg_gen_sar_tl);
--        /* RISC-V requires NaN-boxing of narrower width floating point values */
+ }
--        tcg_gen_ori_i64(cpu_fpr[rd], cpu_fpr[rd], 0xffffffff00000000ULL);
--        break;
+ static bool trans_add(DisasContext *ctx, arg_add *a)
--    case OPC_RISC_FLD:
+@@ -XXX,XX +XXX,XX @@ static bool trans_addiw(DisasContext *ctx, arg_addiw *a)
--        if (!has_ext(ctx, RVD)) {
+ static bool trans_slliw(DisasContext *ctx, arg_slliw *a)
--            goto do_illegal;
+ {
--        }
+     REQUIRE_64BIT(ctx);
--        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEQ);
+-    TCGv source1;
--        break;
+-    source1 = tcg_temp_new();
--    do_illegal:
+-    gen_get_gpr(source1, a->rs1);
 -    default:
 -        gen_exception_illegal(ctx);
 -        break;
 -    }
 -    tcg_temp_free(t0);
 -
--    mark_fs_dirty(ctx);
+-    tcg_gen_shli_tl(source1, source1, a->shamt);
--}
+-    tcg_gen_ext32s_tl(source1, source1);
 -    gen_set_gpr(a->rd, source1);
 -
--static void gen_fp_store(DisasContext *ctx, uint32_t opc, int rs1,
+-    tcg_temp_free(source1);
--        int rs2, target_long imm)
+-    return true;
--{
++    return gen_shiftiw(ctx, a, tcg_gen_shl_tl);
 -    TCGv t0;
 -
 -    if (ctx->mstatus_fs == 0) {
 -        gen_exception_illegal(ctx);
 -        return;
 -    }
 -
 -    t0 = tcg_temp_new();
 -    gen_get_gpr(t0, rs1);
 -    tcg_gen_addi_tl(t0, t0, imm);
 -
 -    switch (opc) {
 -    case OPC_RISC_FSW:
 -        if (!has_ext(ctx, RVF)) {
 -            goto do_illegal;
 -        }
 -        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEUL);
 -        break;
 -    case OPC_RISC_FSD:
 -        if (!has_ext(ctx, RVD)) {
 -            goto do_illegal;
 -        }
 -        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEQ);
 -        break;
 -    do_illegal:
 -    default:
 -        gen_exception_illegal(ctx);
 -        break;
 -    }
 -
 -    tcg_temp_free(t0);
 -}
 -#endif
 -
  static void gen_set_rm(DisasContext *ctx, int rm)
  {
      TCGv_i32 t0;
@@ -XXX,XX +XXX,XX @@ static void gen_set_rm(DisasContext *ctx, int rm)
      tcg_temp_free_i32(t0);
  }
--static void decode_RV32_64C0(DisasContext *ctx, uint16_t opcode)
+ static bool trans_srliw(DisasContext *ctx, arg_srliw *a)
 -{
 -    uint8_t funct3 = extract16(opcode, 13, 3);
 -    uint8_t rd_rs2 = GET_C_RS2S(opcode);
 -    uint8_t rs1s = GET_C_RS1S(opcode);
 -
 -    switch (funct3) {
 -    case 3:
 -#if defined(TARGET_RISCV64)
 -        /* C.LD(RV64/128) -> ld rd', offset[7:3](rs1')*/
 -        gen_load_c(ctx, OPC_RISC_LD, rd_rs2, rs1s,
 -                 GET_C_LD_IMM(opcode));
 -#else
 -        /* C.FLW (RV32) -> flw rd', offset[6:2](rs1')*/
 -        gen_fp_load(ctx, OPC_RISC_FLW, rd_rs2, rs1s,
 -                    GET_C_LW_IMM(opcode));
 -#endif
 -        break;
 -    case 7:
 -#if defined(TARGET_RISCV64)
 -        /* C.SD (RV64/128) -> sd rs2', offset[7:3](rs1')*/
 -        gen_store_c(ctx, OPC_RISC_SD, rs1s, rd_rs2,
 -                  GET_C_LD_IMM(opcode));
 -#else
 -        /* C.FSW (RV32) -> fsw rs2', offset[6:2](rs1')*/
 -        gen_fp_store(ctx, OPC_RISC_FSW, rs1s, rd_rs2,
 -                     GET_C_LW_IMM(opcode));
 -#endif
 -        break;
 -    }
 -}
 -
 -static void decode_RV32_64C(DisasContext *ctx, uint16_t opcode)
 -{
 -    uint8_t op = extract16(opcode, 0, 2);
 -
 -    switch (op) {
 -    case 0:
 -        decode_RV32_64C0(ctx, opcode);
 -        break;
 -    }
 -}
 -
  static int ex_plus_1(DisasContext *ctx, int nf)
  {
      return nf + 1;
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
          } else {
              ctx->pc_succ_insn = ctx->base.pc_next + 2;
              if (!decode_insn16(ctx, opcode)) {
 -                /* fall back to old decoder */
 -                decode_RV32_64C(ctx, opcode);
 +                gen_exception_illegal(ctx);
              }
          }
      } else {
 --
-.30.1
+.31.1

-New patch
+[PULL 24/32] target/riscv: rvb: single-bit instructions
+From: Frank Chang <frank.chang@sifive.com>
 Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
 Signed-off-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20210505160620.15723-10-frank.chang@sifive.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/insn32.decode              | 17 +++++
  target/riscv/translate.c                | 61 ++++++++++++++++
  target/riscv/insn_trans/trans_rvb.c.inc | 97 +++++++++++++++++++++++++
 files changed, 175 insertions(+)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ min        0000101 .......... 100 ..... 0110011 @r
  minu       0000101 .......... 101 ..... 0110011 @r
  max        0000101 .......... 110 ..... 0110011 @r
  maxu       0000101 .......... 111 ..... 0110011 @r
 +bset       0010100 .......... 001 ..... 0110011 @r
 +bclr       0100100 .......... 001 ..... 0110011 @r
 +binv       0110100 .......... 001 ..... 0110011 @r
 +bext       0100100 .......... 101 ..... 0110011 @r
 +
 +bseti      00101. ........... 001 ..... 0010011 @sh
 +bclri      01001. ........... 001 ..... 0010011 @sh
 +binvi      01101. ........... 001 ..... 0010011 @sh
 +bexti      01001. ........... 101 ..... 0010011 @sh
  # *** RV64B Standard Extension (in addition to RV32B) ***
  clzw       0110000 00000 ..... 001 ..... 0011011 @r2
@@ -XXX,XX +XXX,XX @@ cpopw      0110000 00010 ..... 001 ..... 0011011 @r2
  packw      0000100 .......... 100 ..... 0111011 @r
  packuw     0100100 .......... 100 ..... 0111011 @r
 +bsetw      0010100 .......... 001 ..... 0111011 @r
 +bclrw      0100100 .......... 001 ..... 0111011 @r
 +binvw      0110100 .......... 001 ..... 0111011 @r
 +bextw      0100100 .......... 101 ..... 0111011 @r
 +
 +bsetiw     0010100 .......... 001 ..... 0011011 @sh5
 +bclriw     0100100 .......... 001 ..... 0011011 @sh5
 +binviw     0110100 .......... 001 ..... 0011011 @sh5
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_packh(TCGv ret, TCGv arg1, TCGv arg2)
      tcg_temp_free(t);
  }
 +static void gen_sbop_mask(TCGv ret, TCGv shamt)
 +{
 +    tcg_gen_movi_tl(ret, 1);
 +    tcg_gen_shl_tl(ret, ret, shamt);
 +}
 +
 +static void gen_bset(TCGv ret, TCGv arg1, TCGv shamt)
 +{
 +    TCGv t = tcg_temp_new();
 +
 +    gen_sbop_mask(t, shamt);
 +    tcg_gen_or_tl(ret, arg1, t);
 +
 +    tcg_temp_free(t);
 +}
 +
 +static void gen_bclr(TCGv ret, TCGv arg1, TCGv shamt)
 +{
 +    TCGv t = tcg_temp_new();
 +
 +    gen_sbop_mask(t, shamt);
 +    tcg_gen_andc_tl(ret, arg1, t);
 +
 +    tcg_temp_free(t);
 +}
 +
 +static void gen_binv(TCGv ret, TCGv arg1, TCGv shamt)
 +{
 +    TCGv t = tcg_temp_new();
 +
 +    gen_sbop_mask(t, shamt);
 +    tcg_gen_xor_tl(ret, arg1, t);
 +
 +    tcg_temp_free(t);
 +}
 +
 +static void gen_bext(TCGv ret, TCGv arg1, TCGv shamt)
 +{
 +    tcg_gen_shr_tl(ret, arg1, shamt);
 +    tcg_gen_andi_tl(ret, ret, 1);
 +}
 +
  static void gen_ctzw(TCGv ret, TCGv arg1)
  {
      tcg_gen_ori_tl(ret, arg1, (target_ulong)MAKE_64BIT_MASK(32, 32));
@@ -XXX,XX +XXX,XX @@ static bool gen_shifti(DisasContext *ctx, arg_shift *a,
      return true;
  }
 +static bool gen_shiftw(DisasContext *ctx, arg_r *a,
 +                       void(*func)(TCGv, TCGv, TCGv))
 +{
 +    TCGv source1 = tcg_temp_new();
 +    TCGv source2 = tcg_temp_new();
 +
 +    gen_get_gpr(source1, a->rs1);
 +    gen_get_gpr(source2, a->rs2);
 +
 +    tcg_gen_andi_tl(source2, source2, 31);
 +    (*func)(source1, source1, source2);
 +    tcg_gen_ext32s_tl(source1, source1);
 +
 +    gen_set_gpr(a->rd, source1);
 +    tcg_temp_free(source1);
 +    tcg_temp_free(source2);
 +    return true;
 +}
 +
  static bool gen_shiftiw(DisasContext *ctx, arg_shift *a,
                          void(*func)(TCGv, TCGv, TCGv))
  {
 diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvb.c.inc
 +++ b/target/riscv/insn_trans/trans_rvb.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_sext_h(DisasContext *ctx, arg_sext_h *a)
      return gen_unary(ctx, a, tcg_gen_ext16s_tl);
  }
 +static bool trans_bset(DisasContext *ctx, arg_bset *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shift(ctx, a, gen_bset);
 +}
 +
 +static bool trans_bseti(DisasContext *ctx, arg_bseti *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shifti(ctx, a, gen_bset);
 +}
 +
 +static bool trans_bclr(DisasContext *ctx, arg_bclr *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shift(ctx, a, gen_bclr);
 +}
 +
 +static bool trans_bclri(DisasContext *ctx, arg_bclri *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shifti(ctx, a, gen_bclr);
 +}
 +
 +static bool trans_binv(DisasContext *ctx, arg_binv *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shift(ctx, a, gen_binv);
 +}
 +
 +static bool trans_binvi(DisasContext *ctx, arg_binvi *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shifti(ctx, a, gen_binv);
 +}
 +
 +static bool trans_bext(DisasContext *ctx, arg_bext *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shift(ctx, a, gen_bext);
 +}
 +
 +static bool trans_bexti(DisasContext *ctx, arg_bexti *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shifti(ctx, a, gen_bext);
 +}
 +
  static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
  {
      REQUIRE_64BIT(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_packuw(DisasContext *ctx, arg_packuw *a)
      REQUIRE_EXT(ctx, RVB);
      return gen_arith(ctx, a, gen_packuw);
  }
 +
 +static bool trans_bsetw(DisasContext *ctx, arg_bsetw *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shiftw(ctx, a, gen_bset);
 +}
 +
 +static bool trans_bsetiw(DisasContext *ctx, arg_bsetiw *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shiftiw(ctx, a, gen_bset);
 +}
 +
 +static bool trans_bclrw(DisasContext *ctx, arg_bclrw *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shiftw(ctx, a, gen_bclr);
 +}
 +
 +static bool trans_bclriw(DisasContext *ctx, arg_bclriw *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shiftiw(ctx, a, gen_bclr);
 +}
 +
 +static bool trans_binvw(DisasContext *ctx, arg_binvw *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shiftw(ctx, a, gen_binv);
 +}
 +
 +static bool trans_binviw(DisasContext *ctx, arg_binviw *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shiftiw(ctx, a, gen_binv);
 +}
 +
 +static bool trans_bextw(DisasContext *ctx, arg_bextw *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shiftw(ctx, a, gen_bext);
 +}
 --
 .31.1

-New patch
+[PULL 25/32] target/riscv: rvb: shift ones
+From: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20210505160620.15723-11-frank.chang@sifive.com
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn32.decode              |  8 ++++
+ target/riscv/translate.c                | 14 +++++++
+ target/riscv/insn_trans/trans_rvb.c.inc | 52 +++++++++++++++++++++++++
+files changed, 74 insertions(+)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@ bset       0010100 .......... 001 ..... 0110011 @r
+ bclr       0100100 .......... 001 ..... 0110011 @r
+ binv       0110100 .......... 001 ..... 0110011 @r
+ bext       0100100 .......... 101 ..... 0110011 @r
++slo        0010000 .......... 001 ..... 0110011 @r
++sro        0010000 .......... 101 ..... 0110011 @r
+ bseti      00101. ........... 001 ..... 0010011 @sh
+ bclri      01001. ........... 001 ..... 0010011 @sh
+ binvi      01101. ........... 001 ..... 0010011 @sh
+ bexti      01001. ........... 101 ..... 0010011 @sh
++sloi       00100. ........... 001 ..... 0010011 @sh
++sroi       00100. ........... 101 ..... 0010011 @sh
+ # *** RV64B Standard Extension (in addition to RV32B) ***
+ clzw       0110000 00000 ..... 001 ..... 0011011 @r2
+@@ -XXX,XX +XXX,XX @@ bsetw      0010100 .......... 001 ..... 0111011 @r
+ bclrw      0100100 .......... 001 ..... 0111011 @r
+ binvw      0110100 .......... 001 ..... 0111011 @r
+ bextw      0100100 .......... 101 ..... 0111011 @r
++slow       0010000 .......... 001 ..... 0111011 @r
++srow       0010000 .......... 101 ..... 0111011 @r
+ bsetiw     0010100 .......... 001 ..... 0011011 @sh5
+ bclriw     0100100 .......... 001 ..... 0011011 @sh5
+ binviw     0110100 .......... 001 ..... 0011011 @sh5
++sloiw      0010000 .......... 001 ..... 0011011 @sh5
++sroiw      0010000 .......... 101 ..... 0011011 @sh5
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/translate.c
++++ b/target/riscv/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_bext(TCGv ret, TCGv arg1, TCGv shamt)
+     tcg_gen_andi_tl(ret, ret, 1);
+ }
++static void gen_slo(TCGv ret, TCGv arg1, TCGv arg2)
++{
++    tcg_gen_not_tl(ret, arg1);
++    tcg_gen_shl_tl(ret, ret, arg2);
++    tcg_gen_not_tl(ret, ret);
++}
++
++static void gen_sro(TCGv ret, TCGv arg1, TCGv arg2)
++{
++    tcg_gen_not_tl(ret, arg1);
++    tcg_gen_shr_tl(ret, ret, arg2);
++    tcg_gen_not_tl(ret, ret);
++}
++
+ static void gen_ctzw(TCGv ret, TCGv arg1)
+ {
+     tcg_gen_ori_tl(ret, arg1, (target_ulong)MAKE_64BIT_MASK(32, 32));
+diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvb.c.inc
++++ b/target/riscv/insn_trans/trans_rvb.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool trans_bexti(DisasContext *ctx, arg_bexti *a)
+     return gen_shifti(ctx, a, gen_bext);
+ }
++static bool trans_slo(DisasContext *ctx, arg_slo *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shift(ctx, a, gen_slo);
++}
++
++static bool trans_sloi(DisasContext *ctx, arg_sloi *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shifti(ctx, a, gen_slo);
++}
++
++static bool trans_sro(DisasContext *ctx, arg_sro *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shift(ctx, a, gen_sro);
++}
++
++static bool trans_sroi(DisasContext *ctx, arg_sroi *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shifti(ctx, a, gen_sro);
++}
++
+ static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
+ {
+     REQUIRE_64BIT(ctx);
+@@ -XXX,XX +XXX,XX @@ static bool trans_bextw(DisasContext *ctx, arg_bextw *a)
+     REQUIRE_EXT(ctx, RVB);
+     return gen_shiftw(ctx, a, gen_bext);
+ }
++
++static bool trans_slow(DisasContext *ctx, arg_slow *a)
++{
++    REQUIRE_64BIT(ctx);
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shiftw(ctx, a, gen_slo);
++}
++
++static bool trans_sloiw(DisasContext *ctx, arg_sloiw *a)
++{
++    REQUIRE_64BIT(ctx);
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shiftiw(ctx, a, gen_slo);
++}
++
++static bool trans_srow(DisasContext *ctx, arg_srow *a)
++{
++    REQUIRE_64BIT(ctx);
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shiftw(ctx, a, gen_sro);
++}
++
++static bool trans_sroiw(DisasContext *ctx, arg_sroiw *a)
++{
++    REQUIRE_64BIT(ctx);
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shiftiw(ctx, a, gen_sro);
++}
+--
+.31.1

-[PULL 07/16] target/riscv: Make VSTIP and VSEIP read-only in hip
+[PULL 26/32] target/riscv: rvb: rotate (left/right)
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Kito Cheng <kito.cheng@sifive.com>
-Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
 Signed-off-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210311094902.1377593-1-georg.kotheimer@kernkonzept.com
+Message-id: 20210505160620.15723-12-frank.chang@sifive.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 7 ++++---
+ target/riscv/insn32.decode              |  6 ++++
-file changed, 4 insertions(+), 3 deletions(-)
+ target/riscv/translate.c                | 36 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvb.c.inc | 39 +++++++++++++++++++++++++
 files changed, 81 insertions(+)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/target/riscv/insn32.decode
-+++ b/target/riscv/csr.c
++++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
+@@ -XXX,XX +XXX,XX @@ binv       0110100 .......... 001 ..... 0110011 @r
-     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
+ bext       0100100 .......... 101 ..... 0110011 @r
-     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_SD;
+ slo        0010000 .......... 001 ..... 0110011 @r
- static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
+ sro        0010000 .......... 101 ..... 0110011 @r
--static const target_ulong hip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
++ror        0110000 .......... 101 ..... 0110011 @r
-+static const target_ulong hip_writable_mask = MIP_VSSIP;
++rol        0110000 .......... 001 ..... 0110011 @r
-+static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
- static const target_ulong vsip_writable_mask = MIP_VSSIP;
+ bseti      00101. ........... 001 ..... 0010011 @sh
+ bclri      01001. ........... 001 ..... 0010011 @sh
- static const char valid_vm_1_10_32[16] = {
+@@ -XXX,XX +XXX,XX @@ binvi      01101. ........... 001 ..... 0010011 @sh
-@@ -XXX,XX +XXX,XX @@ static int rmw_hvip(CPURISCVState *env, int csrno, target_ulong *ret_value,
+ bexti      01001. ........... 101 ..... 0010011 @sh
-                    target_ulong new_value, target_ulong write_mask)
+ sloi       00100. ........... 001 ..... 0010011 @sh
  sroi       00100. ........... 101 ..... 0010011 @sh
 +rori       01100. ........... 101 ..... 0010011 @sh
  # *** RV64B Standard Extension (in addition to RV32B) ***
  clzw       0110000 00000 ..... 001 ..... 0011011 @r2
@@ -XXX,XX +XXX,XX @@ binvw      0110100 .......... 001 ..... 0111011 @r
  bextw      0100100 .......... 101 ..... 0111011 @r
  slow       0010000 .......... 001 ..... 0111011 @r
  srow       0010000 .......... 101 ..... 0111011 @r
 +rorw       0110000 .......... 101 ..... 0111011 @r
 +rolw       0110000 .......... 001 ..... 0111011 @r
  bsetiw     0010100 .......... 001 ..... 0011011 @sh5
  bclriw     0100100 .......... 001 ..... 0011011 @sh5
  binviw     0110100 .......... 001 ..... 0011011 @sh5
  sloiw      0010000 .......... 001 ..... 0011011 @sh5
  sroiw      0010000 .......... 101 ..... 0011011 @sh5
 +roriw      0110000 .......... 101 ..... 0011011 @sh5
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_packuw(TCGv ret, TCGv arg1, TCGv arg2)
      tcg_temp_free(t);
  }
 +static void gen_rorw(TCGv ret, TCGv arg1, TCGv arg2)
 +{
 +    TCGv_i32 t1 = tcg_temp_new_i32();
 +    TCGv_i32 t2 = tcg_temp_new_i32();
 +
 +    /* truncate to 32-bits */
 +    tcg_gen_trunc_tl_i32(t1, arg1);
 +    tcg_gen_trunc_tl_i32(t2, arg2);
 +
 +    tcg_gen_rotr_i32(t1, t1, t2);
 +
 +    /* sign-extend 64-bits */
 +    tcg_gen_ext_i32_tl(ret, t1);
 +
 +    tcg_temp_free_i32(t1);
 +    tcg_temp_free_i32(t2);
 +}
 +
 +static void gen_rolw(TCGv ret, TCGv arg1, TCGv arg2)
 +{
 +    TCGv_i32 t1 = tcg_temp_new_i32();
 +    TCGv_i32 t2 = tcg_temp_new_i32();
 +
 +    /* truncate to 32-bits */
 +    tcg_gen_trunc_tl_i32(t1, arg1);
 +    tcg_gen_trunc_tl_i32(t2, arg2);
 +
 +    tcg_gen_rotl_i32(t1, t1, t2);
 +
 +    /* sign-extend 64-bits */
 +    tcg_gen_ext_i32_tl(ret, t1);
 +
 +    tcg_temp_free_i32(t1);
 +    tcg_temp_free_i32(t2);
 +}
 +
  static bool gen_arith(DisasContext *ctx, arg_r *a,
                        void(*func)(TCGv, TCGv, TCGv))
  {
-     int ret = rmw_mip(env, 0, ret_value, new_value,
+diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
--                      write_mask & hip_writable_mask);
+index XXXXXXX..XXXXXXX 100644
-+                      write_mask & hvip_writable_mask);
+--- a/target/riscv/insn_trans/trans_rvb.c.inc
++++ b/target/riscv/insn_trans/trans_rvb.c.inc
--    *ret_value &= hip_writable_mask;
+@@ -XXX,XX +XXX,XX @@ static bool trans_sroi(DisasContext *ctx, arg_sroi *a)
-+    *ret_value &= hvip_writable_mask;
+     return gen_shifti(ctx, a, gen_sro);
      return ret;
  }
++static bool trans_ror(DisasContext *ctx, arg_ror *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shift(ctx, a, tcg_gen_rotr_tl);
++}
++
++static bool trans_rori(DisasContext *ctx, arg_rori *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shifti(ctx, a, tcg_gen_rotr_tl);
++}
++
++static bool trans_rol(DisasContext *ctx, arg_rol *a)
++{
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shift(ctx, a, tcg_gen_rotl_tl);
++}
++
+ static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
+ {
+     REQUIRE_64BIT(ctx);
+@@ -XXX,XX +XXX,XX @@ static bool trans_sroiw(DisasContext *ctx, arg_sroiw *a)
+     REQUIRE_EXT(ctx, RVB);
+     return gen_shiftiw(ctx, a, gen_sro);
+ }
++
++static bool trans_rorw(DisasContext *ctx, arg_rorw *a)
++{
++    REQUIRE_64BIT(ctx);
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shiftw(ctx, a, gen_rorw);
++}
++
++static bool trans_roriw(DisasContext *ctx, arg_roriw *a)
++{
++    REQUIRE_64BIT(ctx);
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shiftiw(ctx, a, gen_rorw);
++}
++
++static bool trans_rolw(DisasContext *ctx, arg_rolw *a)
++{
++    REQUIRE_64BIT(ctx);
++    REQUIRE_EXT(ctx, RVB);
++    return gen_shiftw(ctx, a, gen_rolw);
++}
 --
-.30.1
+.31.1

-New patch
+[PULL 27/32] target/riscv: rvb: generalized reverse
+From: Frank Chang <frank.chang@sifive.com>
 Signed-off-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210505160620.15723-13-frank.chang@sifive.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/helper.h                   |  4 ++
  target/riscv/insn32.decode              |  4 ++
  target/riscv/bitmanip_helper.c          | 64 +++++++++++++++++++++++++
  target/riscv/translate.c                | 28 +++++++++++
  target/riscv/insn_trans/trans_rvb.c.inc | 31 ++++++++++++
  target/riscv/meson.build                |  1 +
 files changed, 132 insertions(+)
  create mode 100644 target/riscv/bitmanip_helper.c
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_d_l, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_d_lu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
 +/* Bitmanip */
 +DEF_HELPER_FLAGS_2(grev, TCG_CALL_NO_RWG_SE, tl, tl, tl)
 +DEF_HELPER_FLAGS_2(grevw, TCG_CALL_NO_RWG_SE, tl, tl, tl)
 +
  /* Special functions */
  DEF_HELPER_3(csrrw, tl, env, tl, tl)
  DEF_HELPER_4(csrrs, tl, env, tl, tl, tl)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ slo        0010000 .......... 001 ..... 0110011 @r
  sro        0010000 .......... 101 ..... 0110011 @r
  ror        0110000 .......... 101 ..... 0110011 @r
  rol        0110000 .......... 001 ..... 0110011 @r
 +grev       0110100 .......... 101 ..... 0110011 @r
  bseti      00101. ........... 001 ..... 0010011 @sh
  bclri      01001. ........... 001 ..... 0010011 @sh
@@ -XXX,XX +XXX,XX @@ bexti      01001. ........... 101 ..... 0010011 @sh
  sloi       00100. ........... 001 ..... 0010011 @sh
  sroi       00100. ........... 101 ..... 0010011 @sh
  rori       01100. ........... 101 ..... 0010011 @sh
 +grevi      01101. ........... 101 ..... 0010011 @sh
  # *** RV64B Standard Extension (in addition to RV32B) ***
  clzw       0110000 00000 ..... 001 ..... 0011011 @r2
@@ -XXX,XX +XXX,XX @@ slow       0010000 .......... 001 ..... 0111011 @r
  srow       0010000 .......... 101 ..... 0111011 @r
  rorw       0110000 .......... 101 ..... 0111011 @r
  rolw       0110000 .......... 001 ..... 0111011 @r
 +grevw      0110100 .......... 101 ..... 0111011 @r
  bsetiw     0010100 .......... 001 ..... 0011011 @sh5
  bclriw     0100100 .......... 001 ..... 0011011 @sh5
@@ -XXX,XX +XXX,XX @@ binviw     0110100 .......... 001 ..... 0011011 @sh5
  sloiw      0010000 .......... 001 ..... 0011011 @sh5
  sroiw      0010000 .......... 101 ..... 0011011 @sh5
  roriw      0110000 .......... 101 ..... 0011011 @sh5
 +greviw     0110100 .......... 101 ..... 0011011 @sh5
 diff --git a/target/riscv/bitmanip_helper.c b/target/riscv/bitmanip_helper.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/riscv/bitmanip_helper.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * RISC-V Bitmanip Extension Helpers for QEMU.
 + *
 + * Copyright (c) 2020 Kito Cheng, kito.cheng@sifive.com
 + * Copyright (c) 2020 Frank Chang, frank.chang@sifive.com
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/host-utils.h"
 +#include "exec/exec-all.h"
 +#include "exec/helper-proto.h"
 +#include "tcg/tcg.h"
 +
 +static const uint64_t adjacent_masks[] = {
 +    dup_const(MO_8, 0x55),
 +    dup_const(MO_8, 0x33),
 +    dup_const(MO_8, 0x0f),
 +    dup_const(MO_16, 0xff),
 +    dup_const(MO_32, 0xffff),
 +    UINT32_MAX
 +};
 +
 +static inline target_ulong do_swap(target_ulong x, uint64_t mask, int shift)
 +{
 +    return ((x & mask) << shift) | ((x & ~mask) >> shift);
 +}
 +
 +static target_ulong do_grev(target_ulong rs1,
 +                            target_ulong rs2,
 +                            int bits)
 +{
 +    target_ulong x = rs1;
 +    int i, shift;
 +
 +    for (i = 0, shift = 1; shift < bits; i++, shift <<= 1) {
 +        if (rs2 & shift) {
 +            x = do_swap(x, adjacent_masks[i], shift);
 +        }
 +    }
 +
 +    return x;
 +}
 +
 +target_ulong HELPER(grev)(target_ulong rs1, target_ulong rs2)
 +{
 +    return do_grev(rs1, rs2, TARGET_LONG_BITS);
 +}
 +
 +target_ulong HELPER(grevw)(target_ulong rs1, target_ulong rs2)
 +{
 +    return do_grev(rs1, rs2, 32);
 +}
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_sro(TCGv ret, TCGv arg1, TCGv arg2)
      tcg_gen_not_tl(ret, ret);
  }
 +static bool gen_grevi(DisasContext *ctx, arg_grevi *a)
 +{
 +    TCGv source1 = tcg_temp_new();
 +    TCGv source2;
 +
 +    gen_get_gpr(source1, a->rs1);
 +
 +    if (a->shamt == (TARGET_LONG_BITS - 8)) {
 +        /* rev8, byte swaps */
 +        tcg_gen_bswap_tl(source1, source1);
 +    } else {
 +        source2 = tcg_temp_new();
 +        tcg_gen_movi_tl(source2, a->shamt);
 +        gen_helper_grev(source1, source1, source2);
 +        tcg_temp_free(source2);
 +    }
 +
 +    gen_set_gpr(a->rd, source1);
 +    tcg_temp_free(source1);
 +    return true;
 +}
 +
  static void gen_ctzw(TCGv ret, TCGv arg1)
  {
      tcg_gen_ori_tl(ret, arg1, (target_ulong)MAKE_64BIT_MASK(32, 32));
@@ -XXX,XX +XXX,XX @@ static void gen_rolw(TCGv ret, TCGv arg1, TCGv arg2)
      tcg_temp_free_i32(t2);
  }
 +static void gen_grevw(TCGv ret, TCGv arg1, TCGv arg2)
 +{
 +    tcg_gen_ext32u_tl(arg1, arg1);
 +    gen_helper_grev(ret, arg1, arg2);
 +}
 +
  static bool gen_arith(DisasContext *ctx, arg_r *a,
                        void(*func)(TCGv, TCGv, TCGv))
  {
 diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvb.c.inc
 +++ b/target/riscv/insn_trans/trans_rvb.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_rol(DisasContext *ctx, arg_rol *a)
      return gen_shift(ctx, a, tcg_gen_rotl_tl);
  }
 +static bool trans_grev(DisasContext *ctx, arg_grev *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shift(ctx, a, gen_helper_grev);
 +}
 +
 +static bool trans_grevi(DisasContext *ctx, arg_grevi *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +
 +    if (a->shamt >= TARGET_LONG_BITS) {
 +        return false;
 +    }
 +
 +    return gen_grevi(ctx, a);
 +}
 +
  static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
  {
      REQUIRE_64BIT(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_rolw(DisasContext *ctx, arg_rolw *a)
      REQUIRE_EXT(ctx, RVB);
      return gen_shiftw(ctx, a, gen_rolw);
  }
 +
 +static bool trans_grevw(DisasContext *ctx, arg_grevw *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shiftw(ctx, a, gen_grevw);
 +}
 +
 +static bool trans_greviw(DisasContext *ctx, arg_greviw *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shiftiw(ctx, a, gen_grevw);
 +}
 diff --git a/target/riscv/meson.build b/target/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/meson.build
 +++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
    'gdbstub.c',
    'op_helper.c',
    'vector_helper.c',
 +  'bitmanip_helper.c',
    'translate.c',
  ))
 --
 .31.1

-[PULL 03/16] target/riscv: propagate PMP permission to TLB page
+[PULL 28/32] target/riscv: rvb: generalized or-combine
-From: Jim Shu <cwshu@andestech.com>
+From: Frank Chang <frank.chang@sifive.com>
-Currently, PMP permission checking of TLB page is bypassed if TLB hits
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Fix it by propagating PMP permission to TLB page permission.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210505160620.15723-14-frank.chang@sifive.com
 PMP permission checking also use MMU-style API to change TLB permission
 and size.
 Signed-off-by: Jim Shu <cwshu@andestech.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 1613916082-19528-2-git-send-email-cwshu@andestech.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/pmp.h        |  4 +-
+ target/riscv/helper.h                   |  2 ++
- target/riscv/cpu_helper.c | 84 +++++++++++++++++++++++++++++----------
+ target/riscv/insn32.decode              |  4 ++++
- target/riscv/pmp.c        | 80 +++++++++++++++++++++++++++----------
+ target/riscv/bitmanip_helper.c          | 26 +++++++++++++++++++++++++
-files changed, 125 insertions(+), 43 deletions(-)
+ target/riscv/translate.c                |  6 ++++++
  target/riscv/insn_trans/trans_rvb.c.inc | 26 +++++++++++++++++++++++++
 files changed, 64 insertions(+)
-diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmp.h
+--- a/target/riscv/helper.h
-+++ b/target/riscv/pmp.h
++++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
-     target_ulong val);
+ /* Bitmanip */
- target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
+ DEF_HELPER_FLAGS_2(grev, TCG_CALL_NO_RWG_SE, tl, tl, tl)
- bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+ DEF_HELPER_FLAGS_2(grevw, TCG_CALL_NO_RWG_SE, tl, tl, tl)
--    target_ulong size, pmp_priv_t priv, target_ulong mode);
++DEF_HELPER_FLAGS_2(gorc, TCG_CALL_NO_RWG_SE, tl, tl, tl)
-+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
++DEF_HELPER_FLAGS_2(gorcw, TCG_CALL_NO_RWG_SE, tl, tl, tl)
-+    target_ulong mode);
- bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
+ /* Special functions */
-                          target_ulong *tlb_size);
+ DEF_HELPER_3(csrrw, tl, env, tl, tl)
- void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
  void pmp_update_rule_nums(CPURISCVState *env);
  uint32_t pmp_get_num_rules(CPURISCVState *env);
 +int pmp_priv_to_page_prot(pmp_priv_t pmp_priv);
  #endif
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/insn32.decode
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
+@@ -XXX,XX +XXX,XX @@ sro        0010000 .......... 101 ..... 0110011 @r
-     env->load_res = -1;
+ ror        0110000 .......... 101 ..... 0110011 @r
  rol        0110000 .......... 001 ..... 0110011 @r
  grev       0110100 .......... 101 ..... 0110011 @r
 +gorc       0010100 .......... 101 ..... 0110011 @r
  bseti      00101. ........... 001 ..... 0010011 @sh
  bclri      01001. ........... 001 ..... 0010011 @sh
@@ -XXX,XX +XXX,XX @@ sloi       00100. ........... 001 ..... 0010011 @sh
  sroi       00100. ........... 101 ..... 0010011 @sh
  rori       01100. ........... 101 ..... 0010011 @sh
  grevi      01101. ........... 101 ..... 0010011 @sh
 +gorci      00101. ........... 101 ..... 0010011 @sh
  # *** RV64B Standard Extension (in addition to RV32B) ***
  clzw       0110000 00000 ..... 001 ..... 0011011 @r2
@@ -XXX,XX +XXX,XX @@ srow       0010000 .......... 101 ..... 0111011 @r
  rorw       0110000 .......... 101 ..... 0111011 @r
  rolw       0110000 .......... 001 ..... 0111011 @r
  grevw      0110100 .......... 101 ..... 0111011 @r
 +gorcw      0010100 .......... 101 ..... 0111011 @r
  bsetiw     0010100 .......... 001 ..... 0011011 @sh5
  bclriw     0100100 .......... 001 ..... 0011011 @sh5
@@ -XXX,XX +XXX,XX @@ sloiw      0010000 .......... 001 ..... 0011011 @sh5
  sroiw      0010000 .......... 101 ..... 0011011 @sh5
  roriw      0110000 .......... 101 ..... 0011011 @sh5
  greviw     0110100 .......... 101 ..... 0011011 @sh5
 +gorciw     0010100 .......... 101 ..... 0011011 @sh5
 diff --git a/target/riscv/bitmanip_helper.c b/target/riscv/bitmanip_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/bitmanip_helper.c
 +++ b/target/riscv/bitmanip_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(grevw)(target_ulong rs1, target_ulong rs2)
  {
      return do_grev(rs1, rs2, 32);
  }
++
-+/*
++static target_ulong do_gorc(target_ulong rs1,
-+ * get_physical_address_pmp - check PMP permission for this physical address
++                            target_ulong rs2,
-+ *
++                            int bits)
 + * Match the PMP region and check permission for this physical address and it's
 + * TLB page. Returns 0 if the permission checking was successful
 + *
 + * @env: CPURISCVState
 + * @prot: The returned protection attributes
 + * @tlb_size: TLB page size containing addr. It could be modified after PMP
 + *            permission checking. NULL if not set TLB page for addr.
 + * @addr: The physical address to be checked permission
 + * @access_type: The type of MMU access
 + * @mode: Indicates current privilege level.
 + */
 +static int get_physical_address_pmp(CPURISCVState *env, int *prot,
 +                                    target_ulong *tlb_size, hwaddr addr,
 +                                    int size, MMUAccessType access_type,
 +                                    int mode)
 +{
-+    pmp_priv_t pmp_priv;
++    target_ulong x = rs1;
-+    target_ulong tlb_size_pmp = 0;
++    int i, shift;
 +
-+    if (!riscv_feature(env, RISCV_FEATURE_PMP)) {
++    for (i = 0, shift = 1; shift < bits; i++, shift <<= 1) {
-+        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
++        if (rs2 & shift) {
-+        return TRANSLATE_SUCCESS;
++            x |= do_swap(x, adjacent_masks[i], shift);
 +    }
 +
 +    if (!pmp_hart_has_privs(env, addr, size, 1 << access_type, &pmp_priv,
 +                            mode)) {
 +        *prot = 0;
 +        return TRANSLATE_PMP_FAIL;
 +    }
 +
 +    *prot = pmp_priv_to_page_prot(pmp_priv);
 +    if (tlb_size != NULL) {
 +        if (pmp_is_range_in_tlb(env, addr & ~(*tlb_size - 1), &tlb_size_pmp)) {
 +            *tlb_size = tlb_size_pmp;
 +        }
 +    }
 +
-+    return TRANSLATE_SUCCESS;
++    return x;
 +}
 +
- /* get_physical_address - get the physical address for this virtual address
++target_ulong HELPER(gorc)(target_ulong rs1, target_ulong rs2)
   *
   * Do a page table walk to obtain the physical address corresponding to a
@@ -XXX,XX +XXX,XX @@ restart:
              pte_addr = base + idx * ptesize;
          }
 -        if (riscv_feature(env, RISCV_FEATURE_PMP) &&
 -            !pmp_hart_has_privs(env, pte_addr, sizeof(target_ulong),
 -            1 << MMU_DATA_LOAD, PRV_S)) {
 +        int pmp_prot;
 +        int pmp_ret = get_physical_address_pmp(env, &pmp_prot, NULL, pte_addr,
 +                                               sizeof(target_ulong),
 +                                               MMU_DATA_LOAD, PRV_S);
 +        if (pmp_ret != TRANSLATE_SUCCESS) {
              return TRANSLATE_PMP_FAIL;
          }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
  #ifndef CONFIG_USER_ONLY
      vaddr im_address;
      hwaddr pa = 0;
 -    int prot, prot2;
 +    int prot, prot2, prot_pmp;
      bool pmp_violation = false;
      bool first_stage_error = true;
      bool two_stage_lookup = false;
      int ret = TRANSLATE_FAIL;
      int mode = mmu_idx;
 -    target_ulong tlb_size = 0;
 +    /* default TLB page size */
 +    target_ulong tlb_size = TARGET_PAGE_SIZE;
      env->guest_phys_fault_addr = 0;
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
              prot &= prot2;
 -            if (riscv_feature(env, RISCV_FEATURE_PMP) &&
 -                (ret == TRANSLATE_SUCCESS) &&
 -                !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
 -                ret = TRANSLATE_PMP_FAIL;
 +            if (ret == TRANSLATE_SUCCESS) {
 +                ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
 +                                               size, access_type, mode);
 +                prot &= prot_pmp;
              }
              if (ret != TRANSLATE_SUCCESS) {
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                        "%s address=%" VADDR_PRIx " ret %d physical "
                        TARGET_FMT_plx " prot %d\n",
                        __func__, address, ret, pa, prot);
 -    }
 -    if (riscv_feature(env, RISCV_FEATURE_PMP) &&
 -        (ret == TRANSLATE_SUCCESS) &&
 -        !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
 -        ret = TRANSLATE_PMP_FAIL;
 +        if (ret == TRANSLATE_SUCCESS) {
 +            ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
 +                                           size, access_type, mode);
 +            prot &= prot_pmp;
 +        }
      }
 +
      if (ret == TRANSLATE_PMP_FAIL) {
          pmp_violation = true;
      }
      if (ret == TRANSLATE_SUCCESS) {
 -        if (pmp_is_range_in_tlb(env, pa & TARGET_PAGE_MASK, &tlb_size)) {
 -            tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
 -                         prot, mmu_idx, tlb_size);
 -        } else {
 -            tlb_set_page(cs, address & TARGET_PAGE_MASK, pa & TARGET_PAGE_MASK,
 -                         prot, mmu_idx, TARGET_PAGE_SIZE);
 -        }
 +        tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
 +                     prot, mmu_idx, tlb_size);
          return true;
      } else if (probe) {
          return false;
 diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.c
 +++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
      return result;
  }
 +/*
 + * Check if the address has required RWX privs when no PMP entry is matched.
 + */
 +static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
 +    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
 +    target_ulong mode)
 +{
-+    bool ret;
++    return do_gorc(rs1, rs2, TARGET_LONG_BITS);
 +
 +    if ((!riscv_feature(env, RISCV_FEATURE_PMP)) || (mode == PRV_M)) {
 +        /*
 +         * Privileged spec v1.10 states if HW doesn't implement any PMP entry
 +         * or no PMP entry matches an M-Mode access, the access succeeds.
 +         */
 +        ret = true;
 +        *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 +    } else {
 +        /*
 +         * Other modes are not allowed to succeed if they don't * match a rule,
 +         * but there are rules. We've checked for no rule earlier in this
 +         * function.
 +         */
 +        ret = false;
 +        *allowed_privs = 0;
 +    }
 +
 +    return ret;
 +}
 +
++target_ulong HELPER(gorcw)(target_ulong rs1, target_ulong rs2)
- /*
++{
-  * Public Interface
++    return do_gorc(rs1, rs2, 32);
-@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
++}
-  * Check if the address has required RWX privs to complete desired operation
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-  */
+index XXXXXXX..XXXXXXX 100644
- bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+--- a/target/riscv/translate.c
--    target_ulong size, pmp_priv_t privs, target_ulong mode)
++++ b/target/riscv/translate.c
-+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
+@@ -XXX,XX +XXX,XX @@ static void gen_grevw(TCGv ret, TCGv arg1, TCGv arg2)
-+    target_ulong mode)
+     gen_helper_grev(ret, arg1, arg2);
  }
 +static void gen_gorcw(TCGv ret, TCGv arg1, TCGv arg2)
 +{
 +    tcg_gen_ext32u_tl(arg1, arg1);
 +    gen_helper_gorcw(ret, arg1, arg2);
 +}
 +
  static bool gen_arith(DisasContext *ctx, arg_r *a,
                        void(*func)(TCGv, TCGv, TCGv))
  {
-     int i = 0;
+diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
-     int ret = -1;
+index XXXXXXX..XXXXXXX 100644
-     int pmp_size = 0;
+--- a/target/riscv/insn_trans/trans_rvb.c.inc
-     target_ulong s = 0;
++++ b/target/riscv/insn_trans/trans_rvb.c.inc
-     target_ulong e = 0;
+@@ -XXX,XX +XXX,XX @@ static bool trans_grevi(DisasContext *ctx, arg_grevi *a)
--    pmp_priv_t allowed_privs = 0;
+     return gen_grevi(ctx, a);
      /* Short cut if no rules */
      if (0 == pmp_get_num_rules(env)) {
 -        return (env->priv == PRV_M) ? true : false;
 +        return pmp_hart_has_privs_default(env, addr, size, privs,
 +                                          allowed_privs, mode);
      }
      if (size == 0) {
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
           * check
           */
          if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
 -            allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 +            *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
              if ((mode != PRV_M) || pmp_is_locked(env, i)) {
 -                allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
 +                *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
              }
 -            if ((privs & allowed_privs) == privs) {
 -                ret = 1;
 -                break;
 -            } else {
 -                ret = 0;
 -                break;
 -            }
 +            ret = ((privs & *allowed_privs) == privs);
 +            break;
          }
      }
      /* No rule matched */
      if (ret == -1) {
 -        if (mode == PRV_M) {
 -            ret = 1; /* Privileged spec v1.10 states if no PMP entry matches an
 -                      * M-Mode access, the access succeeds */
 -        } else {
 -            ret = 0; /* Other modes are not allowed to succeed if they don't
 -                      * match a rule, but there are rules.  We've checked for
 -                      * no rule earlier in this function. */
 -        }
 +        return pmp_hart_has_privs_default(env, addr, size, privs,
 +                                          allowed_privs, mode);
      }
      return ret == 1 ? true : false;
  }
--
++static bool trans_gorc(DisasContext *ctx, arg_gorc *a)
- /*
++{
-  * Handle a write to a pmpcfg CSP
++    REQUIRE_EXT(ctx, RVB);
-  */
++    return gen_shift(ctx, a, gen_helper_gorc);
-@@ -XXX,XX +XXX,XX @@ bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
++}
++
-     return false;
++static bool trans_gorci(DisasContext *ctx, arg_gorci *a)
 +{
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shifti(ctx, a, gen_helper_gorc);
 +}
 +
  static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
  {
      REQUIRE_64BIT(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_greviw(DisasContext *ctx, arg_greviw *a)
      REQUIRE_EXT(ctx, RVB);
      return gen_shiftiw(ctx, a, gen_grevw);
  }
 +
-+/*
++static bool trans_gorcw(DisasContext *ctx, arg_gorcw *a)
 + * Convert PMP privilege to TLB page privilege.
 + */
 +int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
 +{
-+    int prot = 0;
++    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +    return gen_shiftw(ctx, a, gen_gorcw);
 +}
 +
-+    if (pmp_priv & PMP_READ) {
++static bool trans_gorciw(DisasContext *ctx, arg_gorciw *a)
-+        prot |= PAGE_READ;
++{
-+    }
++    REQUIRE_64BIT(ctx);
-+    if (pmp_priv & PMP_WRITE) {
++    REQUIRE_EXT(ctx, RVB);
-+        prot |= PAGE_WRITE;
++    return gen_shiftiw(ctx, a, gen_gorcw);
 +    }
 +    if (pmp_priv & PMP_EXEC) {
 +        prot |= PAGE_EXEC;
 +    }
 +
 +    return prot;
 +}
 --
-.30.1
+.31.1

-[PULL 11/16] target/riscv: Fix read and write accesses to vsip and vsie
+[PULL 29/32] target/riscv: rvb: address calculation
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Kito Cheng <kito.cheng@sifive.com>
-The previous implementation was broken in many ways:
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
- - Used mideleg instead of hideleg to mask accesses
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
- - Used MIP_VSSIP instead of VS_MODE_INTERRUPTS to mask writes to vsie
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
- - Did not shift between S bits and VS bits (VSEIP <-> SEIP, ...)
+Message-id: 20210505160620.15723-15-frank.chang@sifive.com
 Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20210311094738.1376795-1-georg.kotheimer@kernkonzept.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 68 +++++++++++++++++++++++-----------------------
+ target/riscv/insn32.decode              |  6 +++++
-file changed, 34 insertions(+), 34 deletions(-)
+ target/riscv/translate.c                | 32 +++++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvb.c.inc | 24 +++++++++++++++++++
 files changed, 62 insertions(+)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/target/riscv/insn32.decode
-+++ b/target/riscv/csr.c
++++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ static int write_sstatus(CPURISCVState *env, int csrno, target_ulong val)
+@@ -XXX,XX +XXX,XX @@ ror        0110000 .......... 101 ..... 0110011 @r
-     return write_mstatus(env, CSR_MSTATUS, newval);
+ rol        0110000 .......... 001 ..... 0110011 @r
  grev       0110100 .......... 101 ..... 0110011 @r
  gorc       0010100 .......... 101 ..... 0110011 @r
 +sh1add     0010000 .......... 010 ..... 0110011 @r
 +sh2add     0010000 .......... 100 ..... 0110011 @r
 +sh3add     0010000 .......... 110 ..... 0110011 @r
  bseti      00101. ........... 001 ..... 0010011 @sh
  bclri      01001. ........... 001 ..... 0010011 @sh
@@ -XXX,XX +XXX,XX @@ rorw       0110000 .......... 101 ..... 0111011 @r
  rolw       0110000 .......... 001 ..... 0111011 @r
  grevw      0110100 .......... 101 ..... 0111011 @r
  gorcw      0010100 .......... 101 ..... 0111011 @r
 +sh1add_uw  0010000 .......... 010 ..... 0111011 @r
 +sh2add_uw  0010000 .......... 100 ..... 0111011 @r
 +sh3add_uw  0010000 .......... 110 ..... 0111011 @r
  bsetiw     0010100 .......... 001 ..... 0011011 @sh5
  bclriw     0100100 .......... 001 ..... 0011011 @sh5
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static bool gen_grevi(DisasContext *ctx, arg_grevi *a)
      return true;
  }
-+static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
++#define GEN_SHADD(SHAMT)                                       \
-+{
++static void gen_sh##SHAMT##add(TCGv ret, TCGv arg1, TCGv arg2) \
-+    /* Shift the VS bits to their S bit location in vsie */
++{                                                              \
-+    *val = (env->mie & env->hideleg & VS_MODE_INTERRUPTS) >> 1;
++    TCGv t = tcg_temp_new();                                   \
-+    return 0;
++                                                               \
 +    tcg_gen_shli_tl(t, arg1, SHAMT);                           \
 +    tcg_gen_add_tl(ret, t, arg2);                              \
 +                                                               \
 +    tcg_temp_free(t);                                          \
 +}
 +
- static int read_sie(CPURISCVState *env, int csrno, target_ulong *val)
++GEN_SHADD(1)
 +GEN_SHADD(2)
 +GEN_SHADD(3)
 +
  static void gen_ctzw(TCGv ret, TCGv arg1)
  {
-     if (riscv_cpu_virt_enabled(env)) {
+     tcg_gen_ori_tl(ret, arg1, (target_ulong)MAKE_64BIT_MASK(32, 32));
--        /* Tell the guest the VS bits, shifted to the S bit locations */
+@@ -XXX,XX +XXX,XX @@ static void gen_gorcw(TCGv ret, TCGv arg1, TCGv arg2)
--        *val = (env->mie & env->mideleg & VS_MODE_INTERRUPTS) >> 1;
+     gen_helper_gorcw(ret, arg1, arg2);
 +        read_vsie(env, CSR_VSIE, val);
      } else {
          *val = env->mie & env->mideleg;
      }
      return 0;
  }
--static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
++#define GEN_SHADD_UW(SHAMT)                                       \
-+static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
++static void gen_sh##SHAMT##add_uw(TCGv ret, TCGv arg1, TCGv arg2) \
- {
++{                                                                 \
--    target_ulong newval;
++    TCGv t = tcg_temp_new();                                      \
-+    /* Shift the S bits to their VS bit location in mie */
++                                                                  \
-+    target_ulong newval = (env->mie & ~VS_MODE_INTERRUPTS) |
++    tcg_gen_ext32u_tl(t, arg1);                                   \
-+                          ((val << 1) & env->hideleg & VS_MODE_INTERRUPTS);
++                                                                  \
-+    return write_mie(env, CSR_MIE, newval);
++    tcg_gen_shli_tl(t, t, SHAMT);                                 \
-+}
++    tcg_gen_add_tl(ret, t, arg2);                                 \
++                                                                  \
-+static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
++    tcg_temp_free(t);                                             \
 +{
      if (riscv_cpu_virt_enabled(env)) {
 -        /* Shift the guests S bits to VS */
 -        newval = (env->mie & ~VS_MODE_INTERRUPTS) |
 -                 ((val << 1) & VS_MODE_INTERRUPTS);
 +        write_vsie(env, CSR_VSIE, val);
      } else {
 -        newval = (env->mie & ~S_MODE_INTERRUPTS) | (val & S_MODE_INTERRUPTS);
 +        target_ulong newval = (env->mie & ~S_MODE_INTERRUPTS) |
 +                              (val & S_MODE_INTERRUPTS);
 +        write_mie(env, CSR_MIE, newval);
      }
 -    return write_mie(env, CSR_MIE, newval);
 +    return 0;
  }
  static int read_stvec(CPURISCVState *env, int csrno, target_ulong *val)
@@ -XXX,XX +XXX,XX @@ static int write_sbadaddr(CPURISCVState *env, int csrno, target_ulong val)
      return 0;
  }
 +static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
 +                    target_ulong new_value, target_ulong write_mask)
 +{
 +    /* Shift the S bits to their VS bit location in mip */
 +    int ret = rmw_mip(env, 0, ret_value, new_value << 1,
 +                      (write_mask << 1) & vsip_writable_mask & env->hideleg);
 +    *ret_value &= VS_MODE_INTERRUPTS;
 +    /* Shift the VS bits to their S bit location in vsip */
 +    *ret_value >>= 1;
 +    return ret;
 +}
 +
- static int rmw_sip(CPURISCVState *env, int csrno, target_ulong *ret_value,
++GEN_SHADD_UW(1)
-                    target_ulong new_value, target_ulong write_mask)
++GEN_SHADD_UW(2)
 +GEN_SHADD_UW(3)
 +
  static bool gen_arith(DisasContext *ctx, arg_r *a,
                        void(*func)(TCGv, TCGv, TCGv))
  {
-     int ret;
+diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
+index XXXXXXX..XXXXXXX 100644
-     if (riscv_cpu_virt_enabled(env)) {
+--- a/target/riscv/insn_trans/trans_rvb.c.inc
--        /* Shift the new values to line up with the VS bits */
++++ b/target/riscv/insn_trans/trans_rvb.c.inc
--        ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value << 1,
+@@ -XXX,XX +XXX,XX @@ static bool trans_gorci(DisasContext *ctx, arg_gorci *a)
--                      (write_mask & sip_writable_mask) << 1 & env->mideleg);
+     return gen_shifti(ctx, a, gen_helper_gorc);
 -        ret &= vsip_writable_mask;
 -        ret >>= 1;
 +        ret = rmw_vsip(env, CSR_VSIP, ret_value, new_value, write_mask);
      } else {
          ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value,
                        write_mask & env->mideleg & sip_writable_mask);
@@ -XXX,XX +XXX,XX @@ static int write_vsstatus(CPURISCVState *env, int csrno, target_ulong val)
      return 0;
  }
--static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
++#define GEN_TRANS_SHADD(SHAMT)                                             \
--                    target_ulong new_value, target_ulong write_mask)
++static bool trans_sh##SHAMT##add(DisasContext *ctx, arg_sh##SHAMT##add *a) \
--{
++{                                                                          \
--    int ret = rmw_mip(env, 0, ret_value, new_value,
++    REQUIRE_EXT(ctx, RVB);                                                 \
--                      write_mask & env->mideleg & vsip_writable_mask);
++    return gen_arith(ctx, a, gen_sh##SHAMT##add);                          \
--    return ret;
++}
--}
++
--
++GEN_TRANS_SHADD(1)
--static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
++GEN_TRANS_SHADD(2)
--{
++GEN_TRANS_SHADD(3)
--    *val = env->mie & env->mideleg & VS_MODE_INTERRUPTS;
++
--    return 0;
+ static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
 -}
 -
 -static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
 -{
 -    target_ulong newval = (env->mie & ~env->mideleg) | (val & env->mideleg & MIP_VSSIP);
 -    return write_mie(env, CSR_MIE, newval);
 -}
 -
  static int read_vstvec(CPURISCVState *env, int csrno, target_ulong *val)
  {
-     *val = env->vstvec;
+     REQUIRE_64BIT(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_gorciw(DisasContext *ctx, arg_gorciw *a)
      REQUIRE_EXT(ctx, RVB);
      return gen_shiftiw(ctx, a, gen_gorcw);
  }
 +
 +#define GEN_TRANS_SHADD_UW(SHAMT)                             \
 +static bool trans_sh##SHAMT##add_uw(DisasContext *ctx,        \
 +                                    arg_sh##SHAMT##add_uw *a) \
 +{                                                             \
 +    REQUIRE_64BIT(ctx);                                       \
 +    REQUIRE_EXT(ctx, RVB);                                    \
 +    return gen_arith(ctx, a, gen_sh##SHAMT##add_uw);          \
 +}
 +
 +GEN_TRANS_SHADD_UW(1)
 +GEN_TRANS_SHADD_UW(2)
 +GEN_TRANS_SHADD_UW(3)
 --
-.30.1
+.31.1

-[PULL 04/16] target/riscv: add log of PMP permission checking
+[PULL 30/32] target/riscv: rvb: add/shift with prefix zero-extend
-From: Jim Shu <cwshu@andestech.com>
+From: Kito Cheng <kito.cheng@sifive.com>
-Like MMU translation, add qemu log of PMP permission checking for
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
-debugging.
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Jim Shu <cwshu@andestech.com>
+Message-id: 20210505160620.15723-16-frank.chang@sifive.com
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 1613916082-19528-3-git-send-email-cwshu@andestech.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 12 ++++++++++++
+ target/riscv/insn32.decode              |  3 +++
-file changed, 12 insertions(+)
+ target/riscv/translate.c                |  6 ++++++
  target/riscv/insn_trans/trans_rvb.c.inc | 26 +++++++++++++++++++++++++
 files changed, 35 insertions(+)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/insn32.decode
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+@@ -XXX,XX +XXX,XX @@ gorcw      0010100 .......... 101 ..... 0111011 @r
-             if (ret == TRANSLATE_SUCCESS) {
+ sh1add_uw  0010000 .......... 010 ..... 0111011 @r
-                 ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
+ sh2add_uw  0010000 .......... 100 ..... 0111011 @r
-                                                size, access_type, mode);
+ sh3add_uw  0010000 .......... 110 ..... 0111011 @r
 +add_uw     0000100 .......... 000 ..... 0111011 @r
  bsetiw     0010100 .......... 001 ..... 0011011 @sh5
  bclriw     0100100 .......... 001 ..... 0011011 @sh5
@@ -XXX,XX +XXX,XX @@ sroiw      0010000 .......... 101 ..... 0011011 @sh5
  roriw      0110000 .......... 101 ..... 0011011 @sh5
  greviw     0110100 .......... 101 ..... 0011011 @sh5
  gorciw     0010100 .......... 101 ..... 0011011 @sh5
 +
-+                qemu_log_mask(CPU_LOG_MMU,
++slli_uw    00001. ........... 001 ..... 0011011 @sh
-+                              "%s PMP address=" TARGET_FMT_plx " ret %d prot"
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-+                              " %d tlb_size " TARGET_FMT_lu "\n",
+index XXXXXXX..XXXXXXX 100644
-+                              __func__, pa, ret, prot_pmp, tlb_size);
+--- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ GEN_SHADD_UW(1)
  GEN_SHADD_UW(2)
  GEN_SHADD_UW(3)
 +static void gen_add_uw(TCGv ret, TCGv arg1, TCGv arg2)
 +{
 +    tcg_gen_ext32u_tl(arg1, arg1);
 +    tcg_gen_add_tl(ret, arg1, arg2);
 +}
 +
-                 prot &= prot_pmp;
+ static bool gen_arith(DisasContext *ctx, arg_r *a,
-             }
+                       void(*func)(TCGv, TCGv, TCGv))
+ {
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
-         if (ret == TRANSLATE_SUCCESS) {
+index XXXXXXX..XXXXXXX 100644
-             ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
+--- a/target/riscv/insn_trans/trans_rvb.c.inc
-                                            size, access_type, mode);
++++ b/target/riscv/insn_trans/trans_rvb.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_sh##SHAMT##add_uw(DisasContext *ctx,        \
  GEN_TRANS_SHADD_UW(1)
  GEN_TRANS_SHADD_UW(2)
  GEN_TRANS_SHADD_UW(3)
 +
-+            qemu_log_mask(CPU_LOG_MMU,
++static bool trans_add_uw(DisasContext *ctx, arg_add_uw *a)
-+                          "%s PMP address=" TARGET_FMT_plx " ret %d prot"
++{
-+                          " %d tlb_size " TARGET_FMT_lu "\n",
++    REQUIRE_64BIT(ctx);
-+                          __func__, pa, ret, prot_pmp, tlb_size);
++    REQUIRE_EXT(ctx, RVB);
 +    return gen_arith(ctx, a, gen_add_uw);
 +}
 +
-             prot &= prot_pmp;
++static bool trans_slli_uw(DisasContext *ctx, arg_slli_uw *a)
-         }
++{
-     }
++    REQUIRE_64BIT(ctx);
 +    REQUIRE_EXT(ctx, RVB);
 +
 +    TCGv source1 = tcg_temp_new();
 +    gen_get_gpr(source1, a->rs1);
 +
 +    if (a->shamt < 32) {
 +        tcg_gen_deposit_z_tl(source1, source1, a->shamt, 32);
 +    } else {
 +        tcg_gen_shli_tl(source1, source1, a->shamt);
 +    }
 +
 +    gen_set_gpr(a->rd, source1);
 +    tcg_temp_free(source1);
 +    return true;
 +}
 --
-.30.1
+.31.1

-[PULL 12/16] target/riscv: Add proper two-stage lookup exception detection
+[PULL 31/32] target/riscv: rvb: support and turn on B-extension from command line
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Kito Cheng <kito.cheng@sifive.com>
-The current two-stage lookup detection in riscv_cpu_do_interrupt falls
+B-extension is default off, use cpu rv32 or rv64 with x-b=true to
-short of its purpose, as all it checks is whether two-stage address
+enable B-extension.
 translation either via the hypervisor-load store instructions or the
 MPRV feature would be allowed.
-What we really need instead is whether two-stage address translation was
+Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
-active when the exception was raised. However, in riscv_cpu_do_interrupt
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
 we do not have the information to reliably detect this. Therefore, when
 we raise a memory fault exception we have to record whether two-stage
 address translation is active.
 Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210319141459.1196741-1-georg.kotheimer@kernkonzept.com
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210505160620.15723-17-frank.chang@sifive.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        |  4 ++++
+ target/riscv/cpu.h | 1 +
- target/riscv/cpu.c        |  1 +
+ target/riscv/cpu.c | 4 ++++
- target/riscv/cpu_helper.c | 21 ++++++++-------------
+files changed, 5 insertions(+)
 files changed, 13 insertions(+), 13 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPU {
-     target_ulong satp_hs;
+         bool ext_f;
-     uint64_t mstatus_hs;
+         bool ext_d;
+         bool ext_c;
-+    /* Signals whether the current exception occurred with two-stage address
++        bool ext_b;
-+       translation active. */
+         bool ext_s;
-+    bool two_stage_lookup;
+         bool ext_u;
-+
+         bool ext_h;
      target_ulong scounteren;
      target_ulong mcounteren;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-     env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
+         if (cpu->cfg.ext_h) {
-     env->mcause = 0;
+             target_misa |= RVH;
      env->pc = env->resetvec;
 +    env->two_stage_lookup = false;
  #endif
      cs->exception_index = EXCP_NONE;
      env->load_res = -1;
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
          g_assert_not_reached();
      }
      env->badaddr = address;
 +    env->two_stage_lookup = two_stage;
  }
  hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
      }
      env->badaddr = addr;
 +    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
 +                            riscv_cpu_two_stage_lookup(mmu_idx);
      riscv_raise_exception(&cpu->env, cs->exception_index, retaddr);
  }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
          g_assert_not_reached();
      }
      env->badaddr = addr;
 +    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
 +                            riscv_cpu_two_stage_lookup(mmu_idx);
      riscv_raise_exception(env, cs->exception_index, retaddr);
  }
  #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
          /* handle the trap in S-mode */
          if (riscv_has_ext(env, RVH)) {
              target_ulong hdeleg = async ? env->hideleg : env->hedeleg;
 -            bool two_stage_lookup = false;
 -            if (env->priv == PRV_M ||
 -                (env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
 -                (env->priv == PRV_U && !riscv_cpu_virt_enabled(env) &&
 -                    get_field(env->hstatus, HSTATUS_HU))) {
 -                    two_stage_lookup = true;
 -            }
 -
 -            if ((riscv_cpu_virt_enabled(env) || two_stage_lookup) && write_tval) {
 +            if (env->two_stage_lookup && write_tval) {
                  /*
                   * If we are writing a guest virtual address to stval, set
                   * this to 1. If we are trapping to VS we will set this to 0
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                  riscv_cpu_set_force_hs_excep(env, 0);
              } else {
                  /* Trap into HS mode */
 -                if (!two_stage_lookup) {
 -                    env->hstatus = set_field(env->hstatus, HSTATUS_SPV,
 -                                             riscv_cpu_virt_enabled(env));
 -                }
 +                env->hstatus = set_field(env->hstatus, HSTATUS_SPV, false);
                  htval = env->guest_phys_fault_addr;
              }
          }
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
++        if (cpu->cfg.ext_b) {
-      * RISC-V ISA Specification.
++            target_misa |= RVB;
-      */
++        }
+         if (cpu->cfg.ext_v) {
-+    env->two_stage_lookup = false;
+             target_misa |= RVV;
- #endif
+             if (!is_power_of_2(cpu->cfg.vlen)) {
-     cs->exception_index = EXCP_NONE; /* mark handled to qemu */
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
- }
+     DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
      DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
      /* This is experimental so mark with 'x-' */
 +    DEFINE_PROP_BOOL("x-b", RISCVCPU, cfg.ext_b, false),
      DEFINE_PROP_BOOL("x-h", RISCVCPU, cfg.ext_h, false),
      DEFINE_PROP_BOOL("x-v", RISCVCPU, cfg.ext_v, false),
      DEFINE_PROP_BOOL("Counters", RISCVCPU, cfg.ext_counters, true),
 --
-.30.1
+.31.1

-[PULL 02/16] hw/char: disable ibex uart receive if the buffer is full
+[PULL 32/32] target/riscv: rvb: add b-ext version cpu option
-From: Alexander Wagner <alexander.wagner@ulal.de>
+From: Frank Chang <frank.chang@sifive.com>
-Not disabling the UART leads to QEMU overwriting the UART receive buffer with
+Default b-ext version is v0.93.
 the newest received byte. The rx_level variable is added to allow the use of
 the existing OpenTitan driver libraries.
-Signed-off-by: Alexander Wagner <alexander.wagner@ulal.de>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210309152130.13038-1-alexander.wagner@ulal.de
+Message-id: 20210505160620.15723-18-frank.chang@sifive.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/char/ibex_uart.h |  4 ++++
+ target/riscv/cpu.h |  3 +++
- hw/char/ibex_uart.c         | 23 ++++++++++++++++++-----
+ target/riscv/cpu.c | 23 +++++++++++++++++++++++
-files changed, 22 insertions(+), 5 deletions(-)
+files changed, 26 insertions(+)
-diff --git a/include/hw/char/ibex_uart.h b/include/hw/char/ibex_uart.h
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/char/ibex_uart.h
+--- a/target/riscv/cpu.h
-+++ b/include/hw/char/ibex_uart.h
++++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ REG32(FIFO_CTRL, 0x1c)
+@@ -XXX,XX +XXX,XX @@ enum {
-     FIELD(FIFO_CTRL, RXILVL, 2, 3)
+ #define PRIV_VERSION_1_10_0 0x00011000
-     FIELD(FIFO_CTRL, TXILVL, 5, 2)
+ #define PRIV_VERSION_1_11_0 0x00011100
- REG32(FIFO_STATUS, 0x20)
-+    FIELD(FIFO_STATUS, TXLVL, 0, 5)
++#define BEXT_VERSION_0_93_0 0x00009300
-+    FIELD(FIFO_STATUS, RXLVL, 16, 5)
+ #define VEXT_VERSION_0_07_1 0x00000701
- REG32(OVRD, 0x24)
- REG32(VAL, 0x28)
+ enum {
- REG32(TIMEOUT_CTRL, 0x2c)
+@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
-@@ -XXX,XX +XXX,XX @@ struct IbexUartState {
+     target_ulong guest_phys_fault_addr;
-     uint8_t tx_fifo[IBEX_UART_TX_FIFO_SIZE];
-     uint32_t tx_level;
+     target_ulong priv_ver;
++    target_ulong bext_ver;
-+    uint32_t rx_level;
+     target_ulong vext_ver;
      target_ulong misa;
      target_ulong misa_mask;
@@ -XXX,XX +XXX,XX @@ struct RISCVCPU {
          char *priv_spec;
          char *user_spec;
 +        char *bext_spec;
          char *vext_spec;
          uint16_t vlen;
          uint16_t elen;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void set_priv_version(CPURISCVState *env, int priv_ver)
      env->priv_ver = priv_ver;
  }
 +static void set_bext_version(CPURISCVState *env, int bext_ver)
 +{
 +    env->bext_ver = bext_ver;
 +}
 +
-     QEMUTimer *fifo_trigger_handle;
+ static void set_vext_version(CPURISCVState *env, int vext_ver)
      uint64_t char_tx_time;
 diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/ibex_uart.c
 +++ b/hw/char/ibex_uart.c
@@ -XXX,XX +XXX,XX @@ static int ibex_uart_can_receive(void *opaque)
  {
-     IbexUartState *s = opaque;
+     env->vext_ver = vext_ver;
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
--    if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
+     CPURISCVState *env = &cpu->env;
-+    if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK)
+     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
-+           && !(s->uart_status & R_STATUS_RXFULL_MASK)) {
+     int priv_version = PRIV_VERSION_1_11_0;
-         return 1;
++    int bext_version = BEXT_VERSION_0_93_0;
      int vext_version = VEXT_VERSION_0_07_1;
      target_ulong target_misa = env->misa;
      Error *local_err = NULL;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
      }
-@@ -XXX,XX +XXX,XX @@ static void ibex_uart_receive(void *opaque, const uint8_t *buf, int size)
+     set_priv_version(env, priv_version);
++    set_bext_version(env, bext_version);
-     s->uart_status &= ~R_STATUS_RXIDLE_MASK;
+     set_vext_version(env, vext_version);
-     s->uart_status &= ~R_STATUS_RXEMPTY_MASK;
-+    /* The RXFULL is set after receiving a single byte
+     if (cpu->cfg.mmu) {
-+     * as the FIFO buffers are not yet implemented.
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-+     */
+         }
-+    s->uart_status |= R_STATUS_RXFULL_MASK;
+         if (cpu->cfg.ext_b) {
-+    s->rx_level += 1;
+             target_misa |= RVB;
++
-     if (size > rx_fifo_level) {
++            if (cpu->cfg.bext_spec) {
-         s->uart_intr_state |= R_INTR_STATE_RX_WATERMARK_MASK;
++                if (!g_strcmp0(cpu->cfg.bext_spec, "v0.93")) {
-@@ -XXX,XX +XXX,XX @@ static void ibex_uart_reset(DeviceState *dev)
++                    bext_version = BEXT_VERSION_0_93_0;
-     s->uart_timeout_ctrl = 0x00000000;
++                } else {
++                    error_setg(errp,
-     s->tx_level = 0;
++                           "Unsupported bitmanip spec version '%s'",
-+    s->rx_level = 0;
++                           cpu->cfg.bext_spec);
++                    return;
-     s->char_tx_time = (NANOSECONDS_PER_SECOND / 230400) * 10;
++                }
++            } else {
-@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
++                qemu_log("bitmanip version is not specified, "
++                         "use the default value v0.93\n");
      case R_RDATA:
          retvalue = s->uart_rdata;
 -        if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
 +        if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) && (s->rx_level > 0)) {
              qemu_chr_fe_accept_input(&s->chr);
 -            s->uart_status |= R_STATUS_RXIDLE_MASK;
 -            s->uart_status |= R_STATUS_RXEMPTY_MASK;
 +            s->rx_level -= 1;
 +            s->uart_status &= ~R_STATUS_RXFULL_MASK;
 +            if (s->rx_level == 0) {
 +                s->uart_status |= R_STATUS_RXIDLE_MASK;
 +                s->uart_status |= R_STATUS_RXEMPTY_MASK;
 +            }
++            set_bext_version(env, bext_version);
          }
-         break;
+         if (cpu->cfg.ext_v) {
-     case R_WDATA:
+             target_misa |= RVV;
-@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
-     case R_FIFO_STATUS:
+     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
-         retvalue = s->uart_fifo_status;
+     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
+     DEFINE_PROP_STRING("priv_spec", RISCVCPU, cfg.priv_spec),
--        retvalue |= s->tx_level & 0x1F;
++    DEFINE_PROP_STRING("bext_spec", RISCVCPU, cfg.bext_spec),
-+        retvalue |= (s->rx_level & 0x1F) << R_FIFO_STATUS_RXLVL_SHIFT;
+     DEFINE_PROP_STRING("vext_spec", RISCVCPU, cfg.vext_spec),
-+        retvalue |= (s->tx_level & 0x1F) << R_FIFO_STATUS_TXLVL_SHIFT;
+     DEFINE_PROP_UINT16("vlen", RISCVCPU, cfg.vlen, 128),
+     DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
          qemu_log_mask(LOG_UNIMP,
                        "%s: RX fifos are not supported\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr,
          s->uart_fifo_ctrl = value;
          if (value & R_FIFO_CTRL_RXRST_MASK) {
 +            s->rx_level = 0;
              qemu_log_mask(LOG_UNIMP,
                            "%s: RX fifos are not supported\n", __func__);
          }
 --
-.30.1
+.31.1

The following changes since commit c95bd5ff1660883d15ad6e0005e4c8571604f51a:

Merge remote-tracking branch 'remotes/philmd/tags/mips-fixes-20210322' into staging (2021-03-22 14:26:13 +0000)

are available in the Git repository at:

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210322-2

for you to fetch changes up to 9a27f69bd668d9d71674407badc412ce1231c7d5:

target/riscv: Prevent lost illegal instruction exceptions (2021-03-22 21:54:40 -0400)

----------------------------------------------------------------
RISC-V PR for 6.0

This PR includes:
 - Fix for vector CSR access
 - Improvements to the Ibex UART device
 - PMP improvements and bug fixes
 - Hypervisor extension bug fixes
 - ramfb support for the virt machine
 - Fast read support for SST flash
 - Improvements to the microchip_pfsoc machine

----------------------------------------------------------------
Alexander Wagner (1):
      hw/char: disable ibex uart receive if the buffer is full

Asherah Connor (2):
      hw/riscv: Add fw_cfg support to virt
      hw/riscv: allow ramfb on virt

Bin Meng (3):
      hw/block: m25p80: Support fast read for SST flashes
      hw/riscv: microchip_pfsoc: Map EMMC/SD mux register
      docs/system: riscv: Add documentation for 'microchip-icicle-kit' machine

Frank Chang (1):
      target/riscv: fix vs() to return proper error code

Georg Kotheimer (6):
      target/riscv: Adjust privilege level for HLV(X)/HSV instructions
      target/riscv: Make VSTIP and VSEIP read-only in hip
      target/riscv: Use background registers also for MSTATUS_MPV
      target/riscv: Fix read and write accesses to vsip and vsie
      target/riscv: Add proper two-stage lookup exception detection
      target/riscv: Prevent lost illegal instruction exceptions

Jim Shu (3):
      target/riscv: propagate PMP permission to TLB page
      target/riscv: add log of PMP permission checking
      target/riscv: flush TLB pages if PMP permission has been changed

From: Frank Chang <frank.chang@sifive.com>

vs() should return -RISCV_EXCP_ILLEGAL_INST instead of -1 if rvv feature
is not enabled.

If -1 is returned, exception will be raised and cs->exception_index will
be set to the negative return value. The exception will then be treated
as an instruction access fault instead of illegal instruction fault.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210223065935.20208-1-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int vs(CPURISCVState *env, int csrno)
     if (env->misa & RVV) {
         return 0;
     }
-    return -1;
+    return -RISCV_EXCP_ILLEGAL_INST;
 }
 
 static int ctr(CPURISCVState *env, int csrno)
-- 
2.30.1

From: Alexander Wagner <alexander.wagner@ulal.de>

Not disabling the UART leads to QEMU overwriting the UART receive buffer with
the newest received byte. The rx_level variable is added to allow the use of
the existing OpenTitan driver libraries.

Signed-off-by: Alexander Wagner <alexander.wagner@ulal.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210309152130.13038-1-alexander.wagner@ulal.de
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/char/ibex_uart.h |  4 ++++
 hw/char/ibex_uart.c         | 23 ++++++++++++++++++-----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/include/hw/char/ibex_uart.h b/include/hw/char/ibex_uart.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/ibex_uart.h
+++ b/include/hw/char/ibex_uart.h
@@ -XXX,XX +XXX,XX @@ REG32(FIFO_CTRL, 0x1c)
     FIELD(FIFO_CTRL, RXILVL, 2, 3)
     FIELD(FIFO_CTRL, TXILVL, 5, 2)
 REG32(FIFO_STATUS, 0x20)
+    FIELD(FIFO_STATUS, TXLVL, 0, 5)
+    FIELD(FIFO_STATUS, RXLVL, 16, 5)
 REG32(OVRD, 0x24)
 REG32(VAL, 0x28)
 REG32(TIMEOUT_CTRL, 0x2c)
@@ -XXX,XX +XXX,XX @@ struct IbexUartState {
     uint8_t tx_fifo[IBEX_UART_TX_FIFO_SIZE];
     uint32_t tx_level;
 
+    uint32_t rx_level;
+
     QEMUTimer *fifo_trigger_handle;
     uint64_t char_tx_time;
 
diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/ibex_uart.c
+++ b/hw/char/ibex_uart.c
@@ -XXX,XX +XXX,XX @@ static int ibex_uart_can_receive(void *opaque)
 {
     IbexUartState *s = opaque;
 
-    if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
+    if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK)
+           && !(s->uart_status & R_STATUS_RXFULL_MASK)) {
         return 1;
     }
 
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_receive(void *opaque, const uint8_t *buf, int size)
 
     s->uart_status &= ~R_STATUS_RXIDLE_MASK;
     s->uart_status &= ~R_STATUS_RXEMPTY_MASK;
+    /* The RXFULL is set after receiving a single byte
+     * as the FIFO buffers are not yet implemented.
+     */
+    s->uart_status |= R_STATUS_RXFULL_MASK;
+    s->rx_level += 1;
 
     if (size > rx_fifo_level) {
         s->uart_intr_state |= R_INTR_STATE_RX_WATERMARK_MASK;
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_reset(DeviceState *dev)
     s->uart_timeout_ctrl = 0x00000000;
 
     s->tx_level = 0;
+    s->rx_level = 0;
 
     s->char_tx_time = (NANOSECONDS_PER_SECOND / 230400) * 10;
 
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
 
     case R_RDATA:
         retvalue = s->uart_rdata;
-        if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
+        if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) && (s->rx_level > 0)) {
             qemu_chr_fe_accept_input(&s->chr);
 
-            s->uart_status |= R_STATUS_RXIDLE_MASK;
-            s->uart_status |= R_STATUS_RXEMPTY_MASK;
+            s->rx_level -= 1;
+            s->uart_status &= ~R_STATUS_RXFULL_MASK;
+            if (s->rx_level == 0) {
+                s->uart_status |= R_STATUS_RXIDLE_MASK;
+                s->uart_status |= R_STATUS_RXEMPTY_MASK;
+            }
         }
         break;
     case R_WDATA:
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
     case R_FIFO_STATUS:
         retvalue = s->uart_fifo_status;
 
-        retvalue |= s->tx_level & 0x1F;
+        retvalue |= (s->rx_level & 0x1F) << R_FIFO_STATUS_RXLVL_SHIFT;
+        retvalue |= (s->tx_level & 0x1F) << R_FIFO_STATUS_TXLVL_SHIFT;
 
         qemu_log_mask(LOG_UNIMP,
                       "%s: RX fifos are not supported\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr,
         s->uart_fifo_ctrl = value;
 
         if (value & R_FIFO_CTRL_RXRST_MASK) {
+            s->rx_level = 0;
             qemu_log_mask(LOG_UNIMP,
                           "%s: RX fifos are not supported\n", __func__);
         }
-- 
2.30.1

From: Jim Shu <cwshu@andestech.com>

Currently, PMP permission checking of TLB page is bypassed if TLB hits
Fix it by propagating PMP permission to TLB page permission.

PMP permission checking also use MMU-style API to change TLB permission
and size.

Signed-off-by: Jim Shu <cwshu@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1613916082-19528-2-git-send-email-cwshu@andestech.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.h        |  4 +-
 target/riscv/cpu_helper.c | 84 +++++++++++++++++++++++++++++----------
 target/riscv/pmp.c        | 80 +++++++++++++++++++++++++++----------
 3 files changed, 125 insertions(+), 43 deletions(-)

diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -XXX,XX +XXX,XX @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
     target_ulong val);
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-    target_ulong size, pmp_priv_t priv, target_ulong mode);
+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
+    target_ulong mode);
 bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
                          target_ulong *tlb_size);
 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
 void pmp_update_rule_nums(CPURISCVState *env);
 uint32_t pmp_get_num_rules(CPURISCVState *env);
+int pmp_priv_to_page_prot(pmp_priv_t pmp_priv);
 
 #endif
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
     env->load_res = -1;
 }
 
+/*
+ * get_physical_address_pmp - check PMP permission for this physical address
+ *
+ * Match the PMP region and check permission for this physical address and it's
+ * TLB page. Returns 0 if the permission checking was successful
+ *
+ * @env: CPURISCVState
+ * @prot: The returned protection attributes
+ * @tlb_size: TLB page size containing addr. It could be modified after PMP
+ *            permission checking. NULL if not set TLB page for addr.
+ * @addr: The physical address to be checked permission
+ * @access_type: The type of MMU access
+ * @mode: Indicates current privilege level.
+ */
+static int get_physical_address_pmp(CPURISCVState *env, int *prot,
+                                    target_ulong *tlb_size, hwaddr addr,
+                                    int size, MMUAccessType access_type,
+                                    int mode)
+{
+    pmp_priv_t pmp_priv;
+    target_ulong tlb_size_pmp = 0;
+
+    if (!riscv_feature(env, RISCV_FEATURE_PMP)) {
+        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+        return TRANSLATE_SUCCESS;
+    }
+
+    if (!pmp_hart_has_privs(env, addr, size, 1 << access_type, &pmp_priv,
+                            mode)) {
+        *prot = 0;
+        return TRANSLATE_PMP_FAIL;
+    }
+
+    *prot = pmp_priv_to_page_prot(pmp_priv);
+    if (tlb_size != NULL) {
+        if (pmp_is_range_in_tlb(env, addr & ~(*tlb_size - 1), &tlb_size_pmp)) {
+            *tlb_size = tlb_size_pmp;
+        }
+    }
+
+    return TRANSLATE_SUCCESS;
+}
+
 /* get_physical_address - get the physical address for this virtual address
  *
  * Do a page table walk to obtain the physical address corresponding to a
@@ -XXX,XX +XXX,XX @@ restart:
             pte_addr = base + idx * ptesize;
         }
 
-        if (riscv_feature(env, RISCV_FEATURE_PMP) &&
-            !pmp_hart_has_privs(env, pte_addr, sizeof(target_ulong),
-            1 << MMU_DATA_LOAD, PRV_S)) {
+        int pmp_prot;
+        int pmp_ret = get_physical_address_pmp(env, &pmp_prot, NULL, pte_addr,
+                                               sizeof(target_ulong),
+                                               MMU_DATA_LOAD, PRV_S);
+        if (pmp_ret != TRANSLATE_SUCCESS) {
             return TRANSLATE_PMP_FAIL;
         }
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 #ifndef CONFIG_USER_ONLY
     vaddr im_address;
     hwaddr pa = 0;
-    int prot, prot2;
+    int prot, prot2, prot_pmp;
     bool pmp_violation = false;
     bool first_stage_error = true;
     bool two_stage_lookup = false;
     int ret = TRANSLATE_FAIL;
     int mode = mmu_idx;
-    target_ulong tlb_size = 0;
+    /* default TLB page size */
+    target_ulong tlb_size = TARGET_PAGE_SIZE;
 
     env->guest_phys_fault_addr = 0;
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 
             prot &= prot2;
 
-            if (riscv_feature(env, RISCV_FEATURE_PMP) &&
-                (ret == TRANSLATE_SUCCESS) &&
-                !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
-                ret = TRANSLATE_PMP_FAIL;
+            if (ret == TRANSLATE_SUCCESS) {
+                ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
+                                               size, access_type, mode);
+                prot &= prot_pmp;
             }
 
             if (ret != TRANSLATE_SUCCESS) {
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                       "%s address=%" VADDR_PRIx " ret %d physical "
                       TARGET_FMT_plx " prot %d\n",
                       __func__, address, ret, pa, prot);
-    }
 
-    if (riscv_feature(env, RISCV_FEATURE_PMP) &&
-        (ret == TRANSLATE_SUCCESS) &&
-        !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
-        ret = TRANSLATE_PMP_FAIL;
+        if (ret == TRANSLATE_SUCCESS) {
+            ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
+                                           size, access_type, mode);
+            prot &= prot_pmp;
+        }
     }
+
     if (ret == TRANSLATE_PMP_FAIL) {
         pmp_violation = true;
     }
 
     if (ret == TRANSLATE_SUCCESS) {
-        if (pmp_is_range_in_tlb(env, pa & TARGET_PAGE_MASK, &tlb_size)) {
-            tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
-                         prot, mmu_idx, tlb_size);
-        } else {
-            tlb_set_page(cs, address & TARGET_PAGE_MASK, pa & TARGET_PAGE_MASK,
-                         prot, mmu_idx, TARGET_PAGE_SIZE);
-        }
+        tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
+                     prot, mmu_idx, tlb_size);
         return true;
     } else if (probe) {
         return false;
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
     return result;
 }
 
+/*
+ * Check if the address has required RWX privs when no PMP entry is matched.
+ */
+static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
+    target_ulong mode)
+{
+    bool ret;
+
+    if ((!riscv_feature(env, RISCV_FEATURE_PMP)) || (mode == PRV_M)) {
+        /*
+         * Privileged spec v1.10 states if HW doesn't implement any PMP entry
+         * or no PMP entry matches an M-Mode access, the access succeeds.
+         */
+        ret = true;
+        *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
+    } else {
+        /*
+         * Other modes are not allowed to succeed if they don't * match a rule,
+         * but there are rules. We've checked for no rule earlier in this
+         * function.
+         */
+        ret = false;
+        *allowed_privs = 0;
+    }
+
+    return ret;
+}
+
 
 /*
  * Public Interface
@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
  * Check if the address has required RWX privs to complete desired operation
  */
 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-    target_ulong size, pmp_priv_t privs, target_ulong mode)
+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
+    target_ulong mode)
 {
     int i = 0;
     int ret = -1;
     int pmp_size = 0;
     target_ulong s = 0;
     target_ulong e = 0;
-    pmp_priv_t allowed_privs = 0;
 
     /* Short cut if no rules */
     if (0 == pmp_get_num_rules(env)) {
-        return (env->priv == PRV_M) ? true : false;
+        return pmp_hart_has_privs_default(env, addr, size, privs,
+                                          allowed_privs, mode);
     }
 
     if (size == 0) {
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
          * check
          */
         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
-            allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
+            *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
             if ((mode != PRV_M) || pmp_is_locked(env, i)) {
-                allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
+                *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
             }
 
-            if ((privs & allowed_privs) == privs) {
-                ret = 1;
-                break;
-            } else {
-                ret = 0;
-                break;
-            }
+            ret = ((privs & *allowed_privs) == privs);
+            break;
         }
     }
 
     /* No rule matched */
     if (ret == -1) {
-        if (mode == PRV_M) {
-            ret = 1; /* Privileged spec v1.10 states if no PMP entry matches an
-                      * M-Mode access, the access succeeds */
-        } else {
-            ret = 0; /* Other modes are not allowed to succeed if they don't
-                      * match a rule, but there are rules.  We've checked for
-                      * no rule earlier in this function. */
-        }
+        return pmp_hart_has_privs_default(env, addr, size, privs,
+                                          allowed_privs, mode);
     }
 
     return ret == 1 ? true : false;
 }
 
-
 /*
  * Handle a write to a pmpcfg CSP
  */
@@ -XXX,XX +XXX,XX @@ bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
 
     return false;
 }
+
+/*
+ * Convert PMP privilege to TLB page privilege.
+ */
+int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
+{
+    int prot = 0;
+
+    if (pmp_priv & PMP_READ) {
+        prot |= PAGE_READ;
+    }
+    if (pmp_priv & PMP_WRITE) {
+        prot |= PAGE_WRITE;
+    }
+    if (pmp_priv & PMP_EXEC) {
+        prot |= PAGE_EXEC;
+    }
+
+    return prot;
+}
-- 
2.30.1

From: Jim Shu <cwshu@andestech.com>

Like MMU translation, add qemu log of PMP permission checking for
debugging.

Signed-off-by: Jim Shu <cwshu@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1613916082-19528-3-git-send-email-cwshu@andestech.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
             if (ret == TRANSLATE_SUCCESS) {
                 ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
                                                size, access_type, mode);
+
+                qemu_log_mask(CPU_LOG_MMU,
+                              "%s PMP address=" TARGET_FMT_plx " ret %d prot"
+                              " %d tlb_size " TARGET_FMT_lu "\n",
+                              __func__, pa, ret, prot_pmp, tlb_size);
+
                 prot &= prot_pmp;
             }
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         if (ret == TRANSLATE_SUCCESS) {
             ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
                                            size, access_type, mode);
+
+            qemu_log_mask(CPU_LOG_MMU,
+                          "%s PMP address=" TARGET_FMT_plx " ret %d prot"
+                          " %d tlb_size " TARGET_FMT_lu "\n",
+                          __func__, pa, ret, prot_pmp, tlb_size);
+
             prot &= prot_pmp;
         }
     }
-- 
2.30.1

From: Jim Shu <cwshu@andestech.com>

If PMP permission of any address has been changed by updating PMP entry,
flush all TLB pages to prevent from getting old permission.

Signed-off-by: Jim Shu <cwshu@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1613916082-19528-4-git-send-email-cwshu@andestech.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "cpu.h"
 #include "trace.h"
+#include "exec/exec-all.h"
 
 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
     uint8_t val);
@@ -XXX,XX +XXX,XX @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
         cfg_val = (val >> 8 * i)  & 0xff;
         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
     }
+
+    /* If PMP permission of any addr has been changed, flush TLB pages. */
+    tlb_flush(env_cpu(env));
 }
 
 
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

According to the specification the "field SPVP of hstatus controls the
privilege level of the access" for the hypervisor virtual-machine load
and store instructions HLV, HLVX and HSV.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311103005.1400718-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         use_background = true;
     }
 
-    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
+    /* MPRV does not affect the virtual-machine load/store
+       instructions, HLV, HLVX, and HSV. */
+    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
+        mode = get_field(env->hstatus, HSTATUS_SPVP);
+    } else if (mode == PRV_M && access_type != MMU_INST_FETCH) {
         if (get_field(env->mstatus, MSTATUS_MPRV)) {
             mode = get_field(env->mstatus, MSTATUS_MPP);
         }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n",
                   __func__, address, access_type, mmu_idx);
 
-    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
-        if (get_field(env->mstatus, MSTATUS_MPRV)) {
-            mode = get_field(env->mstatus, MSTATUS_MPP);
+    /* MPRV does not affect the virtual-machine load/store
+       instructions, HLV, HLVX, and HSV. */
+    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
+        mode = get_field(env->hstatus, HSTATUS_SPVP);
+    } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
+               get_field(env->mstatus, MSTATUS_MPRV)) {
+        mode = get_field(env->mstatus, MSTATUS_MPP);
+        if (riscv_has_ext(env, RVH) && get_field(env->mstatus, MSTATUS_MPV)) {
+            two_stage_lookup = true;
         }
     }
 
-    if (riscv_has_ext(env, RVH) && env->priv == PRV_M &&
-        access_type != MMU_INST_FETCH &&
-        get_field(env->mstatus, MSTATUS_MPRV) &&
-        get_field(env->mstatus, MSTATUS_MPV)) {
-        two_stage_lookup = true;
-    }
-
     if (riscv_cpu_virt_enabled(env) ||
         ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
          access_type != MMU_INST_FETCH)) {
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311094902.1377593-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_SD;
 static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
-static const target_ulong hip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
+static const target_ulong hip_writable_mask = MIP_VSSIP;
+static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
 static const target_ulong vsip_writable_mask = MIP_VSSIP;
 
 static const char valid_vm_1_10_32[16] = {
@@ -XXX,XX +XXX,XX @@ static int rmw_hvip(CPURISCVState *env, int csrno, target_ulong *ret_value,
                    target_ulong new_value, target_ulong write_mask)
 {
     int ret = rmw_mip(env, 0, ret_value, new_value,
-                      write_mask & hip_writable_mask);
+                      write_mask & hvip_writable_mask);
 
-    *ret_value &= hip_writable_mask;
+    *ret_value &= hvip_writable_mask;
 
     return ret;
 }
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

The current condition for the use of background registers only
considers the hypervisor load and store instructions,
but not accesses from M mode via MSTATUS_MPRV+MPV.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311103036.1401073-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: Asherah Connor <ashe@kivikakk.ee>

Provides fw_cfg for the virt machine on riscv.  This enables
using e.g.  ramfb later.

Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210318235041.17175-2-ashe@kivikakk.ee
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h |  2 ++
 hw/riscv/virt.c         | 30 ++++++++++++++++++++++++++++++
 hw/riscv/Kconfig        |  1 +
 3 files changed, 33 insertions(+)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
     RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
     DeviceState *plic[VIRT_SOCKETS_MAX];
     PFlashCFI01 *flash[2];
+    FWCfgState *fw_cfg;
 
     int fdt_size;
 };
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_PLIC,
     VIRT_UART0,
     VIRT_VIRTIO,
+    VIRT_FW_CFG,
     VIRT_FLASH,
     VIRT_DRAM,
     VIRT_PCIE_MMIO,
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
     [VIRT_PLIC] =        {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
     [VIRT_UART0] =       { 0x10000000,         0x100 },
     [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
+    [VIRT_FW_CFG] =      { 0x10100000,          0x18 },
     [VIRT_FLASH] =       { 0x20000000,     0x4000000 },
     [VIRT_PCIE_ECAM] =   { 0x30000000,    0x10000000 },
     [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
     return dev;
 }
 
+static FWCfgState *create_fw_cfg(const MachineState *mc)
+{
+    hwaddr base = virt_memmap[VIRT_FW_CFG].base;
+    hwaddr size = virt_memmap[VIRT_FW_CFG].size;
+    FWCfgState *fw_cfg;
+    char *nodename;
+
+    fw_cfg = fw_cfg_init_mem_wide(base + 8, base, 8, base + 16,
+                                  &address_space_memory);
+    fw_cfg_add_i16(fw_cfg, FW_CFG_NB_CPUS, (uint16_t)mc->smp.cpus);
+
+    nodename = g_strdup_printf("/fw-cfg@%" PRIx64, base);
+    qemu_fdt_add_subnode(mc->fdt, nodename);
+    qemu_fdt_setprop_string(mc->fdt, nodename,
+                            "compatible", "qemu,fw-cfg-mmio");
+    qemu_fdt_setprop_sized_cells(mc->fdt, nodename, "reg",
+                                 2, base, 2, size);
+    qemu_fdt_setprop(mc->fdt, nodename, "dma-coherent", NULL, 0);
+    g_free(nodename);
+    return fw_cfg;
+}
+
 static void virt_machine_init(MachineState *machine)
 {
     const MemMapEntry *memmap = virt_memmap;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         start_addr = virt_memmap[VIRT_FLASH].base;
     }
 
+    /*
+     * Init fw_cfg.  Must be done before riscv_load_fdt, otherwise the device
+     * tree cannot be altered and we get FDT_ERR_NOSPACE.
+     */
+    s->fw_cfg = create_fw_cfg(machine);
+    rom_set_fw(s->fw_cfg);
+
     /* Compute the fdt load address in dram */
     fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
                                    machine->ram_size, machine->fdt);
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select SIFIVE_PLIC
     select SIFIVE_TEST
     select VIRTIO_MMIO
+    select FW_CFG_DMA
 
 config SIFIVE_E
     bool
-- 
2.30.1

From: Asherah Connor <ashe@kivikakk.ee>

Allow ramfb on virt.  This lets `-device ramfb' work.

Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210318235041.17175-3-ashe@kivikakk.ee
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/pci/pci.h"
 #include "hw/pci-host/gpex.h"
+#include "hw/display/ramfb.h"
 
 static const MemMapEntry virt_memmap[] = {
     [VIRT_DEBUG] =       {        0x0,         0x100 },
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     mc->cpu_index_to_instance_props = riscv_numa_cpu_index_to_props;
     mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
     mc->numa_mem_supported = true;
+
+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
 }
 
 static const TypeInfo virt_machine_typeinfo = {
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

The previous implementation was broken in many ways:
 - Used mideleg instead of hideleg to mask accesses
 - Used MIP_VSSIP instead of VS_MODE_INTERRUPTS to mask writes to vsie
 - Did not shift between S bits and VS bits (VSEIP <-> SEIP, ...)

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311094738.1376795-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 68 +++++++++++++++++++++++-----------------------
 1 file changed, 34 insertions(+), 34 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int write_sstatus(CPURISCVState *env, int csrno, target_ulong val)
     return write_mstatus(env, CSR_MSTATUS, newval);
 }
 
+static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
+{
+    /* Shift the VS bits to their S bit location in vsie */
+    *val = (env->mie & env->hideleg & VS_MODE_INTERRUPTS) >> 1;
+    return 0;
+}
+
 static int read_sie(CPURISCVState *env, int csrno, target_ulong *val)
 {
     if (riscv_cpu_virt_enabled(env)) {
-        /* Tell the guest the VS bits, shifted to the S bit locations */
-        *val = (env->mie & env->mideleg & VS_MODE_INTERRUPTS) >> 1;
+        read_vsie(env, CSR_VSIE, val);
     } else {
         *val = env->mie & env->mideleg;
     }
     return 0;
 }
 
-static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
+static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
 {
-    target_ulong newval;
+    /* Shift the S bits to their VS bit location in mie */
+    target_ulong newval = (env->mie & ~VS_MODE_INTERRUPTS) |
+                          ((val << 1) & env->hideleg & VS_MODE_INTERRUPTS);
+    return write_mie(env, CSR_MIE, newval);
+}
 
+static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
+{
     if (riscv_cpu_virt_enabled(env)) {
-        /* Shift the guests S bits to VS */
-        newval = (env->mie & ~VS_MODE_INTERRUPTS) |
-                 ((val << 1) & VS_MODE_INTERRUPTS);
+        write_vsie(env, CSR_VSIE, val);
     } else {
-        newval = (env->mie & ~S_MODE_INTERRUPTS) | (val & S_MODE_INTERRUPTS);
+        target_ulong newval = (env->mie & ~S_MODE_INTERRUPTS) |
+                              (val & S_MODE_INTERRUPTS);
+        write_mie(env, CSR_MIE, newval);
     }
 
-    return write_mie(env, CSR_MIE, newval);
+    return 0;
 }
 
 static int read_stvec(CPURISCVState *env, int csrno, target_ulong *val)
@@ -XXX,XX +XXX,XX @@ static int write_sbadaddr(CPURISCVState *env, int csrno, target_ulong val)
     return 0;
 }
 
+static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
+                    target_ulong new_value, target_ulong write_mask)
+{
+    /* Shift the S bits to their VS bit location in mip */
+    int ret = rmw_mip(env, 0, ret_value, new_value << 1,
+                      (write_mask << 1) & vsip_writable_mask & env->hideleg);
+    *ret_value &= VS_MODE_INTERRUPTS;
+    /* Shift the VS bits to their S bit location in vsip */
+    *ret_value >>= 1;
+    return ret;
+}
+
 static int rmw_sip(CPURISCVState *env, int csrno, target_ulong *ret_value,
                    target_ulong new_value, target_ulong write_mask)
 {
     int ret;
 
     if (riscv_cpu_virt_enabled(env)) {
-        /* Shift the new values to line up with the VS bits */
-        ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value << 1,
-                      (write_mask & sip_writable_mask) << 1 & env->mideleg);
-        ret &= vsip_writable_mask;
-        ret >>= 1;
+        ret = rmw_vsip(env, CSR_VSIP, ret_value, new_value, write_mask);
     } else {
         ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value,
                       write_mask & env->mideleg & sip_writable_mask);
@@ -XXX,XX +XXX,XX @@ static int write_vsstatus(CPURISCVState *env, int csrno, target_ulong val)
     return 0;
 }
 
-static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
-                    target_ulong new_value, target_ulong write_mask)
-{
-    int ret = rmw_mip(env, 0, ret_value, new_value,
-                      write_mask & env->mideleg & vsip_writable_mask);
-    return ret;
-}
-
-static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
-{
-    *val = env->mie & env->mideleg & VS_MODE_INTERRUPTS;
-    return 0;
-}
-
-static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
-{
-    target_ulong newval = (env->mie & ~env->mideleg) | (val & env->mideleg & MIP_VSSIP);
-    return write_mie(env, CSR_MIE, newval);
-}
-
 static int read_vstvec(CPURISCVState *env, int csrno, target_ulong *val)
 {
     *val = env->vstvec;
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

The current two-stage lookup detection in riscv_cpu_do_interrupt falls
short of its purpose, as all it checks is whether two-stage address
translation either via the hypervisor-load store instructions or the
MPRV feature would be allowed.

What we really need instead is whether two-stage address translation was
active when the exception was raised. However, in riscv_cpu_do_interrupt
we do not have the information to reliably detect this. Therefore, when
we raise a memory fault exception we have to record whether two-stage
address translation is active.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210319141459.1196741-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  4 ++++
 target/riscv/cpu.c        |  1 +
 target/riscv/cpu_helper.c | 21 ++++++++-------------
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
     target_ulong satp_hs;
     uint64_t mstatus_hs;
 
+    /* Signals whether the current exception occurred with two-stage address
+       translation active. */
+    bool two_stage_lookup;
+
     target_ulong scounteren;
     target_ulong mcounteren;
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
     env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
     env->mcause = 0;
     env->pc = env->resetvec;
+    env->two_stage_lookup = false;
 #endif
     cs->exception_index = EXCP_NONE;
     env->load_res = -1;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
         g_assert_not_reached();
     }
     env->badaddr = address;
+    env->two_stage_lookup = two_stage;
 }
 
 hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     }
 
     env->badaddr = addr;
+    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
+                            riscv_cpu_two_stage_lookup(mmu_idx);
     riscv_raise_exception(&cpu->env, cs->exception_index, retaddr);
 }
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
         g_assert_not_reached();
     }
     env->badaddr = addr;
+    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
+                            riscv_cpu_two_stage_lookup(mmu_idx);
     riscv_raise_exception(env, cs->exception_index, retaddr);
 }
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         /* handle the trap in S-mode */
         if (riscv_has_ext(env, RVH)) {
             target_ulong hdeleg = async ? env->hideleg : env->hedeleg;
-            bool two_stage_lookup = false;
 
-            if (env->priv == PRV_M ||
-                (env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
-                (env->priv == PRV_U && !riscv_cpu_virt_enabled(env) &&
-                    get_field(env->hstatus, HSTATUS_HU))) {
-                    two_stage_lookup = true;
-            }
-
-            if ((riscv_cpu_virt_enabled(env) || two_stage_lookup) && write_tval) {
+            if (env->two_stage_lookup && write_tval) {
                 /*
                  * If we are writing a guest virtual address to stval, set
                  * this to 1. If we are trapping to VS we will set this to 0
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                 riscv_cpu_set_force_hs_excep(env, 0);
             } else {
                 /* Trap into HS mode */
-                if (!two_stage_lookup) {
-                    env->hstatus = set_field(env->hstatus, HSTATUS_SPV,
-                                             riscv_cpu_virt_enabled(env));
-                }
+                env->hstatus = set_field(env->hstatus, HSTATUS_SPV, false);
                 htval = env->guest_phys_fault_addr;
             }
         }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      * RISC-V ISA Specification.
      */
 
+    env->two_stage_lookup = false;
 #endif
     cs->exception_index = EXCP_NONE; /* mark handled to qemu */
 }
-- 
2.30.1

From: Bin Meng <bin.meng@windriver.com>

Per SST25VF016B datasheet [1], SST flash requires a dummy byte after
the address bytes. Note only SPI mode is supported by SST flashes.

[1] http://ww1.microchip.com/downloads/en/devicedoc/s71271_04.pdf

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210306060152.7250-1-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/block/m25p80.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@ static void decode_fast_read_cmd(Flash *s)
     s->needed_bytes = get_addr_length(s);
     switch (get_man(s)) {
     /* Dummy cycles - modeled with bytes writes instead of bits */
+    case MAN_SST:
+        s->needed_bytes += 1;
+        break;
     case MAN_WINBOND:
         s->needed_bytes += 8;
         break;
-- 
2.30.1

From: Bin Meng <bin.meng@windriver.com>

Since HSS commit c20a89f8dcac, the Icicle Kit reference design has
been updated to use a register mapped at 0x4f000000 instead of a
GPIO to control whether eMMC or SD card is to be used. With this
support the same HSS image can be used for both eMMC and SD card
boot flow, while previously two different board configurations were
used. This is undocumented but one can take a look at the HSS code
HSS_MMCInit() in services/mmc/mmc_api.c.

With this commit, HSS image built from 2020.12 release boots again.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210322075248.136255-1-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h | 1 +
 hw/riscv/microchip_pfsoc.c         | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_ENVM_DATA,
     MICROCHIP_PFSOC_QSPI_XIP,
     MICROCHIP_PFSOC_IOSCB,
+    MICROCHIP_PFSOC_EMMC_SD_MUX,
     MICROCHIP_PFSOC_DRAM_LO,
     MICROCHIP_PFSOC_DRAM_LO_ALIAS,
     MICROCHIP_PFSOC_DRAM_HI,
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
     [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
     [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,  0x1000000 },
     [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000, 0x10000000 },
+    [MICROCHIP_PFSOC_EMMC_SD_MUX] =     { 0x4f000000,        0x4 },
     [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000, 0x40000000 },
     [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000, 0x40000000 },
     [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,        0x0 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ioscb), 0,
                     memmap[MICROCHIP_PFSOC_IOSCB].base);
 
+    /* eMMC/SD mux */
+    create_unimplemented_device("microchip.pfsoc.emmc_sd_mux",
+        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].base,
+        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].size);
+
     /* QSPI Flash */
     memory_region_init_rom(qspi_xip_mem, OBJECT(dev),
                            "microchip.pfsoc.qspi_xip",
-- 
2.30.1

From: Bin Meng <bin.meng@windriver.com>

This adds the documentation to describe what is supported for the
'microchip-icicle-kit' machine, and how to boot the machine in QEMU.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210322075248.136255-2-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/microchip-icicle-kit.rst | 89 ++++++++++++++++++++++
 docs/system/target-riscv.rst               |  1 +
 2 files changed, 90 insertions(+)
 create mode 100644 docs/system/riscv/microchip-icicle-kit.rst

diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/riscv/microchip-icicle-kit.rst
@@ -XXX,XX +XXX,XX @@
+Microchip PolarFire SoC Icicle Kit (``microchip-icicle-kit``)
+=============================================================
+
+Microchip PolarFire SoC Icicle Kit integrates a PolarFire SoC, with one
+SiFive's E51 plus four U54 cores and many on-chip peripherals and an FPGA.
+
+For more details about Microchip PolarFire SoC, please see:
+https://www.microsemi.com/product-directory/soc-fpgas/5498-polarfire-soc-fpga
+
+The Icicle Kit board information can be found here:
+https://www.microsemi.com/existing-parts/parts/152514
+
+Supported devices
+-----------------
+
+The ``microchip-icicle-kit`` machine supports the following devices:
+
+ * 1 E51 core
+ * 4 U54 cores
+ * Core Level Interruptor (CLINT)
+ * Platform-Level Interrupt Controller (PLIC)
+ * L2 Loosely Integrated Memory (L2-LIM)
+ * DDR memory controller
+ * 5 MMUARTs
+ * 1 DMA controller
+ * 2 GEM Ethernet controllers
+ * 1 SDHC storage controller
+
+Boot options
+------------
+
+The ``microchip-icicle-kit`` machine can start using the standard -bios
+functionality for loading its BIOS image, aka Hart Software Services (HSS_).
+HSS loads the second stage bootloader U-Boot from an SD card. It does not
+support direct kernel loading via the -kernel option. One has to load kernel
+from U-Boot.
+
+The memory is set to 1537 MiB by default which is the minimum required high
+memory size by HSS. A sanity check on ram size is performed in the machine
+init routine to prompt user to increase the RAM size to > 1537 MiB when less
+than 1537 MiB ram is detected.
+
+Boot the machine
+----------------
+
+HSS 2020.12 release is tested at the time of writing. To build an HSS image
+that can be booted by the ``microchip-icicle-kit`` machine, type the following
+in the HSS source tree:
+
+.. code-block:: bash
+
+  $ export CROSS_COMPILE=riscv64-linux-
+  $ cp boards/mpfs-icicle-kit-es/def_config .config
+  $ make BOARD=mpfs-icicle-kit-es
+
+Download the official SD card image released by Microchip and prepare it for
+QEMU usage:
+
+.. code-block:: bash
+
+  $ wget ftp://ftpsoc.microsemi.com/outgoing/core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
+  $ gunzip core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
+  $ qemu-img resize core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic 4G
+
+Then we can boot the machine by:
+
+.. code-block:: bash
+
+  $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 \
+      -bios path/to/hss.bin -sd path/to/sdcard.img \
+      -nic user,model=cadence_gem \
+      -nic tap,ifname=tap,model=cadence_gem,script=no \
+      -display none -serial stdio \
+      -chardev socket,id=serial1,path=serial1.sock,server=on,wait=on \
+      -serial chardev:serial1
+
+With above command line, current terminal session will be used for the first
+serial port. Open another terminal window, and use `minicom` to connect the
+second serial port.
+
+.. code-block:: bash
+
+  $ minicom -D unix\#serial1.sock
+
+HSS output is on the first serial port (stdio) and U-Boot outputs on the
+second serial port. U-Boot will automatically load the Linux kernel from
+the SD card image.
+
+.. _HSS: https://github.com/polarfire-soc/hart-software-services
diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-riscv.rst
+++ b/docs/system/target-riscv.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
 .. toctree::
    :maxdepth: 1
 
+   riscv/microchip-icicle-kit
    riscv/sifive_u
 
 RISC-V CPU features
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

When decode_insn16() fails, we fall back to decode_RV32_64C() for
further compressed instruction decoding. However, prior to this change,
we did not raise an illegal instruction exception, if decode_RV32_64C()
fails to decode the instruction. This means that we skipped illegal
compressed instructions instead of raising an illegal instruction
exception.

Instead of patching decode_RV32_64C(), we can just remove it,
as it is dead code since f330433b363 anyway.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210322121609.3097928-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c | 179 +--------------------------------------
 1 file changed, 1 insertion(+), 178 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     CPUState *cs;
 } DisasContext;
 
-#ifdef TARGET_RISCV64
-/* convert riscv funct3 to qemu memop for load/store */
-static const int tcg_memop_lookup[8] = {
-    [0 ... 7] = -1,
-    [0] = MO_SB,
-    [1] = MO_TESW,
-    [2] = MO_TESL,
-    [3] = MO_TEQ,
-    [4] = MO_UB,
-    [5] = MO_TEUW,
-    [6] = MO_TEUL,
-};
-#endif
-
 #ifdef TARGET_RISCV64
 #define CASE_OP_32_64(X) case X: case glue(X, W)
 #else
@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
-#ifdef TARGET_RISCV64
-static void gen_load_c(DisasContext *ctx, uint32_t opc, int rd, int rs1,
-        target_long imm)
-{
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
-
-    if (memop < 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, memop);
-    gen_set_gpr(rd, t1);
-    tcg_temp_free(t0);
-    tcg_temp_free(t1);
-}
-
-static void gen_store_c(DisasContext *ctx, uint32_t opc, int rs1, int rs2,
-        target_long imm)
-{
-    TCGv t0 = tcg_temp_new();
-    TCGv dat = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-    gen_get_gpr(dat, rs2);
-    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
-
-    if (memop < 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    tcg_gen_qemu_st_tl(dat, t0, ctx->mem_idx, memop);
-    tcg_temp_free(t0);
-    tcg_temp_free(dat);
-}
-#endif
-
 #ifndef CONFIG_USER_ONLY
 /* The states of mstatus_fs are:
  * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
 static inline void mark_fs_dirty(DisasContext *ctx) { }
 #endif
 
-#if !defined(TARGET_RISCV64)
-static void gen_fp_load(DisasContext *ctx, uint32_t opc, int rd,
-        int rs1, target_long imm)
-{
-    TCGv t0;
-
-    if (ctx->mstatus_fs == 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    t0 = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-
-    switch (opc) {
-    case OPC_RISC_FLW:
-        if (!has_ext(ctx, RVF)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEUL);
-        /* RISC-V requires NaN-boxing of narrower width floating point values */
-        tcg_gen_ori_i64(cpu_fpr[rd], cpu_fpr[rd], 0xffffffff00000000ULL);
-        break;
-    case OPC_RISC_FLD:
-        if (!has_ext(ctx, RVD)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEQ);
-        break;
-    do_illegal:
-    default:
-        gen_exception_illegal(ctx);
-        break;
-    }
-    tcg_temp_free(t0);
-
-    mark_fs_dirty(ctx);
-}
-
-static void gen_fp_store(DisasContext *ctx, uint32_t opc, int rs1,
-        int rs2, target_long imm)
-{
-    TCGv t0;
-
-    if (ctx->mstatus_fs == 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    t0 = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-
-    switch (opc) {
-    case OPC_RISC_FSW:
-        if (!has_ext(ctx, RVF)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEUL);
-        break;
-    case OPC_RISC_FSD:
-        if (!has_ext(ctx, RVD)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEQ);
-        break;
-    do_illegal:
-    default:
-        gen_exception_illegal(ctx);
-        break;
-    }
-
-    tcg_temp_free(t0);
-}
-#endif
-
 static void gen_set_rm(DisasContext *ctx, int rm)
 {
     TCGv_i32 t0;
@@ -XXX,XX +XXX,XX @@ static void gen_set_rm(DisasContext *ctx, int rm)
     tcg_temp_free_i32(t0);
 }
 
-static void decode_RV32_64C0(DisasContext *ctx, uint16_t opcode)
-{
-    uint8_t funct3 = extract16(opcode, 13, 3);
-    uint8_t rd_rs2 = GET_C_RS2S(opcode);
-    uint8_t rs1s = GET_C_RS1S(opcode);
-
-    switch (funct3) {
-    case 3:
-#if defined(TARGET_RISCV64)
-        /* C.LD(RV64/128) -> ld rd', offset[7:3](rs1')*/
-        gen_load_c(ctx, OPC_RISC_LD, rd_rs2, rs1s,
-                 GET_C_LD_IMM(opcode));
-#else
-        /* C.FLW (RV32) -> flw rd', offset[6:2](rs1')*/
-        gen_fp_load(ctx, OPC_RISC_FLW, rd_rs2, rs1s,
-                    GET_C_LW_IMM(opcode));
-#endif
-        break;
-    case 7:
-#if defined(TARGET_RISCV64)
-        /* C.SD (RV64/128) -> sd rs2', offset[7:3](rs1')*/
-        gen_store_c(ctx, OPC_RISC_SD, rs1s, rd_rs2,
-                  GET_C_LD_IMM(opcode));
-#else
-        /* C.FSW (RV32) -> fsw rs2', offset[6:2](rs1')*/
-        gen_fp_store(ctx, OPC_RISC_FSW, rs1s, rd_rs2,
-                     GET_C_LW_IMM(opcode));
-#endif
-        break;
-    }
-}
-
-static void decode_RV32_64C(DisasContext *ctx, uint16_t opcode)
-{
-    uint8_t op = extract16(opcode, 0, 2);
-
-    switch (op) {
-    case 0:
-        decode_RV32_64C0(ctx, opcode);
-        break;
-    }
-}
-
 static int ex_plus_1(DisasContext *ctx, int nf)
 {
     return nf + 1;
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
         } else {
             ctx->pc_succ_insn = ctx->base.pc_next + 2;
             if (!decode_insn16(ctx, opcode)) {
-                /* fall back to old decoder */
-                decode_RV32_64C(ctx, opcode);
+                gen_exception_illegal(ctx);
             }
         }
     } else {
-- 
2.30.1

The following changes since commit a35947f15c0ee695eba3c55248ec8ac3e4e23cca:

Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-updates-070621-2' into staging (2021-06-07 15:45:48 +0100)

are available in the Git repository at:

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210608-1

for you to fetch changes up to d2c1a177b138be35cb96216baa870c3564b123e4:

target/riscv: rvb: add b-ext version cpu option (2021-06-08 09:59:46 +1000)

----------------------------------------------------------------
Second RISC-V PR for QEMU 6.1

- Update the PLIC and CLINT DT bindings
 - Improve documentation for RISC-V machines
 - Support direct kernel boot for microchip_pfsoc
 - Fix WFI exception behaviour
 - Improve CSR printing
 - Initial support for the experimental Bit Manip extension

----------------------------------------------------------------
Alistair Francis (2):
      docs/system: Move the RISC-V -bios information to removed
      target/riscv/pmp: Add assert for ePMP operations

Bin Meng (9):
      hw/riscv: sifive_u: Switch to use qemu_fdt_setprop_string_array() helper
      hw/riscv: virt: Switch to use qemu_fdt_setprop_string_array() helper
      hw/riscv: Support the official CLINT DT bindings
      hw/riscv: Support the official PLIC DT bindings
      docs/system/riscv: Correct the indentation level of supported devices
      docs/system/riscv: sifive_u: Document '-dtb' usage
      hw/riscv: Use macros for BIOS image names
      hw/riscv: microchip_pfsoc: Support direct kernel boot
      target/riscv: Remove unnecessary riscv_*_names[] declaration

Changbin Du (1):
      target/riscv: Dump CSR mscratch/sscratch/satp

Frank Chang (6):
      target/riscv: rvb: count bits set
      target/riscv: add gen_shifti() and gen_shiftiw() helper functions
      target/riscv: rvb: single-bit instructions
      target/riscv: rvb: generalized reverse
      target/riscv: rvb: generalized or-combine
      target/riscv: rvb: add b-ext version cpu option

Jose Martins (1):
      target/riscv: fix wfi exception behavior

Kito Cheng (11):
      target/riscv: reformat @sh format encoding for B-extension
      target/riscv: rvb: count leading/trailing zeros
      target/riscv: rvb: logic-with-negate
      target/riscv: rvb: pack two words into one register
      target/riscv: rvb: min/max instructions
      target/riscv: rvb: sign-extend instructions
      target/riscv: rvb: shift ones
      target/riscv: rvb: rotate (left/right)
      target/riscv: rvb: address calculation
      target/riscv: rvb: add/shift with prefix zero-extend
      target/riscv: rvb: support and turn on B-extension from command line

LIU Zhiwei (1):
      target/riscv: Pass the same value to oprsz and maxsz.

Philippe Mathieu-Daudé (1):
      target/riscv: Do not include 'pmp.h' in user emulation

docs/system/deprecated.rst                 |  19 --
 docs/system/removed-features.rst           |   5 +
 docs/system/riscv/microchip-icicle-kit.rst |  50 +++-
 docs/system/riscv/sifive_u.rst             |  77 +++--
 docs/system/target-riscv.rst               |  13 +-
 include/hw/riscv/boot.h                    |   5 +
 target/riscv/cpu.h                         |   9 +-
 target/riscv/cpu_bits.h                    |   1 +
 target/riscv/helper.h                      |   6 +
 target/riscv/insn32.decode                 |  87 +++++-
 hw/riscv/microchip_pfsoc.c                 |  81 +++++-
 hw/riscv/sifive_u.c                        |  24 +-
 hw/riscv/spike.c                           |  12 +-
 hw/riscv/virt.c                            |  25 +-
 target/riscv/bitmanip_helper.c             |  90 ++++++
 target/riscv/cpu.c                         |  38 ++-
 target/riscv/op_helper.c                   |  11 +-
 target/riscv/pmp.c                         |   4 +
 target/riscv/translate.c                   | 306 ++++++++++++++++++++
 target/riscv/insn_trans/trans_rvb.c.inc    | 438 +++++++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvi.c.inc    |  54 +---
 target/riscv/insn_trans/trans_rvv.c.inc    |  89 +++---
 target/riscv/meson.build                   |   1 +
 23 files changed, 1260 insertions(+), 185 deletions(-)
 create mode 100644 target/riscv/bitmanip_helper.c
 create mode 100644 target/riscv/insn_trans/trans_rvb.c.inc

From: Bin Meng <bin.meng@windriver.com>

Since commit 78da6a1bca22 ("device_tree: add qemu_fdt_setprop_string_array helper"),
we can use the new helper to set the clock name for the ethernet
controller node.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210430071302.1489082-1-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/sifive_u.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

From: Bin Meng <bin.meng@windriver.com>

Since commit 78da6a1bca22 ("device_tree: add qemu_fdt_setprop_string_array helper"),
we can use the new helper to set the compatible strings for the
SiFive test device node.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210430071302.1489082-2-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
         (long)memmap[VIRT_TEST].base);
     qemu_fdt_add_subnode(fdt, name);
     {
-        const char compat[] = "sifive,test1\0sifive,test0\0syscon";
-        qemu_fdt_setprop(fdt, name, "compatible", compat, sizeof(compat));
+        static const char * const compat[3] = {
+            "sifive,test1", "sifive,test0", "syscon"
+        };
+        qemu_fdt_setprop_string_array(fdt, name, "compatible", (char **)&compat,
+                                      ARRAY_SIZE(compat));
     }
     qemu_fdt_setprop_cells(fdt, name, "reg",
         0x0, memmap[VIRT_TEST].base,
-- 
2.31.1

From: Bin Meng <bin.meng@windriver.com>

Linux kernel commit a2770b57d083 ("dt-bindings: timer: Add CLINT bindings")
adds the official DT bindings for CLINT, which uses "sifive,clint0"
as the compatible string. "riscv,clint0" is now legacy and has to
be kept for backward compatibility of legacy systems.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210430071302.1489082-3-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/sifive_u.c | 6 +++++-
 hw/riscv/spike.c    | 6 +++++-
 hw/riscv/virt.c     | 6 +++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
     uint32_t plic_phandle, prci_phandle, gpio_phandle, phandle = 1;
     uint32_t hfclk_phandle, rtcclk_phandle, phy_phandle;
     static const char * const ethclk_names[2] = { "pclk", "hclk" };
+    static const char * const clint_compat[2] = {
+        "sifive,clint0", "riscv,clint0"
+    };
 
     if (ms->dtb) {
         fdt = s->fdt = load_device_tree(ms->dtb, &s->fdt_size);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
     nodename = g_strdup_printf("/soc/clint@%lx",
         (long)memmap[SIFIVE_U_DEV_CLINT].base);
     qemu_fdt_add_subnode(fdt, nodename);
-    qemu_fdt_setprop_string(fdt, nodename, "compatible", "riscv,clint0");
+    qemu_fdt_setprop_string_array(fdt, nodename, "compatible",
+        (char **)&clint_compat, ARRAY_SIZE(clint_compat));
     qemu_fdt_setprop_cells(fdt, nodename, "reg",
         0x0, memmap[SIFIVE_U_DEV_CLINT].base,
         0x0, memmap[SIFIVE_U_DEV_CLINT].size);
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
     uint32_t cpu_phandle, intc_phandle, phandle = 1;
     char *name, *mem_name, *clint_name, *clust_name;
     char *core_name, *cpu_name, *intc_name;
+    static const char * const clint_compat[2] = {
+        "sifive,clint0", "riscv,clint0"
+    };
 
     fdt = s->fdt = create_device_tree(&s->fdt_size);
     if (!fdt) {
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
             (memmap[SPIKE_CLINT].size * socket);
         clint_name = g_strdup_printf("/soc/clint@%lx", clint_addr);
         qemu_fdt_add_subnode(fdt, clint_name);
-        qemu_fdt_setprop_string(fdt, clint_name, "compatible", "riscv,clint0");
+        qemu_fdt_setprop_string_array(fdt, clint_name, "compatible",
+            (char **)&clint_compat, ARRAY_SIZE(clint_compat));
         qemu_fdt_setprop_cells(fdt, clint_name, "reg",
             0x0, clint_addr, 0x0, memmap[SPIKE_CLINT].size);
         qemu_fdt_setprop(fdt, clint_name, "interrupts-extended",
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
     char *name, *clint_name, *plic_name, *clust_name;
     hwaddr flashsize = virt_memmap[VIRT_FLASH].size / 2;
     hwaddr flashbase = virt_memmap[VIRT_FLASH].base;
+    static const char * const clint_compat[2] = {
+        "sifive,clint0", "riscv,clint0"
+    };
 
     if (mc->dtb) {
         fdt = mc->fdt = load_device_tree(mc->dtb, &s->fdt_size);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
             (memmap[VIRT_CLINT].size * socket);
         clint_name = g_strdup_printf("/soc/clint@%lx", clint_addr);
         qemu_fdt_add_subnode(fdt, clint_name);
-        qemu_fdt_setprop_string(fdt, clint_name, "compatible", "riscv,clint0");
+        qemu_fdt_setprop_string_array(fdt, clint_name, "compatible",
+            (char **)&clint_compat, ARRAY_SIZE(clint_compat));
         qemu_fdt_setprop_cells(fdt, clint_name, "reg",
             0x0, clint_addr, 0x0, memmap[VIRT_CLINT].size);
         qemu_fdt_setprop(fdt, clint_name, "interrupts-extended",
-- 
2.31.1

From: Bin Meng <bin.meng@windriver.com>

The official DT bindings of PLIC uses "sifive,plic-1.0.0" as the
compatible string in the upstream Linux kernel. "riscv,plic0" is
now legacy and has to be kept for backward compatibility of legacy
systems.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210430071302.1489082-4-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/sifive_u.c | 6 +++++-
 hw/riscv/virt.c     | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
     static const char * const clint_compat[2] = {
         "sifive,clint0", "riscv,clint0"
     };
+    static const char * const plic_compat[2] = {
+        "sifive,plic-1.0.0", "riscv,plic0"
+    };
 
     if (ms->dtb) {
         fdt = s->fdt = load_device_tree(ms->dtb, &s->fdt_size);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
         (long)memmap[SIFIVE_U_DEV_PLIC].base);
     qemu_fdt_add_subnode(fdt, nodename);
     qemu_fdt_setprop_cell(fdt, nodename, "#interrupt-cells", 1);
-    qemu_fdt_setprop_string(fdt, nodename, "compatible", "riscv,plic0");
+    qemu_fdt_setprop_string_array(fdt, nodename, "compatible",
+        (char **)&plic_compat, ARRAY_SIZE(plic_compat));
     qemu_fdt_setprop(fdt, nodename, "interrupt-controller", NULL, 0);
     qemu_fdt_setprop(fdt, nodename, "interrupts-extended",
         cells, (ms->smp.cpus * 4 - 2) * sizeof(uint32_t));
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
     static const char * const clint_compat[2] = {
         "sifive,clint0", "riscv,clint0"
     };
+    static const char * const plic_compat[2] = {
+        "sifive,plic-1.0.0", "riscv,plic0"
+    };
 
     if (mc->dtb) {
         fdt = mc->fdt = load_device_tree(mc->dtb, &s->fdt_size);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
             "#address-cells", FDT_PLIC_ADDR_CELLS);
         qemu_fdt_setprop_cell(fdt, plic_name,
             "#interrupt-cells", FDT_PLIC_INT_CELLS);
-        qemu_fdt_setprop_string(fdt, plic_name, "compatible", "riscv,plic0");
+        qemu_fdt_setprop_string_array(fdt, plic_name, "compatible",
+            (char **)&plic_compat, ARRAY_SIZE(plic_compat));
         qemu_fdt_setprop(fdt, plic_name, "interrupt-controller", NULL, 0);
         qemu_fdt_setprop(fdt, plic_name, "interrupts-extended",
             plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
-- 
2.31.1

From: Bin Meng <bin.meng@windriver.com>

The supported device bullet list has an additional space before each
entry, which makes a wrong indentation level. Correct it.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210430071302.1489082-5-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/microchip-icicle-kit.rst | 20 +++++++--------
 docs/system/riscv/sifive_u.rst             | 30 +++++++++++-----------
 2 files changed, 25 insertions(+), 25 deletions(-)

From: Bin Meng <bin.meng@windriver.com>

Update the 'sifive_u' machine documentation to mention the '-dtb'
option that can be used to pass a custom DTB to QEMU.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210430071302.1489082-6-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/sifive_u.rst | 47 +++++++++++++++++++++++++++++-----
 1 file changed, 41 insertions(+), 6 deletions(-)

diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/sifive_u.rst
+++ b/docs/system/riscv/sifive_u.rst
@@ -XXX,XX +XXX,XX @@ Hardware configuration information
 ----------------------------------
 
 The ``sifive_u`` machine automatically generates a device tree blob ("dtb")
-which it passes to the guest. This provides information about the addresses,
-interrupt lines and other configuration of the various devices in the system.
-Guest software should discover the devices that are present in the generated
-DTB instead of using a DTB for the real hardware, as some of the devices are
-not modeled by QEMU and trying to access these devices may cause unexpected
-behavior.
+which it passes to the guest, if there is no ``-dtb`` option. This provides
+information about the addresses, interrupt lines and other configuration of
+the various devices in the system. Guest software should discover the devices
+that are present in the generated DTB instead of using a DTB for the real
+hardware, as some of the devices are not modeled by QEMU and trying to access
+these devices may cause unexpected behavior.
+
+If users want to provide their own DTB, they can use the ``-dtb`` option.
+These DTBs should have the following requirements:
+
+* The /cpus node should contain at least one subnode for E51 and the number
+  of subnodes should match QEMU's ``-smp`` option
+* The /memory reg size should match QEMU’s selected ram_size via ``-m``
+* Should contain a node for the CLINT device with a compatible string
+  "riscv,clint0" if using with OpenSBI BIOS images
 
 Boot options
 ------------
@@ -XXX,XX +XXX,XX @@ To boot the newly built Linux kernel in QEMU with the ``sifive_u`` machine:
       -initrd /path/to/rootfs.ext4 \
       -append "root=/dev/ram"
 
+Alternatively, we can use a custom DTB to boot the machine by inserting a CLINT
+node in fu540-c000.dtsi in the Linux kernel,
+
+.. code-block:: none
+
+    clint: clint@2000000 {
+        compatible = "riscv,clint0";
+        interrupts-extended = <&cpu0_intc 3 &cpu0_intc 7
+                               &cpu1_intc 3 &cpu1_intc 7
+                               &cpu2_intc 3 &cpu2_intc 7
+                               &cpu3_intc 3 &cpu3_intc 7
+                               &cpu4_intc 3 &cpu4_intc 7>;
+        reg = <0x00 0x2000000 0x00 0x10000>;
+    };
+
+with the following command line options:
+
+.. code-block:: bash
+
+  $ qemu-system-riscv64 -M sifive_u -smp 5 -m 8G \
+      -display none -serial stdio \
+      -kernel arch/riscv/boot/Image \
+      -dtb arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dtb \
+      -initrd /path/to/rootfs.ext4 \
+      -append "root=/dev/ram"
+
 To build a Linux mainline kernel that can be booted by the ``sifive_u`` machine
 in 32-bit mode, use the rv32_defconfig configuration. A patch is required to
 fix the 32-bit boot issue for Linux kernel v5.10.
-- 
2.31.1

From: Bin Meng <bin.meng@windriver.com>

The OpenSBI BIOS image names are used by many RISC-V machines.
Let's define macros for them.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210430071302.1489082-7-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/boot.h | 5 +++++
 hw/riscv/sifive_u.c     | 6 ++----
 hw/riscv/spike.c        | 6 ++----
 hw/riscv/virt.c         | 6 ++----
 4 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/loader.h"
 #include "hw/riscv/riscv_hart.h"
 
+#define RISCV32_BIOS_BIN    "opensbi-riscv32-generic-fw_dynamic.bin"
+#define RISCV32_BIOS_ELF    "opensbi-riscv32-generic-fw_dynamic.elf"
+#define RISCV64_BIOS_BIN    "opensbi-riscv64-generic-fw_dynamic.bin"
+#define RISCV64_BIOS_ELF    "opensbi-riscv64-generic-fw_dynamic.elf"
+
 bool riscv_is_32bit(RISCVHartArrayState *harts);
 
 target_ulong riscv_calc_kernel_start_addr(RISCVHartArrayState *harts,
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_machine_init(MachineState *machine)
 
     if (riscv_is_32bit(&s->soc.u_cpus)) {
         firmware_end_addr = riscv_find_and_load_firmware(machine,
-                                    "opensbi-riscv32-generic-fw_dynamic.bin",
-                                    start_addr, NULL);
+                                    RISCV32_BIOS_BIN, start_addr, NULL);
     } else {
         firmware_end_addr = riscv_find_and_load_firmware(machine,
-                                    "opensbi-riscv64-generic-fw_dynamic.bin",
-                                    start_addr, NULL);
+                                    RISCV64_BIOS_BIN, start_addr, NULL);
     }
 
     if (machine->kernel_filename) {
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      */
     if (riscv_is_32bit(&s->soc[0])) {
         firmware_end_addr = riscv_find_and_load_firmware(machine,
-                                    "opensbi-riscv32-generic-fw_dynamic.elf",
-                                    memmap[SPIKE_DRAM].base,
+                                    RISCV32_BIOS_ELF, memmap[SPIKE_DRAM].base,
                                     htif_symbol_callback);
     } else {
         firmware_end_addr = riscv_find_and_load_firmware(machine,
-                                    "opensbi-riscv64-generic-fw_dynamic.elf",
-                                    memmap[SPIKE_DRAM].base,
+                                    RISCV64_BIOS_ELF, memmap[SPIKE_DRAM].base,
                                     htif_symbol_callback);
     }
 
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
 
     if (riscv_is_32bit(&s->soc[0])) {
         firmware_end_addr = riscv_find_and_load_firmware(machine,
-                                    "opensbi-riscv32-generic-fw_dynamic.bin",
-                                    start_addr, NULL);
+                                    RISCV32_BIOS_BIN, start_addr, NULL);
     } else {
         firmware_end_addr = riscv_find_and_load_firmware(machine,
-                                    "opensbi-riscv64-generic-fw_dynamic.bin",
-                                    start_addr, NULL);
+                                    RISCV64_BIOS_BIN, start_addr, NULL);
     }
 
     if (machine->kernel_filename) {
-- 
2.31.1

From: Bin Meng <bin.meng@windriver.com>

At present the Microchip Icicle Kit machine only supports using
'-bios' to load the HSS, and does not support '-kernel' for direct
kernel booting just like other RISC-V machines do. One has to use
U-Boot which is chain-loaded by HSS, to load a kernel for testing.
This is not so convenient.

Adding '-kernel' support together with the existing '-bios', we
follow the following table to select which payload we execute:

This ensures backwards compatibility with how we used to expose
'-bios' to users. When '-kernel' is used for direct boot, '-dtb'
must be present to provide a valid device tree for the board,
as we don't generate device tree.

When direct kernel boot is used, the OpenSBI fw_dynamic BIOS image
is used to boot a payload like U-Boot or OS kernel directly.

Documentation is updated to describe the direct kernel boot. Note
as of today there is still no PolarFire SoC support in the upstream
Linux kernel hence the document does not include instructions for
that. It will be updated in the future.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210430071302.1489082-8-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/microchip-icicle-kit.rst | 30 ++++++--
 hw/riscv/microchip_pfsoc.c                 | 81 +++++++++++++++++++++-
 2 files changed, 103 insertions(+), 8 deletions(-)

diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/microchip-icicle-kit.rst
+++ b/docs/system/riscv/microchip-icicle-kit.rst
@@ -XXX,XX +XXX,XX @@ Boot options
 
 The ``microchip-icicle-kit`` machine can start using the standard -bios
 functionality for loading its BIOS image, aka Hart Software Services (HSS_).
-HSS loads the second stage bootloader U-Boot from an SD card. It does not
-support direct kernel loading via the -kernel option. One has to load kernel
-from U-Boot.
+HSS loads the second stage bootloader U-Boot from an SD card. Then a kernel
+can be loaded from U-Boot. It also supports direct kernel booting via the
+-kernel option along with the device tree blob via -dtb. When direct kernel
+boot is used, the OpenSBI fw_dynamic BIOS image is used to boot a payload
+like U-Boot or OS kernel directly.
+
+The user provided DTB should have the following requirements:
+
+* The /cpus node should contain at least one subnode for E51 and the number
+  of subnodes should match QEMU's ``-smp`` option
+* The /memory reg size should match QEMU’s selected ram_size via ``-m``
+* Should contain a node for the CLINT device with a compatible string
+  "riscv,clint0"
+
+QEMU follows below truth table to select which payload to execute:
+
+=====  ========== =======
+-bios     -kernel payload
+=====  ========== =======
+    N           N     HSS
+    Y  don't care     HSS
+    N           Y  kernel
+=====  ========== =======
 
 The memory is set to 1537 MiB by default which is the minimum required high
 memory size by HSS. A sanity check on ram size is performed in the machine
 init routine to prompt user to increase the RAM size to > 1537 MiB when less
 than 1537 MiB ram is detected.
 
-Boot the machine
-----------------
+Running HSS
+-----------
 
 HSS 2020.12 release is tested at the time of writing. To build an HSS image
 that can be booted by the ``microchip-icicle-kit`` machine, type the following
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/microchip_pfsoc.h"
 #include "hw/intc/sifive_clint.h"
 #include "hw/intc/sifive_plic.h"
+#include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
 
 /*
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
     MemoryRegion *mem_high = g_new(MemoryRegion, 1);
     MemoryRegion *mem_high_alias = g_new(MemoryRegion, 1);
     uint64_t mem_high_size;
+    hwaddr firmware_load_addr;
+    const char *firmware_name;
+    bool kernel_as_payload = false;
+    target_ulong firmware_end_addr, kernel_start_addr;
+    uint64_t kernel_entry;
+    uint32_t fdt_load_addr;
     DriveInfo *dinfo = drive_get_next(IF_SD);
 
     /* Sanity check on RAM size */
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
                                 memmap[MICROCHIP_PFSOC_DRAM_HI_ALIAS].base,
                                 mem_high_alias);
 
-    /* Load the firmware */
-    riscv_find_and_load_firmware(machine, BIOS_FILENAME, RESET_VECTOR, NULL);
-
     /* Attach an SD card */
     if (dinfo) {
         CadenceSDHCIState *sdhci = &(s->soc.sdhci);
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
                                 &error_fatal);
         qdev_realize_and_unref(card, sdhci->bus, &error_fatal);
     }
+
+    /*
+     * We follow the following table to select which payload we execute.
+     *
+     *  -bios |    -kernel | payload
+     * -------+------------+--------
+     *      N |          N | HSS
+     *      Y | don't care | HSS
+     *      N |          Y | kernel
+     *
+     * This ensures backwards compatibility with how we used to expose -bios
+     * to users but allows them to run through direct kernel booting as well.
+     *
+     * When -kernel is used for direct boot, -dtb must be present to provide
+     * a valid device tree for the board, as we don't generate device tree.
+     */
+
+    if (machine->kernel_filename && machine->dtb) {
+        int fdt_size;
+        machine->fdt = load_device_tree(machine->dtb, &fdt_size);
+        if (!machine->fdt) {
+            error_report("load_device_tree() failed");
+            exit(1);
+        }
+
+        firmware_name = RISCV64_BIOS_BIN;
+        firmware_load_addr = memmap[MICROCHIP_PFSOC_DRAM_LO].base;
+        kernel_as_payload = true;
+    }
+
+    if (!kernel_as_payload) {
+        firmware_name = BIOS_FILENAME;
+        firmware_load_addr = RESET_VECTOR;
+    }
+
+    /* Load the firmware */
+    firmware_end_addr = riscv_find_and_load_firmware(machine, firmware_name,
+                                                     firmware_load_addr, NULL);
+
+    if (kernel_as_payload) {
+        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc.u_cpus,
+                                                         firmware_end_addr);
+
+        kernel_entry = riscv_load_kernel(machine->kernel_filename,
+                                         kernel_start_addr, NULL);
+
+        if (machine->initrd_filename) {
+            hwaddr start;
+            hwaddr end = riscv_load_initrd(machine->initrd_filename,
+                                           machine->ram_size, kernel_entry,
+                                           &start);
+            qemu_fdt_setprop_cell(machine->fdt, "/chosen",
+                                  "linux,initrd-start", start);
+            qemu_fdt_setprop_cell(machine->fdt, "/chosen",
+                                  "linux,initrd-end", end);
+        }
+
+        if (machine->kernel_cmdline) {
+            qemu_fdt_setprop_string(machine->fdt, "/chosen",
+                                    "bootargs", machine->kernel_cmdline);
+        }
+
+        /* Compute the fdt load address in dram */
+        fdt_load_addr = riscv_load_fdt(memmap[MICROCHIP_PFSOC_DRAM_LO].base,
+                                       machine->ram_size, machine->fdt);
+        /* Load the reset vector */
+        riscv_setup_rom_reset_vec(machine, &s->soc.u_cpus, firmware_load_addr,
+                                  memmap[MICROCHIP_PFSOC_ENVM_DATA].base,
+                                  memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
+                                  kernel_entry, fdt_load_addr, machine->fdt);
+    }
 }
 
 static void microchip_icicle_kit_machine_class_init(ObjectClass *oc, void *data)
-- 
2.31.1

From: Jose Martins <josemartins90@gmail.com>

The wfi exception trigger behavior should take into account user mode,
hstatus.vtw, and the fact the an wfi might raise different types of
exceptions depending on various factors:

If supervisor mode is not present:

- an illegal instruction exception should be generated if user mode
executes and wfi instruction and mstatus.tw = 1.

If supervisor mode is present:

- when a wfi instruction is executed, an illegal exception should be triggered
if either the current mode is user or the mode is supervisor and mstatus.tw is
set.

Plus, if the hypervisor extensions are enabled:

- a virtual instruction exception should be raised when a wfi is executed from
virtual-user or virtual-supervisor and hstatus.vtw is set.

Signed-off-by: Jose Martins <josemartins90@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210420213656.85148-1-josemartins90@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h  |  1 +
 target/riscv/op_helper.c | 11 ++++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define HSTATUS_HU           0x00000200
 #define HSTATUS_VGEIN        0x0003F000
 #define HSTATUS_VTVM         0x00100000
+#define HSTATUS_VTW          0x00200000
 #define HSTATUS_VTSR         0x00400000
 #define HSTATUS_VSXL         0x300000000
 
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env, target_ulong cpu_pc_deb)
 void helper_wfi(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
+    bool rvs = riscv_has_ext(env, RVS);
+    bool prv_u = env->priv == PRV_U;
+    bool prv_s = env->priv == PRV_S;
 
-    if ((env->priv == PRV_S &&
-        get_field(env->mstatus, MSTATUS_TW)) ||
-        riscv_cpu_virt_enabled(env)) {
+    if (((prv_s || (!rvs && prv_u)) && get_field(env->mstatus, MSTATUS_TW)) ||
+        (rvs && prv_u && !riscv_cpu_virt_enabled(env))) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+    } else if (riscv_cpu_virt_enabled(env) && (prv_u ||
+        (prv_s && get_field(env->hstatus, HSTATUS_VTW)))) {
         riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
     } else {
         cs->halted = 1;
-- 
2.31.1

QEMU 5.1 changed the behaviour of the default boot for the RISC-V virt
and sifive_u machines. This patch moves that change from the
deprecated.rst file to the removed-features.rst file and the
target-riscv.rst.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 4f1c261e7f69045ab8bb8926d85fe1d35e48ea5b.1620081256.git.alistair.francis@wdc.com
---
 docs/system/deprecated.rst       | 19 -------------------
 docs/system/removed-features.rst |  5 +++++
 docs/system/target-riscv.rst     | 13 ++++++++++++-
 3 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -XXX,XX +XXX,XX @@ pcspk-audiodev=<name>``.
 ``tty`` and ``parport`` are aliases that will be removed. Instead, the
 actual backend names ``serial`` and ``parallel`` should be used.
 
-RISC-V ``-bios`` (since 5.1)
-''''''''''''''''''''''''''''
-
-QEMU 4.1 introduced support for the -bios option in QEMU for RISC-V for the
-RISC-V virt machine and sifive_u machine. QEMU 4.1 had no changes to the
-default behaviour to avoid breakages.
-
-QEMU 5.1 changes the default behaviour from ``-bios none`` to ``-bios default``.
-
-QEMU 5.1 has three options:
- 1. ``-bios default`` - This is the current default behavior if no -bios option
-      is included. This option will load the default OpenSBI firmware automatically.
-      The firmware is included with the QEMU release and no user interaction is
-      required. All a user needs to do is specify the kernel they want to boot
-      with the -kernel option
- 2. ``-bios none`` - QEMU will not automatically load any firmware. It is up
-      to the user to load all the images they need.
- 3. ``-bios <file>`` - Tells QEMU to load the specified file as the firmwrae.
-
 Short-form boolean options (since 6.0)
 ''''''''''''''''''''''''''''''''''''''
 
diff --git a/docs/system/removed-features.rst b/docs/system/removed-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/removed-features.rst
+++ b/docs/system/removed-features.rst
@@ -XXX,XX +XXX,XX @@ devices.  Drives the board doesn't pick up can no longer be used with
 This option was undocumented and not used in the field.
 Use `-device usb-ccid`` instead.
 
+RISC-V firmware not booted by default (removed in 5.1)
+''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+QEMU 5.1 changes the default behaviour from ``-bios none`` to ``-bios default``
+for the RISC-V ``virt`` machine and ``sifive_u`` machine.
 
 QEMU Machine Protocol (QMP) commands
 ------------------------------------
diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-riscv.rst
+++ b/docs/system/target-riscv.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    riscv/shakti-c
    riscv/sifive_u
 
-RISC-V CPU features
+RISC-V CPU firmware
 -------------------
+
+When using the ``sifive_u`` or ``virt`` machine there are three different
+firmware boot options:
+1. ``-bios default`` - This is the default behaviour if no -bios option
+is included. This option will load the default OpenSBI firmware automatically.
+The firmware is included with the QEMU release and no user interaction is
+required. All a user needs to do is specify the kernel they want to boot
+with the -kernel option
+2. ``-bios none`` - QEMU will not automatically load any firmware. It is up
+to the user to load all the images they need.
+3. ``-bios <file>`` - Tells QEMU to load the specified file as the firmware.
-- 
2.31.1

From: Bin Meng <bmeng.cn@gmail.com>

riscv_excp_names[] and riscv_intr_names[] are only referenced by
target/riscv/cpu.c locally.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210514052435.2203156-1-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 2 --
 target/riscv/cpu.c | 4 ++--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool riscv_feature(CPURISCVState *env, int feature)
 
 extern const char * const riscv_int_regnames[];
 extern const char * const riscv_fpr_regnames[];
-extern const char * const riscv_excp_names[];
-extern const char * const riscv_intr_names[];
 
 const char *riscv_cpu_get_trap_name(target_ulong cause, bool async);
 void riscv_cpu_do_interrupt(CPUState *cpu);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const char * const riscv_fpr_regnames[] = {
   "f30/ft10", "f31/ft11"
 };
 
-const char * const riscv_excp_names[] = {
+static const char * const riscv_excp_names[] = {
     "misaligned_fetch",
     "fault_fetch",
     "illegal_instruction",
@@ -XXX,XX +XXX,XX @@ const char * const riscv_excp_names[] = {
     "guest_store_page_fault",
 };
 
-const char * const riscv_intr_names[] = {
+static const char * const riscv_intr_names[] = {
     "u_software",
     "s_software",
     "vs_software",
-- 
2.31.1

From: Changbin Du <changbin.du@gmail.com>

This dumps the CSR mscratch/sscratch/satp and meanwhile aligns
the output of CSR mtval/stval.

Signed-off-by: Changbin Du <changbin.du@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 20210519155738.20486-1-changbin.du@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     if (riscv_has_ext(env, RVH)) {
         qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "vscause ", env->vscause);
     }
-    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mtval ", env->mtval);
-    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "stval ", env->stval);
+    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mtval   ", env->mtval);
+    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "stval   ", env->stval);
     if (riscv_has_ext(env, RVH)) {
         qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "htval ", env->htval);
         qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mtval2 ", env->mtval2);
     }
+    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mscratch", env->mscratch);
+    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "sscratch", env->sscratch);
+    qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "satp    ", env->satp);
 #endif
 
     for (i = 0; i < 32; i++) {
-- 
2.31.1

Although we construct epmp_operation in such a way that it can only be
between 0 and 15 Coverity complains that we don't handle the other
possible cases. To fix Coverity and make it easier for humans to read
add a default case to the switch statement that calls
g_assert_not_reached().

Fixes: CID 1453108
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Message-id: ec5f225928eec448278c82fcb1f6805ee61dde82.1621550996.git.alistair.francis@wdc.com
---
 target/riscv/pmp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
                     case 15:
                         *allowed_privs = PMP_READ;
                         break;
+                    default:
+                        g_assert_not_reached();
                     }
                 } else {
                     switch (epmp_operation) {
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
                     case 7:
                         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
                         break;
+                    default:
+                        g_assert_not_reached();
                     }
                 }
             }
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Since commit e2e7168a214b0ed98dc357bba96816486a289762, if oprsz
is still zero(as we don't use this field), simd_desc will trigger an
assert.

Besides, tcg_gen_gvec_*_ptr calls simd_desc in it's implementation.
Here we pass the value to maxsz and oprsz to bypass the assert.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210521054816.1784297-1-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 89 ++++++++++++++-----------
 1 file changed, 50 insertions(+), 39 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
      * The first part is vlen in bytes, encoded in maxsz of simd_desc.
      * The second part is lmul, encoded in data of simd_desc.
      */
-    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
 
     gen_get_gpr(base, rs1);
     tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
     mask = tcg_temp_new_ptr();
     base = tcg_temp_new();
     stride = tcg_temp_new();
-    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
 
     gen_get_gpr(base, rs1);
     gen_get_gpr(stride, rs2);
@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     mask = tcg_temp_new_ptr();
     index = tcg_temp_new_ptr();
     base = tcg_temp_new();
-    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
 
     gen_get_gpr(base, rs1);
     tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     dest = tcg_temp_new_ptr();
     mask = tcg_temp_new_ptr();
     base = tcg_temp_new();
-    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
 
     gen_get_gpr(base, rs1);
     tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
@@ -XXX,XX +XXX,XX @@ static bool amo_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     mask = tcg_temp_new_ptr();
     index = tcg_temp_new_ptr();
     base = tcg_temp_new();
-    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
 
     gen_get_gpr(base, rs1);
     tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                            vreg_ofs(s, a->rs1), vreg_ofs(s, a->rs2),
-                           cpu_env, 0, s->vlen / 8, data, fn);
+                           cpu_env, s->vlen / 8, s->vlen / 8, data, fn);
     }
     gen_set_label(over);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
     data = FIELD_DP32(data, VDATA, MLEN, s->mlen);
     data = FIELD_DP32(data, VDATA, VM, vm);
     data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
-    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
 
     tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
     tcg_gen_addi_ptr(src2, cpu_env, vreg_ofs(s, vs2));
@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
     data = FIELD_DP32(data, VDATA, MLEN, s->mlen);
     data = FIELD_DP32(data, VDATA, VM, vm);
     data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
-    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
 
     tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
     tcg_gen_addi_ptr(src2, cpu_env, vreg_ofs(s, vs2));
@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                            vreg_ofs(s, a->rs1),
                            vreg_ofs(s, a->rs2),
-                           cpu_env, 0, s->vlen / 8,
+                           cpu_env, s->vlen / 8, s->vlen / 8,
                            data, fn);
         gen_set_label(over);
         return true;
@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                            vreg_ofs(s, a->rs1),
                            vreg_ofs(s, a->rs2),
-                           cpu_env, 0, s->vlen / 8, data, fn);
+                           cpu_env, s->vlen / 8, s->vlen / 8, data, fn);
         gen_set_label(over);
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                            vreg_ofs(s, a->rs1),                    \
-                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
-                           s->vlen / 8, data, fns[s->sew]);        \
+                           vreg_ofs(s, a->rs2), cpu_env,           \
+                           s->vlen / 8, s->vlen / 8, data,         \
+                           fns[s->sew]);                           \
         gen_set_label(over);                                       \
         return true;                                               \
     }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                            vreg_ofs(s, a->rs1),                    \
-                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
-                           s->vlen / 8, data, fns[s->sew]);        \
+                           vreg_ofs(s, a->rs2), cpu_env,           \
+                           s->vlen / 8, s->vlen / 8, data,         \
+                           fns[s->sew]);                           \
         gen_set_label(over);                                       \
         return true;                                               \
     }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
             };
 
             tcg_gen_ext_tl_i64(s1_i64, s1);
-            desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+            desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
             tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, a->rd));
             fns[s->sew](dest, s1_i64, cpu_env, desc);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
 
             s1 = tcg_const_i64(simm);
             dest = tcg_temp_new_ptr();
-            desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+            desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
             tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, a->rd));
             fns[s->sew](dest, s1, cpu_env, desc);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                            vreg_ofs(s, a->rs1),                    \
-                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
-                           s->vlen / 8, data, fns[s->sew - 1]);    \
+                           vreg_ofs(s, a->rs2), cpu_env,           \
+                           s->vlen / 8, s->vlen / 8, data,         \
+                           fns[s->sew - 1]);                       \
         gen_set_label(over);                                       \
         return true;                                               \
     }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     dest = tcg_temp_new_ptr();
     mask = tcg_temp_new_ptr();
     src2 = tcg_temp_new_ptr();
-    desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+    desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
 
     tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, vd));
     tcg_gen_addi_ptr(src2, cpu_env, vreg_ofs(s, vs2));
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);           \
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),   \
                            vreg_ofs(s, a->rs1),                  \
-                           vreg_ofs(s, a->rs2), cpu_env, 0,      \
-                           s->vlen / 8, data, fns[s->sew - 1]);  \
+                           vreg_ofs(s, a->rs2), cpu_env,         \
+                           s->vlen / 8, s->vlen / 8, data,       \
+                           fns[s->sew - 1]);                     \
         gen_set_label(over);                                     \
         return true;                                             \
     }                                                            \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                            vreg_ofs(s, a->rs1),                    \
-                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
-                           s->vlen / 8, data, fns[s->sew - 1]);    \
+                           vreg_ofs(s, a->rs2), cpu_env,           \
+                           s->vlen / 8, s->vlen / 8, data,         \
+                           fns[s->sew - 1]);                       \
         gen_set_label(over);                                       \
         return true;                                               \
     }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
-                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
-                           s->vlen / 8, data, fns[s->sew - 1]);    \
+                           vreg_ofs(s, a->rs2), cpu_env,           \
+                           s->vlen / 8, s->vlen / 8, data,         \
+                           fns[s->sew - 1]);                       \
         gen_set_label(over);                                       \
         return true;                                               \
     }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
             tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
 
             dest = tcg_temp_new_ptr();
-            desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+            desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
             tcg_gen_addi_ptr(dest, cpu_env, vreg_ofs(s, a->rd));
             fns[s->sew - 1](dest, cpu_fpr[a->rs1], cpu_env, desc);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
-                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
-                           s->vlen / 8, data, fns[s->sew - 1]);    \
+                           vreg_ofs(s, a->rs2), cpu_env,           \
+                           s->vlen / 8, s->vlen / 8, data,         \
+                           fns[s->sew - 1]);                       \
         gen_set_label(over);                                       \
         return true;                                               \
     }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
-                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
-                           s->vlen / 8, data, fns[s->sew - 1]);    \
+                           vreg_ofs(s, a->rs2), cpu_env,           \
+                           s->vlen / 8, s->vlen / 8, data,         \
+                           fns[s->sew - 1]);                       \
         gen_set_label(over);                                       \
         return true;                                               \
     }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                            vreg_ofs(s, a->rs1),                    \
-                           vreg_ofs(s, a->rs2), cpu_env, 0,        \
-                           s->vlen / 8, data, fn);                 \
+                           vreg_ofs(s, a->rs2), cpu_env,           \
+                           s->vlen / 8, s->vlen / 8, data, fn);    \
         gen_set_label(over);                                       \
         return true;                                               \
     }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_vmpopc_m(DisasContext *s, arg_rmr *a)
         mask = tcg_temp_new_ptr();
         src2 = tcg_temp_new_ptr();
         dst = tcg_temp_new();
-        desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+        desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
 
         tcg_gen_addi_ptr(src2, cpu_env, vreg_ofs(s, a->rs2));
         tcg_gen_addi_ptr(mask, cpu_env, vreg_ofs(s, 0));
@@ -XXX,XX +XXX,XX @@ static bool trans_vmfirst_m(DisasContext *s, arg_rmr *a)
         mask = tcg_temp_new_ptr();
         src2 = tcg_temp_new_ptr();
         dst = tcg_temp_new();
-        desc = tcg_const_i32(simd_desc(0, s->vlen / 8, data));
+        desc = tcg_const_i32(simd_desc(s->vlen / 8, s->vlen / 8, data));
 
         tcg_gen_addi_ptr(src2, cpu_env, vreg_ofs(s, a->rs2));
         tcg_gen_addi_ptr(mask, cpu_env, vreg_ofs(s, 0));
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd),                     \
                            vreg_ofs(s, 0), vreg_ofs(s, a->rs2),    \
-                           cpu_env, 0, s->vlen / 8, data, fn);     \
+                           cpu_env, s->vlen / 8, s->vlen / 8,      \
+                           data, fn);                              \
         gen_set_label(over);                                       \
         return true;                                               \
     }                                                              \
@@ -XXX,XX +XXX,XX @@ static bool trans_viota_m(DisasContext *s, arg_viota_m *a)
             gen_helper_viota_m_w, gen_helper_viota_m_d,
         };
         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
-                           vreg_ofs(s, a->rs2), cpu_env, 0,
-                           s->vlen / 8, data, fns[s->sew]);
+                           vreg_ofs(s, a->rs2), cpu_env,
+                           s->vlen / 8, s->vlen / 8, data, fns[s->sew]);
         gen_set_label(over);
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
             gen_helper_vid_v_w, gen_helper_vid_v_d,
         };
         tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
-                           cpu_env, 0, s->vlen / 8, data, fns[s->sew]);
+                           cpu_env, s->vlen / 8, s->vlen / 8,
+                           data, fns[s->sew]);
         gen_set_label(over);
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_vcompress_vm(DisasContext *s, arg_r *a)
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                            vreg_ofs(s, a->rs1), vreg_ofs(s, a->rs2),
-                           cpu_env, 0, s->vlen / 8, data, fns[s->sew]);
+                           cpu_env, s->vlen / 8, s->vlen / 8, data,
+                           fns[s->sew]);
         gen_set_label(over);
         return true;
     }
-- 
2.31.1

From: Kito Cheng <kito.cheng@sifive.com>

diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 %rd        7:5
 %sh5       20:5
 
-%sh10    20:10
+%sh7    20:7
 %csr    20:12
 %rm     12:3
 %nf     29:3                     !function=ex_plus_1
@@ -XXX,XX +XXX,XX @@
 @u       ....................      ..... ....... &u      imm=%imm_u          %rd
 @j       ....................      ..... ....... &j      imm=%imm_j          %rd
 
-@sh      ......  ...... .....  ... ..... ....... &shift  shamt=%sh10      %rs1 %rd
+@sh      ......  ...... .....  ... ..... ....... &shift  shamt=%sh7     %rs1 %rd
 @csr     ............   .....  ... ..... .......               %csr     %rs1 %rd
 
 @atom_ld ..... aq:1 rl:1 ..... ........ ..... ....... &atomic rs2=0     %rs1 %rd
@@ -XXX,XX +XXX,XX @@ sltiu    ............     ..... 011 ..... 0010011 @i
 xori     ............     ..... 100 ..... 0010011 @i
 ori      ............     ..... 110 ..... 0010011 @i
 andi     ............     ..... 111 ..... 0010011 @i
-slli     00.... ......    ..... 001 ..... 0010011 @sh
-srli     00.... ......    ..... 101 ..... 0010011 @sh
-srai     01.... ......    ..... 101 ..... 0010011 @sh
+slli     00000. ......    ..... 001 ..... 0010011 @sh
+srli     00000. ......    ..... 101 ..... 0010011 @sh
+srai     01000. ......    ..... 101 ..... 0010011 @sh
 add      0000000 .....    ..... 000 ..... 0110011 @r
 sub      0100000 .....    ..... 000 ..... 0110011 @r
 sll      0000000 .....    ..... 001 ..... 0110011 @r
-- 
2.31.1

From: Kito Cheng <kito.cheng@sifive.com>

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210505160620.15723-3-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                      |  1 +
 target/riscv/insn32.decode              | 11 ++++++-
 target/riscv/translate.c                | 38 +++++++++++++++++++++
 target/riscv/insn_trans/trans_rvb.c.inc | 44 +++++++++++++++++++++++++
 4 files changed, 93 insertions(+), 1 deletion(-)
 create mode 100644 target/riscv/insn_trans/trans_rvb.c.inc

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@
 #define RVS RV('S')
 #define RVU RV('U')
 #define RVH RV('H')
+#define RVB RV('B')
 
 /* S extension denotes that Supervisor mode exists, however it is possible
    to have a core that support S mode but does not have an MMU and there
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 &i    imm rs1 rd
 &j    imm rd
 &r    rd rs1 rs2
+&r2   rd rs1
 &s    imm rs1 rs2
 &u    imm rd
 &shift     shamt rs1 rd
@@ -XXX,XX +XXX,XX @@
 @r4_rm   ..... ..  ..... ..... ... ..... ....... %rs3 %rs2 %rs1 %rm %rd
 @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
 @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
-@r2      .......   ..... ..... ... ..... ....... %rs1 %rd
+@r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
 @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
 @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
 @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
@@ -XXX,XX +XXX,XX @@ vamomind_v      10000 . . ..... ..... 111 ..... 0101111 @r_wdvm
 vamomaxd_v      10100 . . ..... ..... 111 ..... 0101111 @r_wdvm
 vamominud_v     11000 . . ..... ..... 111 ..... 0101111 @r_wdvm
 vamomaxud_v     11100 . . ..... ..... 111 ..... 0101111 @r_wdvm
+
+# *** RV32B Standard Extension ***
+clz        011000 000000 ..... 001 ..... 0010011 @r2
+ctz        011000 000001 ..... 001 ..... 0010011 @r2
+
+# *** RV64B Standard Extension (in addition to RV32B) ***
+clzw       0110000 00000 ..... 001 ..... 0011011 @r2
+ctzw       0110000 00001 ..... 001 ..... 0011011 @r2
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static bool gen_arith_div_uw(DisasContext *ctx, arg_r *a,
     return true;
 }
 
+static void gen_ctzw(TCGv ret, TCGv arg1)
+{
+    tcg_gen_ori_tl(ret, arg1, (target_ulong)MAKE_64BIT_MASK(32, 32));
+    tcg_gen_ctzi_tl(ret, ret, 64);
+}
+
+static void gen_clzw(TCGv ret, TCGv arg1)
+{
+    tcg_gen_ext32u_tl(ret, arg1);
+    tcg_gen_clzi_tl(ret, ret, 64);
+    tcg_gen_subi_tl(ret, ret, 32);
+}
+
 static bool gen_arith(DisasContext *ctx, arg_r *a,
                       void(*func)(TCGv, TCGv, TCGv))
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
     return cpu_ldl_code(env, pc);
 }
 
+static void gen_ctz(TCGv ret, TCGv arg1)
+{
+    tcg_gen_ctzi_tl(ret, arg1, TARGET_LONG_BITS);
+}
+
+static void gen_clz(TCGv ret, TCGv arg1)
+{
+    tcg_gen_clzi_tl(ret, arg1, TARGET_LONG_BITS);
+}
+
+static bool gen_unary(DisasContext *ctx, arg_r2 *a,
+                      void(*func)(TCGv, TCGv))
+{
+    TCGv source = tcg_temp_new();
+
+    gen_get_gpr(source, a->rs1);
+
+    (*func)(source, source);
+
+    gen_set_gpr(a->rd, source);
+    tcg_temp_free(source);
+    return true;
+}
+
 /* Include insn module translation function */
 #include "insn_trans/trans_rvi.c.inc"
 #include "insn_trans/trans_rvm.c.inc"
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvd.c.inc"
 #include "insn_trans/trans_rvh.c.inc"
 #include "insn_trans/trans_rvv.c.inc"
+#include "insn_trans/trans_rvb.c.inc"
 #include "insn_trans/trans_privileged.c.inc"
 
 /* Include the auto-generated decoder for 16 bit insn */
diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvb.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the RVB Standard Extension.
+ *
+ * Copyright (c) 2020 Kito Cheng, kito.cheng@sifive.com
+ * Copyright (c) 2020 Frank Chang, frank.chang@sifive.com
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+static bool trans_clz(DisasContext *ctx, arg_clz *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_unary(ctx, a, gen_clz);
+}
+
+static bool trans_ctz(DisasContext *ctx, arg_ctz *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_unary(ctx, a, gen_ctz);
+}
+
+static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_unary(ctx, a, gen_clzw);
+}
+
+static bool trans_ctzw(DisasContext *ctx, arg_ctzw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_unary(ctx, a, gen_ctzw);
+}
-- 
2.31.1

From: Frank Chang <frank.chang@sifive.com>

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Message-id: 20210505160620.15723-4-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode              |  2 ++
 target/riscv/translate.c                |  6 ++++++
 target/riscv/insn_trans/trans_rvb.c.inc | 13 +++++++++++++
 3 files changed, 21 insertions(+)

diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vamomaxud_v     11100 . . ..... ..... 111 ..... 0101111 @r_wdvm
 # *** RV32B Standard Extension ***
 clz        011000 000000 ..... 001 ..... 0010011 @r2
 ctz        011000 000001 ..... 001 ..... 0010011 @r2
+cpop       011000 000010 ..... 001 ..... 0010011 @r2
 
 # *** RV64B Standard Extension (in addition to RV32B) ***
 clzw       0110000 00000 ..... 001 ..... 0011011 @r2
 ctzw       0110000 00001 ..... 001 ..... 0011011 @r2
+cpopw      0110000 00010 ..... 001 ..... 0011011 @r2
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_clzw(TCGv ret, TCGv arg1)
     tcg_gen_subi_tl(ret, ret, 32);
 }
 
+static void gen_cpopw(TCGv ret, TCGv arg1)
+{
+    tcg_gen_ext32u_tl(arg1, arg1);
+    tcg_gen_ctpop_tl(ret, arg1);
+}
+
 static bool gen_arith(DisasContext *ctx, arg_r *a,
                       void(*func)(TCGv, TCGv, TCGv))
 {
diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvb.c.inc
+++ b/target/riscv/insn_trans/trans_rvb.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_ctz(DisasContext *ctx, arg_ctz *a)
     return gen_unary(ctx, a, gen_ctz);
 }
 
+static bool trans_cpop(DisasContext *ctx, arg_cpop *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_unary(ctx, a, tcg_gen_ctpop_tl);
+}
+
 static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
 {
     REQUIRE_64BIT(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_ctzw(DisasContext *ctx, arg_ctzw *a)
     REQUIRE_EXT(ctx, RVB);
     return gen_unary(ctx, a, gen_ctzw);
 }
+
+static bool trans_cpopw(DisasContext *ctx, arg_cpopw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_unary(ctx, a, gen_cpopw);
+}
-- 
2.31.1

From: Kito Cheng <kito.cheng@sifive.com>

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210505160620.15723-5-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode              |  3 +++
 target/riscv/insn_trans/trans_rvb.c.inc | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+)

From: Kito Cheng <kito.cheng@sifive.com>

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210505160620.15723-6-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode              |  6 ++++
 target/riscv/translate.c                | 40 +++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvb.c.inc | 32 ++++++++++++++++++++
 3 files changed, 78 insertions(+)

From: Kito Cheng <kito.cheng@sifive.com>

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Message-id: 20210505160620.15723-7-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode              |  4 ++++
 target/riscv/insn_trans/trans_rvb.c.inc | 24 ++++++++++++++++++++++++
 2 files changed, 28 insertions(+)

From: Kito Cheng <kito.cheng@sifive.com>

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Message-id: 20210505160620.15723-8-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode              |  3 +++
 target/riscv/insn_trans/trans_rvb.c.inc | 12 ++++++++++++
 2 files changed, 15 insertions(+)

From: Frank Chang <frank.chang@sifive.com>

Add gen_shifti() and gen_shiftiw() helper functions to reuse the same
interfaces for immediate shift instructions.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210505160620.15723-9-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c                | 39 ++++++++++++++++++
 target/riscv/insn_trans/trans_rvi.c.inc | 54 ++-----------------------
 2 files changed, 43 insertions(+), 50 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
     return cpu_ldl_code(env, pc);
 }
 
+static bool gen_shifti(DisasContext *ctx, arg_shift *a,
+                       void(*func)(TCGv, TCGv, TCGv))
+{
+    if (a->shamt >= TARGET_LONG_BITS) {
+        return false;
+    }
+
+    TCGv source1 = tcg_temp_new();
+    TCGv source2 = tcg_temp_new();
+
+    gen_get_gpr(source1, a->rs1);
+
+    tcg_gen_movi_tl(source2, a->shamt);
+    (*func)(source1, source1, source2);
+
+    gen_set_gpr(a->rd, source1);
+    tcg_temp_free(source1);
+    tcg_temp_free(source2);
+    return true;
+}
+
+static bool gen_shiftiw(DisasContext *ctx, arg_shift *a,
+                        void(*func)(TCGv, TCGv, TCGv))
+{
+    TCGv source1 = tcg_temp_new();
+    TCGv source2 = tcg_temp_new();
+
+    gen_get_gpr(source1, a->rs1);
+    tcg_gen_movi_tl(source2, a->shamt);
+
+    (*func)(source1, source1, source2);
+    tcg_gen_ext32s_tl(source1, source1);
+
+    gen_set_gpr(a->rd, source1);
+    tcg_temp_free(source1);
+    tcg_temp_free(source2);
+    return true;
+}
+
 static void gen_ctz(TCGv ret, TCGv arg1)
 {
     tcg_gen_ctzi_tl(ret, arg1, TARGET_LONG_BITS);
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_andi(DisasContext *ctx, arg_andi *a)
 }
 static bool trans_slli(DisasContext *ctx, arg_slli *a)
 {
-    if (a->shamt >= TARGET_LONG_BITS) {
-        return false;
-    }
-
-    if (a->rd != 0) {
-        TCGv t = tcg_temp_new();
-        gen_get_gpr(t, a->rs1);
-
-        tcg_gen_shli_tl(t, t, a->shamt);
-
-        gen_set_gpr(a->rd, t);
-        tcg_temp_free(t);
-    } /* NOP otherwise */
-    return true;
+    return gen_shifti(ctx, a, tcg_gen_shl_tl);
 }
 
 static bool trans_srli(DisasContext *ctx, arg_srli *a)
 {
-    if (a->shamt >= TARGET_LONG_BITS) {
-        return false;
-    }
-
-    if (a->rd != 0) {
-        TCGv t = tcg_temp_new();
-        gen_get_gpr(t, a->rs1);
-
-        tcg_gen_shri_tl(t, t, a->shamt);
-        gen_set_gpr(a->rd, t);
-        tcg_temp_free(t);
-    } /* NOP otherwise */
-    return true;
+    return gen_shifti(ctx, a, tcg_gen_shr_tl);
 }
 
 static bool trans_srai(DisasContext *ctx, arg_srai *a)
 {
-    if (a->shamt >= TARGET_LONG_BITS) {
-        return false;
-    }
-
-    if (a->rd != 0) {
-        TCGv t = tcg_temp_new();
-        gen_get_gpr(t, a->rs1);
-
-        tcg_gen_sari_tl(t, t, a->shamt);
-        gen_set_gpr(a->rd, t);
-        tcg_temp_free(t);
-    } /* NOP otherwise */
-    return true;
+    return gen_shifti(ctx, a, tcg_gen_sar_tl);
 }
 
 static bool trans_add(DisasContext *ctx, arg_add *a)
@@ -XXX,XX +XXX,XX @@ static bool trans_addiw(DisasContext *ctx, arg_addiw *a)
 static bool trans_slliw(DisasContext *ctx, arg_slliw *a)
 {
     REQUIRE_64BIT(ctx);
-    TCGv source1;
-    source1 = tcg_temp_new();
-    gen_get_gpr(source1, a->rs1);
-
-    tcg_gen_shli_tl(source1, source1, a->shamt);
-    tcg_gen_ext32s_tl(source1, source1);
-    gen_set_gpr(a->rd, source1);
-
-    tcg_temp_free(source1);
-    return true;
+    return gen_shiftiw(ctx, a, tcg_gen_shl_tl);
 }
 
 static bool trans_srliw(DisasContext *ctx, arg_srliw *a)
-- 
2.31.1

From: Frank Chang <frank.chang@sifive.com>

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210505160620.15723-10-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode              | 17 +++++
 target/riscv/translate.c                | 61 ++++++++++++++++
 target/riscv/insn_trans/trans_rvb.c.inc | 97 +++++++++++++++++++++++++
 3 files changed, 175 insertions(+)

diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ min        0000101 .......... 100 ..... 0110011 @r
 minu       0000101 .......... 101 ..... 0110011 @r
 max        0000101 .......... 110 ..... 0110011 @r
 maxu       0000101 .......... 111 ..... 0110011 @r
+bset       0010100 .......... 001 ..... 0110011 @r
+bclr       0100100 .......... 001 ..... 0110011 @r
+binv       0110100 .......... 001 ..... 0110011 @r
+bext       0100100 .......... 101 ..... 0110011 @r
+
+bseti      00101. ........... 001 ..... 0010011 @sh
+bclri      01001. ........... 001 ..... 0010011 @sh
+binvi      01101. ........... 001 ..... 0010011 @sh
+bexti      01001. ........... 101 ..... 0010011 @sh
 
 # *** RV64B Standard Extension (in addition to RV32B) ***
 clzw       0110000 00000 ..... 001 ..... 0011011 @r2
@@ -XXX,XX +XXX,XX @@ cpopw      0110000 00010 ..... 001 ..... 0011011 @r2
 
 packw      0000100 .......... 100 ..... 0111011 @r
 packuw     0100100 .......... 100 ..... 0111011 @r
+bsetw      0010100 .......... 001 ..... 0111011 @r
+bclrw      0100100 .......... 001 ..... 0111011 @r
+binvw      0110100 .......... 001 ..... 0111011 @r
+bextw      0100100 .......... 101 ..... 0111011 @r
+
+bsetiw     0010100 .......... 001 ..... 0011011 @sh5
+bclriw     0100100 .......... 001 ..... 0011011 @sh5
+binviw     0110100 .......... 001 ..... 0011011 @sh5
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_packh(TCGv ret, TCGv arg1, TCGv arg2)
     tcg_temp_free(t);
 }
 
+static void gen_sbop_mask(TCGv ret, TCGv shamt)
+{
+    tcg_gen_movi_tl(ret, 1);
+    tcg_gen_shl_tl(ret, ret, shamt);
+}
+
+static void gen_bset(TCGv ret, TCGv arg1, TCGv shamt)
+{
+    TCGv t = tcg_temp_new();
+
+    gen_sbop_mask(t, shamt);
+    tcg_gen_or_tl(ret, arg1, t);
+
+    tcg_temp_free(t);
+}
+
+static void gen_bclr(TCGv ret, TCGv arg1, TCGv shamt)
+{
+    TCGv t = tcg_temp_new();
+
+    gen_sbop_mask(t, shamt);
+    tcg_gen_andc_tl(ret, arg1, t);
+
+    tcg_temp_free(t);
+}
+
+static void gen_binv(TCGv ret, TCGv arg1, TCGv shamt)
+{
+    TCGv t = tcg_temp_new();
+
+    gen_sbop_mask(t, shamt);
+    tcg_gen_xor_tl(ret, arg1, t);
+
+    tcg_temp_free(t);
+}
+
+static void gen_bext(TCGv ret, TCGv arg1, TCGv shamt)
+{
+    tcg_gen_shr_tl(ret, arg1, shamt);
+    tcg_gen_andi_tl(ret, ret, 1);
+}
+
 static void gen_ctzw(TCGv ret, TCGv arg1)
 {
     tcg_gen_ori_tl(ret, arg1, (target_ulong)MAKE_64BIT_MASK(32, 32));
@@ -XXX,XX +XXX,XX @@ static bool gen_shifti(DisasContext *ctx, arg_shift *a,
     return true;
 }
 
+static bool gen_shiftw(DisasContext *ctx, arg_r *a,
+                       void(*func)(TCGv, TCGv, TCGv))
+{
+    TCGv source1 = tcg_temp_new();
+    TCGv source2 = tcg_temp_new();
+
+    gen_get_gpr(source1, a->rs1);
+    gen_get_gpr(source2, a->rs2);
+
+    tcg_gen_andi_tl(source2, source2, 31);
+    (*func)(source1, source1, source2);
+    tcg_gen_ext32s_tl(source1, source1);
+
+    gen_set_gpr(a->rd, source1);
+    tcg_temp_free(source1);
+    tcg_temp_free(source2);
+    return true;
+}
+
 static bool gen_shiftiw(DisasContext *ctx, arg_shift *a,
                         void(*func)(TCGv, TCGv, TCGv))
 {
diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvb.c.inc
+++ b/target/riscv/insn_trans/trans_rvb.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_sext_h(DisasContext *ctx, arg_sext_h *a)
     return gen_unary(ctx, a, tcg_gen_ext16s_tl);
 }
 
+static bool trans_bset(DisasContext *ctx, arg_bset *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shift(ctx, a, gen_bset);
+}
+
+static bool trans_bseti(DisasContext *ctx, arg_bseti *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shifti(ctx, a, gen_bset);
+}
+
+static bool trans_bclr(DisasContext *ctx, arg_bclr *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shift(ctx, a, gen_bclr);
+}
+
+static bool trans_bclri(DisasContext *ctx, arg_bclri *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shifti(ctx, a, gen_bclr);
+}
+
+static bool trans_binv(DisasContext *ctx, arg_binv *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shift(ctx, a, gen_binv);
+}
+
+static bool trans_binvi(DisasContext *ctx, arg_binvi *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shifti(ctx, a, gen_binv);
+}
+
+static bool trans_bext(DisasContext *ctx, arg_bext *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shift(ctx, a, gen_bext);
+}
+
+static bool trans_bexti(DisasContext *ctx, arg_bexti *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shifti(ctx, a, gen_bext);
+}
+
 static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
 {
     REQUIRE_64BIT(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_packuw(DisasContext *ctx, arg_packuw *a)
     REQUIRE_EXT(ctx, RVB);
     return gen_arith(ctx, a, gen_packuw);
 }
+
+static bool trans_bsetw(DisasContext *ctx, arg_bsetw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shiftw(ctx, a, gen_bset);
+}
+
+static bool trans_bsetiw(DisasContext *ctx, arg_bsetiw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shiftiw(ctx, a, gen_bset);
+}
+
+static bool trans_bclrw(DisasContext *ctx, arg_bclrw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shiftw(ctx, a, gen_bclr);
+}
+
+static bool trans_bclriw(DisasContext *ctx, arg_bclriw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shiftiw(ctx, a, gen_bclr);
+}
+
+static bool trans_binvw(DisasContext *ctx, arg_binvw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shiftw(ctx, a, gen_binv);
+}
+
+static bool trans_binviw(DisasContext *ctx, arg_binviw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shiftiw(ctx, a, gen_binv);
+}
+
+static bool trans_bextw(DisasContext *ctx, arg_bextw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shiftw(ctx, a, gen_bext);
+}
-- 
2.31.1

From: Kito Cheng <kito.cheng@sifive.com>

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210505160620.15723-11-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode              |  8 ++++
 target/riscv/translate.c                | 14 +++++++
 target/riscv/insn_trans/trans_rvb.c.inc | 52 +++++++++++++++++++++++++
 3 files changed, 74 insertions(+)

From: Kito Cheng <kito.cheng@sifive.com>

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210505160620.15723-12-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode              |  6 ++++
 target/riscv/translate.c                | 36 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvb.c.inc | 39 +++++++++++++++++++++++++
 3 files changed, 81 insertions(+)

From: Frank Chang <frank.chang@sifive.com>

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210505160620.15723-13-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                   |  4 ++
 target/riscv/insn32.decode              |  4 ++
 target/riscv/bitmanip_helper.c          | 64 +++++++++++++++++++++++++
 target/riscv/translate.c                | 28 +++++++++++
 target/riscv/insn_trans/trans_rvb.c.inc | 31 ++++++++++++
 target/riscv/meson.build                |  1 +
 6 files changed, 132 insertions(+)
 create mode 100644 target/riscv/bitmanip_helper.c

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_d_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_d_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
 
+/* Bitmanip */
+DEF_HELPER_FLAGS_2(grev, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+DEF_HELPER_FLAGS_2(grevw, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+
 /* Special functions */
 DEF_HELPER_3(csrrw, tl, env, tl, tl)
 DEF_HELPER_4(csrrs, tl, env, tl, tl, tl)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ slo        0010000 .......... 001 ..... 0110011 @r
 sro        0010000 .......... 101 ..... 0110011 @r
 ror        0110000 .......... 101 ..... 0110011 @r
 rol        0110000 .......... 001 ..... 0110011 @r
+grev       0110100 .......... 101 ..... 0110011 @r
 
 bseti      00101. ........... 001 ..... 0010011 @sh
 bclri      01001. ........... 001 ..... 0010011 @sh
@@ -XXX,XX +XXX,XX @@ bexti      01001. ........... 101 ..... 0010011 @sh
 sloi       00100. ........... 001 ..... 0010011 @sh
 sroi       00100. ........... 101 ..... 0010011 @sh
 rori       01100. ........... 101 ..... 0010011 @sh
+grevi      01101. ........... 101 ..... 0010011 @sh
 
 # *** RV64B Standard Extension (in addition to RV32B) ***
 clzw       0110000 00000 ..... 001 ..... 0011011 @r2
@@ -XXX,XX +XXX,XX @@ slow       0010000 .......... 001 ..... 0111011 @r
 srow       0010000 .......... 101 ..... 0111011 @r
 rorw       0110000 .......... 101 ..... 0111011 @r
 rolw       0110000 .......... 001 ..... 0111011 @r
+grevw      0110100 .......... 101 ..... 0111011 @r
 
 bsetiw     0010100 .......... 001 ..... 0011011 @sh5
 bclriw     0100100 .......... 001 ..... 0011011 @sh5
@@ -XXX,XX +XXX,XX @@ binviw     0110100 .......... 001 ..... 0011011 @sh5
 sloiw      0010000 .......... 001 ..... 0011011 @sh5
 sroiw      0010000 .......... 101 ..... 0011011 @sh5
 roriw      0110000 .......... 101 ..... 0011011 @sh5
+greviw     0110100 .......... 101 ..... 0011011 @sh5
diff --git a/target/riscv/bitmanip_helper.c b/target/riscv/bitmanip_helper.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/bitmanip_helper.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Bitmanip Extension Helpers for QEMU.
+ *
+ * Copyright (c) 2020 Kito Cheng, kito.cheng@sifive.com
+ * Copyright (c) 2020 Frank Chang, frank.chang@sifive.com
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/host-utils.h"
+#include "exec/exec-all.h"
+#include "exec/helper-proto.h"
+#include "tcg/tcg.h"
+
+static const uint64_t adjacent_masks[] = {
+    dup_const(MO_8, 0x55),
+    dup_const(MO_8, 0x33),
+    dup_const(MO_8, 0x0f),
+    dup_const(MO_16, 0xff),
+    dup_const(MO_32, 0xffff),
+    UINT32_MAX
+};
+
+static inline target_ulong do_swap(target_ulong x, uint64_t mask, int shift)
+{
+    return ((x & mask) << shift) | ((x & ~mask) >> shift);
+}
+
+static target_ulong do_grev(target_ulong rs1,
+                            target_ulong rs2,
+                            int bits)
+{
+    target_ulong x = rs1;
+    int i, shift;
+
+    for (i = 0, shift = 1; shift < bits; i++, shift <<= 1) {
+        if (rs2 & shift) {
+            x = do_swap(x, adjacent_masks[i], shift);
+        }
+    }
+
+    return x;
+}
+
+target_ulong HELPER(grev)(target_ulong rs1, target_ulong rs2)
+{
+    return do_grev(rs1, rs2, TARGET_LONG_BITS);
+}
+
+target_ulong HELPER(grevw)(target_ulong rs1, target_ulong rs2)
+{
+    return do_grev(rs1, rs2, 32);
+}
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_sro(TCGv ret, TCGv arg1, TCGv arg2)
     tcg_gen_not_tl(ret, ret);
 }
 
+static bool gen_grevi(DisasContext *ctx, arg_grevi *a)
+{
+    TCGv source1 = tcg_temp_new();
+    TCGv source2;
+
+    gen_get_gpr(source1, a->rs1);
+
+    if (a->shamt == (TARGET_LONG_BITS - 8)) {
+        /* rev8, byte swaps */
+        tcg_gen_bswap_tl(source1, source1);
+    } else {
+        source2 = tcg_temp_new();
+        tcg_gen_movi_tl(source2, a->shamt);
+        gen_helper_grev(source1, source1, source2);
+        tcg_temp_free(source2);
+    }
+
+    gen_set_gpr(a->rd, source1);
+    tcg_temp_free(source1);
+    return true;
+}
+
 static void gen_ctzw(TCGv ret, TCGv arg1)
 {
     tcg_gen_ori_tl(ret, arg1, (target_ulong)MAKE_64BIT_MASK(32, 32));
@@ -XXX,XX +XXX,XX @@ static void gen_rolw(TCGv ret, TCGv arg1, TCGv arg2)
     tcg_temp_free_i32(t2);
 }
 
+static void gen_grevw(TCGv ret, TCGv arg1, TCGv arg2)
+{
+    tcg_gen_ext32u_tl(arg1, arg1);
+    gen_helper_grev(ret, arg1, arg2);
+}
+
 static bool gen_arith(DisasContext *ctx, arg_r *a,
                       void(*func)(TCGv, TCGv, TCGv))
 {
diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvb.c.inc
+++ b/target/riscv/insn_trans/trans_rvb.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_rol(DisasContext *ctx, arg_rol *a)
     return gen_shift(ctx, a, tcg_gen_rotl_tl);
 }
 
+static bool trans_grev(DisasContext *ctx, arg_grev *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shift(ctx, a, gen_helper_grev);
+}
+
+static bool trans_grevi(DisasContext *ctx, arg_grevi *a)
+{
+    REQUIRE_EXT(ctx, RVB);
+
+    if (a->shamt >= TARGET_LONG_BITS) {
+        return false;
+    }
+
+    return gen_grevi(ctx, a);
+}
+
 static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
 {
     REQUIRE_64BIT(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_rolw(DisasContext *ctx, arg_rolw *a)
     REQUIRE_EXT(ctx, RVB);
     return gen_shiftw(ctx, a, gen_rolw);
 }
+
+static bool trans_grevw(DisasContext *ctx, arg_grevw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shiftw(ctx, a, gen_grevw);
+}
+
+static bool trans_greviw(DisasContext *ctx, arg_greviw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EXT(ctx, RVB);
+    return gen_shiftiw(ctx, a, gen_grevw);
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
   'gdbstub.c',
   'op_helper.c',
   'vector_helper.c',
+  'bitmanip_helper.c',
   'translate.c',
 ))
 
-- 
2.31.1

From: Frank Chang <frank.chang@sifive.com>

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210505160620.15723-14-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                   |  2 ++
 target/riscv/insn32.decode              |  4 ++++
 target/riscv/bitmanip_helper.c          | 26 +++++++++++++++++++++++++
 target/riscv/translate.c                |  6 ++++++
 target/riscv/insn_trans/trans_rvb.c.inc | 26 +++++++++++++++++++++++++
 5 files changed, 64 insertions(+)

From: Kito Cheng <kito.cheng@sifive.com>

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210505160620.15723-15-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode              |  6 +++++
 target/riscv/translate.c                | 32 +++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvb.c.inc | 24 +++++++++++++++++++
 3 files changed, 62 insertions(+)

diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ ror        0110000 .......... 101 ..... 0110011 @r
 rol        0110000 .......... 001 ..... 0110011 @r
 grev       0110100 .......... 101 ..... 0110011 @r
 gorc       0010100 .......... 101 ..... 0110011 @r
+sh1add     0010000 .......... 010 ..... 0110011 @r
+sh2add     0010000 .......... 100 ..... 0110011 @r
+sh3add     0010000 .......... 110 ..... 0110011 @r
 
 bseti      00101. ........... 001 ..... 0010011 @sh
 bclri      01001. ........... 001 ..... 0010011 @sh
@@ -XXX,XX +XXX,XX @@ rorw       0110000 .......... 101 ..... 0111011 @r
 rolw       0110000 .......... 001 ..... 0111011 @r
 grevw      0110100 .......... 101 ..... 0111011 @r
 gorcw      0010100 .......... 101 ..... 0111011 @r
+sh1add_uw  0010000 .......... 010 ..... 0111011 @r
+sh2add_uw  0010000 .......... 100 ..... 0111011 @r
+sh3add_uw  0010000 .......... 110 ..... 0111011 @r
 
 bsetiw     0010100 .......... 001 ..... 0011011 @sh5
 bclriw     0100100 .......... 001 ..... 0011011 @sh5
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static bool gen_grevi(DisasContext *ctx, arg_grevi *a)
     return true;
 }
 
+#define GEN_SHADD(SHAMT)                                       \
+static void gen_sh##SHAMT##add(TCGv ret, TCGv arg1, TCGv arg2) \
+{                                                              \
+    TCGv t = tcg_temp_new();                                   \
+                                                               \
+    tcg_gen_shli_tl(t, arg1, SHAMT);                           \
+    tcg_gen_add_tl(ret, t, arg2);                              \
+                                                               \
+    tcg_temp_free(t);                                          \
+}
+
+GEN_SHADD(1)
+GEN_SHADD(2)
+GEN_SHADD(3)
+
 static void gen_ctzw(TCGv ret, TCGv arg1)
 {
     tcg_gen_ori_tl(ret, arg1, (target_ulong)MAKE_64BIT_MASK(32, 32));
@@ -XXX,XX +XXX,XX @@ static void gen_gorcw(TCGv ret, TCGv arg1, TCGv arg2)
     gen_helper_gorcw(ret, arg1, arg2);
 }
 
+#define GEN_SHADD_UW(SHAMT)                                       \
+static void gen_sh##SHAMT##add_uw(TCGv ret, TCGv arg1, TCGv arg2) \
+{                                                                 \
+    TCGv t = tcg_temp_new();                                      \
+                                                                  \
+    tcg_gen_ext32u_tl(t, arg1);                                   \
+                                                                  \
+    tcg_gen_shli_tl(t, t, SHAMT);                                 \
+    tcg_gen_add_tl(ret, t, arg2);                                 \
+                                                                  \
+    tcg_temp_free(t);                                             \
+}
+
+GEN_SHADD_UW(1)
+GEN_SHADD_UW(2)
+GEN_SHADD_UW(3)
+
 static bool gen_arith(DisasContext *ctx, arg_r *a,
                       void(*func)(TCGv, TCGv, TCGv))
 {
diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvb.c.inc
+++ b/target/riscv/insn_trans/trans_rvb.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_gorci(DisasContext *ctx, arg_gorci *a)
     return gen_shifti(ctx, a, gen_helper_gorc);
 }
 
+#define GEN_TRANS_SHADD(SHAMT)                                             \
+static bool trans_sh##SHAMT##add(DisasContext *ctx, arg_sh##SHAMT##add *a) \
+{                                                                          \
+    REQUIRE_EXT(ctx, RVB);                                                 \
+    return gen_arith(ctx, a, gen_sh##SHAMT##add);                          \
+}
+
+GEN_TRANS_SHADD(1)
+GEN_TRANS_SHADD(2)
+GEN_TRANS_SHADD(3)
+
 static bool trans_clzw(DisasContext *ctx, arg_clzw *a)
 {
     REQUIRE_64BIT(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_gorciw(DisasContext *ctx, arg_gorciw *a)
     REQUIRE_EXT(ctx, RVB);
     return gen_shiftiw(ctx, a, gen_gorcw);
 }
+
+#define GEN_TRANS_SHADD_UW(SHAMT)                             \
+static bool trans_sh##SHAMT##add_uw(DisasContext *ctx,        \
+                                    arg_sh##SHAMT##add_uw *a) \
+{                                                             \
+    REQUIRE_64BIT(ctx);                                       \
+    REQUIRE_EXT(ctx, RVB);                                    \
+    return gen_arith(ctx, a, gen_sh##SHAMT##add_uw);          \
+}
+
+GEN_TRANS_SHADD_UW(1)
+GEN_TRANS_SHADD_UW(2)
+GEN_TRANS_SHADD_UW(3)
-- 
2.31.1

From: Kito Cheng <kito.cheng@sifive.com>

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210505160620.15723-16-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode              |  3 +++
 target/riscv/translate.c                |  6 ++++++
 target/riscv/insn_trans/trans_rvb.c.inc | 26 +++++++++++++++++++++++++
 3 files changed, 35 insertions(+)

From: Kito Cheng <kito.cheng@sifive.com>

B-extension is default off, use cpu rv32 or rv64 with x-b=true to
enable B-extension.

Signed-off-by: Kito Cheng <kito.cheng@sifive.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210505160620.15723-17-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 1 +
 target/riscv/cpu.c | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPU {
         bool ext_f;
         bool ext_d;
         bool ext_c;
+        bool ext_b;
         bool ext_s;
         bool ext_u;
         bool ext_h;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         if (cpu->cfg.ext_h) {
             target_misa |= RVH;
         }
+        if (cpu->cfg.ext_b) {
+            target_misa |= RVB;
+        }
         if (cpu->cfg.ext_v) {
             target_misa |= RVV;
             if (!is_power_of_2(cpu->cfg.vlen)) {
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("s", RISCVCPU, cfg.ext_s, true),
     DEFINE_PROP_BOOL("u", RISCVCPU, cfg.ext_u, true),
     /* This is experimental so mark with 'x-' */
+    DEFINE_PROP_BOOL("x-b", RISCVCPU, cfg.ext_b, false),
     DEFINE_PROP_BOOL("x-h", RISCVCPU, cfg.ext_h, false),
     DEFINE_PROP_BOOL("x-v", RISCVCPU, cfg.ext_v, false),
     DEFINE_PROP_BOOL("Counters", RISCVCPU, cfg.ext_counters, true),
-- 
2.31.1

From: Frank Chang <frank.chang@sifive.com>

Default b-ext version is v0.93.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210505160620.15723-18-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  3 +++
 target/riscv/cpu.c | 23 +++++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ enum {
 #define PRIV_VERSION_1_10_0 0x00011000
 #define PRIV_VERSION_1_11_0 0x00011100
 
+#define BEXT_VERSION_0_93_0 0x00009300
 #define VEXT_VERSION_0_07_1 0x00000701
 
 enum {
@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
     target_ulong guest_phys_fault_addr;
 
     target_ulong priv_ver;
+    target_ulong bext_ver;
     target_ulong vext_ver;
     target_ulong misa;
     target_ulong misa_mask;
@@ -XXX,XX +XXX,XX @@ struct RISCVCPU {
 
         char *priv_spec;
         char *user_spec;
+        char *bext_spec;
         char *vext_spec;
         uint16_t vlen;
         uint16_t elen;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void set_priv_version(CPURISCVState *env, int priv_ver)
     env->priv_ver = priv_ver;
 }
 
+static void set_bext_version(CPURISCVState *env, int bext_ver)
+{
+    env->bext_ver = bext_ver;
+}
+
 static void set_vext_version(CPURISCVState *env, int vext_ver)
 {
     env->vext_ver = vext_ver;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
     CPURISCVState *env = &cpu->env;
     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
     int priv_version = PRIV_VERSION_1_11_0;
+    int bext_version = BEXT_VERSION_0_93_0;
     int vext_version = VEXT_VERSION_0_07_1;
     target_ulong target_misa = env->misa;
     Error *local_err = NULL;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
     }
 
     set_priv_version(env, priv_version);
+    set_bext_version(env, bext_version);
     set_vext_version(env, vext_version);
 
     if (cpu->cfg.mmu) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         }
         if (cpu->cfg.ext_b) {
             target_misa |= RVB;
+
+            if (cpu->cfg.bext_spec) {
+                if (!g_strcmp0(cpu->cfg.bext_spec, "v0.93")) {
+                    bext_version = BEXT_VERSION_0_93_0;
+                } else {
+                    error_setg(errp,
+                           "Unsupported bitmanip spec version '%s'",
+                           cpu->cfg.bext_spec);
+                    return;
+                }
+            } else {
+                qemu_log("bitmanip version is not specified, "
+                         "use the default value v0.93\n");
+            }
+            set_bext_version(env, bext_version);
         }
         if (cpu->cfg.ext_v) {
             target_misa |= RVV;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
     DEFINE_PROP_STRING("priv_spec", RISCVCPU, cfg.priv_spec),
+    DEFINE_PROP_STRING("bext_spec", RISCVCPU, cfg.bext_spec),
     DEFINE_PROP_STRING("vext_spec", RISCVCPU, cfg.vext_spec),
     DEFINE_PROP_UINT16("vlen", RISCVCPU, cfg.vlen, 128),
     DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
-- 
2.31.1