Series comparison

-[PULL 00/16] riscv-to-apply queue
+[PULL v2 00/22] riscv-to-apply queue
-The following changes since commit c95bd5ff1660883d15ad6e0005e4c8571604f51a:
+From: Alistair Francis <alistair.francis@wdc.com>
-  Merge remote-tracking branch 'remotes/philmd/tags/mips-fixes-20210322' into staging (2021-03-22 14:26:13 +0000)
+The following changes since commit 99d6b11b5b44d7dd64f4cb1973184e40a4a174f8:
   Merge tag 'pull-target-arm-20220922' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2022-09-26 13:38:26 -0400)
 are available in the Git repository at:
-  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210322-2
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20220927
-for you to fetch changes up to 9a27f69bd668d9d71674407badc412ce1231c7d5:
+for you to fetch changes up to a3ab69f9f6c000481c439923d16416b8941d5b37:
-  target/riscv: Prevent lost illegal instruction exceptions (2021-03-22 21:54:40 -0400)
+  target/riscv: rvv-1.0: vf[w]redsum distinguish between ordered/unordered (2022-09-27 11:23:57 +1000)
 ----------------------------------------------------------------
-RISC-V PR for 6.0
+Second RISC-V PR for QEMU 7.2
-This PR includes:
+* Fixup typos and register addresses for Ibex SPI
- - Fix for vector CSR access
+* Cleanup the RISC-V virt machine documentation
- - Improvements to the Ibex UART device
+* Remove the sideleg and sedeleg CSR macros
- - PMP improvements and bug fixes
+* Fix the CSR check for cycle{h}, instret{h}, time{h}, hpmcounter3-31{h}
- - Hypervisor extension bug fixes
+* Remove fixed numbering from GDB xml feature files
- - ramfb support for the virt machine
+* Allow setting the resetvec for the OpenTitan machine
- - Fast read support for SST flash
+* Check the correct exception cause in vector GDB stub
- - Improvements to the microchip_pfsoc machine
+* Fix inheritance of SiFiveEState
 * Improvements to the RISC-V debugger spec
 * Simplify some vector code
 ----------------------------------------------------------------
-Alexander Wagner (1):
+Alex Bennée (1):
-      hw/char: disable ibex uart receive if the buffer is full
+      docs/system: clean up code escape for riscv virt platform
-Asherah Connor (2):
+Alistair Francis (3):
-      hw/riscv: Add fw_cfg support to virt
+      target/riscv: Set the CPU resetvec directly
-      hw/riscv: allow ramfb on virt
+      hw/riscv: opentitan: Fixup resetvec
       hw/riscv: opentitan: Expose the resetvec as a SoC property
-Bin Meng (3):
+Andrew Burgess (2):
-      hw/block: m25p80: Support fast read for SST flashes
+      target/riscv: remove fflags, frm, and fcsr from riscv-*-fpu.xml
-      hw/riscv: microchip_pfsoc: Map EMMC/SD mux register
+      target/riscv: remove fixed numbering from GDB xml feature files
       docs/system: riscv: Add documentation for 'microchip-icicle-kit' machine
-Frank Chang (1):
+Bernhard Beschow (1):
-      target/riscv: fix vs() to return proper error code
+      hw/riscv/sifive_e: Fix inheritance of SiFiveEState
-Georg Kotheimer (6):
+Frank Chang (9):
-      target/riscv: Adjust privilege level for HLV(X)/HSV instructions
+      target/riscv: Check the correct exception cause in vector GDB stub
-      target/riscv: Make VSTIP and VSEIP read-only in hip
+      target/riscv: debug: Determine the trigger type from tdata1.type
-      target/riscv: Use background registers also for MSTATUS_MPV
+      target/riscv: debug: Introduce build_tdata1() to build tdata1 register content
-      target/riscv: Fix read and write accesses to vsip and vsie
+      target/riscv: debug: Introduce tdata1, tdata2, and tdata3 CSRs
-      target/riscv: Add proper two-stage lookup exception detection
+      target/riscv: debug: Restrict the range of tselect value can be written
-      target/riscv: Prevent lost illegal instruction exceptions
+      target/riscv: debug: Introduce tinfo CSR
       target/riscv: debug: Create common trigger actions function
       target/riscv: debug: Check VU/VS modes for type 2 trigger
       target/riscv: debug: Add initial support of type 6 trigger
-Jim Shu (3):
+Rahul Pathak (1):
-      target/riscv: propagate PMP permission to TLB page
+      target/riscv: Remove sideleg and sedeleg
       target/riscv: add log of PMP permission checking
       target/riscv: flush TLB pages if PMP permission has been changed
- docs/system/riscv/microchip-icicle-kit.rst |  89 ++++++++++++++
+Weiwei Li (1):
- docs/system/target-riscv.rst               |   1 +
+      target/riscv: fix csr check for cycle{h}, instret{h}, time{h}, hpmcounter3-31{h}
  include/hw/char/ibex_uart.h                |   4 +
  include/hw/riscv/microchip_pfsoc.h         |   1 +
  include/hw/riscv/virt.h                    |   2 +
  target/riscv/cpu.h                         |   4 +
  target/riscv/pmp.h                         |   4 +-
  hw/block/m25p80.c                          |   3 +
  hw/char/ibex_uart.c                        |  23 +++-
  hw/riscv/microchip_pfsoc.c                 |   6 +
  hw/riscv/virt.c                            |  33 ++++++
  target/riscv/cpu.c                         |   1 +
  target/riscv/cpu_helper.c                  | 144 +++++++++++++++--------
  target/riscv/csr.c                         |  77 +++++++------
  target/riscv/pmp.c                         |  84 ++++++++++----
  target/riscv/translate.c                   | 179 +----------------------------
  hw/riscv/Kconfig                           |   1 +
 files changed, 367 insertions(+), 289 deletions(-)
  create mode 100644 docs/system/riscv/microchip-icicle-kit.rst
+Wilfred Mallawa (2):
+      hw/ssi: ibex_spi: fixup typos in ibex_spi_host
+      hw/ssi: ibex_spi: update reg addr
+Yang Liu (2):
+      target/riscv: rvv-1.0: Simplify vfwredsum code
+      target/riscv: rvv-1.0: vf[w]redsum distinguish between ordered/unordered
+ docs/system/riscv/virt.rst              |  13 +-
+ include/hw/riscv/opentitan.h            |   2 +
+ include/hw/riscv/sifive_e.h             |   3 +-
+ target/riscv/cpu.h                      |   9 +-
+ target/riscv/cpu_bits.h                 |   3 +-
+ target/riscv/debug.h                    |  55 ++--
+ target/riscv/helper.h                   |  15 +-
+ target/riscv/insn32.decode              |   6 +-
+ disas/riscv.c                           |   2 -
+ hw/riscv/opentitan.c                    |   8 +-
+ hw/ssi/ibex_spi_host.c                  |   8 +-
+ target/riscv/cpu.c                      |  13 +-
+ target/riscv/csr.c                      |  23 +-
+ target/riscv/debug.c                    | 484 +++++++++++++++++++++++++-------
+ target/riscv/gdbstub.c                  |  36 +--
+ target/riscv/machine.c                  |  26 +-
+ target/riscv/vector_helper.c            |  69 ++---
+ target/riscv/insn_trans/trans_rvv.c.inc |   6 +-
+ gdb-xml/riscv-32bit-cpu.xml             |   6 +-
+ gdb-xml/riscv-32bit-fpu.xml             |  10 +-
+ gdb-xml/riscv-64bit-cpu.xml             |   6 +-
+ gdb-xml/riscv-64bit-fpu.xml             |  10 +-
+files changed, 531 insertions(+), 282 deletions(-)

-New patch
+[PULL v2 01/22] hw/ssi: ibex_spi: fixup typos in ibex_spi_host
+From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+This patch fixes up minor typos in ibex_spi_host
+Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-Id: <20220823061201.132342-2-wilfred.mallawa@opensource.wdc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/ssi/ibex_spi_host.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/hw/ssi/ibex_spi_host.c b/hw/ssi/ibex_spi_host.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ssi/ibex_spi_host.c
++++ b/hw/ssi/ibex_spi_host.c
+@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_irq(IbexSPIHostState *s)
+                         & R_INTR_STATE_SPI_EVENT_MASK;
+     int err_irq = 0, event_irq = 0;
+-    /* Error IRQ enabled and Error IRQ Cleared*/
++    /* Error IRQ enabled and Error IRQ Cleared */
+     if (error_en && !err_pending) {
+         /* Event enabled, Interrupt Test Error */
+         if (s->regs[IBEX_SPI_HOST_INTR_TEST] & R_INTR_TEST_ERROR_MASK) {
+@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_write(void *opaque, hwaddr addr,
+     case IBEX_SPI_HOST_TXDATA:
+         /*
+          * This is a hardware `feature` where
+-         * the first word written TXDATA after init is omitted entirely
++         * the first word written to TXDATA after init is omitted entirely
+          */
+         if (s->init_status) {
+             s->init_status = false;
+@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_write(void *opaque, hwaddr addr,
+         break;
+     case IBEX_SPI_HOST_ERROR_STATUS:
+     /*
+-     *  Indicates that any errors that have occurred.
++     *  Indicates any errors that have occurred.
+      *  When an error occurs, the corresponding bit must be cleared
+      *  here before issuing any further commands
+      */
+--
+.37.3

-New patch
+[PULL v2 02/22] hw/ssi: ibex_spi: update reg addr
+From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Updates the `EVENT_ENABLE` register to offset `0x34` as per
+OpenTitan spec [1].
+[1] https://docs.opentitan.org/hw/ip/spi_host/doc/#Reg_event_enable
+Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20220823061201.132342-5-wilfred.mallawa@opensource.wdc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/ssi/ibex_spi_host.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/ssi/ibex_spi_host.c b/hw/ssi/ibex_spi_host.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ssi/ibex_spi_host.c
++++ b/hw/ssi/ibex_spi_host.c
+@@ -XXX,XX +XXX,XX @@ REG32(ERROR_STATUS, 0x30)
+     FIELD(ERROR_STATUS, CMDINVAL, 3, 1)
+     FIELD(ERROR_STATUS, CSIDINVAL, 4, 1)
+     FIELD(ERROR_STATUS, ACCESSINVAL, 5, 1)
+-REG32(EVENT_ENABLE, 0x30)
++REG32(EVENT_ENABLE, 0x34)
+     FIELD(EVENT_ENABLE, RXFULL, 0, 1)
+     FIELD(EVENT_ENABLE, TXEMPTY, 1, 1)
+     FIELD(EVENT_ENABLE, RXWM, 2, 1)
+--
+.37.3

-[PULL 15/16] docs/system: riscv: Add documentation for 'microchip-icicle-kit' machine
+[PULL v2 03/22] docs/system: clean up code escape for riscv virt platform
-From: Bin Meng <bin.meng@windriver.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-This adds the documentation to describe what is supported for the
+The example code is rendered slightly mangled due to missing code
-'microchip-icicle-kit' machine, and how to boot the machine in QEMU.
+block. Properly escape the code block and add shell prompt and qemu to
 fit in with the other examples on the page.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210322075248.136255-2-bmeng.cn@gmail.com
+Message-Id: <20220905163939.1599368-1-alex.bennee@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- docs/system/riscv/microchip-icicle-kit.rst | 89 ++++++++++++++++++++++
+ docs/system/riscv/virt.rst | 13 +++++++++----
- docs/system/target-riscv.rst               |  1 +
+file changed, 9 insertions(+), 4 deletions(-)
 files changed, 90 insertions(+)
  create mode 100644 docs/system/riscv/microchip-icicle-kit.rst
-diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
+diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/docs/system/riscv/virt.rst
---- /dev/null
++++ b/docs/system/riscv/virt.rst
-+++ b/docs/system/riscv/microchip-icicle-kit.rst
+@@ -XXX,XX +XXX,XX @@ Enabling TPM
-@@ -XXX,XX +XXX,XX @@
-+Microchip PolarFire SoC Icicle Kit (``microchip-icicle-kit``)
+ A TPM device can be connected to the virt board by following the steps below.
-+=============================================================
 -First launch the TPM emulator
 +First launch the TPM emulator:
 -    swtpm socket --tpm2 -t -d --tpmstate dir=/tmp/tpm \
 +.. code-block:: bash
 +
-+Microchip PolarFire SoC Icicle Kit integrates a PolarFire SoC, with one
++  $ swtpm socket --tpm2 -t -d --tpmstate dir=/tmp/tpm \
-+SiFive's E51 plus four U54 cores and many on-chip peripherals and an FPGA.
+         --ctrl type=unixio,path=swtpm-sock
-+
-+For more details about Microchip PolarFire SoC, please see:
+-Then launch QEMU with:
-+https://www.microsemi.com/product-directory/soc-fpgas/5498-polarfire-soc-fpga
++Then launch QEMU with some additional arguments to link a TPM device to the backend:
 +
 +The Icicle Kit board information can be found here:
 +https://www.microsemi.com/existing-parts/parts/152514
 +
 +Supported devices
 +-----------------
 +
 +The ``microchip-icicle-kit`` machine supports the following devices:
 +
 + * 1 E51 core
 + * 4 U54 cores
 + * Core Level Interruptor (CLINT)
 + * Platform-Level Interrupt Controller (PLIC)
 + * L2 Loosely Integrated Memory (L2-LIM)
 + * DDR memory controller
 + * 5 MMUARTs
 + * 1 DMA controller
 + * 2 GEM Ethernet controllers
 + * 1 SDHC storage controller
 +
 +Boot options
 +------------
 +
 +The ``microchip-icicle-kit`` machine can start using the standard -bios
 +functionality for loading its BIOS image, aka Hart Software Services (HSS_).
 +HSS loads the second stage bootloader U-Boot from an SD card. It does not
 +support direct kernel loading via the -kernel option. One has to load kernel
 +from U-Boot.
 +
 +The memory is set to 1537 MiB by default which is the minimum required high
 +memory size by HSS. A sanity check on ram size is performed in the machine
 +init routine to prompt user to increase the RAM size to > 1537 MiB when less
 +than 1537 MiB ram is detected.
 +
 +Boot the machine
 +----------------
 +
 +HSS 2020.12 release is tested at the time of writing. To build an HSS image
 +that can be booted by the ``microchip-icicle-kit`` machine, type the following
 +in the HSS source tree:
 +
 +.. code-block:: bash
-+
-+  $ export CROSS_COMPILE=riscv64-linux-
+-    ...
-+  $ cp boards/mpfs-icicle-kit-es/def_config .config
++  $ qemu-system-riscv64 \
-+  $ make BOARD=mpfs-icicle-kit-es
++    ... other args .... \
-+
+     -chardev socket,id=chrtpm,path=swtpm-sock \
-+Download the official SD card image released by Microchip and prepare it for
+     -tpmdev emulator,id=tpm0,chardev=chrtpm \
-+QEMU usage:
+     -device tpm-tis-device,tpmdev=tpm0
 +
 +.. code-block:: bash
 +
 +  $ wget ftp://ftpsoc.microsemi.com/outgoing/core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
 +  $ gunzip core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
 +  $ qemu-img resize core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic 4G
 +
 +Then we can boot the machine by:
 +
 +.. code-block:: bash
 +
 +  $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 \
 +      -bios path/to/hss.bin -sd path/to/sdcard.img \
 +      -nic user,model=cadence_gem \
 +      -nic tap,ifname=tap,model=cadence_gem,script=no \
 +      -display none -serial stdio \
 +      -chardev socket,id=serial1,path=serial1.sock,server=on,wait=on \
 +      -serial chardev:serial1
 +
 +With above command line, current terminal session will be used for the first
 +serial port. Open another terminal window, and use `minicom` to connect the
 +second serial port.
 +
 +.. code-block:: bash
 +
 +  $ minicom -D unix\#serial1.sock
 +
 +HSS output is on the first serial port (stdio) and U-Boot outputs on the
 +second serial port. U-Boot will automatically load the Linux kernel from
 +the SD card image.
 +
 +.. _HSS: https://github.com/polarfire-soc/hart-software-services
 diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/target-riscv.rst
 +++ b/docs/system/target-riscv.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
  .. toctree::
     :maxdepth: 1
 +   riscv/microchip-icicle-kit
     riscv/sifive_u
  RISC-V CPU features
 --
-.30.1
+.37.3

-New patch
+[PULL v2 04/22] target/riscv: Remove sideleg and sedeleg
+From: Rahul Pathak <rpathak@ventanamicro.com>
+sideleg and sedeleg csrs are not part of riscv isa spec
+anymore, these csrs were part of N extension which
+is removed from the riscv isa specification.
+These commits removed all traces of these csrs from
+riscv spec (https://github.com/riscv/riscv-isa-manual) -
+commit f8d27f805b65 ("Remove or downgrade more references to N extension (#674)")
+commit b6cade07034d ("Remove N extension chapter for now")
+Signed-off-by: Rahul Pathak <rpathak@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20220824145255.400040-1-rpathak@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_bits.h | 2 --
+ disas/riscv.c           | 2 --
+files changed, 4 deletions(-)
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@
+ /* Supervisor Trap Setup */
+ #define CSR_SSTATUS         0x100
+-#define CSR_SEDELEG         0x102
+-#define CSR_SIDELEG         0x103
+ #define CSR_SIE             0x104
+ #define CSR_STVEC           0x105
+ #define CSR_SCOUNTEREN      0x106
+diff --git a/disas/riscv.c b/disas/riscv.c
+index XXXXXXX..XXXXXXX 100644
+--- a/disas/riscv.c
++++ b/disas/riscv.c
+@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
+     case 0x0043: return "utval";
+     case 0x0044: return "uip";
+     case 0x0100: return "sstatus";
+-    case 0x0102: return "sedeleg";
+-    case 0x0103: return "sideleg";
+     case 0x0104: return "sie";
+     case 0x0105: return "stvec";
+     case 0x0106: return "scounteren";
+--
+.37.3

-[PULL 07/16] target/riscv: Make VSTIP and VSEIP read-only in hip
+[PULL v2 05/22] target/riscv: fix csr check for cycle{h}, instret{h}, time{h}, hpmcounter3-31{h}
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+- modify check for mcounteren to work in all less-privilege mode
 - modify check for scounteren to work only when S mode is enabled
 - distinguish the exception type raised by check for scounteren between U
 and VU mode
 Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210311094902.1377593-1-georg.kotheimer@kernkonzept.com
+Message-Id: <20220817083756.12471-1-liweiwei@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 7 ++++---
+ target/riscv/csr.c | 13 +++++++++----
-file changed, 4 insertions(+), 3 deletions(-)
+file changed, 9 insertions(+), 4 deletions(-)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
+@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
-     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
-     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_SD;
+ skip_ext_pmu_check:
- static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
--static const target_ulong hip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
+-    if (((env->priv == PRV_S) && (!get_field(env->mcounteren, ctr_mask))) ||
-+static const target_ulong hip_writable_mask = MIP_VSSIP;
+-        ((env->priv == PRV_U) && (!get_field(env->scounteren, ctr_mask)))) {
-+static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
++    if (env->priv < PRV_M && !get_field(env->mcounteren, ctr_mask)) {
- static const target_ulong vsip_writable_mask = MIP_VSSIP;
+         return RISCV_EXCP_ILLEGAL_INST;
+     }
- static const char valid_vm_1_10_32[16] = {
-@@ -XXX,XX +XXX,XX @@ static int rmw_hvip(CPURISCVState *env, int csrno, target_ulong *ret_value,
+     if (riscv_cpu_virt_enabled(env)) {
-                    target_ulong new_value, target_ulong write_mask)
+-        if (!get_field(env->hcounteren, ctr_mask) &&
- {
+-            get_field(env->mcounteren, ctr_mask)) {
-     int ret = rmw_mip(env, 0, ret_value, new_value,
++        if (!get_field(env->hcounteren, ctr_mask) ||
--                      write_mask & hip_writable_mask);
++            (env->priv == PRV_U && !get_field(env->scounteren, ctr_mask))) {
-+                      write_mask & hvip_writable_mask);
+             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+         }
--    *ret_value &= hip_writable_mask;
+     }
-+    *ret_value &= hvip_writable_mask;
++
++    if (riscv_has_ext(env, RVS) && env->priv == PRV_U &&
-     return ret;
++        !get_field(env->scounteren, ctr_mask)) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
  #endif
      return RISCV_EXCP_NONE;
  }
 --
-.30.1
+.37.3

-New patch
+[PULL v2 06/22] target/riscv: remove fflags, frm, and fcsr from riscv-*-fpu.xml
+From: Andrew Burgess <aburgess@redhat.com>
+While testing some changes to GDB's handling for the RISC-V registers
+fcsr, fflags, and frm, I spotted that QEMU includes these registers
+twice in the target description it sends to GDB, once in the fpu
+feature, and once in the csr feature.
+Right now things basically work OK, QEMU maps these registers onto two
+different register numbers, e.g. fcsr maps to both 68 and 73, and GDB
+can use either of these to access the register.
+However, GDB's target descriptions don't really work this way, each
+register should appear just once in a target description, mapping the
+register name onto the number GDB should use when accessing the
+register on the target.  Duplicate register names actually result in
+duplicate registers on the GDB side, however, as the registers have
+the same name, the user can only access one of these registers.
+Currently GDB has a hack in place, specifically for RISC-V, to spot
+the duplicate copies of these three registers, and hide them from the
+user, ensuring the user only ever sees a single copy of each.
+In this commit I propose fixing this issue on the QEMU side, and in
+the process, simplify the fpu register handling a little.
+I think we should, remove fflags, frm, and fcsr from the two (32-bit
+and 64-bit) fpu feature xml files.  These files will only contain the
+core floating point register f0 to f31.  The fflags, frm, and fcsr
+registers will continue to be advertised in the csr feature as they
+currently are.
+With that change made, I will simplify riscv_gdb_get_fpu and
+riscv_gdb_set_fpu, removing the extra handling for the 3 status
+registers.
+Signed-off-by: Andrew Burgess <aburgess@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <0fbf2a5b12e3210ff3867d5cf7022b3f3462c9c8.1661934573.git.aburgess@redhat.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/gdbstub.c      | 32 ++------------------------------
+ gdb-xml/riscv-32bit-fpu.xml |  4 ----
+ gdb-xml/riscv-64bit-fpu.xml |  4 ----
+files changed, 2 insertions(+), 38 deletions(-)
+diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/gdbstub.c
++++ b/target/riscv/gdbstub.c
+@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_get_fpu(CPURISCVState *env, GByteArray *buf, int n)
+         if (env->misa_ext & RVF) {
+             return gdb_get_reg32(buf, env->fpr[n]);
+         }
+-    /* there is hole between ft11 and fflags in fpu.xml */
+-    } else if (n < 36 && n > 32) {
+-        target_ulong val = 0;
+-        int result;
+-        /*
+-         * CSR_FFLAGS is at index 1 in csr_register, and gdb says it is FP
+-         * register 33, so we recalculate the map index.
+-         * This also works for CSR_FRM and CSR_FCSR.
+-         */
+-        result = riscv_csrrw_debug(env, n - 32, &val,
+-                                   0, 0);
+-        if (result == RISCV_EXCP_NONE) {
+-            return gdb_get_regl(buf, val);
+-        }
+     }
+     return 0;
+ }
+@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_set_fpu(CPURISCVState *env, uint8_t *mem_buf, int n)
+     if (n < 32) {
+         env->fpr[n] = ldq_p(mem_buf); /* always 64-bit */
+         return sizeof(uint64_t);
+-    /* there is hole between ft11 and fflags in fpu.xml */
+-    } else if (n < 36 && n > 32) {
+-        target_ulong val = ldtul_p(mem_buf);
+-        int result;
+-        /*
+-         * CSR_FFLAGS is at index 1 in csr_register, and gdb says it is FP
+-         * register 33, so we recalculate the map index.
+-         * This also works for CSR_FRM and CSR_FCSR.
+-         */
+-        result = riscv_csrrw_debug(env, n - 32, NULL,
+-                                   val, -1);
+-        if (result == RISCV_EXCP_NONE) {
+-            return sizeof(target_ulong);
+-        }
+     }
+     return 0;
+ }
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
+     CPURISCVState *env = &cpu->env;
+     if (env->misa_ext & RVD) {
+         gdb_register_coprocessor(cs, riscv_gdb_get_fpu, riscv_gdb_set_fpu,
+-                                 36, "riscv-64bit-fpu.xml", 0);
++                                 32, "riscv-64bit-fpu.xml", 0);
+     } else if (env->misa_ext & RVF) {
+         gdb_register_coprocessor(cs, riscv_gdb_get_fpu, riscv_gdb_set_fpu,
+-                                 36, "riscv-32bit-fpu.xml", 0);
++                                 32, "riscv-32bit-fpu.xml", 0);
+     }
+     if (env->misa_ext & RVV) {
+         gdb_register_coprocessor(cs, riscv_gdb_get_vector, riscv_gdb_set_vector,
+diff --git a/gdb-xml/riscv-32bit-fpu.xml b/gdb-xml/riscv-32bit-fpu.xml
+index XXXXXXX..XXXXXXX 100644
+--- a/gdb-xml/riscv-32bit-fpu.xml
++++ b/gdb-xml/riscv-32bit-fpu.xml
+@@ -XXX,XX +XXX,XX @@
+   <reg name="ft9" bitsize="32" type="ieee_single"/>
+   <reg name="ft10" bitsize="32" type="ieee_single"/>
+   <reg name="ft11" bitsize="32" type="ieee_single"/>
+-
+-  <reg name="fflags" bitsize="32" type="int" regnum="66"/>
+-  <reg name="frm" bitsize="32" type="int" regnum="67"/>
+-  <reg name="fcsr" bitsize="32" type="int" regnum="68"/>
+ </feature>
+diff --git a/gdb-xml/riscv-64bit-fpu.xml b/gdb-xml/riscv-64bit-fpu.xml
+index XXXXXXX..XXXXXXX 100644
+--- a/gdb-xml/riscv-64bit-fpu.xml
++++ b/gdb-xml/riscv-64bit-fpu.xml
+@@ -XXX,XX +XXX,XX @@
+   <reg name="ft9" bitsize="64" type="riscv_double"/>
+   <reg name="ft10" bitsize="64" type="riscv_double"/>
+   <reg name="ft11" bitsize="64" type="riscv_double"/>
+-
+-  <reg name="fflags" bitsize="32" type="int" regnum="66"/>
+-  <reg name="frm" bitsize="32" type="int" regnum="67"/>
+-  <reg name="fcsr" bitsize="32" type="int" regnum="68"/>
+ </feature>
+--
+.37.3

-New patch
+[PULL v2 07/22] target/riscv: remove fixed numbering from GDB xml feature files
+From: Andrew Burgess <aburgess@redhat.com>
+The fixed register numbering in the various GDB feature files for
+RISC-V only exists because these files were originally copied from the
+GDB source tree.
+However, the fixed numbering only exists in the GDB source tree so
+that GDB, when it connects to a target that doesn't provide a target
+description, will use a specific numbering scheme.
+That numbering scheme is designed to be compatible with the first
+versions of QEMU (for RISC-V), that didn't send a target description,
+and relied on a fixed numbering scheme.
+Because of the way that QEMU manages its target descriptions,
+recording the number of registers in each feature, and just relying on
+GDB's numbering starting from 0, then I propose that we remove all the
+fixed numbering from the RISC-V feature xml files, and just rely on
+the standard numbering scheme.  Plenty of other targets manage their
+xml files this way, e.g. ARM, AArch64, Loongarch, m68k, rx, and s390.
+Signed-off-by: Andrew Burgess <aburgess@redhat.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com>
+Message-Id: <6069395f90e6fc24dac92197be815fedf42f5974.1661934573.git.aburgess@redhat.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ gdb-xml/riscv-32bit-cpu.xml | 6 +-----
+ gdb-xml/riscv-32bit-fpu.xml | 6 +-----
+ gdb-xml/riscv-64bit-cpu.xml | 6 +-----
+ gdb-xml/riscv-64bit-fpu.xml | 6 +-----
+files changed, 4 insertions(+), 20 deletions(-)
+diff --git a/gdb-xml/riscv-32bit-cpu.xml b/gdb-xml/riscv-32bit-cpu.xml
+index XXXXXXX..XXXXXXX 100644
+--- a/gdb-xml/riscv-32bit-cpu.xml
++++ b/gdb-xml/riscv-32bit-cpu.xml
+@@ -XXX,XX +XXX,XX @@
+      are permitted in any medium without royalty provided the copyright
+      notice and this notice are preserved.  -->
+-<!-- Register numbers are hard-coded in order to maintain backward
+-     compatibility with older versions of tools that didn't use xml
+-     register descriptions.  -->
+-
+ <!DOCTYPE feature SYSTEM "gdb-target.dtd">
+ <feature name="org.gnu.gdb.riscv.cpu">
+-  <reg name="zero" bitsize="32" type="int" regnum="0"/>
++  <reg name="zero" bitsize="32" type="int"/>
+   <reg name="ra" bitsize="32" type="code_ptr"/>
+   <reg name="sp" bitsize="32" type="data_ptr"/>
+   <reg name="gp" bitsize="32" type="data_ptr"/>
+diff --git a/gdb-xml/riscv-32bit-fpu.xml b/gdb-xml/riscv-32bit-fpu.xml
+index XXXXXXX..XXXXXXX 100644
+--- a/gdb-xml/riscv-32bit-fpu.xml
++++ b/gdb-xml/riscv-32bit-fpu.xml
+@@ -XXX,XX +XXX,XX @@
+      are permitted in any medium without royalty provided the copyright
+      notice and this notice are preserved.  -->
+-<!-- Register numbers are hard-coded in order to maintain backward
+-     compatibility with older versions of tools that didn't use xml
+-     register descriptions.  -->
+-
+ <!DOCTYPE feature SYSTEM "gdb-target.dtd">
+ <feature name="org.gnu.gdb.riscv.fpu">
+-  <reg name="ft0" bitsize="32" type="ieee_single" regnum="33"/>
++  <reg name="ft0" bitsize="32" type="ieee_single"/>
+   <reg name="ft1" bitsize="32" type="ieee_single"/>
+   <reg name="ft2" bitsize="32" type="ieee_single"/>
+   <reg name="ft3" bitsize="32" type="ieee_single"/>
+diff --git a/gdb-xml/riscv-64bit-cpu.xml b/gdb-xml/riscv-64bit-cpu.xml
+index XXXXXXX..XXXXXXX 100644
+--- a/gdb-xml/riscv-64bit-cpu.xml
++++ b/gdb-xml/riscv-64bit-cpu.xml
+@@ -XXX,XX +XXX,XX @@
+      are permitted in any medium without royalty provided the copyright
+      notice and this notice are preserved.  -->
+-<!-- Register numbers are hard-coded in order to maintain backward
+-     compatibility with older versions of tools that didn't use xml
+-     register descriptions.  -->
+-
+ <!DOCTYPE feature SYSTEM "gdb-target.dtd">
+ <feature name="org.gnu.gdb.riscv.cpu">
+-  <reg name="zero" bitsize="64" type="int" regnum="0"/>
++  <reg name="zero" bitsize="64" type="int"/>
+   <reg name="ra" bitsize="64" type="code_ptr"/>
+   <reg name="sp" bitsize="64" type="data_ptr"/>
+   <reg name="gp" bitsize="64" type="data_ptr"/>
+diff --git a/gdb-xml/riscv-64bit-fpu.xml b/gdb-xml/riscv-64bit-fpu.xml
+index XXXXXXX..XXXXXXX 100644
+--- a/gdb-xml/riscv-64bit-fpu.xml
++++ b/gdb-xml/riscv-64bit-fpu.xml
+@@ -XXX,XX +XXX,XX @@
+      are permitted in any medium without royalty provided the copyright
+      notice and this notice are preserved.  -->
+-<!-- Register numbers are hard-coded in order to maintain backward
+-     compatibility with older versions of tools that didn't use xml
+-     register descriptions.  -->
+-
+ <!DOCTYPE feature SYSTEM "gdb-target.dtd">
+ <feature name="org.gnu.gdb.riscv.fpu">
+@@ -XXX,XX +XXX,XX @@
+     <field name="double" type="ieee_double"/>
+   </union>
+-  <reg name="ft0" bitsize="64" type="riscv_double" regnum="33"/>
++  <reg name="ft0" bitsize="64" type="riscv_double"/>
+   <reg name="ft1" bitsize="64" type="riscv_double"/>
+   <reg name="ft2" bitsize="64" type="riscv_double"/>
+   <reg name="ft3" bitsize="64" type="riscv_double"/>
+--
+.37.3

-[PULL 12/16] target/riscv: Add proper two-stage lookup exception detection
+[PULL v2 08/22] target/riscv: Set the CPU resetvec directly
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Alistair Francis <alistair.francis@wdc.com>
-The current two-stage lookup detection in riscv_cpu_do_interrupt falls
+Instead of using our properties to set a config value which then might
-short of its purpose, as all it checks is whether two-stage address
+be used to set the resetvec (depending on your timing), let's instead
-translation either via the hypervisor-load store instructions or the
+just set the resetvec directly in the env struct.
 MPRV feature would be allowed.
-What we really need instead is whether two-stage address translation was
+This allows us to set the reset vec from the command line with:
-active when the exception was raised. However, in riscv_cpu_do_interrupt
+    -global driver=riscv.hart_array,property=resetvec,value=0x20000400
 we do not have the information to reliably detect this. Therefore, when
 we raise a memory fault exception we have to record whether two-stage
 address translation is active.
-Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20210319141459.1196741-1-georg.kotheimer@kernkonzept.com
+Message-Id: <20220914101108.82571-2-alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        |  4 ++++
+ target/riscv/cpu.h     |  3 +--
- target/riscv/cpu.c        |  1 +
+ target/riscv/cpu.c     | 13 +++----------
- target/riscv/cpu_helper.c | 21 ++++++++-------------
+ target/riscv/machine.c |  6 +++---
-files changed, 13 insertions(+), 13 deletions(-)
+files changed, 7 insertions(+), 15 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
+@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
-     target_ulong satp_hs;
+     /* This contains QEMU specific information about the virt state. */
-     uint64_t mstatus_hs;
+     target_ulong virt;
+     target_ulong geilen;
-+    /* Signals whether the current exception occurred with two-stage address
+-    target_ulong resetvec;
-+       translation active. */
++    uint64_t resetvec;
-+    bool two_stage_lookup;
-+
+     target_ulong mhartid;
-     target_ulong scounteren;
+     /*
-     target_ulong mcounteren;
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool pmp;
      bool epmp;
      bool debug;
 -    uint64_t resetvec;
      bool short_isa_string;
  };
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ static void set_vext_version(CPURISCVState *env, int vext_ver)
-     env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
+     env->vext_ver = vext_ver;
-     env->mcause = 0;
+ }
-     env->pc = env->resetvec;
-+    env->two_stage_lookup = false;
+-static void set_resetvec(CPURISCVState *env, target_ulong resetvec)
 -{
 -#ifndef CONFIG_USER_ONLY
 -    env->resetvec = resetvec;
 -#endif
 -}
 -
  static void riscv_any_cpu_init(Object *obj)
  {
      CPURISCVState *env = &RISCV_CPU(obj)->env;
@@ -XXX,XX +XXX,XX @@ static void rv32_imafcu_nommu_cpu_init(Object *obj)
      set_misa(env, MXL_RV32, RVI | RVM | RVA | RVF | RVC | RVU);
      set_priv_version(env, PRIV_VERSION_1_10_0);
 -    set_resetvec(env, DEFAULT_RSTVEC);
      cpu->cfg.mmu = false;
  }
  #endif
-     cs->exception_index = EXCP_NONE;
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-     env->load_res = -1;
+         riscv_set_feature(env, RISCV_FEATURE_DEBUG);
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+     }
 -    set_resetvec(env, cpu->cfg.resetvec);
  #ifndef CONFIG_USER_ONLY
      if (cpu->cfg.ext_sstc) {
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
      DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
      DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
 -    DEFINE_PROP_UINT64("resetvec", RISCVCPU, cfg.resetvec, DEFAULT_RSTVEC),
 +#ifndef CONFIG_USER_ONLY
 +    DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
 +#endif
      DEFINE_PROP_BOOL("short-isa-string", RISCVCPU, cfg.short_isa_string, false),
 diff --git a/target/riscv/machine.c b/target/riscv/machine.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/machine.c
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/machine.c
-@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pmu_ctr_state = {
-         g_assert_not_reached();
-     }
+ const VMStateDescription vmstate_riscv_cpu = {
-     env->badaddr = address;
+     .name = "cpu",
-+    env->two_stage_lookup = two_stage;
+-    .version_id = 4,
- }
+-    .minimum_version_id = 4,
++    .version_id = 5,
- hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
++    .minimum_version_id = 5,
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
+     .post_load = riscv_cpu_post_load,
-     }
+     .fields = (VMStateField[]) {
+         VMSTATE_UINTTL_ARRAY(env.gpr, RISCVCPU, 32),
-     env->badaddr = addr;
+@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
-+    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
+         VMSTATE_UINT32(env.features, RISCVCPU),
-+                            riscv_cpu_two_stage_lookup(mmu_idx);
+         VMSTATE_UINTTL(env.priv, RISCVCPU),
-     riscv_raise_exception(&cpu->env, cs->exception_index, retaddr);
+         VMSTATE_UINTTL(env.virt, RISCVCPU),
- }
+-        VMSTATE_UINTTL(env.resetvec, RISCVCPU),
++        VMSTATE_UINT64(env.resetvec, RISCVCPU),
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
+         VMSTATE_UINTTL(env.mhartid, RISCVCPU),
-         g_assert_not_reached();
+         VMSTATE_UINT64(env.mstatus, RISCVCPU),
-     }
+         VMSTATE_UINT64(env.mip, RISCVCPU),
      env->badaddr = addr;
 +    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
 +                            riscv_cpu_two_stage_lookup(mmu_idx);
      riscv_raise_exception(env, cs->exception_index, retaddr);
  }
  #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
          /* handle the trap in S-mode */
          if (riscv_has_ext(env, RVH)) {
              target_ulong hdeleg = async ? env->hideleg : env->hedeleg;
 -            bool two_stage_lookup = false;
 -            if (env->priv == PRV_M ||
 -                (env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
 -                (env->priv == PRV_U && !riscv_cpu_virt_enabled(env) &&
 -                    get_field(env->hstatus, HSTATUS_HU))) {
 -                    two_stage_lookup = true;
 -            }
 -
 -            if ((riscv_cpu_virt_enabled(env) || two_stage_lookup) && write_tval) {
 +            if (env->two_stage_lookup && write_tval) {
                  /*
                   * If we are writing a guest virtual address to stval, set
                   * this to 1. If we are trapping to VS we will set this to 0
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                  riscv_cpu_set_force_hs_excep(env, 0);
              } else {
                  /* Trap into HS mode */
 -                if (!two_stage_lookup) {
 -                    env->hstatus = set_field(env->hstatus, HSTATUS_SPV,
 -                                             riscv_cpu_virt_enabled(env));
 -                }
 +                env->hstatus = set_field(env->hstatus, HSTATUS_SPV, false);
                  htval = env->guest_phys_fault_addr;
              }
          }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
       * RISC-V ISA Specification.
       */
 +    env->two_stage_lookup = false;
  #endif
      cs->exception_index = EXCP_NONE; /* mark handled to qemu */
  }
 --
-.30.1
+.37.3

-[PULL 08/16] target/riscv: Use background registers also for MSTATUS_MPV
+[PULL v2 09/22] hw/riscv: opentitan: Fixup resetvec
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Alistair Francis <alistair.francis@wdc.com>
-The current condition for the use of background registers only
+The resetvec for the OpenTitan machine ended up being set to an out of
-considers the hypervisor load and store instructions,
+date value, so let's fix that and bump it to the correct start address
-but not accesses from M mode via MSTATUS_MPRV+MPV.
+(after the boot ROM)
-Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+Fixes: bf8803c64d75 "hw/riscv: opentitan: bump opentitan version"
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210311103036.1401073-1-georg.kotheimer@kernkonzept.com
+Message-Id: <20220914101108.82571-3-alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 2 +-
+ hw/riscv/opentitan.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/hw/riscv/opentitan.c
-+++ b/target/riscv/cpu_helper.c
++++ b/hw/riscv/opentitan.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
+@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
-      * was called. Background registers will be used if the guest has
+                             &error_abort);
-      * forced a two stage translation to be on (in HS or M mode).
+     object_property_set_int(OBJECT(&s->cpus), "num-harts", ms->smp.cpus,
-      */
+                             &error_abort);
--    if (!riscv_cpu_virt_enabled(env) && riscv_cpu_two_stage_lookup(mmu_idx)) {
+-    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x20000490,
-+    if (!riscv_cpu_virt_enabled(env) && two_stage) {
++    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x20000400,
-         use_background = true;
+                             &error_abort);
-     }
+     sysbus_realize(SYS_BUS_DEVICE(&s->cpus), &error_fatal);
 --
-.30.1
+.37.3

-New patch
+[PULL v2 10/22] hw/riscv: opentitan: Expose the resetvec as a SoC property
+From: Alistair Francis <alistair.francis@wdc.com>
+On the OpenTitan hardware the resetvec is fixed at the start of ROM. In
+QEMU we don't run the ROM code and instead just jump to the next stage.
+This means we need to be a little more flexible about what the resetvec
+is.
+This patch allows us to set the resetvec from the command line with
+something like this:
+    -global driver=riscv.lowrisc.ibex.soc,property=resetvec,value=0x20000400
+This way as the next stage changes we can update the resetvec.
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-Id: <20220914101108.82571-4-alistair.francis@wdc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ include/hw/riscv/opentitan.h | 2 ++
+ hw/riscv/opentitan.c         | 8 +++++++-
+files changed, 9 insertions(+), 1 deletion(-)
+diff --git a/include/hw/riscv/opentitan.h b/include/hw/riscv/opentitan.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/riscv/opentitan.h
++++ b/include/hw/riscv/opentitan.h
+@@ -XXX,XX +XXX,XX @@ struct LowRISCIbexSoCState {
+     IbexTimerState timer;
+     IbexSPIHostState spi_host[OPENTITAN_NUM_SPI_HOSTS];
++    uint32_t resetvec;
++
+     MemoryRegion flash_mem;
+     MemoryRegion rom;
+     MemoryRegion flash_alias;
+diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/opentitan.c
++++ b/hw/riscv/opentitan.c
+@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
+                             &error_abort);
+     object_property_set_int(OBJECT(&s->cpus), "num-harts", ms->smp.cpus,
+                             &error_abort);
+-    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x20000400,
++    object_property_set_int(OBJECT(&s->cpus), "resetvec", s->resetvec,
+                             &error_abort);
+     sysbus_realize(SYS_BUS_DEVICE(&s->cpus), &error_fatal);
+@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
+         memmap[IBEX_DEV_PERI].base, memmap[IBEX_DEV_PERI].size);
+ }
++static Property lowrisc_ibex_soc_props[] = {
++    DEFINE_PROP_UINT32("resetvec", LowRISCIbexSoCState, resetvec, 0x20000400),
++    DEFINE_PROP_END_OF_LIST()
++};
++
+ static void lowrisc_ibex_soc_class_init(ObjectClass *oc, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(oc);
++    device_class_set_props(dc, lowrisc_ibex_soc_props);
+     dc->realize = lowrisc_ibex_soc_realize;
+     /* Reason: Uses serial_hds in realize function, thus can't be used twice */
+     dc->user_creatable = false;
+--
+.37.3

-[PULL 02/16] hw/char: disable ibex uart receive if the buffer is full
+[PULL v2 11/22] target/riscv: Check the correct exception cause in vector GDB stub
-From: Alexander Wagner <alexander.wagner@ulal.de>
+From: Frank Chang <frank.chang@sifive.com>
-Not disabling the UART leads to QEMU overwriting the UART receive buffer with
+After RISCVException enum is introduced, riscv_csrrw_debug() returns
-the newest received byte. The rx_level variable is added to allow the use of
+RISCV_EXCP_NONE to indicate there's no error. RISC-V vector GDB stub
-the existing OpenTitan driver libraries.
+should check the result against RISCV_EXCP_NONE instead of value 0.
 Otherwise, 'E14' packet would be incorrectly reported for vector CSRs
 when using "info reg vector" GDB command.
-Signed-off-by: Alexander Wagner <alexander.wagner@ulal.de>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Jim Shu <jim.shu@sifive.com>
 Reviewed-by: Tommy Wu <tommy.wu@sifive.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210309152130.13038-1-alexander.wagner@ulal.de
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Message-Id: <20220918083245.13028-1-frank.chang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/char/ibex_uart.h |  4 ++++
+ target/riscv/gdbstub.c | 4 ++--
- hw/char/ibex_uart.c         | 23 ++++++++++++++++++-----
+file changed, 2 insertions(+), 2 deletions(-)
 files changed, 22 insertions(+), 5 deletions(-)
-diff --git a/include/hw/char/ibex_uart.h b/include/hw/char/ibex_uart.h
+diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/char/ibex_uart.h
+--- a/target/riscv/gdbstub.c
-+++ b/include/hw/char/ibex_uart.h
++++ b/target/riscv/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ REG32(FIFO_CTRL, 0x1c)
+@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_get_vector(CPURISCVState *env, GByteArray *buf, int n)
-     FIELD(FIFO_CTRL, RXILVL, 2, 3)
+     target_ulong val = 0;
-     FIELD(FIFO_CTRL, TXILVL, 5, 2)
+     int result = riscv_csrrw_debug(env, csrno, &val, 0, 0);
- REG32(FIFO_STATUS, 0x20)
-+    FIELD(FIFO_STATUS, TXLVL, 0, 5)
+-    if (result == 0) {
-+    FIELD(FIFO_STATUS, RXLVL, 16, 5)
++    if (result == RISCV_EXCP_NONE) {
- REG32(OVRD, 0x24)
+         return gdb_get_regl(buf, val);
  REG32(VAL, 0x28)
  REG32(TIMEOUT_CTRL, 0x2c)
@@ -XXX,XX +XXX,XX @@ struct IbexUartState {
      uint8_t tx_fifo[IBEX_UART_TX_FIFO_SIZE];
      uint32_t tx_level;
 +    uint32_t rx_level;
 +
      QEMUTimer *fifo_trigger_handle;
      uint64_t char_tx_time;
 diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/ibex_uart.c
 +++ b/hw/char/ibex_uart.c
@@ -XXX,XX +XXX,XX @@ static int ibex_uart_can_receive(void *opaque)
  {
      IbexUartState *s = opaque;
 -    if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
 +    if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK)
 +           && !(s->uart_status & R_STATUS_RXFULL_MASK)) {
          return 1;
      }
-@@ -XXX,XX +XXX,XX @@ static void ibex_uart_receive(void *opaque, const uint8_t *buf, int size)
+@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_set_vector(CPURISCVState *env, uint8_t *mem_buf, int n)
+     target_ulong val = ldtul_p(mem_buf);
-     s->uart_status &= ~R_STATUS_RXIDLE_MASK;
+     int result = riscv_csrrw_debug(env, csrno, NULL, val, -1);
-     s->uart_status &= ~R_STATUS_RXEMPTY_MASK;
-+    /* The RXFULL is set after receiving a single byte
+-    if (result == 0) {
-+     * as the FIFO buffers are not yet implemented.
++    if (result == RISCV_EXCP_NONE) {
-+     */
+         return sizeof(target_ulong);
-+    s->uart_status |= R_STATUS_RXFULL_MASK;
+     }
-+    s->rx_level += 1;
      if (size > rx_fifo_level) {
          s->uart_intr_state |= R_INTR_STATE_RX_WATERMARK_MASK;
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_reset(DeviceState *dev)
      s->uart_timeout_ctrl = 0x00000000;
      s->tx_level = 0;
 +    s->rx_level = 0;
      s->char_tx_time = (NANOSECONDS_PER_SECOND / 230400) * 10;
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
      case R_RDATA:
          retvalue = s->uart_rdata;
 -        if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
 +        if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) && (s->rx_level > 0)) {
              qemu_chr_fe_accept_input(&s->chr);
 -            s->uart_status |= R_STATUS_RXIDLE_MASK;
 -            s->uart_status |= R_STATUS_RXEMPTY_MASK;
 +            s->rx_level -= 1;
 +            s->uart_status &= ~R_STATUS_RXFULL_MASK;
 +            if (s->rx_level == 0) {
 +                s->uart_status |= R_STATUS_RXIDLE_MASK;
 +                s->uart_status |= R_STATUS_RXEMPTY_MASK;
 +            }
          }
          break;
      case R_WDATA:
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
      case R_FIFO_STATUS:
          retvalue = s->uart_fifo_status;
 -        retvalue |= s->tx_level & 0x1F;
 +        retvalue |= (s->rx_level & 0x1F) << R_FIFO_STATUS_RXLVL_SHIFT;
 +        retvalue |= (s->tx_level & 0x1F) << R_FIFO_STATUS_TXLVL_SHIFT;
          qemu_log_mask(LOG_UNIMP,
                        "%s: RX fifos are not supported\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr,
          s->uart_fifo_ctrl = value;
          if (value & R_FIFO_CTRL_RXRST_MASK) {
 +            s->rx_level = 0;
              qemu_log_mask(LOG_UNIMP,
                            "%s: RX fifos are not supported\n", __func__);
          }
 --
-.30.1
+.37.3

-[PULL 14/16] hw/riscv: microchip_pfsoc: Map EMMC/SD mux register
+[PULL v2 12/22] hw/riscv/sifive_e: Fix inheritance of SiFiveEState
-From: Bin Meng <bin.meng@windriver.com>
+From: Bernhard Beschow <shentey@gmail.com>
-Since HSS commit c20a89f8dcac, the Icicle Kit reference design has
+SiFiveEState inherits from SysBusDevice while it's TypeInfo claims it to
-been updated to use a register mapped at 0x4f000000 instead of a
+inherit from TYPE_MACHINE. This is an inconsistency which can cause
-GPIO to control whether eMMC or SD card is to be used. With this
+undefined behavior such as memory corruption.
 support the same HSS image can be used for both eMMC and SD card
 boot flow, while previously two different board configurations were
 used. This is undocumented but one can take a look at the HSS code
 HSS_MMCInit() in services/mmc/mmc_api.c.
-With this commit, HSS image built from 2020.12 release boots again.
+Change SiFiveEState to inherit from MachineState since it is registered
 as a machine.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Fixes: 0869490b1c ("riscv: sifive_e: Manually define the machine")
 Signed-off-by: Bernhard Beschow <shentey@gmail.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210322075248.136255-1-bmeng.cn@gmail.com
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-Id: <20220922075232.33653-1-shentey@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/microchip_pfsoc.h | 1 +
+ include/hw/riscv/sifive_e.h | 3 ++-
- hw/riscv/microchip_pfsoc.c         | 6 ++++++
+file changed, 2 insertions(+), 1 deletion(-)
 files changed, 7 insertions(+)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
+--- a/include/hw/riscv/sifive_e.h
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/include/hw/riscv/sifive_e.h
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@
-     MICROCHIP_PFSOC_ENVM_DATA,
+ #include "hw/riscv/riscv_hart.h"
-     MICROCHIP_PFSOC_QSPI_XIP,
+ #include "hw/riscv/sifive_cpu.h"
-     MICROCHIP_PFSOC_IOSCB,
+ #include "hw/gpio/sifive_gpio.h"
-+    MICROCHIP_PFSOC_EMMC_SD_MUX,
++#include "hw/boards.h"
-     MICROCHIP_PFSOC_DRAM_LO,
-     MICROCHIP_PFSOC_DRAM_LO_ALIAS,
+ #define TYPE_RISCV_E_SOC "riscv.sifive.e.soc"
-     MICROCHIP_PFSOC_DRAM_HI,
+ #define RISCV_E_SOC(obj) \
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
+@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveESoCState {
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/microchip_pfsoc.c
+ typedef struct SiFiveEState {
-+++ b/hw/riscv/microchip_pfsoc.c
+     /*< private >*/
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
+-    SysBusDevice parent_obj;
-     [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
++    MachineState parent_obj;
-     [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,  0x1000000 },
-     [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000, 0x10000000 },
+     /*< public >*/
-+    [MICROCHIP_PFSOC_EMMC_SD_MUX] =     { 0x4f000000,        0x4 },
+     SiFiveESoCState soc;
      [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000, 0x40000000 },
      [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000, 0x40000000 },
      [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,        0x0 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->ioscb), 0,
                      memmap[MICROCHIP_PFSOC_IOSCB].base);
 +    /* eMMC/SD mux */
 +    create_unimplemented_device("microchip.pfsoc.emmc_sd_mux",
 +        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].base,
 +        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].size);
 +
      /* QSPI Flash */
      memory_region_init_rom(qspi_xip_mem, OBJECT(dev),
                             "microchip.pfsoc.qspi_xip",
 --
-.30.1
+.37.3

-[PULL 01/16] target/riscv: fix vs() to return proper error code
+[PULL v2 13/22] target/riscv: debug: Determine the trigger type from tdata1.type
 From: Frank Chang <frank.chang@sifive.com>
-vs() should return -RISCV_EXCP_ILLEGAL_INST instead of -1 if rvv feature
+Current RISC-V debug assumes that only type 2 trigger is supported.
-is not enabled.
+To allow more types of triggers to be supported in the future
 (e.g. type 6 trigger, which is similar to type 2 trigger with additional
  functionality), we should determine the trigger type from tdata1.type.
-If -1 is returned, exception will be raised and cs->exception_index will
+RV_MAX_TRIGGERS is also introduced in replacement of TRIGGER_TYPE2_NUM.
 be set to the negative return value. The exception will then be treated
 as an instruction access fault instead of illegal instruction fault.
 Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 20210223065935.20208-1-frank.chang@sifive.com
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 [bmeng: fixed MXL_RV128 case, and moved macros to the following patch]
 Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Message-Id: <20220909134215.1843865-2-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 2 +-
+ target/riscv/cpu.h     |   2 +-
-file changed, 1 insertion(+), 1 deletion(-)
+ target/riscv/debug.h   |  13 +--
  target/riscv/csr.c     |   2 +-
  target/riscv/debug.c   | 188 +++++++++++++++++++++++++++++------------
  target/riscv/machine.c |   2 +-
 files changed, 140 insertions(+), 67 deletions(-)
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.h
++++ b/target/riscv/cpu.h
+@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
+     /* trigger module */
+     target_ulong trigger_cur;
+-    type2_trigger_t type2_trig[TRIGGER_TYPE2_NUM];
++    type2_trigger_t type2_trig[RV_MAX_TRIGGERS];
+     /* machine specific rdtime callback */
+     uint64_t (*rdtime_fn)(void *);
+diff --git a/target/riscv/debug.h b/target/riscv/debug.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/debug.h
++++ b/target/riscv/debug.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef RISCV_DEBUG_H
+ #define RISCV_DEBUG_H
+-/* trigger indexes implemented */
+-enum {
+-    TRIGGER_TYPE2_IDX_0 = 0,
+-    TRIGGER_TYPE2_IDX_1,
+-    TRIGGER_TYPE2_NUM,
+-    TRIGGER_NUM = TRIGGER_TYPE2_NUM
+-};
++#define RV_MAX_TRIGGERS         2
+ /* register index of tdata CSRs */
+ enum {
+@@ -XXX,XX +XXX,XX @@ typedef enum {
+     TRIGGER_TYPE_EXCP = 5,          /* exception trigger */
+     TRIGGER_TYPE_AD_MATCH6 = 6,     /* new address/data match trigger */
+     TRIGGER_TYPE_EXT_SRC = 7,       /* external source trigger */
+-    TRIGGER_TYPE_UNAVAIL = 15       /* trigger exists, but unavailable */
++    TRIGGER_TYPE_UNAVAIL = 15,      /* trigger exists, but unavailable */
++    TRIGGER_TYPE_NUM
+ } trigger_type_t;
+ typedef struct {
+@@ -XXX,XX +XXX,XX @@ typedef struct {
+     struct CPUWatchpoint *wp;
+ } type2_trigger_t;
+-/* tdata field masks */
++/* tdata1 field masks */
+ #define RV32_TYPE(t)    ((uint32_t)(t) << 28)
+ #define RV32_TYPE_MASK  (0xf << 28)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static int vs(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_tdata(CPURISCVState *env, int csrno,
-     if (env->misa & RVV) {
+                                  target_ulong *val)
-         return 0;
+ {
-     }
+     /* return 0 in tdata1 to end the trigger enumeration */
--    return -1;
+-    if (env->trigger_cur >= TRIGGER_NUM && csrno == CSR_TDATA1) {
-+    return -RISCV_EXCP_ILLEGAL_INST;
++    if (env->trigger_cur >= RV_MAX_TRIGGERS && csrno == CSR_TDATA1) {
- }
+         *val = 0;
+         return RISCV_EXCP_NONE;
- static int ctr(CPURISCVState *env, int csrno)
+     }
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@
  /* tdata availability of a trigger */
  typedef bool tdata_avail[TDATA_NUM];
 -static tdata_avail tdata_mapping[TRIGGER_NUM] = {
 -    [TRIGGER_TYPE2_IDX_0 ... TRIGGER_TYPE2_IDX_1] = { true, true, false },
 +static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = {
 +    [TRIGGER_TYPE_NO_EXIST] = { false, false, false },
 +    [TRIGGER_TYPE_AD_MATCH] = { true, true, true },
 +    [TRIGGER_TYPE_INST_CNT] = { true, false, true },
 +    [TRIGGER_TYPE_INT] = { true, true, true },
 +    [TRIGGER_TYPE_EXCP] = { true, true, true },
 +    [TRIGGER_TYPE_AD_MATCH6] = { true, true, true },
 +    [TRIGGER_TYPE_EXT_SRC] = { true, false, false },
 +    [TRIGGER_TYPE_UNAVAIL] = { true, true, true }
  };
  /* only breakpoint size 1/2/4/8 supported */
@@ -XXX,XX +XXX,XX @@ static int access_size[SIZE_NUM] = {
      [6 ... 15] = -1,
  };
 +static inline target_ulong extract_trigger_type(CPURISCVState *env,
 +                                                target_ulong tdata1)
 +{
 +    switch (riscv_cpu_mxl(env)) {
 +    case MXL_RV32:
 +        return extract32(tdata1, 28, 4);
 +    case MXL_RV64:
 +    case MXL_RV128:
 +        return extract64(tdata1, 60, 4);
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
 +static inline target_ulong get_trigger_type(CPURISCVState *env,
 +                                            target_ulong trigger_index)
 +{
 +    target_ulong tdata1 = env->type2_trig[trigger_index].mcontrol;
 +    return extract_trigger_type(env, tdata1);
 +}
 +
  static inline target_ulong trigger_type(CPURISCVState *env,
                                          trigger_type_t type)
  {
@@ -XXX,XX +XXX,XX @@ static inline target_ulong trigger_type(CPURISCVState *env,
  bool tdata_available(CPURISCVState *env, int tdata_index)
  {
 +    int trigger_type = get_trigger_type(env, env->trigger_cur);
 +
      if (unlikely(tdata_index >= TDATA_NUM)) {
          return false;
      }
 -    if (unlikely(env->trigger_cur >= TRIGGER_NUM)) {
 +    if (unlikely(env->trigger_cur >= RV_MAX_TRIGGERS)) {
          return false;
      }
 -    return tdata_mapping[env->trigger_cur][tdata_index];
 +    return tdata_mapping[trigger_type][tdata_index];
  }
  target_ulong tselect_csr_read(CPURISCVState *env)
@@ -XXX,XX +XXX,XX @@ static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
          qemu_log_mask(LOG_GUEST_ERROR,
                        "ignoring type write to tdata1 register\n");
      }
 +
      if (dmode != 0) {
          qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n");
      }
@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
  }
  static target_ulong type2_reg_read(CPURISCVState *env,
 -                                   target_ulong trigger_index, int tdata_index)
 +                                   target_ulong index, int tdata_index)
  {
 -    uint32_t index = trigger_index - TRIGGER_TYPE2_IDX_0;
      target_ulong tdata;
      switch (tdata_index) {
@@ -XXX,XX +XXX,XX @@ static target_ulong type2_reg_read(CPURISCVState *env,
      return tdata;
  }
 -static void type2_reg_write(CPURISCVState *env, target_ulong trigger_index,
 +static void type2_reg_write(CPURISCVState *env, target_ulong index,
                              int tdata_index, target_ulong val)
  {
 -    uint32_t index = trigger_index - TRIGGER_TYPE2_IDX_0;
      target_ulong new_val;
      switch (tdata_index) {
@@ -XXX,XX +XXX,XX @@ static void type2_reg_write(CPURISCVState *env, target_ulong trigger_index,
      return;
  }
 -typedef target_ulong (*tdata_read_func)(CPURISCVState *env,
 -                                        target_ulong trigger_index,
 -                                        int tdata_index);
 -
 -static tdata_read_func trigger_read_funcs[TRIGGER_NUM] = {
 -    [TRIGGER_TYPE2_IDX_0 ... TRIGGER_TYPE2_IDX_1] = type2_reg_read,
 -};
 -
 -typedef void (*tdata_write_func)(CPURISCVState *env,
 -                                 target_ulong trigger_index,
 -                                 int tdata_index,
 -                                 target_ulong val);
 -
 -static tdata_write_func trigger_write_funcs[TRIGGER_NUM] = {
 -    [TRIGGER_TYPE2_IDX_0 ... TRIGGER_TYPE2_IDX_1] = type2_reg_write,
 -};
 -
  target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
  {
 -    tdata_read_func read_func = trigger_read_funcs[env->trigger_cur];
 +    int trigger_type = get_trigger_type(env, env->trigger_cur);
 +
 +    switch (trigger_type) {
 +    case TRIGGER_TYPE_AD_MATCH:
 +        return type2_reg_read(env, env->trigger_cur, tdata_index);
 +        break;
 +    case TRIGGER_TYPE_INST_CNT:
 +    case TRIGGER_TYPE_INT:
 +    case TRIGGER_TYPE_EXCP:
 +    case TRIGGER_TYPE_AD_MATCH6:
 +    case TRIGGER_TYPE_EXT_SRC:
 +        qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
 +                      trigger_type);
 +        break;
 +    case TRIGGER_TYPE_NO_EXIST:
 +    case TRIGGER_TYPE_UNAVAIL:
 +        qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
 +                      trigger_type);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 -    return read_func(env, env->trigger_cur, tdata_index);
 +    return 0;
  }
  void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
  {
 -    tdata_write_func write_func = trigger_write_funcs[env->trigger_cur];
 +    int trigger_type;
 -    return write_func(env, env->trigger_cur, tdata_index, val);
 +    if (tdata_index == TDATA1) {
 +        trigger_type = extract_trigger_type(env, val);
 +    } else {
 +        trigger_type = get_trigger_type(env, env->trigger_cur);
 +    }
 +
 +    switch (trigger_type) {
 +    case TRIGGER_TYPE_AD_MATCH:
 +        type2_reg_write(env, env->trigger_cur, tdata_index, val);
 +        break;
 +    case TRIGGER_TYPE_INST_CNT:
 +    case TRIGGER_TYPE_INT:
 +    case TRIGGER_TYPE_EXCP:
 +    case TRIGGER_TYPE_AD_MATCH6:
 +    case TRIGGER_TYPE_EXT_SRC:
 +        qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
 +                      trigger_type);
 +        break;
 +    case TRIGGER_TYPE_NO_EXIST:
 +    case TRIGGER_TYPE_UNAVAIL:
 +        qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
 +                      trigger_type);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
  }
  void riscv_cpu_debug_excp_handler(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
      CPUBreakpoint *bp;
      target_ulong ctrl;
      target_ulong pc;
 +    int trigger_type;
      int i;
      QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
 -        for (i = 0; i < TRIGGER_TYPE2_NUM; i++) {
 -            ctrl = env->type2_trig[i].mcontrol;
 -            pc = env->type2_trig[i].maddress;
 -
 -            if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
 -                /* check U/S/M bit against current privilege level */
 -                if ((ctrl >> 3) & BIT(env->priv)) {
 -                    return true;
 +        for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 +            trigger_type = get_trigger_type(env, i);
 +
 +            switch (trigger_type) {
 +            case TRIGGER_TYPE_AD_MATCH:
 +                ctrl = env->type2_trig[i].mcontrol;
 +                pc = env->type2_trig[i].maddress;
 +
 +                if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
 +                    /* check U/S/M bit against current privilege level */
 +                    if ((ctrl >> 3) & BIT(env->priv)) {
 +                        return true;
 +                    }
                  }
 +                break;
 +            default:
 +                /* other trigger types are not supported or irrelevant */
 +                break;
              }
          }
      }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
      CPURISCVState *env = &cpu->env;
      target_ulong ctrl;
      target_ulong addr;
 +    int trigger_type;
      int flags;
      int i;
 -    for (i = 0; i < TRIGGER_TYPE2_NUM; i++) {
 -        ctrl = env->type2_trig[i].mcontrol;
 -        addr = env->type2_trig[i].maddress;
 -        flags = 0;
 +    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 +        trigger_type = get_trigger_type(env, i);
 -        if (ctrl & TYPE2_LOAD) {
 -            flags |= BP_MEM_READ;
 -        }
 -        if (ctrl & TYPE2_STORE) {
 -            flags |= BP_MEM_WRITE;
 -        }
 +        switch (trigger_type) {
 +        case TRIGGER_TYPE_AD_MATCH:
 +            ctrl = env->type2_trig[i].mcontrol;
 +            addr = env->type2_trig[i].maddress;
 +            flags = 0;
 -        if ((wp->flags & flags) && (wp->vaddr == addr)) {
 -            /* check U/S/M bit against current privilege level */
 -            if ((ctrl >> 3) & BIT(env->priv)) {
 -                return true;
 +            if (ctrl & TYPE2_LOAD) {
 +                flags |= BP_MEM_READ;
 +            }
 +            if (ctrl & TYPE2_STORE) {
 +                flags |= BP_MEM_WRITE;
 +            }
 +
 +            if ((wp->flags & flags) && (wp->vaddr == addr)) {
 +                /* check U/S/M bit against current privilege level */
 +                if ((ctrl >> 3) & BIT(env->priv)) {
 +                    return true;
 +                }
              }
 +            break;
 +        default:
 +            /* other trigger types are not supported */
 +            break;
          }
      }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
  void riscv_trigger_init(CPURISCVState *env)
  {
 -    target_ulong type2 = trigger_type(env, TRIGGER_TYPE_AD_MATCH);
 +    target_ulong tdata1 = trigger_type(env, TRIGGER_TYPE_AD_MATCH);
      int i;
 -    /* type 2 triggers */
 -    for (i = 0; i < TRIGGER_TYPE2_NUM; i++) {
 +    /* init to type 2 triggers */
 +    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
          /*
           * type = TRIGGER_TYPE_AD_MATCH
           * dmode = 0 (both debug and M-mode can write tdata)
@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
           * chain = 0 (unimplemented, always 0)
           * match = 0 (always 0, when any compare value equals tdata2)
           */
 -        env->type2_trig[i].mcontrol = type2;
 +        env->type2_trig[i].mcontrol = tdata1;
          env->type2_trig[i].maddress = 0;
          env->type2_trig[i].bp = NULL;
          env->type2_trig[i].wp = NULL;
 diff --git a/target/riscv/machine.c b/target/riscv/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/machine.c
 +++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_debug = {
      .needed = debug_needed,
      .fields = (VMStateField[]) {
          VMSTATE_UINTTL(env.trigger_cur, RISCVCPU),
 -        VMSTATE_STRUCT_ARRAY(env.type2_trig, RISCVCPU, TRIGGER_TYPE2_NUM,
 +        VMSTATE_STRUCT_ARRAY(env.type2_trig, RISCVCPU, RV_MAX_TRIGGERS,
 , vmstate_debug_type2, type2_trigger_t),
          VMSTATE_END_OF_LIST()
      }
 --
-.30.1
+.37.3

-[PULL 10/16] hw/riscv: allow ramfb on virt
+[PULL v2 14/22] target/riscv: debug: Introduce build_tdata1() to build tdata1 register content
-From: Asherah Connor <ashe@kivikakk.ee>
+From: Frank Chang <frank.chang@sifive.com>
-Allow ramfb on virt.  This lets `-device ramfb' work.
+Introduce build_tdata1() to build tdata1 register content, which can be
 shared among all types of triggers.
-Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 20210318235041.17175-3-ashe@kivikakk.ee
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 [bmeng: moved RV{32,64}_DATA_MASK definition to this patch]
 Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Message-Id: <20220909134215.1843865-3-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 3 +++
+ target/riscv/debug.h |  2 ++
-file changed, 3 insertions(+)
+ target/riscv/debug.c | 15 ++++++++++-----
 files changed, 12 insertions(+), 5 deletions(-)
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
+diff --git a/target/riscv/debug.h b/target/riscv/debug.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
+--- a/target/riscv/debug.h
-+++ b/hw/riscv/virt.c
++++ b/target/riscv/debug.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct {
- #include "sysemu/sysemu.h"
+ #define RV32_TYPE(t)    ((uint32_t)(t) << 28)
- #include "hw/pci/pci.h"
+ #define RV32_TYPE_MASK  (0xf << 28)
- #include "hw/pci-host/gpex.h"
+ #define RV32_DMODE      BIT(27)
-+#include "hw/display/ramfb.h"
++#define RV32_DATA_MASK  0x7ffffff
+ #define RV64_TYPE(t)    ((uint64_t)(t) << 60)
- static const MemMapEntry virt_memmap[] = {
+ #define RV64_TYPE_MASK  (0xfULL << 60)
-     [VIRT_DEBUG] =       {        0x0,         0x100 },
+ #define RV64_DMODE      BIT_ULL(59)
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
++#define RV64_DATA_MASK  0x7ffffffffffffff
-     mc->cpu_index_to_instance_props = riscv_numa_cpu_index_to_props;
-     mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
+ /* mcontrol field masks */
-     mc->numa_mem_supported = true;
-+
+diff --git a/target/riscv/debug.c b/target/riscv/debug.c
-+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
+index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ static inline target_ulong get_trigger_type(CPURISCVState *env,
      return extract_trigger_type(env, tdata1);
  }
- static const TypeInfo virt_machine_typeinfo = {
+-static inline target_ulong trigger_type(CPURISCVState *env,
 -                                        trigger_type_t type)
 +static inline target_ulong build_tdata1(CPURISCVState *env,
 +                                        trigger_type_t type,
 +                                        bool dmode, target_ulong data)
  {
      target_ulong tdata1;
      switch (riscv_cpu_mxl(env)) {
      case MXL_RV32:
 -        tdata1 = RV32_TYPE(type);
 +        tdata1 = RV32_TYPE(type) |
 +                 (dmode ? RV32_DMODE : 0) |
 +                 (data & RV32_DATA_MASK);
          break;
      case MXL_RV64:
      case MXL_RV128:
 -        tdata1 = RV64_TYPE(type);
 +        tdata1 = RV64_TYPE(type) |
 +                 (dmode ? RV64_DMODE : 0) |
 +                 (data & RV64_DATA_MASK);
          break;
      default:
          g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
  void riscv_trigger_init(CPURISCVState *env)
  {
 -    target_ulong tdata1 = trigger_type(env, TRIGGER_TYPE_AD_MATCH);
 +    target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
      int i;
      /* init to type 2 triggers */
 --
-.30.1
+.37.3

-[PULL 04/16] target/riscv: add log of PMP permission checking
+[PULL v2 15/22] target/riscv: debug: Introduce tdata1, tdata2, and tdata3 CSRs
-From: Jim Shu <cwshu@andestech.com>
+From: Frank Chang <frank.chang@sifive.com>
-Like MMU translation, add qemu log of PMP permission checking for
+Replace type2_trigger_t with the real tdata1, tdata2, and tdata3 CSRs,
-debugging.
+which allows us to support more types of triggers in the future.
-Signed-off-by: Jim Shu <cwshu@andestech.com>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 1613916082-19528-3-git-send-email-cwshu@andestech.com
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Message-Id: <20220909134215.1843865-4-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 12 ++++++++++++
+ target/riscv/cpu.h     |   6 ++-
-file changed, 12 insertions(+)
+ target/riscv/debug.h   |   7 ---
  target/riscv/debug.c   | 103 +++++++++++++++--------------------------
  target/riscv/machine.c |  20 ++------
 files changed, 48 insertions(+), 88 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
-             if (ret == TRANSLATE_SUCCESS) {
-                 ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
+     /* trigger module */
-                                                size, access_type, mode);
+     target_ulong trigger_cur;
 -    type2_trigger_t type2_trig[RV_MAX_TRIGGERS];
 +    target_ulong tdata1[RV_MAX_TRIGGERS];
 +    target_ulong tdata2[RV_MAX_TRIGGERS];
 +    target_ulong tdata3[RV_MAX_TRIGGERS];
 +    struct CPUBreakpoint *cpu_breakpoint[RV_MAX_TRIGGERS];
 +    struct CPUWatchpoint *cpu_watchpoint[RV_MAX_TRIGGERS];
      /* machine specific rdtime callback */
      uint64_t (*rdtime_fn)(void *);
 diff --git a/target/riscv/debug.h b/target/riscv/debug.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.h
 +++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
      TRIGGER_TYPE_NUM
  } trigger_type_t;
 -typedef struct {
 -    target_ulong mcontrol;
 -    target_ulong maddress;
 -    struct CPUBreakpoint *bp;
 -    struct CPUWatchpoint *wp;
 -} type2_trigger_t;
 -
  /* tdata1 field masks */
  #define RV32_TYPE(t)    ((uint32_t)(t) << 28)
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ static inline target_ulong extract_trigger_type(CPURISCVState *env,
  static inline target_ulong get_trigger_type(CPURISCVState *env,
                                              target_ulong trigger_index)
  {
 -    target_ulong tdata1 = env->type2_trig[trigger_index].mcontrol;
 -    return extract_trigger_type(env, tdata1);
 +    return extract_trigger_type(env, env->tdata1[trigger_index]);
  }
  static inline target_ulong build_tdata1(CPURISCVState *env,
@@ -XXX,XX +XXX,XX @@ static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
      }
  }
 +/* type 2 trigger */
 +
-+                qemu_log_mask(CPU_LOG_MMU,
+ static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
-+                              "%s PMP address=" TARGET_FMT_plx " ret %d prot"
+ {
-+                              " %d tlb_size " TARGET_FMT_lu "\n",
+     uint32_t size, sizelo, sizehi = 0;
-+                              __func__, pa, ret, prot_pmp, tlb_size);
+@@ -XXX,XX +XXX,XX @@ static target_ulong type2_mcontrol_validate(CPURISCVState *env,
-+
-                 prot &= prot_pmp;
+ static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
-             }
+ {
+-    target_ulong ctrl = env->type2_trig[index].mcontrol;
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+-    target_ulong addr = env->type2_trig[index].maddress;
-         if (ret == TRANSLATE_SUCCESS) {
++    target_ulong ctrl = env->tdata1[index];
-             ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
++    target_ulong addr = env->tdata2[index];
-                                            size, access_type, mode);
+     bool enabled = type2_breakpoint_enabled(ctrl);
-+
+     CPUState *cs = env_cpu(env);
-+            qemu_log_mask(CPU_LOG_MMU,
+     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
-+                          "%s PMP address=" TARGET_FMT_plx " ret %d prot"
+@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
-+                          " %d tlb_size " TARGET_FMT_lu "\n",
+     }
-+                          __func__, pa, ret, prot_pmp, tlb_size);
-+
+     if (ctrl & TYPE2_EXEC) {
-             prot &= prot_pmp;
+-        cpu_breakpoint_insert(cs, addr, flags, &env->type2_trig[index].bp);
 +        cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
      }
      if (ctrl & TYPE2_LOAD) {
@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
          size = type2_breakpoint_size(env, ctrl);
          if (size != 0) {
              cpu_watchpoint_insert(cs, addr, size, flags,
 -                                  &env->type2_trig[index].wp);
 +                                  &env->cpu_watchpoint[index]);
          } else {
              cpu_watchpoint_insert(cs, addr, 8, flags,
 -                                  &env->type2_trig[index].wp);
 +                                  &env->cpu_watchpoint[index]);
          }
      }
+ }
+@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
+ {
+     CPUState *cs = env_cpu(env);
+-    if (env->type2_trig[index].bp) {
+-        cpu_breakpoint_remove_by_ref(cs, env->type2_trig[index].bp);
+-        env->type2_trig[index].bp = NULL;
++    if (env->cpu_breakpoint[index]) {
++        cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]);
++        env->cpu_breakpoint[index] = NULL;
+     }
+-    if (env->type2_trig[index].wp) {
+-        cpu_watchpoint_remove_by_ref(cs, env->type2_trig[index].wp);
+-        env->type2_trig[index].wp = NULL;
++    if (env->cpu_watchpoint[index]) {
++        cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]);
++        env->cpu_watchpoint[index] = NULL;
+     }
+ }
+-static target_ulong type2_reg_read(CPURISCVState *env,
+-                                   target_ulong index, int tdata_index)
+-{
+-    target_ulong tdata;
+-
+-    switch (tdata_index) {
+-    case TDATA1:
+-        tdata = env->type2_trig[index].mcontrol;
+-        break;
+-    case TDATA2:
+-        tdata = env->type2_trig[index].maddress;
+-        break;
+-    default:
+-        g_assert_not_reached();
+-    }
+-
+-    return tdata;
+-}
+-
+ static void type2_reg_write(CPURISCVState *env, target_ulong index,
+                             int tdata_index, target_ulong val)
+ {
+@@ -XXX,XX +XXX,XX @@ static void type2_reg_write(CPURISCVState *env, target_ulong index,
+     switch (tdata_index) {
+     case TDATA1:
+         new_val = type2_mcontrol_validate(env, val);
+-        if (new_val != env->type2_trig[index].mcontrol) {
+-            env->type2_trig[index].mcontrol = new_val;
++        if (new_val != env->tdata1[index]) {
++            env->tdata1[index] = new_val;
+             type2_breakpoint_remove(env, index);
+             type2_breakpoint_insert(env, index);
+         }
+         break;
+     case TDATA2:
+-        if (val != env->type2_trig[index].maddress) {
+-            env->type2_trig[index].maddress = val;
++        if (val != env->tdata2[index]) {
++            env->tdata2[index] = val;
+             type2_breakpoint_remove(env, index);
+             type2_breakpoint_insert(env, index);
+         }
+         break;
++    case TDATA3:
++        qemu_log_mask(LOG_UNIMP,
++                      "tdata3 is not supported for type 2 trigger\n");
++        break;
+     default:
+         g_assert_not_reached();
+     }
+@@ -XXX,XX +XXX,XX @@ static void type2_reg_write(CPURISCVState *env, target_ulong index,
+ target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
+ {
+-    int trigger_type = get_trigger_type(env, env->trigger_cur);
+-
+-    switch (trigger_type) {
+-    case TRIGGER_TYPE_AD_MATCH:
+-        return type2_reg_read(env, env->trigger_cur, tdata_index);
+-        break;
+-    case TRIGGER_TYPE_INST_CNT:
+-    case TRIGGER_TYPE_INT:
+-    case TRIGGER_TYPE_EXCP:
+-    case TRIGGER_TYPE_AD_MATCH6:
+-    case TRIGGER_TYPE_EXT_SRC:
+-        qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
+-                      trigger_type);
+-        break;
+-    case TRIGGER_TYPE_NO_EXIST:
+-    case TRIGGER_TYPE_UNAVAIL:
+-        qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
+-                      trigger_type);
+-        break;
++    switch (tdata_index) {
++    case TDATA1:
++        return env->tdata1[env->trigger_cur];
++    case TDATA2:
++        return env->tdata2[env->trigger_cur];
++    case TDATA3:
++        return env->tdata3[env->trigger_cur];
+     default:
+         g_assert_not_reached();
+     }
+-
+-    return 0;
+ }
+ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
+             switch (trigger_type) {
+             case TRIGGER_TYPE_AD_MATCH:
+-                ctrl = env->type2_trig[i].mcontrol;
+-                pc = env->type2_trig[i].maddress;
++                ctrl = env->tdata1[i];
++                pc = env->tdata2[i];
+                 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
+                     /* check U/S/M bit against current privilege level */
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
+         switch (trigger_type) {
+         case TRIGGER_TYPE_AD_MATCH:
+-            ctrl = env->type2_trig[i].mcontrol;
+-            addr = env->type2_trig[i].maddress;
++            ctrl = env->tdata1[i];
++            addr = env->tdata2[i];
+             flags = 0;
+             if (ctrl & TYPE2_LOAD) {
+@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
+          * chain = 0 (unimplemented, always 0)
+          * match = 0 (always 0, when any compare value equals tdata2)
+          */
+-        env->type2_trig[i].mcontrol = tdata1;
+-        env->type2_trig[i].maddress = 0;
+-        env->type2_trig[i].bp = NULL;
+-        env->type2_trig[i].wp = NULL;
++        env->tdata1[i] = tdata1;
++        env->tdata2[i] = 0;
++        env->tdata3[i] = 0;
++        env->cpu_breakpoint[i] = NULL;
++        env->cpu_watchpoint[i] = NULL;
+     }
+ }
+diff --git a/target/riscv/machine.c b/target/riscv/machine.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/machine.c
++++ b/target/riscv/machine.c
+@@ -XXX,XX +XXX,XX @@ static bool debug_needed(void *opaque)
+     return riscv_feature(env, RISCV_FEATURE_DEBUG);
+ }
+-static const VMStateDescription vmstate_debug_type2 = {
+-    .name = "cpu/debug/type2",
+-    .version_id = 1,
+-    .minimum_version_id = 1,
+-    .fields = (VMStateField[]) {
+-        VMSTATE_UINTTL(mcontrol, type2_trigger_t),
+-        VMSTATE_UINTTL(maddress, type2_trigger_t),
+-        VMSTATE_END_OF_LIST()
+-   }
+-};
+-
+ static const VMStateDescription vmstate_debug = {
+     .name = "cpu/debug",
+-    .version_id = 1,
+-    .minimum_version_id = 1,
++    .version_id = 2,
++    .minimum_version_id = 2,
+     .needed = debug_needed,
+     .fields = (VMStateField[]) {
+         VMSTATE_UINTTL(env.trigger_cur, RISCVCPU),
+-        VMSTATE_STRUCT_ARRAY(env.type2_trig, RISCVCPU, RV_MAX_TRIGGERS,
+-                             0, vmstate_debug_type2, type2_trigger_t),
++        VMSTATE_UINTTL_ARRAY(env.tdata1, RISCVCPU, RV_MAX_TRIGGERS),
++        VMSTATE_UINTTL_ARRAY(env.tdata2, RISCVCPU, RV_MAX_TRIGGERS),
++        VMSTATE_UINTTL_ARRAY(env.tdata3, RISCVCPU, RV_MAX_TRIGGERS),
+         VMSTATE_END_OF_LIST()
+     }
+ };
 --
-.30.1
+.37.3

-[PULL 06/16] target/riscv: Adjust privilege level for HLV(X)/HSV instructions
+[PULL v2 16/22] target/riscv: debug: Restrict the range of tselect value can be written
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Frank Chang <frank.chang@sifive.com>
-According to the specification the "field SPVP of hstatus controls the
+The value of tselect CSR can be written should be limited within the
-privilege level of the access" for the hypervisor virtual-machine load
+range of supported triggers number.
 and store instructions HLV, HLVX and HSV.
-Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 20210311103005.1400718-1-georg.kotheimer@kernkonzept.com
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Message-Id: <20220909134215.1843865-5-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 25 ++++++++++++++-----------
+ target/riscv/debug.c | 9 +++------
-file changed, 14 insertions(+), 11 deletions(-)
+file changed, 3 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/debug.c
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/debug.c
-@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
+@@ -XXX,XX +XXX,XX @@ bool tdata_available(CPURISCVState *env, int tdata_index)
-         use_background = true;
+         return false;
      }
--    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
+-    if (unlikely(env->trigger_cur >= RV_MAX_TRIGGERS)) {
-+    /* MPRV does not affect the virtual-machine load/store
+-        return false;
 +       instructions, HLV, HLVX, and HSV. */
 +    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
 +        mode = get_field(env->hstatus, HSTATUS_SPVP);
 +    } else if (mode == PRV_M && access_type != MMU_INST_FETCH) {
          if (get_field(env->mstatus, MSTATUS_MPRV)) {
              mode = get_field(env->mstatus, MSTATUS_MPP);
          }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
      qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n",
                    __func__, address, access_type, mmu_idx);
 -    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
 -        if (get_field(env->mstatus, MSTATUS_MPRV)) {
 -            mode = get_field(env->mstatus, MSTATUS_MPP);
 +    /* MPRV does not affect the virtual-machine load/store
 +       instructions, HLV, HLVX, and HSV. */
 +    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
 +        mode = get_field(env->hstatus, HSTATUS_SPVP);
 +    } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
 +               get_field(env->mstatus, MSTATUS_MPRV)) {
 +        mode = get_field(env->mstatus, MSTATUS_MPP);
 +        if (riscv_has_ext(env, RVH) && get_field(env->mstatus, MSTATUS_MPV)) {
 +            two_stage_lookup = true;
          }
      }
 -    if (riscv_has_ext(env, RVH) && env->priv == PRV_M &&
 -        access_type != MMU_INST_FETCH &&
 -        get_field(env->mstatus, MSTATUS_MPRV) &&
 -        get_field(env->mstatus, MSTATUS_MPV)) {
 -        two_stage_lookup = true;
 -    }
 -
-     if (riscv_cpu_virt_enabled(env) ||
+     return tdata_mapping[trigger_type][tdata_index];
-         ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
+ }
-          access_type != MMU_INST_FETCH)) {
@@ -XXX,XX +XXX,XX @@ target_ulong tselect_csr_read(CPURISCVState *env)
  void tselect_csr_write(CPURISCVState *env, target_ulong val)
  {
 -    /* all target_ulong bits of tselect are implemented */
 -    env->trigger_cur = val;
 +    if (val < RV_MAX_TRIGGERS) {
 +        env->trigger_cur = val;
 +    }
  }
  static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
 --
-.30.1
+.37.3

-[PULL 11/16] target/riscv: Fix read and write accesses to vsip and vsie
+[PULL v2 17/22] target/riscv: debug: Introduce tinfo CSR
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Frank Chang <frank.chang@sifive.com>
-The previous implementation was broken in many ways:
+tinfo.info:
- - Used mideleg instead of hideleg to mask accesses
+  One bit for each possible type enumerated in tdata1.
- - Used MIP_VSSIP instead of VS_MODE_INTERRUPTS to mask writes to vsie
+  If the bit is set, then that type is supported by the currently
- - Did not shift between S bits and VS bits (VSEIP <-> SEIP, ...)
+  selected trigger.
-Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 20210311094738.1376795-1-georg.kotheimer@kernkonzept.com
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Message-Id: <20220909134215.1843865-6-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 68 +++++++++++++++++++++++-----------------------
+ target/riscv/cpu_bits.h |  1 +
-file changed, 34 insertions(+), 34 deletions(-)
+ target/riscv/debug.h    |  2 ++
  target/riscv/csr.c      |  8 ++++++++
  target/riscv/debug.c    | 10 +++++++---
 files changed, 18 insertions(+), 3 deletions(-)
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@
+ #define CSR_TDATA1          0x7a1
+ #define CSR_TDATA2          0x7a2
+ #define CSR_TDATA3          0x7a3
++#define CSR_TINFO           0x7a4
+ /* Debug Mode Registers */
+ #define CSR_DCSR            0x7b0
+diff --git a/target/riscv/debug.h b/target/riscv/debug.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/debug.h
++++ b/target/riscv/debug.h
+@@ -XXX,XX +XXX,XX @@ void tselect_csr_write(CPURISCVState *env, target_ulong val);
+ target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index);
+ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val);
++target_ulong tinfo_csr_read(CPURISCVState *env);
++
+ void riscv_cpu_debug_excp_handler(CPUState *cs);
+ bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
+ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static int write_sstatus(CPURISCVState *env, int csrno, target_ulong val)
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_tdata(CPURISCVState *env, int csrno,
-     return write_mstatus(env, CSR_MSTATUS, newval);
+     return RISCV_EXCP_NONE;
  }
-+static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
++static RISCVException read_tinfo(CPURISCVState *env, int csrno,
 +                                 target_ulong *val)
 +{
-+    /* Shift the VS bits to their S bit location in vsie */
++    *val = tinfo_csr_read(env);
-+    *val = (env->mie & env->hideleg & VS_MODE_INTERRUPTS) >> 1;
++    return RISCV_EXCP_NONE;
 +    return 0;
 +}
 +
- static int read_sie(CPURISCVState *env, int csrno, target_ulong *val)
+ /*
- {
+  * Functions to access Pointer Masking feature registers
-     if (riscv_cpu_virt_enabled(env)) {
+  * We have to check if current priv lvl could modify
--        /* Tell the guest the VS bits, shifted to the S bit locations */
+@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
--        *val = (env->mie & env->mideleg & VS_MODE_INTERRUPTS) >> 1;
+     [CSR_TDATA1]    =  { "tdata1",  debug, read_tdata,   write_tdata   },
-+        read_vsie(env, CSR_VSIE, val);
+     [CSR_TDATA2]    =  { "tdata2",  debug, read_tdata,   write_tdata   },
-     } else {
+     [CSR_TDATA3]    =  { "tdata3",  debug, read_tdata,   write_tdata   },
-         *val = env->mie & env->mideleg;
++    [CSR_TINFO]     =  { "tinfo",   debug, read_tinfo,   write_ignore  },
      /* User Pointer Masking */
      [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,  write_umte },
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@
   * - tdata1
   * - tdata2
   * - tdata3
 - *
 - * We don't support writable 'type' field in the tdata1 register, so there is
 - * no need to implement the "tinfo" CSR.
 + * - tinfo
   *
   * The following triggers are implemented:
   *
@@ -XXX,XX +XXX,XX @@ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
      }
-     return 0;
  }
--static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
++target_ulong tinfo_csr_read(CPURISCVState *env)
 +static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
  {
 -    target_ulong newval;
 +    /* Shift the S bits to their VS bit location in mie */
 +    target_ulong newval = (env->mie & ~VS_MODE_INTERRUPTS) |
 +                          ((val << 1) & env->hideleg & VS_MODE_INTERRUPTS);
 +    return write_mie(env, CSR_MIE, newval);
 +}
 +static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
 +{
-     if (riscv_cpu_virt_enabled(env)) {
++    /* assume all triggers support the same types of triggers */
--        /* Shift the guests S bits to VS */
++    return BIT(TRIGGER_TYPE_AD_MATCH);
 -        newval = (env->mie & ~VS_MODE_INTERRUPTS) |
 -                 ((val << 1) & VS_MODE_INTERRUPTS);
 +        write_vsie(env, CSR_VSIE, val);
      } else {
 -        newval = (env->mie & ~S_MODE_INTERRUPTS) | (val & S_MODE_INTERRUPTS);
 +        target_ulong newval = (env->mie & ~S_MODE_INTERRUPTS) |
 +                              (val & S_MODE_INTERRUPTS);
 +        write_mie(env, CSR_MIE, newval);
      }
 -    return write_mie(env, CSR_MIE, newval);
 +    return 0;
  }
  static int read_stvec(CPURISCVState *env, int csrno, target_ulong *val)
@@ -XXX,XX +XXX,XX @@ static int write_sbadaddr(CPURISCVState *env, int csrno, target_ulong val)
      return 0;
  }
 +static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
 +                    target_ulong new_value, target_ulong write_mask)
 +{
 +    /* Shift the S bits to their VS bit location in mip */
 +    int ret = rmw_mip(env, 0, ret_value, new_value << 1,
 +                      (write_mask << 1) & vsip_writable_mask & env->hideleg);
 +    *ret_value &= VS_MODE_INTERRUPTS;
 +    /* Shift the VS bits to their S bit location in vsip */
 +    *ret_value >>= 1;
 +    return ret;
 +}
 +
- static int rmw_sip(CPURISCVState *env, int csrno, target_ulong *ret_value,
+ void riscv_cpu_debug_excp_handler(CPUState *cs)
                     target_ulong new_value, target_ulong write_mask)
  {
-     int ret;
+     RISCVCPU *cpu = RISCV_CPU(cs);
      if (riscv_cpu_virt_enabled(env)) {
 -        /* Shift the new values to line up with the VS bits */
 -        ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value << 1,
 -                      (write_mask & sip_writable_mask) << 1 & env->mideleg);
 -        ret &= vsip_writable_mask;
 -        ret >>= 1;
 +        ret = rmw_vsip(env, CSR_VSIP, ret_value, new_value, write_mask);
      } else {
          ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value,
                        write_mask & env->mideleg & sip_writable_mask);
@@ -XXX,XX +XXX,XX @@ static int write_vsstatus(CPURISCVState *env, int csrno, target_ulong val)
      return 0;
  }
 -static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
 -                    target_ulong new_value, target_ulong write_mask)
 -{
 -    int ret = rmw_mip(env, 0, ret_value, new_value,
 -                      write_mask & env->mideleg & vsip_writable_mask);
 -    return ret;
 -}
 -
 -static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
 -{
 -    *val = env->mie & env->mideleg & VS_MODE_INTERRUPTS;
 -    return 0;
 -}
 -
 -static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
 -{
 -    target_ulong newval = (env->mie & ~env->mideleg) | (val & env->mideleg & MIP_VSSIP);
 -    return write_mie(env, CSR_MIE, newval);
 -}
 -
  static int read_vstvec(CPURISCVState *env, int csrno, target_ulong *val)
  {
      *val = env->vstvec;
 --
-.30.1
+.37.3

-[PULL 03/16] target/riscv: propagate PMP permission to TLB page
+[PULL v2 18/22] target/riscv: debug: Create common trigger actions function
-From: Jim Shu <cwshu@andestech.com>
+From: Frank Chang <frank.chang@sifive.com>
-Currently, PMP permission checking of TLB page is bypassed if TLB hits
+Trigger actions are shared among all triggers. Extract to a common
-Fix it by propagating PMP permission to TLB page permission.
+function.
-PMP permission checking also use MMU-style API to change TLB permission
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-and size.
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Signed-off-by: Jim Shu <cwshu@andestech.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+[bmeng: handle the DBG_ACTION_NONE case]
-Message-id: 1613916082-19528-2-git-send-email-cwshu@andestech.com
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Message-Id: <20220909134215.1843865-7-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/pmp.h        |  4 +-
+ target/riscv/debug.h | 13 ++++++++++
- target/riscv/cpu_helper.c | 84 +++++++++++++++++++++++++++++----------
+ target/riscv/debug.c | 59 ++++++++++++++++++++++++++++++++++++++++++--
- target/riscv/pmp.c        | 80 +++++++++++++++++++++++++++----------
+files changed, 70 insertions(+), 2 deletions(-)
 files changed, 125 insertions(+), 43 deletions(-)
-diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
+diff --git a/target/riscv/debug.h b/target/riscv/debug.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmp.h
+--- a/target/riscv/debug.h
-+++ b/target/riscv/pmp.h
++++ b/target/riscv/debug.h
-@@ -XXX,XX +XXX,XX @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
+@@ -XXX,XX +XXX,XX @@ typedef enum {
-     target_ulong val);
+     TRIGGER_TYPE_NUM
- target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
+ } trigger_type_t;
- bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
--    target_ulong size, pmp_priv_t priv, target_ulong mode);
++/* actions */
-+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
++typedef enum {
-+    target_ulong mode);
++    DBG_ACTION_NONE = -1,           /* sentinel value */
- bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
++    DBG_ACTION_BP = 0,
-                          target_ulong *tlb_size);
++    DBG_ACTION_DBG_MODE,
- void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
++    DBG_ACTION_TRACE0,
- void pmp_update_rule_nums(CPURISCVState *env);
++    DBG_ACTION_TRACE1,
- uint32_t pmp_get_num_rules(CPURISCVState *env);
++    DBG_ACTION_TRACE2,
-+int pmp_priv_to_page_prot(pmp_priv_t pmp_priv);
++    DBG_ACTION_TRACE3,
++    DBG_ACTION_EXT_DBG0 = 8,
- #endif
++    DBG_ACTION_EXT_DBG1
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
++} trigger_action_t;
 +
  /* tdata1 field masks */
  #define RV32_TYPE(t)    ((uint32_t)(t) << 28)
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/debug.c
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/debug.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
+@@ -XXX,XX +XXX,XX @@ static inline target_ulong get_trigger_type(CPURISCVState *env,
-     env->load_res = -1;
+     return extract_trigger_type(env, env->tdata1[trigger_index]);
  }
-+/*
++static trigger_action_t get_trigger_action(CPURISCVState *env,
-+ * get_physical_address_pmp - check PMP permission for this physical address
++                                           target_ulong trigger_index)
 + *
 + * Match the PMP region and check permission for this physical address and it's
 + * TLB page. Returns 0 if the permission checking was successful
 + *
 + * @env: CPURISCVState
 + * @prot: The returned protection attributes
 + * @tlb_size: TLB page size containing addr. It could be modified after PMP
 + *            permission checking. NULL if not set TLB page for addr.
 + * @addr: The physical address to be checked permission
 + * @access_type: The type of MMU access
 + * @mode: Indicates current privilege level.
 + */
 +static int get_physical_address_pmp(CPURISCVState *env, int *prot,
 +                                    target_ulong *tlb_size, hwaddr addr,
 +                                    int size, MMUAccessType access_type,
 +                                    int mode)
 +{
-+    pmp_priv_t pmp_priv;
++    target_ulong tdata1 = env->tdata1[trigger_index];
-+    target_ulong tlb_size_pmp = 0;
++    int trigger_type = get_trigger_type(env, trigger_index);
 +    trigger_action_t action = DBG_ACTION_NONE;
 +
-+    if (!riscv_feature(env, RISCV_FEATURE_PMP)) {
++    switch (trigger_type) {
-+        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
++    case TRIGGER_TYPE_AD_MATCH:
-+        return TRANSLATE_SUCCESS;
++        action = (tdata1 & TYPE2_ACTION) >> 12;
 +        break;
 +    case TRIGGER_TYPE_INST_CNT:
 +    case TRIGGER_TYPE_INT:
 +    case TRIGGER_TYPE_EXCP:
 +    case TRIGGER_TYPE_AD_MATCH6:
 +    case TRIGGER_TYPE_EXT_SRC:
 +        qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
 +                      trigger_type);
 +        break;
 +    case TRIGGER_TYPE_NO_EXIST:
 +    case TRIGGER_TYPE_UNAVAIL:
 +        qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
 +                      trigger_type);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
-+    if (!pmp_hart_has_privs(env, addr, size, 1 << access_type, &pmp_priv,
++    return action;
 +                            mode)) {
 +        *prot = 0;
 +        return TRANSLATE_PMP_FAIL;
 +    }
 +
 +    *prot = pmp_priv_to_page_prot(pmp_priv);
 +    if (tlb_size != NULL) {
 +        if (pmp_is_range_in_tlb(env, addr & ~(*tlb_size - 1), &tlb_size_pmp)) {
 +            *tlb_size = tlb_size_pmp;
 +        }
 +    }
 +
 +    return TRANSLATE_SUCCESS;
 +}
 +
- /* get_physical_address - get the physical address for this virtual address
+ static inline target_ulong build_tdata1(CPURISCVState *env,
-  *
+                                         trigger_type_t type,
-  * Do a page table walk to obtain the physical address corresponding to a
+                                         bool dmode, target_ulong data)
-@@ -XXX,XX +XXX,XX @@ restart:
+@@ -XXX,XX +XXX,XX @@ static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
              pte_addr = base + idx * ptesize;
          }
 -        if (riscv_feature(env, RISCV_FEATURE_PMP) &&
 -            !pmp_hart_has_privs(env, pte_addr, sizeof(target_ulong),
 -            1 << MMU_DATA_LOAD, PRV_S)) {
 +        int pmp_prot;
 +        int pmp_ret = get_physical_address_pmp(env, &pmp_prot, NULL, pte_addr,
 +                                               sizeof(target_ulong),
 +                                               MMU_DATA_LOAD, PRV_S);
 +        if (pmp_ret != TRANSLATE_SUCCESS) {
              return TRANSLATE_PMP_FAIL;
          }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
  #ifndef CONFIG_USER_ONLY
      vaddr im_address;
      hwaddr pa = 0;
 -    int prot, prot2;
 +    int prot, prot2, prot_pmp;
      bool pmp_violation = false;
      bool first_stage_error = true;
      bool two_stage_lookup = false;
      int ret = TRANSLATE_FAIL;
      int mode = mmu_idx;
 -    target_ulong tlb_size = 0;
 +    /* default TLB page size */
 +    target_ulong tlb_size = TARGET_PAGE_SIZE;
      env->guest_phys_fault_addr = 0;
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
              prot &= prot2;
 -            if (riscv_feature(env, RISCV_FEATURE_PMP) &&
 -                (ret == TRANSLATE_SUCCESS) &&
 -                !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
 -                ret = TRANSLATE_PMP_FAIL;
 +            if (ret == TRANSLATE_SUCCESS) {
 +                ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
 +                                               size, access_type, mode);
 +                prot &= prot_pmp;
              }
              if (ret != TRANSLATE_SUCCESS) {
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                        "%s address=%" VADDR_PRIx " ret %d physical "
                        TARGET_FMT_plx " prot %d\n",
                        __func__, address, ret, pa, prot);
 -    }
 -    if (riscv_feature(env, RISCV_FEATURE_PMP) &&
 -        (ret == TRANSLATE_SUCCESS) &&
 -        !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
 -        ret = TRANSLATE_PMP_FAIL;
 +        if (ret == TRANSLATE_SUCCESS) {
 +            ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
 +                                           size, access_type, mode);
 +            prot &= prot_pmp;
 +        }
      }
+ }
++static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
++{
++    trigger_action_t action = get_trigger_action(env, trigger_index);
 +
-     if (ret == TRANSLATE_PMP_FAIL) {
++    switch (action) {
-         pmp_violation = true;
++    case DBG_ACTION_NONE:
-     }
++        break;
++    case DBG_ACTION_BP:
-     if (ret == TRANSLATE_SUCCESS) {
++        riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
--        if (pmp_is_range_in_tlb(env, pa & TARGET_PAGE_MASK, &tlb_size)) {
++        break;
--            tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
++    case DBG_ACTION_DBG_MODE:
--                         prot, mmu_idx, tlb_size);
++    case DBG_ACTION_TRACE0:
--        } else {
++    case DBG_ACTION_TRACE1:
--            tlb_set_page(cs, address & TARGET_PAGE_MASK, pa & TARGET_PAGE_MASK,
++    case DBG_ACTION_TRACE2:
--                         prot, mmu_idx, TARGET_PAGE_SIZE);
++    case DBG_ACTION_TRACE3:
--        }
++    case DBG_ACTION_EXT_DBG0:
-+        tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
++    case DBG_ACTION_EXT_DBG1:
-+                     prot, mmu_idx, tlb_size);
++        qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action);
-         return true;
++        break;
-     } else if (probe) {
++    default:
-         return false;
++        g_assert_not_reached();
 diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.c
 +++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
      return result;
  }
 +/*
 + * Check if the address has required RWX privs when no PMP entry is matched.
 + */
 +static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
 +    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
 +    target_ulong mode)
 +{
 +    bool ret;
 +
 +    if ((!riscv_feature(env, RISCV_FEATURE_PMP)) || (mode == PRV_M)) {
 +        /*
 +         * Privileged spec v1.10 states if HW doesn't implement any PMP entry
 +         * or no PMP entry matches an M-Mode access, the access succeeds.
 +         */
 +        ret = true;
 +        *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 +    } else {
 +        /*
 +         * Other modes are not allowed to succeed if they don't * match a rule,
 +         * but there are rules. We've checked for no rule earlier in this
 +         * function.
 +         */
 +        ret = false;
 +        *allowed_privs = 0;
 +    }
-+
-+    return ret;
 +}
 +
+ /* type 2 trigger */
- /*
-  * Public Interface
+ static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
-@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs)
-  * Check if the address has required RWX privs to complete desired operation
+     if (cs->watchpoint_hit) {
-  */
+         if (cs->watchpoint_hit->flags & BP_CPU) {
- bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+             cs->watchpoint_hit = NULL;
--    target_ulong size, pmp_priv_t privs, target_ulong mode)
+-            riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
-+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
++            do_trigger_action(env, DBG_ACTION_BP);
-+    target_ulong mode)
+         }
- {
+     } else {
-     int i = 0;
+         if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) {
-     int ret = -1;
+-            riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
-     int pmp_size = 0;
++            do_trigger_action(env, DBG_ACTION_BP);
      target_ulong s = 0;
      target_ulong e = 0;
 -    pmp_priv_t allowed_privs = 0;
      /* Short cut if no rules */
      if (0 == pmp_get_num_rules(env)) {
 -        return (env->priv == PRV_M) ? true : false;
 +        return pmp_hart_has_privs_default(env, addr, size, privs,
 +                                          allowed_privs, mode);
      }
      if (size == 0) {
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
           * check
           */
          if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
 -            allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 +            *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
              if ((mode != PRV_M) || pmp_is_locked(env, i)) {
 -                allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
 +                *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
              }
 -            if ((privs & allowed_privs) == privs) {
 -                ret = 1;
 -                break;
 -            } else {
 -                ret = 0;
 -                break;
 -            }
 +            ret = ((privs & *allowed_privs) == privs);
 +            break;
          }
      }
-     /* No rule matched */
-     if (ret == -1) {
--        if (mode == PRV_M) {
--            ret = 1; /* Privileged spec v1.10 states if no PMP entry matches an
--                      * M-Mode access, the access succeeds */
--        } else {
--            ret = 0; /* Other modes are not allowed to succeed if they don't
--                      * match a rule, but there are rules.  We've checked for
--                      * no rule earlier in this function. */
--        }
-+        return pmp_hart_has_privs_default(env, addr, size, privs,
-+                                          allowed_privs, mode);
-     }
-     return ret == 1 ? true : false;
  }
--
- /*
-  * Handle a write to a pmpcfg CSP
-  */
-@@ -XXX,XX +XXX,XX @@ bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
-     return false;
- }
-+
-+/*
-+ * Convert PMP privilege to TLB page privilege.
-+ */
-+int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
-+{
-+    int prot = 0;
-+
-+    if (pmp_priv & PMP_READ) {
-+        prot |= PAGE_READ;
-+    }
-+    if (pmp_priv & PMP_WRITE) {
-+        prot |= PAGE_WRITE;
-+    }
-+    if (pmp_priv & PMP_EXEC) {
-+        prot |= PAGE_EXEC;
-+    }
-+
-+    return prot;
-+}
 --
-.30.1
+.37.3

-[PULL 13/16] hw/block: m25p80: Support fast read for SST flashes
+[PULL v2 19/22] target/riscv: debug: Check VU/VS modes for type 2 trigger
-From: Bin Meng <bin.meng@windriver.com>
+From: Frank Chang <frank.chang@sifive.com>
-Per SST25VF016B datasheet [1], SST flash requires a dummy byte after
+Type 2 trigger cannot be fired in VU/VS modes.
 the address bytes. Note only SPI mode is supported by SST flashes.
-[1] http://ww1.microchip.com/downloads/en/devicedoc/s71271_04.pdf
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20220909134215.1843865-8-bmeng.cn@gmail.com>
 Message-id: 20210306060152.7250-1-bmeng.cn@gmail.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/block/m25p80.c | 3 +++
+ target/riscv/debug.c | 10 ++++++++++
-file changed, 3 insertions(+)
+file changed, 10 insertions(+)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
+diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/target/riscv/debug.c
-+++ b/hw/block/m25p80.c
++++ b/target/riscv/debug.c
-@@ -XXX,XX +XXX,XX @@ static void decode_fast_read_cmd(Flash *s)
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
-     s->needed_bytes = get_addr_length(s);
-     switch (get_man(s)) {
+             switch (trigger_type) {
-     /* Dummy cycles - modeled with bytes writes instead of bits */
+             case TRIGGER_TYPE_AD_MATCH:
-+    case MAN_SST:
++                /* type 2 trigger cannot be fired in VU/VS mode */
-+        s->needed_bytes += 1;
++                if (riscv_cpu_virt_enabled(env)) {
-+        break;
++                    return false;
-     case MAN_WINBOND:
++                }
-         s->needed_bytes += 8;
++
-         break;
+                 ctrl = env->tdata1[i];
                  pc = env->tdata2[i];
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
          switch (trigger_type) {
          case TRIGGER_TYPE_AD_MATCH:
 +            /* type 2 trigger cannot be fired in VU/VS mode */
 +            if (riscv_cpu_virt_enabled(env)) {
 +                return false;
 +            }
 +
              ctrl = env->tdata1[i];
              addr = env->tdata2[i];
              flags = 0;
 --
-.30.1
+.37.3

-[PULL 05/16] target/riscv: flush TLB pages if PMP permission has been changed
+[PULL v2 20/22] target/riscv: debug: Add initial support of type 6 trigger
-From: Jim Shu <cwshu@andestech.com>
+From: Frank Chang <frank.chang@sifive.com>
-If PMP permission of any address has been changed by updating PMP entry,
+Type 6 trigger is similar to a type 2 trigger, but provides additional
-flush all TLB pages to prevent from getting old permission.
+functionality and should be used instead of type 2 in newer
 implementations.
-Signed-off-by: Jim Shu <cwshu@andestech.com>
+Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 1613916082-19528-4-git-send-email-cwshu@andestech.com
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Message-Id: <20220909134215.1843865-9-bmeng.cn@gmail.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/pmp.c | 4 ++++
+ target/riscv/debug.h |  18 +++++
-file changed, 4 insertions(+)
+ target/riscv/debug.c | 174 ++++++++++++++++++++++++++++++++++++++++++-
 files changed, 188 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
+diff --git a/target/riscv/debug.h b/target/riscv/debug.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmp.c
+--- a/target/riscv/debug.h
-+++ b/target/riscv/pmp.c
++++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
  #define TYPE2_HIT       BIT(20)
  #define TYPE2_SIZEHI    (0x3 << 21) /* RV64 only */
 +/* mcontrol6 field masks */
 +
 +#define TYPE6_LOAD      BIT(0)
 +#define TYPE6_STORE     BIT(1)
 +#define TYPE6_EXEC      BIT(2)
 +#define TYPE6_U         BIT(3)
 +#define TYPE6_S         BIT(4)
 +#define TYPE6_M         BIT(6)
 +#define TYPE6_MATCH     (0xf << 7)
 +#define TYPE6_CHAIN     BIT(11)
 +#define TYPE6_ACTION    (0xf << 12)
 +#define TYPE6_SIZE      (0xf << 16)
 +#define TYPE6_TIMING    BIT(20)
 +#define TYPE6_SELECT    BIT(21)
 +#define TYPE6_HIT       BIT(22)
 +#define TYPE6_VU        BIT(23)
 +#define TYPE6_VS        BIT(24)
 +
  /* access size */
  enum {
      SIZE_ANY = 0,
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
 @@ -XXX,XX +XXX,XX @@
- #include "qapi/error.h"
+  * - tdata3
- #include "cpu.h"
+  * - tinfo
- #include "trace.h"
+  *
-+#include "exec/exec-all.h"
+- * The following triggers are implemented:
++ * The following triggers are initialized by default:
- static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
+  *
-     uint8_t val);
+  * Index | Type |          tdata mapping | Description
-@@ -XXX,XX +XXX,XX @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
+  * ------+------+------------------------+------------
-         cfg_val = (val >> 8 * i)  & 0xff;
+@@ -XXX,XX +XXX,XX @@ static trigger_action_t get_trigger_action(CPURISCVState *env,
-         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
+     case TRIGGER_TYPE_AD_MATCH:
-     }
+         action = (tdata1 & TYPE2_ACTION) >> 12;
-+
+         break;
-+    /* If PMP permission of any addr has been changed, flush TLB pages. */
++    case TRIGGER_TYPE_AD_MATCH6:
-+    tlb_flush(env_cpu(env));
++        action = (tdata1 & TYPE6_ACTION) >> 12;
 +        break;
      case TRIGGER_TYPE_INST_CNT:
      case TRIGGER_TYPE_INT:
      case TRIGGER_TYPE_EXCP:
 -    case TRIGGER_TYPE_AD_MATCH6:
      case TRIGGER_TYPE_EXT_SRC:
          qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
                        trigger_type);
@@ -XXX,XX +XXX,XX @@ static void type2_reg_write(CPURISCVState *env, target_ulong index,
      return;
  }
++/* type 6 trigger */
 +
 +static inline bool type6_breakpoint_enabled(target_ulong ctrl)
 +{
 +    bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M));
 +    bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
 +
 +    return mode && rwx;
 +}
 +
 +static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
 +                                             target_ulong ctrl)
 +{
 +    target_ulong val;
 +    uint32_t size;
 +
 +    /* validate the generic part first */
 +    val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6);
 +
 +    /* validate unimplemented (always zero) bits */
 +    warn_always_zero_bit(ctrl, TYPE6_MATCH, "match");
 +    warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain");
 +    warn_always_zero_bit(ctrl, TYPE6_ACTION, "action");
 +    warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing");
 +    warn_always_zero_bit(ctrl, TYPE6_SELECT, "select");
 +    warn_always_zero_bit(ctrl, TYPE6_HIT, "hit");
 +
 +    /* validate size encoding */
 +    size = extract32(ctrl, 16, 4);
 +    if (access_size[size] == -1) {
 +        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
 +                      size);
 +    } else {
 +        val |= (ctrl & TYPE6_SIZE);
 +    }
 +
 +    /* keep the mode and attribute bits */
 +    val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M |
 +                    TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
 +
 +    return val;
 +}
 +
 +static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
 +{
 +    target_ulong ctrl = env->tdata1[index];
 +    target_ulong addr = env->tdata2[index];
 +    bool enabled = type6_breakpoint_enabled(ctrl);
 +    CPUState *cs = env_cpu(env);
 +    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
 +    uint32_t size;
 +
 +    if (!enabled) {
 +        return;
 +    }
 +
 +    if (ctrl & TYPE6_EXEC) {
 +        cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
 +    }
 +
 +    if (ctrl & TYPE6_LOAD) {
 +        flags |= BP_MEM_READ;
 +    }
 +
 +    if (ctrl & TYPE6_STORE) {
 +        flags |= BP_MEM_WRITE;
 +    }
 +
 +    if (flags & BP_MEM_ACCESS) {
 +        size = extract32(ctrl, 16, 4);
 +        if (size != 0) {
 +            cpu_watchpoint_insert(cs, addr, size, flags,
 +                                  &env->cpu_watchpoint[index]);
 +        } else {
 +            cpu_watchpoint_insert(cs, addr, 8, flags,
 +                                  &env->cpu_watchpoint[index]);
 +        }
 +    }
 +}
 +
 +static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index)
 +{
 +    type2_breakpoint_remove(env, index);
 +}
 +
 +static void type6_reg_write(CPURISCVState *env, target_ulong index,
 +                            int tdata_index, target_ulong val)
 +{
 +    target_ulong new_val;
 +
 +    switch (tdata_index) {
 +    case TDATA1:
 +        new_val = type6_mcontrol6_validate(env, val);
 +        if (new_val != env->tdata1[index]) {
 +            env->tdata1[index] = new_val;
 +            type6_breakpoint_remove(env, index);
 +            type6_breakpoint_insert(env, index);
 +        }
 +        break;
 +    case TDATA2:
 +        if (val != env->tdata2[index]) {
 +            env->tdata2[index] = val;
 +            type6_breakpoint_remove(env, index);
 +            type6_breakpoint_insert(env, index);
 +        }
 +        break;
 +    case TDATA3:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "tdata3 is not supported for type 6 trigger\n");
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    return;
 +}
 +
  target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
  {
      switch (tdata_index) {
@@ -XXX,XX +XXX,XX @@ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
      case TRIGGER_TYPE_AD_MATCH:
          type2_reg_write(env, env->trigger_cur, tdata_index, val);
          break;
 +    case TRIGGER_TYPE_AD_MATCH6:
 +        type6_reg_write(env, env->trigger_cur, tdata_index, val);
 +        break;
      case TRIGGER_TYPE_INST_CNT:
      case TRIGGER_TYPE_INT:
      case TRIGGER_TYPE_EXCP:
 -    case TRIGGER_TYPE_AD_MATCH6:
      case TRIGGER_TYPE_EXT_SRC:
          qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
                        trigger_type);
@@ -XXX,XX +XXX,XX @@ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
  target_ulong tinfo_csr_read(CPURISCVState *env)
  {
      /* assume all triggers support the same types of triggers */
 -    return BIT(TRIGGER_TYPE_AD_MATCH);
 +    return BIT(TRIGGER_TYPE_AD_MATCH) |
 +           BIT(TRIGGER_TYPE_AD_MATCH6);
  }
  void riscv_cpu_debug_excp_handler(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                      }
                  }
                  break;
 +            case TRIGGER_TYPE_AD_MATCH6:
 +                ctrl = env->tdata1[i];
 +                pc = env->tdata2[i];
 +
 +                if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) {
 +                    if (riscv_cpu_virt_enabled(env)) {
 +                        /* check VU/VS bit against current privilege level */
 +                        if ((ctrl >> 23) & BIT(env->priv)) {
 +                            return true;
 +                        }
 +                    } else {
 +                        /* check U/S/M bit against current privilege level */
 +                        if ((ctrl >> 3) & BIT(env->priv)) {
 +                            return true;
 +                        }
 +                    }
 +                }
 +                break;
              default:
                  /* other trigger types are not supported or irrelevant */
                  break;
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
                  }
              }
              break;
 +        case TRIGGER_TYPE_AD_MATCH6:
 +            ctrl = env->tdata1[i];
 +            addr = env->tdata2[i];
 +            flags = 0;
 +
 +            if (ctrl & TYPE6_LOAD) {
 +                flags |= BP_MEM_READ;
 +            }
 +            if (ctrl & TYPE6_STORE) {
 +                flags |= BP_MEM_WRITE;
 +            }
 +
 +            if ((wp->flags & flags) && (wp->vaddr == addr)) {
 +                if (riscv_cpu_virt_enabled(env)) {
 +                    /* check VU/VS bit against current privilege level */
 +                    if ((ctrl >> 23) & BIT(env->priv)) {
 +                        return true;
 +                    }
 +                } else {
 +                    /* check U/S/M bit against current privilege level */
 +                    if ((ctrl >> 3) & BIT(env->priv)) {
 +                        return true;
 +                    }
 +                }
 +            }
 +            break;
          default:
              /* other trigger types are not supported */
              break;
 --
-.30.1
+.37.3

-[PULL 16/16] target/riscv: Prevent lost illegal instruction exceptions
+[PULL v2 21/22] target/riscv: rvv-1.0: Simplify vfwredsum code
-From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
+From: Yang Liu <liuyang22@iscas.ac.cn>
-When decode_insn16() fails, we fall back to decode_RV32_64C() for
+Remove duplicate code by wrapping vfwredsum_vs's OP function.
 further compressed instruction decoding. However, prior to this change,
 we did not raise an illegal instruction exception, if decode_RV32_64C()
 fails to decode the instruction. This means that we skipped illegal
 compressed instructions instead of raising an illegal instruction
 exception.
-Instead of patching decode_RV32_64C(), we can just remove it,
+Signed-off-by: Yang Liu <liuyang22@iscas.ac.cn>
 as it is dead code since f330433b363 anyway.
 Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Message-id: 20210322121609.3097928-1-georg.kotheimer@kernkonzept.com
+Message-Id: <20220817074802.20765-1-liuyang22@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/translate.c | 179 +--------------------------------------
+ target/riscv/vector_helper.c | 56 +++++++-----------------------------
-file changed, 1 insertion(+), 178 deletions(-)
+file changed, 10 insertions(+), 46 deletions(-)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/target/riscv/vector_helper.c
-+++ b/target/riscv/translate.c
++++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_FRED(vfredmin_vs_h, uint16_t, uint16_t, H2, H2, float16_minimum_number)
-     CPUState *cs;
+ GEN_VEXT_FRED(vfredmin_vs_w, uint32_t, uint32_t, H4, H4, float32_minimum_number)
- } DisasContext;
+ GEN_VEXT_FRED(vfredmin_vs_d, uint64_t, uint64_t, H8, H8, float64_minimum_number)
--#ifdef TARGET_RISCV64
+-/* Vector Widening Floating-Point Reduction Instructions */
--/* convert riscv funct3 to qemu memop for load/store */
+-/* Unordered reduce 2*SEW = 2*SEW + sum(promote(SEW)) */
--static const int tcg_memop_lookup[8] = {
+-void HELPER(vfwredsum_vs_h)(void *vd, void *v0, void *vs1,
--    [0 ... 7] = -1,
+-                            void *vs2, CPURISCVState *env, uint32_t desc)
--    [0] = MO_SB,
++/* Vector Widening Floating-Point Add Instructions */
--    [1] = MO_TESW,
++static uint32_t fwadd16(uint32_t a, uint16_t b, float_status *s)
--    [2] = MO_TESL,
+ {
--    [3] = MO_TEQ,
+-    uint32_t vm = vext_vm(desc);
--    [4] = MO_UB,
+-    uint32_t vl = env->vl;
--    [5] = MO_TEUW,
+-    uint32_t esz = sizeof(uint32_t);
--    [6] = MO_TEUL,
+-    uint32_t vlenb = simd_maxsz(desc);
--};
+-    uint32_t vta = vext_vta(desc);
--#endif
+-    uint32_t i;
 -    uint32_t s1 =  *((uint32_t *)vs1 + H4(0));
 -
- #ifdef TARGET_RISCV64
+-    for (i = env->vstart; i < vl; i++) {
- #define CASE_OP_32_64(X) case X: case glue(X, W)
+-        uint16_t s2 = *((uint16_t *)vs2 + H2(i));
- #else
+-        if (!vm && !vext_elem_mask(v0, i)) {
-@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
+-            continue;
-     ctx->base.is_jmp = DISAS_NORETURN;
+-        }
 -        s1 = float32_add(s1, float16_to_float32(s2, true, &env->fp_status),
 -                         &env->fp_status);
 -    }
 -    *((uint32_t *)vd + H4(0)) = s1;
 -    env->vstart = 0;
 -    /* set tail elements to 1s */
 -    vext_set_elems_1s(vd, vta, esz, vlenb);
 +    return float32_add(a, float16_to_float32(b, true, s), s);
  }
--#ifdef TARGET_RISCV64
+-void HELPER(vfwredsum_vs_w)(void *vd, void *v0, void *vs1,
--static void gen_load_c(DisasContext *ctx, uint32_t opc, int rd, int rs1,
+-                            void *vs2, CPURISCVState *env, uint32_t desc)
--        target_long imm)
++static uint64_t fwadd32(uint64_t a, uint32_t b, float_status *s)
--{
+ {
--    TCGv t0 = tcg_temp_new();
+-    uint32_t vm = vext_vm(desc);
--    TCGv t1 = tcg_temp_new();
+-    uint32_t vl = env->vl;
--    gen_get_gpr(t0, rs1);
+-    uint32_t esz = sizeof(uint64_t);
--    tcg_gen_addi_tl(t0, t0, imm);
+-    uint32_t vlenb = simd_maxsz(desc);
--    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
+-    uint32_t vta = vext_vta(desc);
 -    uint32_t i;
 -    uint64_t s1 =  *((uint64_t *)vs1);
 -
--    if (memop < 0) {
+-    for (i = env->vstart; i < vl; i++) {
--        gen_exception_illegal(ctx);
+-        uint32_t s2 = *((uint32_t *)vs2 + H4(i));
--        return;
+-        if (!vm && !vext_elem_mask(v0, i)) {
 -            continue;
 -        }
 -        s1 = float64_add(s1, float32_to_float64(s2, &env->fp_status),
 -                         &env->fp_status);
 -    }
--
+-    *((uint64_t *)vd) = s1;
--    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, memop);
+-    env->vstart = 0;
--    gen_set_gpr(rd, t1);
+-    /* set tail elements to 1s */
--    tcg_temp_free(t0);
+-    vext_set_elems_1s(vd, vta, esz, vlenb);
--    tcg_temp_free(t1);
++    return float64_add(a, float32_to_float64(b, s), s);
 -}
 -
 -static void gen_store_c(DisasContext *ctx, uint32_t opc, int rs1, int rs2,
 -        target_long imm)
 -{
 -    TCGv t0 = tcg_temp_new();
 -    TCGv dat = tcg_temp_new();
 -    gen_get_gpr(t0, rs1);
 -    tcg_gen_addi_tl(t0, t0, imm);
 -    gen_get_gpr(dat, rs2);
 -    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
 -
 -    if (memop < 0) {
 -        gen_exception_illegal(ctx);
 -        return;
 -    }
 -
 -    tcg_gen_qemu_st_tl(dat, t0, ctx->mem_idx, memop);
 -    tcg_temp_free(t0);
 -    tcg_temp_free(dat);
 -}
 -#endif
 -
  #ifndef CONFIG_USER_ONLY
  /* The states of mstatus_fs are:
   * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
  static inline void mark_fs_dirty(DisasContext *ctx) { }
  #endif
 -#if !defined(TARGET_RISCV64)
 -static void gen_fp_load(DisasContext *ctx, uint32_t opc, int rd,
 -        int rs1, target_long imm)
 -{
 -    TCGv t0;
 -
 -    if (ctx->mstatus_fs == 0) {
 -        gen_exception_illegal(ctx);
 -        return;
 -    }
 -
 -    t0 = tcg_temp_new();
 -    gen_get_gpr(t0, rs1);
 -    tcg_gen_addi_tl(t0, t0, imm);
 -
 -    switch (opc) {
 -    case OPC_RISC_FLW:
 -        if (!has_ext(ctx, RVF)) {
 -            goto do_illegal;
 -        }
 -        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEUL);
 -        /* RISC-V requires NaN-boxing of narrower width floating point values */
 -        tcg_gen_ori_i64(cpu_fpr[rd], cpu_fpr[rd], 0xffffffff00000000ULL);
 -        break;
 -    case OPC_RISC_FLD:
 -        if (!has_ext(ctx, RVD)) {
 -            goto do_illegal;
 -        }
 -        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEQ);
 -        break;
 -    do_illegal:
 -    default:
 -        gen_exception_illegal(ctx);
 -        break;
 -    }
 -    tcg_temp_free(t0);
 -
 -    mark_fs_dirty(ctx);
 -}
 -
 -static void gen_fp_store(DisasContext *ctx, uint32_t opc, int rs1,
 -        int rs2, target_long imm)
 -{
 -    TCGv t0;
 -
 -    if (ctx->mstatus_fs == 0) {
 -        gen_exception_illegal(ctx);
 -        return;
 -    }
 -
 -    t0 = tcg_temp_new();
 -    gen_get_gpr(t0, rs1);
 -    tcg_gen_addi_tl(t0, t0, imm);
 -
 -    switch (opc) {
 -    case OPC_RISC_FSW:
 -        if (!has_ext(ctx, RVF)) {
 -            goto do_illegal;
 -        }
 -        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEUL);
 -        break;
 -    case OPC_RISC_FSD:
 -        if (!has_ext(ctx, RVD)) {
 -            goto do_illegal;
 -        }
 -        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEQ);
 -        break;
 -    do_illegal:
 -    default:
 -        gen_exception_illegal(ctx);
 -        break;
 -    }
 -
 -    tcg_temp_free(t0);
 -}
 -#endif
 -
  static void gen_set_rm(DisasContext *ctx, int rm)
  {
      TCGv_i32 t0;
@@ -XXX,XX +XXX,XX @@ static void gen_set_rm(DisasContext *ctx, int rm)
      tcg_temp_free_i32(t0);
  }
--static void decode_RV32_64C0(DisasContext *ctx, uint16_t opcode)
++/* Vector Widening Floating-Point Reduction Instructions */
--{
++/* Unordered reduce 2*SEW = 2*SEW + sum(promote(SEW)) */
--    uint8_t funct3 = extract16(opcode, 13, 3);
++GEN_VEXT_FRED(vfwredsum_vs_h, uint32_t, uint16_t, H4, H2, fwadd16)
--    uint8_t rd_rs2 = GET_C_RS2S(opcode);
++GEN_VEXT_FRED(vfwredsum_vs_w, uint64_t, uint32_t, H8, H4, fwadd32)
--    uint8_t rs1s = GET_C_RS1S(opcode);
++
--
+ /*
--    switch (funct3) {
+  *** Vector Mask Operations
--    case 3:
+  */
 -#if defined(TARGET_RISCV64)
 -        /* C.LD(RV64/128) -> ld rd', offset[7:3](rs1')*/
 -        gen_load_c(ctx, OPC_RISC_LD, rd_rs2, rs1s,
 -                 GET_C_LD_IMM(opcode));
 -#else
 -        /* C.FLW (RV32) -> flw rd', offset[6:2](rs1')*/
 -        gen_fp_load(ctx, OPC_RISC_FLW, rd_rs2, rs1s,
 -                    GET_C_LW_IMM(opcode));
 -#endif
 -        break;
 -    case 7:
 -#if defined(TARGET_RISCV64)
 -        /* C.SD (RV64/128) -> sd rs2', offset[7:3](rs1')*/
 -        gen_store_c(ctx, OPC_RISC_SD, rs1s, rd_rs2,
 -                  GET_C_LD_IMM(opcode));
 -#else
 -        /* C.FSW (RV32) -> fsw rs2', offset[6:2](rs1')*/
 -        gen_fp_store(ctx, OPC_RISC_FSW, rs1s, rd_rs2,
 -                     GET_C_LW_IMM(opcode));
 -#endif
 -        break;
 -    }
 -}
 -
 -static void decode_RV32_64C(DisasContext *ctx, uint16_t opcode)
 -{
 -    uint8_t op = extract16(opcode, 0, 2);
 -
 -    switch (op) {
 -    case 0:
 -        decode_RV32_64C0(ctx, opcode);
 -        break;
 -    }
 -}
 -
  static int ex_plus_1(DisasContext *ctx, int nf)
  {
      return nf + 1;
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
          } else {
              ctx->pc_succ_insn = ctx->base.pc_next + 2;
              if (!decode_insn16(ctx, opcode)) {
 -                /* fall back to old decoder */
 -                decode_RV32_64C(ctx, opcode);
 +                gen_exception_illegal(ctx);
              }
          }
      } else {
 --
-.30.1
+.37.3

-[PULL 09/16] hw/riscv: Add fw_cfg support to virt
+[PULL v2 22/22] target/riscv: rvv-1.0: vf[w]redsum distinguish between ordered/unordered
-From: Asherah Connor <ashe@kivikakk.ee>
+From: Yang Liu <liuyang22@iscas.ac.cn>
-Provides fw_cfg for the virt machine on riscv.  This enables
+Starting with RVV1.0, the original vf[w]redsum_vs instruction was renamed
-using e.g.  ramfb later.
+to vf[w]redusum_vs. The distinction between ordered and unordered is also
 more consistent with other instructions, although there is no difference
 in implementation between the two for QEMU.
-Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
+Signed-off-by: Yang Liu <liuyang22@iscas.ac.cn>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Message-id: 20210318235041.17175-2-ashe@kivikakk.ee
+Message-Id: <20220817074802.20765-2-liuyang22@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h |  2 ++
+ target/riscv/helper.h                   | 15 ++++++++++-----
- hw/riscv/virt.c         | 30 ++++++++++++++++++++++++++++++
+ target/riscv/insn32.decode              |  6 ++++--
- hw/riscv/Kconfig        |  1 +
+ target/riscv/vector_helper.c            | 19 +++++++++++++------
-files changed, 33 insertions(+)
+ target/riscv/insn_trans/trans_rvv.c.inc |  6 ++++--
 files changed, 31 insertions(+), 15 deletions(-)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
+--- a/target/riscv/helper.h
-+++ b/include/hw/riscv/virt.h
++++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vwredsum_vs_b, void, ptr, ptr, ptr, ptr, env, i32)
-     RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
+ DEF_HELPER_6(vwredsum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
-     DeviceState *plic[VIRT_SOCKETS_MAX];
+ DEF_HELPER_6(vwredsum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
-     PFlashCFI01 *flash[2];
-+    FWCfgState *fw_cfg;
+-DEF_HELPER_6(vfredsum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
+-DEF_HELPER_6(vfredsum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
-     int fdt_size;
+-DEF_HELPER_6(vfredsum_vs_d, void, ptr, ptr, ptr, ptr, env, i32)
- };
++DEF_HELPER_6(vfredusum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
-@@ -XXX,XX +XXX,XX @@ enum {
++DEF_HELPER_6(vfredusum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
-     VIRT_PLIC,
++DEF_HELPER_6(vfredusum_vs_d, void, ptr, ptr, ptr, ptr, env, i32)
-     VIRT_UART0,
++DEF_HELPER_6(vfredosum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
-     VIRT_VIRTIO,
++DEF_HELPER_6(vfredosum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
-+    VIRT_FW_CFG,
++DEF_HELPER_6(vfredosum_vs_d, void, ptr, ptr, ptr, ptr, env, i32)
-     VIRT_FLASH,
+ DEF_HELPER_6(vfredmax_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
-     VIRT_DRAM,
+ DEF_HELPER_6(vfredmax_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
-     VIRT_PCIE_MMIO,
+ DEF_HELPER_6(vfredmax_vs_d, void, ptr, ptr, ptr, ptr, env, i32)
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vfredmin_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vfredmin_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vfredmin_vs_d, void, ptr, ptr, ptr, ptr, env, i32)
 -DEF_HELPER_6(vfwredsum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
 -DEF_HELPER_6(vfwredsum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vfwredusum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vfwredusum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vfwredosum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vfwredosum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vmand_mm, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vmnand_mm, void, ptr, ptr, ptr, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
+--- a/target/riscv/insn32.decode
-+++ b/hw/riscv/virt.c
++++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
+@@ -XXX,XX +XXX,XX @@ vredmax_vs      000111 . ..... ..... 010 ..... 1010111 @r_vm
-     [VIRT_PLIC] =        {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
+ vwredsumu_vs    110000 . ..... ..... 000 ..... 1010111 @r_vm
-     [VIRT_UART0] =       { 0x10000000,         0x100 },
+ vwredsum_vs     110001 . ..... ..... 000 ..... 1010111 @r_vm
-     [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
+ # Vector ordered and unordered reduction sum
-+    [VIRT_FW_CFG] =      { 0x10100000,          0x18 },
+-vfredsum_vs     0000-1 . ..... ..... 001 ..... 1010111 @r_vm
-     [VIRT_FLASH] =       { 0x20000000,     0x4000000 },
++vfredusum_vs    000001 . ..... ..... 001 ..... 1010111 @r_vm
-     [VIRT_PCIE_ECAM] =   { 0x30000000,    0x10000000 },
++vfredosum_vs    000011 . ..... ..... 001 ..... 1010111 @r_vm
-     [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
+ vfredmin_vs     000101 . ..... ..... 001 ..... 1010111 @r_vm
-@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
+ vfredmax_vs     000111 . ..... ..... 001 ..... 1010111 @r_vm
-     return dev;
+ # Vector widening ordered and unordered float reduction sum
 -vfwredsum_vs    1100-1 . ..... ..... 001 ..... 1010111 @r_vm
 +vfwredusum_vs   110001 . ..... ..... 001 ..... 1010111 @r_vm
 +vfwredosum_vs   110011 . ..... ..... 001 ..... 1010111 @r_vm
  vmand_mm        011001 - ..... ..... 010 ..... 1010111 @r
  vmnand_mm       011101 - ..... ..... 010 ..... 1010111 @r
  vmandn_mm       011000 - ..... ..... 010 ..... 1010111 @r
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,           \
  }
-+static FWCfgState *create_fw_cfg(const MachineState *mc)
+ /* Unordered sum */
-+{
+-GEN_VEXT_FRED(vfredsum_vs_h, uint16_t, uint16_t, H2, H2, float16_add)
-+    hwaddr base = virt_memmap[VIRT_FW_CFG].base;
+-GEN_VEXT_FRED(vfredsum_vs_w, uint32_t, uint32_t, H4, H4, float32_add)
-+    hwaddr size = virt_memmap[VIRT_FW_CFG].size;
+-GEN_VEXT_FRED(vfredsum_vs_d, uint64_t, uint64_t, H8, H8, float64_add)
-+    FWCfgState *fw_cfg;
++GEN_VEXT_FRED(vfredusum_vs_h, uint16_t, uint16_t, H2, H2, float16_add)
-+    char *nodename;
++GEN_VEXT_FRED(vfredusum_vs_w, uint32_t, uint32_t, H4, H4, float32_add)
 +GEN_VEXT_FRED(vfredusum_vs_d, uint64_t, uint64_t, H8, H8, float64_add)
 +
-+    fw_cfg = fw_cfg_init_mem_wide(base + 8, base, 8, base + 16,
++/* Ordered sum */
-+                                  &address_space_memory);
++GEN_VEXT_FRED(vfredosum_vs_h, uint16_t, uint16_t, H2, H2, float16_add)
-+    fw_cfg_add_i16(fw_cfg, FW_CFG_NB_CPUS, (uint16_t)mc->smp.cpus);
++GEN_VEXT_FRED(vfredosum_vs_w, uint32_t, uint32_t, H4, H4, float32_add)
-+
++GEN_VEXT_FRED(vfredosum_vs_d, uint64_t, uint64_t, H8, H8, float64_add)
-+    nodename = g_strdup_printf("/fw-cfg@%" PRIx64, base);
-+    qemu_fdt_add_subnode(mc->fdt, nodename);
+ /* Maximum value */
-+    qemu_fdt_setprop_string(mc->fdt, nodename,
+ GEN_VEXT_FRED(vfredmax_vs_h, uint16_t, uint16_t, H2, H2, float16_maximum_number)
-+                            "compatible", "qemu,fw-cfg-mmio");
+@@ -XXX,XX +XXX,XX @@ static uint64_t fwadd32(uint64_t a, uint32_t b, float_status *s)
-+    qemu_fdt_setprop_sized_cells(mc->fdt, nodename, "reg",
+ }
-+                                 2, base, 2, size);
-+    qemu_fdt_setprop(mc->fdt, nodename, "dma-coherent", NULL, 0);
+ /* Vector Widening Floating-Point Reduction Instructions */
-+    g_free(nodename);
+-/* Unordered reduce 2*SEW = 2*SEW + sum(promote(SEW)) */
-+    return fw_cfg;
+-GEN_VEXT_FRED(vfwredsum_vs_h, uint32_t, uint16_t, H4, H2, fwadd16)
-+}
+-GEN_VEXT_FRED(vfwredsum_vs_w, uint64_t, uint32_t, H8, H4, fwadd32)
-+
++/* Ordered/unordered reduce 2*SEW = 2*SEW + sum(promote(SEW)) */
- static void virt_machine_init(MachineState *machine)
++GEN_VEXT_FRED(vfwredusum_vs_h, uint32_t, uint16_t, H4, H2, fwadd16)
- {
++GEN_VEXT_FRED(vfwredusum_vs_w, uint64_t, uint32_t, H8, H4, fwadd32)
-     const MemMapEntry *memmap = virt_memmap;
++GEN_VEXT_FRED(vfwredosum_vs_h, uint32_t, uint16_t, H4, H2, fwadd16)
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
++GEN_VEXT_FRED(vfwredosum_vs_w, uint64_t, uint32_t, H8, H4, fwadd32)
-         start_addr = virt_memmap[VIRT_FLASH].base;
-     }
+ /*
+  *** Vector Mask Operations
-+    /*
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 +     * Init fw_cfg.  Must be done before riscv_load_fdt, otherwise the device
 +     * tree cannot be altered and we get FDT_ERR_NOSPACE.
 +     */
 +    s->fw_cfg = create_fw_cfg(machine);
 +    rom_set_fw(s->fw_cfg);
 +
      /* Compute the fdt load address in dram */
      fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
                                     machine->ram_size, machine->fdt);
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/Kconfig
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/hw/riscv/Kconfig
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
+@@ -XXX,XX +XXX,XX @@ static bool freduction_check(DisasContext *s, arg_rmrr *a)
-     select SIFIVE_PLIC
+            require_zve64f(s);
-     select SIFIVE_TEST
+ }
-     select VIRTIO_MMIO
-+    select FW_CFG_DMA
+-GEN_OPFVV_TRANS(vfredsum_vs, freduction_check)
++GEN_OPFVV_TRANS(vfredusum_vs, freduction_check)
- config SIFIVE_E
++GEN_OPFVV_TRANS(vfredosum_vs, freduction_check)
-     bool
+ GEN_OPFVV_TRANS(vfredmax_vs, freduction_check)
  GEN_OPFVV_TRANS(vfredmin_vs, freduction_check)
@@ -XXX,XX +XXX,XX @@ static bool freduction_widen_check(DisasContext *s, arg_rmrr *a)
             (s->sew != MO_8);
  }
 -GEN_OPFVV_WIDEN_TRANS(vfwredsum_vs, freduction_widen_check)
 +GEN_OPFVV_WIDEN_TRANS(vfwredusum_vs, freduction_widen_check)
 +GEN_OPFVV_WIDEN_TRANS(vfwredosum_vs, freduction_widen_check)
  /*
   *** Vector Mask Operations
 --
-.30.1
+.37.3

The following changes since commit c95bd5ff1660883d15ad6e0005e4c8571604f51a:

Merge remote-tracking branch 'remotes/philmd/tags/mips-fixes-20210322' into staging (2021-03-22 14:26:13 +0000)

are available in the Git repository at:

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210322-2

for you to fetch changes up to 9a27f69bd668d9d71674407badc412ce1231c7d5:

target/riscv: Prevent lost illegal instruction exceptions (2021-03-22 21:54:40 -0400)

----------------------------------------------------------------
RISC-V PR for 6.0

This PR includes:
 - Fix for vector CSR access
 - Improvements to the Ibex UART device
 - PMP improvements and bug fixes
 - Hypervisor extension bug fixes
 - ramfb support for the virt machine
 - Fast read support for SST flash
 - Improvements to the microchip_pfsoc machine

----------------------------------------------------------------
Alexander Wagner (1):
      hw/char: disable ibex uart receive if the buffer is full

Asherah Connor (2):
      hw/riscv: Add fw_cfg support to virt
      hw/riscv: allow ramfb on virt

Bin Meng (3):
      hw/block: m25p80: Support fast read for SST flashes
      hw/riscv: microchip_pfsoc: Map EMMC/SD mux register
      docs/system: riscv: Add documentation for 'microchip-icicle-kit' machine

Frank Chang (1):
      target/riscv: fix vs() to return proper error code

Georg Kotheimer (6):
      target/riscv: Adjust privilege level for HLV(X)/HSV instructions
      target/riscv: Make VSTIP and VSEIP read-only in hip
      target/riscv: Use background registers also for MSTATUS_MPV
      target/riscv: Fix read and write accesses to vsip and vsie
      target/riscv: Add proper two-stage lookup exception detection
      target/riscv: Prevent lost illegal instruction exceptions

Jim Shu (3):
      target/riscv: propagate PMP permission to TLB page
      target/riscv: add log of PMP permission checking
      target/riscv: flush TLB pages if PMP permission has been changed

From: Frank Chang <frank.chang@sifive.com>

vs() should return -RISCV_EXCP_ILLEGAL_INST instead of -1 if rvv feature
is not enabled.

If -1 is returned, exception will be raised and cs->exception_index will
be set to the negative return value. The exception will then be treated
as an instruction access fault instead of illegal instruction fault.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210223065935.20208-1-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int vs(CPURISCVState *env, int csrno)
     if (env->misa & RVV) {
         return 0;
     }
-    return -1;
+    return -RISCV_EXCP_ILLEGAL_INST;
 }
 
 static int ctr(CPURISCVState *env, int csrno)
-- 
2.30.1

From: Alexander Wagner <alexander.wagner@ulal.de>

Not disabling the UART leads to QEMU overwriting the UART receive buffer with
the newest received byte. The rx_level variable is added to allow the use of
the existing OpenTitan driver libraries.

Signed-off-by: Alexander Wagner <alexander.wagner@ulal.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210309152130.13038-1-alexander.wagner@ulal.de
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/char/ibex_uart.h |  4 ++++
 hw/char/ibex_uart.c         | 23 ++++++++++++++++++-----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/include/hw/char/ibex_uart.h b/include/hw/char/ibex_uart.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/ibex_uart.h
+++ b/include/hw/char/ibex_uart.h
@@ -XXX,XX +XXX,XX @@ REG32(FIFO_CTRL, 0x1c)
     FIELD(FIFO_CTRL, RXILVL, 2, 3)
     FIELD(FIFO_CTRL, TXILVL, 5, 2)
 REG32(FIFO_STATUS, 0x20)
+    FIELD(FIFO_STATUS, TXLVL, 0, 5)
+    FIELD(FIFO_STATUS, RXLVL, 16, 5)
 REG32(OVRD, 0x24)
 REG32(VAL, 0x28)
 REG32(TIMEOUT_CTRL, 0x2c)
@@ -XXX,XX +XXX,XX @@ struct IbexUartState {
     uint8_t tx_fifo[IBEX_UART_TX_FIFO_SIZE];
     uint32_t tx_level;
 
+    uint32_t rx_level;
+
     QEMUTimer *fifo_trigger_handle;
     uint64_t char_tx_time;
 
diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/ibex_uart.c
+++ b/hw/char/ibex_uart.c
@@ -XXX,XX +XXX,XX @@ static int ibex_uart_can_receive(void *opaque)
 {
     IbexUartState *s = opaque;
 
-    if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
+    if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK)
+           && !(s->uart_status & R_STATUS_RXFULL_MASK)) {
         return 1;
     }
 
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_receive(void *opaque, const uint8_t *buf, int size)
 
     s->uart_status &= ~R_STATUS_RXIDLE_MASK;
     s->uart_status &= ~R_STATUS_RXEMPTY_MASK;
+    /* The RXFULL is set after receiving a single byte
+     * as the FIFO buffers are not yet implemented.
+     */
+    s->uart_status |= R_STATUS_RXFULL_MASK;
+    s->rx_level += 1;
 
     if (size > rx_fifo_level) {
         s->uart_intr_state |= R_INTR_STATE_RX_WATERMARK_MASK;
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_reset(DeviceState *dev)
     s->uart_timeout_ctrl = 0x00000000;
 
     s->tx_level = 0;
+    s->rx_level = 0;
 
     s->char_tx_time = (NANOSECONDS_PER_SECOND / 230400) * 10;
 
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
 
     case R_RDATA:
         retvalue = s->uart_rdata;
-        if (s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) {
+        if ((s->uart_ctrl & R_CTRL_RX_ENABLE_MASK) && (s->rx_level > 0)) {
             qemu_chr_fe_accept_input(&s->chr);
 
-            s->uart_status |= R_STATUS_RXIDLE_MASK;
-            s->uart_status |= R_STATUS_RXEMPTY_MASK;
+            s->rx_level -= 1;
+            s->uart_status &= ~R_STATUS_RXFULL_MASK;
+            if (s->rx_level == 0) {
+                s->uart_status |= R_STATUS_RXIDLE_MASK;
+                s->uart_status |= R_STATUS_RXEMPTY_MASK;
+            }
         }
         break;
     case R_WDATA:
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_uart_read(void *opaque, hwaddr addr,
     case R_FIFO_STATUS:
         retvalue = s->uart_fifo_status;
 
-        retvalue |= s->tx_level & 0x1F;
+        retvalue |= (s->rx_level & 0x1F) << R_FIFO_STATUS_RXLVL_SHIFT;
+        retvalue |= (s->tx_level & 0x1F) << R_FIFO_STATUS_TXLVL_SHIFT;
 
         qemu_log_mask(LOG_UNIMP,
                       "%s: RX fifos are not supported\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr,
         s->uart_fifo_ctrl = value;
 
         if (value & R_FIFO_CTRL_RXRST_MASK) {
+            s->rx_level = 0;
             qemu_log_mask(LOG_UNIMP,
                           "%s: RX fifos are not supported\n", __func__);
         }
-- 
2.30.1

From: Jim Shu <cwshu@andestech.com>

Currently, PMP permission checking of TLB page is bypassed if TLB hits
Fix it by propagating PMP permission to TLB page permission.

PMP permission checking also use MMU-style API to change TLB permission
and size.

Signed-off-by: Jim Shu <cwshu@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1613916082-19528-2-git-send-email-cwshu@andestech.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.h        |  4 +-
 target/riscv/cpu_helper.c | 84 +++++++++++++++++++++++++++++----------
 target/riscv/pmp.c        | 80 +++++++++++++++++++++++++++----------
 3 files changed, 125 insertions(+), 43 deletions(-)

diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -XXX,XX +XXX,XX @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
     target_ulong val);
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-    target_ulong size, pmp_priv_t priv, target_ulong mode);
+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
+    target_ulong mode);
 bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
                          target_ulong *tlb_size);
 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
 void pmp_update_rule_nums(CPURISCVState *env);
 uint32_t pmp_get_num_rules(CPURISCVState *env);
+int pmp_priv_to_page_prot(pmp_priv_t pmp_priv);
 
 #endif
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
     env->load_res = -1;
 }
 
+/*
+ * get_physical_address_pmp - check PMP permission for this physical address
+ *
+ * Match the PMP region and check permission for this physical address and it's
+ * TLB page. Returns 0 if the permission checking was successful
+ *
+ * @env: CPURISCVState
+ * @prot: The returned protection attributes
+ * @tlb_size: TLB page size containing addr. It could be modified after PMP
+ *            permission checking. NULL if not set TLB page for addr.
+ * @addr: The physical address to be checked permission
+ * @access_type: The type of MMU access
+ * @mode: Indicates current privilege level.
+ */
+static int get_physical_address_pmp(CPURISCVState *env, int *prot,
+                                    target_ulong *tlb_size, hwaddr addr,
+                                    int size, MMUAccessType access_type,
+                                    int mode)
+{
+    pmp_priv_t pmp_priv;
+    target_ulong tlb_size_pmp = 0;
+
+    if (!riscv_feature(env, RISCV_FEATURE_PMP)) {
+        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+        return TRANSLATE_SUCCESS;
+    }
+
+    if (!pmp_hart_has_privs(env, addr, size, 1 << access_type, &pmp_priv,
+                            mode)) {
+        *prot = 0;
+        return TRANSLATE_PMP_FAIL;
+    }
+
+    *prot = pmp_priv_to_page_prot(pmp_priv);
+    if (tlb_size != NULL) {
+        if (pmp_is_range_in_tlb(env, addr & ~(*tlb_size - 1), &tlb_size_pmp)) {
+            *tlb_size = tlb_size_pmp;
+        }
+    }
+
+    return TRANSLATE_SUCCESS;
+}
+
 /* get_physical_address - get the physical address for this virtual address
  *
  * Do a page table walk to obtain the physical address corresponding to a
@@ -XXX,XX +XXX,XX @@ restart:
             pte_addr = base + idx * ptesize;
         }
 
-        if (riscv_feature(env, RISCV_FEATURE_PMP) &&
-            !pmp_hart_has_privs(env, pte_addr, sizeof(target_ulong),
-            1 << MMU_DATA_LOAD, PRV_S)) {
+        int pmp_prot;
+        int pmp_ret = get_physical_address_pmp(env, &pmp_prot, NULL, pte_addr,
+                                               sizeof(target_ulong),
+                                               MMU_DATA_LOAD, PRV_S);
+        if (pmp_ret != TRANSLATE_SUCCESS) {
             return TRANSLATE_PMP_FAIL;
         }
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 #ifndef CONFIG_USER_ONLY
     vaddr im_address;
     hwaddr pa = 0;
-    int prot, prot2;
+    int prot, prot2, prot_pmp;
     bool pmp_violation = false;
     bool first_stage_error = true;
     bool two_stage_lookup = false;
     int ret = TRANSLATE_FAIL;
     int mode = mmu_idx;
-    target_ulong tlb_size = 0;
+    /* default TLB page size */
+    target_ulong tlb_size = TARGET_PAGE_SIZE;
 
     env->guest_phys_fault_addr = 0;
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 
             prot &= prot2;
 
-            if (riscv_feature(env, RISCV_FEATURE_PMP) &&
-                (ret == TRANSLATE_SUCCESS) &&
-                !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
-                ret = TRANSLATE_PMP_FAIL;
+            if (ret == TRANSLATE_SUCCESS) {
+                ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
+                                               size, access_type, mode);
+                prot &= prot_pmp;
             }
 
             if (ret != TRANSLATE_SUCCESS) {
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                       "%s address=%" VADDR_PRIx " ret %d physical "
                       TARGET_FMT_plx " prot %d\n",
                       __func__, address, ret, pa, prot);
-    }
 
-    if (riscv_feature(env, RISCV_FEATURE_PMP) &&
-        (ret == TRANSLATE_SUCCESS) &&
-        !pmp_hart_has_privs(env, pa, size, 1 << access_type, mode)) {
-        ret = TRANSLATE_PMP_FAIL;
+        if (ret == TRANSLATE_SUCCESS) {
+            ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
+                                           size, access_type, mode);
+            prot &= prot_pmp;
+        }
     }
+
     if (ret == TRANSLATE_PMP_FAIL) {
         pmp_violation = true;
     }
 
     if (ret == TRANSLATE_SUCCESS) {
-        if (pmp_is_range_in_tlb(env, pa & TARGET_PAGE_MASK, &tlb_size)) {
-            tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
-                         prot, mmu_idx, tlb_size);
-        } else {
-            tlb_set_page(cs, address & TARGET_PAGE_MASK, pa & TARGET_PAGE_MASK,
-                         prot, mmu_idx, TARGET_PAGE_SIZE);
-        }
+        tlb_set_page(cs, address & ~(tlb_size - 1), pa & ~(tlb_size - 1),
+                     prot, mmu_idx, tlb_size);
         return true;
     } else if (probe) {
         return false;
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
     return result;
 }
 
+/*
+ * Check if the address has required RWX privs when no PMP entry is matched.
+ */
+static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
+    target_ulong mode)
+{
+    bool ret;
+
+    if ((!riscv_feature(env, RISCV_FEATURE_PMP)) || (mode == PRV_M)) {
+        /*
+         * Privileged spec v1.10 states if HW doesn't implement any PMP entry
+         * or no PMP entry matches an M-Mode access, the access succeeds.
+         */
+        ret = true;
+        *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
+    } else {
+        /*
+         * Other modes are not allowed to succeed if they don't * match a rule,
+         * but there are rules. We've checked for no rule earlier in this
+         * function.
+         */
+        ret = false;
+        *allowed_privs = 0;
+    }
+
+    return ret;
+}
+
 
 /*
  * Public Interface
@@ -XXX,XX +XXX,XX @@ static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
  * Check if the address has required RWX privs to complete desired operation
  */
 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
-    target_ulong size, pmp_priv_t privs, target_ulong mode)
+    target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
+    target_ulong mode)
 {
     int i = 0;
     int ret = -1;
     int pmp_size = 0;
     target_ulong s = 0;
     target_ulong e = 0;
-    pmp_priv_t allowed_privs = 0;
 
     /* Short cut if no rules */
     if (0 == pmp_get_num_rules(env)) {
-        return (env->priv == PRV_M) ? true : false;
+        return pmp_hart_has_privs_default(env, addr, size, privs,
+                                          allowed_privs, mode);
     }
 
     if (size == 0) {
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
          * check
          */
         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
-            allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
+            *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
             if ((mode != PRV_M) || pmp_is_locked(env, i)) {
-                allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
+                *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
             }
 
-            if ((privs & allowed_privs) == privs) {
-                ret = 1;
-                break;
-            } else {
-                ret = 0;
-                break;
-            }
+            ret = ((privs & *allowed_privs) == privs);
+            break;
         }
     }
 
     /* No rule matched */
     if (ret == -1) {
-        if (mode == PRV_M) {
-            ret = 1; /* Privileged spec v1.10 states if no PMP entry matches an
-                      * M-Mode access, the access succeeds */
-        } else {
-            ret = 0; /* Other modes are not allowed to succeed if they don't
-                      * match a rule, but there are rules.  We've checked for
-                      * no rule earlier in this function. */
-        }
+        return pmp_hart_has_privs_default(env, addr, size, privs,
+                                          allowed_privs, mode);
     }
 
     return ret == 1 ? true : false;
 }
 
-
 /*
  * Handle a write to a pmpcfg CSP
  */
@@ -XXX,XX +XXX,XX @@ bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
 
     return false;
 }
+
+/*
+ * Convert PMP privilege to TLB page privilege.
+ */
+int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
+{
+    int prot = 0;
+
+    if (pmp_priv & PMP_READ) {
+        prot |= PAGE_READ;
+    }
+    if (pmp_priv & PMP_WRITE) {
+        prot |= PAGE_WRITE;
+    }
+    if (pmp_priv & PMP_EXEC) {
+        prot |= PAGE_EXEC;
+    }
+
+    return prot;
+}
-- 
2.30.1

From: Jim Shu <cwshu@andestech.com>

Like MMU translation, add qemu log of PMP permission checking for
debugging.

Signed-off-by: Jim Shu <cwshu@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1613916082-19528-3-git-send-email-cwshu@andestech.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
             if (ret == TRANSLATE_SUCCESS) {
                 ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
                                                size, access_type, mode);
+
+                qemu_log_mask(CPU_LOG_MMU,
+                              "%s PMP address=" TARGET_FMT_plx " ret %d prot"
+                              " %d tlb_size " TARGET_FMT_lu "\n",
+                              __func__, pa, ret, prot_pmp, tlb_size);
+
                 prot &= prot_pmp;
             }
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         if (ret == TRANSLATE_SUCCESS) {
             ret = get_physical_address_pmp(env, &prot_pmp, &tlb_size, pa,
                                            size, access_type, mode);
+
+            qemu_log_mask(CPU_LOG_MMU,
+                          "%s PMP address=" TARGET_FMT_plx " ret %d prot"
+                          " %d tlb_size " TARGET_FMT_lu "\n",
+                          __func__, pa, ret, prot_pmp, tlb_size);
+
             prot &= prot_pmp;
         }
     }
-- 
2.30.1

From: Jim Shu <cwshu@andestech.com>

If PMP permission of any address has been changed by updating PMP entry,
flush all TLB pages to prevent from getting old permission.

Signed-off-by: Jim Shu <cwshu@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 1613916082-19528-4-git-send-email-cwshu@andestech.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "cpu.h"
 #include "trace.h"
+#include "exec/exec-all.h"
 
 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
     uint8_t val);
@@ -XXX,XX +XXX,XX @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
         cfg_val = (val >> 8 * i)  & 0xff;
         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
     }
+
+    /* If PMP permission of any addr has been changed, flush TLB pages. */
+    tlb_flush(env_cpu(env));
 }
 
 
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

According to the specification the "field SPVP of hstatus controls the
privilege level of the access" for the hypervisor virtual-machine load
and store instructions HLV, HLVX and HSV.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311103005.1400718-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         use_background = true;
     }
 
-    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
+    /* MPRV does not affect the virtual-machine load/store
+       instructions, HLV, HLVX, and HSV. */
+    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
+        mode = get_field(env->hstatus, HSTATUS_SPVP);
+    } else if (mode == PRV_M && access_type != MMU_INST_FETCH) {
         if (get_field(env->mstatus, MSTATUS_MPRV)) {
             mode = get_field(env->mstatus, MSTATUS_MPP);
         }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n",
                   __func__, address, access_type, mmu_idx);
 
-    if (mode == PRV_M && access_type != MMU_INST_FETCH) {
-        if (get_field(env->mstatus, MSTATUS_MPRV)) {
-            mode = get_field(env->mstatus, MSTATUS_MPP);
+    /* MPRV does not affect the virtual-machine load/store
+       instructions, HLV, HLVX, and HSV. */
+    if (riscv_cpu_two_stage_lookup(mmu_idx)) {
+        mode = get_field(env->hstatus, HSTATUS_SPVP);
+    } else if (mode == PRV_M && access_type != MMU_INST_FETCH &&
+               get_field(env->mstatus, MSTATUS_MPRV)) {
+        mode = get_field(env->mstatus, MSTATUS_MPP);
+        if (riscv_has_ext(env, RVH) && get_field(env->mstatus, MSTATUS_MPV)) {
+            two_stage_lookup = true;
         }
     }
 
-    if (riscv_has_ext(env, RVH) && env->priv == PRV_M &&
-        access_type != MMU_INST_FETCH &&
-        get_field(env->mstatus, MSTATUS_MPRV) &&
-        get_field(env->mstatus, MSTATUS_MPV)) {
-        two_stage_lookup = true;
-    }
-
     if (riscv_cpu_virt_enabled(env) ||
         ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
          access_type != MMU_INST_FETCH)) {
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311094902.1377593-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_SD;
 static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
-static const target_ulong hip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
+static const target_ulong hip_writable_mask = MIP_VSSIP;
+static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
 static const target_ulong vsip_writable_mask = MIP_VSSIP;
 
 static const char valid_vm_1_10_32[16] = {
@@ -XXX,XX +XXX,XX @@ static int rmw_hvip(CPURISCVState *env, int csrno, target_ulong *ret_value,
                    target_ulong new_value, target_ulong write_mask)
 {
     int ret = rmw_mip(env, 0, ret_value, new_value,
-                      write_mask & hip_writable_mask);
+                      write_mask & hvip_writable_mask);
 
-    *ret_value &= hip_writable_mask;
+    *ret_value &= hvip_writable_mask;
 
     return ret;
 }
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

The current condition for the use of background registers only
considers the hypervisor load and store instructions,
but not accesses from M mode via MSTATUS_MPRV+MPV.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311103036.1401073-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: Asherah Connor <ashe@kivikakk.ee>

Provides fw_cfg for the virt machine on riscv.  This enables
using e.g.  ramfb later.

Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210318235041.17175-2-ashe@kivikakk.ee
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h |  2 ++
 hw/riscv/virt.c         | 30 ++++++++++++++++++++++++++++++
 hw/riscv/Kconfig        |  1 +
 3 files changed, 33 insertions(+)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
     RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
     DeviceState *plic[VIRT_SOCKETS_MAX];
     PFlashCFI01 *flash[2];
+    FWCfgState *fw_cfg;
 
     int fdt_size;
 };
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_PLIC,
     VIRT_UART0,
     VIRT_VIRTIO,
+    VIRT_FW_CFG,
     VIRT_FLASH,
     VIRT_DRAM,
     VIRT_PCIE_MMIO,
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
     [VIRT_PLIC] =        {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
     [VIRT_UART0] =       { 0x10000000,         0x100 },
     [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
+    [VIRT_FW_CFG] =      { 0x10100000,          0x18 },
     [VIRT_FLASH] =       { 0x20000000,     0x4000000 },
     [VIRT_PCIE_ECAM] =   { 0x30000000,    0x10000000 },
     [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
     return dev;
 }
 
+static FWCfgState *create_fw_cfg(const MachineState *mc)
+{
+    hwaddr base = virt_memmap[VIRT_FW_CFG].base;
+    hwaddr size = virt_memmap[VIRT_FW_CFG].size;
+    FWCfgState *fw_cfg;
+    char *nodename;
+
+    fw_cfg = fw_cfg_init_mem_wide(base + 8, base, 8, base + 16,
+                                  &address_space_memory);
+    fw_cfg_add_i16(fw_cfg, FW_CFG_NB_CPUS, (uint16_t)mc->smp.cpus);
+
+    nodename = g_strdup_printf("/fw-cfg@%" PRIx64, base);
+    qemu_fdt_add_subnode(mc->fdt, nodename);
+    qemu_fdt_setprop_string(mc->fdt, nodename,
+                            "compatible", "qemu,fw-cfg-mmio");
+    qemu_fdt_setprop_sized_cells(mc->fdt, nodename, "reg",
+                                 2, base, 2, size);
+    qemu_fdt_setprop(mc->fdt, nodename, "dma-coherent", NULL, 0);
+    g_free(nodename);
+    return fw_cfg;
+}
+
 static void virt_machine_init(MachineState *machine)
 {
     const MemMapEntry *memmap = virt_memmap;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         start_addr = virt_memmap[VIRT_FLASH].base;
     }
 
+    /*
+     * Init fw_cfg.  Must be done before riscv_load_fdt, otherwise the device
+     * tree cannot be altered and we get FDT_ERR_NOSPACE.
+     */
+    s->fw_cfg = create_fw_cfg(machine);
+    rom_set_fw(s->fw_cfg);
+
     /* Compute the fdt load address in dram */
     fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
                                    machine->ram_size, machine->fdt);
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select SIFIVE_PLIC
     select SIFIVE_TEST
     select VIRTIO_MMIO
+    select FW_CFG_DMA
 
 config SIFIVE_E
     bool
-- 
2.30.1

From: Asherah Connor <ashe@kivikakk.ee>

Allow ramfb on virt.  This lets `-device ramfb' work.

Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210318235041.17175-3-ashe@kivikakk.ee
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/pci/pci.h"
 #include "hw/pci-host/gpex.h"
+#include "hw/display/ramfb.h"
 
 static const MemMapEntry virt_memmap[] = {
     [VIRT_DEBUG] =       {        0x0,         0x100 },
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     mc->cpu_index_to_instance_props = riscv_numa_cpu_index_to_props;
     mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
     mc->numa_mem_supported = true;
+
+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
 }
 
 static const TypeInfo virt_machine_typeinfo = {
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

The previous implementation was broken in many ways:
 - Used mideleg instead of hideleg to mask accesses
 - Used MIP_VSSIP instead of VS_MODE_INTERRUPTS to mask writes to vsie
 - Did not shift between S bits and VS bits (VSEIP <-> SEIP, ...)

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210311094738.1376795-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 68 +++++++++++++++++++++++-----------------------
 1 file changed, 34 insertions(+), 34 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int write_sstatus(CPURISCVState *env, int csrno, target_ulong val)
     return write_mstatus(env, CSR_MSTATUS, newval);
 }
 
+static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
+{
+    /* Shift the VS bits to their S bit location in vsie */
+    *val = (env->mie & env->hideleg & VS_MODE_INTERRUPTS) >> 1;
+    return 0;
+}
+
 static int read_sie(CPURISCVState *env, int csrno, target_ulong *val)
 {
     if (riscv_cpu_virt_enabled(env)) {
-        /* Tell the guest the VS bits, shifted to the S bit locations */
-        *val = (env->mie & env->mideleg & VS_MODE_INTERRUPTS) >> 1;
+        read_vsie(env, CSR_VSIE, val);
     } else {
         *val = env->mie & env->mideleg;
     }
     return 0;
 }
 
-static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
+static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
 {
-    target_ulong newval;
+    /* Shift the S bits to their VS bit location in mie */
+    target_ulong newval = (env->mie & ~VS_MODE_INTERRUPTS) |
+                          ((val << 1) & env->hideleg & VS_MODE_INTERRUPTS);
+    return write_mie(env, CSR_MIE, newval);
+}
 
+static int write_sie(CPURISCVState *env, int csrno, target_ulong val)
+{
     if (riscv_cpu_virt_enabled(env)) {
-        /* Shift the guests S bits to VS */
-        newval = (env->mie & ~VS_MODE_INTERRUPTS) |
-                 ((val << 1) & VS_MODE_INTERRUPTS);
+        write_vsie(env, CSR_VSIE, val);
     } else {
-        newval = (env->mie & ~S_MODE_INTERRUPTS) | (val & S_MODE_INTERRUPTS);
+        target_ulong newval = (env->mie & ~S_MODE_INTERRUPTS) |
+                              (val & S_MODE_INTERRUPTS);
+        write_mie(env, CSR_MIE, newval);
     }
 
-    return write_mie(env, CSR_MIE, newval);
+    return 0;
 }
 
 static int read_stvec(CPURISCVState *env, int csrno, target_ulong *val)
@@ -XXX,XX +XXX,XX @@ static int write_sbadaddr(CPURISCVState *env, int csrno, target_ulong val)
     return 0;
 }
 
+static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
+                    target_ulong new_value, target_ulong write_mask)
+{
+    /* Shift the S bits to their VS bit location in mip */
+    int ret = rmw_mip(env, 0, ret_value, new_value << 1,
+                      (write_mask << 1) & vsip_writable_mask & env->hideleg);
+    *ret_value &= VS_MODE_INTERRUPTS;
+    /* Shift the VS bits to their S bit location in vsip */
+    *ret_value >>= 1;
+    return ret;
+}
+
 static int rmw_sip(CPURISCVState *env, int csrno, target_ulong *ret_value,
                    target_ulong new_value, target_ulong write_mask)
 {
     int ret;
 
     if (riscv_cpu_virt_enabled(env)) {
-        /* Shift the new values to line up with the VS bits */
-        ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value << 1,
-                      (write_mask & sip_writable_mask) << 1 & env->mideleg);
-        ret &= vsip_writable_mask;
-        ret >>= 1;
+        ret = rmw_vsip(env, CSR_VSIP, ret_value, new_value, write_mask);
     } else {
         ret = rmw_mip(env, CSR_MSTATUS, ret_value, new_value,
                       write_mask & env->mideleg & sip_writable_mask);
@@ -XXX,XX +XXX,XX @@ static int write_vsstatus(CPURISCVState *env, int csrno, target_ulong val)
     return 0;
 }
 
-static int rmw_vsip(CPURISCVState *env, int csrno, target_ulong *ret_value,
-                    target_ulong new_value, target_ulong write_mask)
-{
-    int ret = rmw_mip(env, 0, ret_value, new_value,
-                      write_mask & env->mideleg & vsip_writable_mask);
-    return ret;
-}
-
-static int read_vsie(CPURISCVState *env, int csrno, target_ulong *val)
-{
-    *val = env->mie & env->mideleg & VS_MODE_INTERRUPTS;
-    return 0;
-}
-
-static int write_vsie(CPURISCVState *env, int csrno, target_ulong val)
-{
-    target_ulong newval = (env->mie & ~env->mideleg) | (val & env->mideleg & MIP_VSSIP);
-    return write_mie(env, CSR_MIE, newval);
-}
-
 static int read_vstvec(CPURISCVState *env, int csrno, target_ulong *val)
 {
     *val = env->vstvec;
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

The current two-stage lookup detection in riscv_cpu_do_interrupt falls
short of its purpose, as all it checks is whether two-stage address
translation either via the hypervisor-load store instructions or the
MPRV feature would be allowed.

What we really need instead is whether two-stage address translation was
active when the exception was raised. However, in riscv_cpu_do_interrupt
we do not have the information to reliably detect this. Therefore, when
we raise a memory fault exception we have to record whether two-stage
address translation is active.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210319141459.1196741-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  4 ++++
 target/riscv/cpu.c        |  1 +
 target/riscv/cpu_helper.c | 21 ++++++++-------------
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
     target_ulong satp_hs;
     uint64_t mstatus_hs;
 
+    /* Signals whether the current exception occurred with two-stage address
+       translation active. */
+    bool two_stage_lookup;
+
     target_ulong scounteren;
     target_ulong mcounteren;
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
     env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
     env->mcause = 0;
     env->pc = env->resetvec;
+    env->two_stage_lookup = false;
 #endif
     cs->exception_index = EXCP_NONE;
     env->load_res = -1;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
         g_assert_not_reached();
     }
     env->badaddr = address;
+    env->two_stage_lookup = two_stage;
 }
 
 hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     }
 
     env->badaddr = addr;
+    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
+                            riscv_cpu_two_stage_lookup(mmu_idx);
     riscv_raise_exception(&cpu->env, cs->exception_index, retaddr);
 }
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
         g_assert_not_reached();
     }
     env->badaddr = addr;
+    env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
+                            riscv_cpu_two_stage_lookup(mmu_idx);
     riscv_raise_exception(env, cs->exception_index, retaddr);
 }
 #endif /* !CONFIG_USER_ONLY */
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         /* handle the trap in S-mode */
         if (riscv_has_ext(env, RVH)) {
             target_ulong hdeleg = async ? env->hideleg : env->hedeleg;
-            bool two_stage_lookup = false;
 
-            if (env->priv == PRV_M ||
-                (env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
-                (env->priv == PRV_U && !riscv_cpu_virt_enabled(env) &&
-                    get_field(env->hstatus, HSTATUS_HU))) {
-                    two_stage_lookup = true;
-            }
-
-            if ((riscv_cpu_virt_enabled(env) || two_stage_lookup) && write_tval) {
+            if (env->two_stage_lookup && write_tval) {
                 /*
                  * If we are writing a guest virtual address to stval, set
                  * this to 1. If we are trapping to VS we will set this to 0
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                 riscv_cpu_set_force_hs_excep(env, 0);
             } else {
                 /* Trap into HS mode */
-                if (!two_stage_lookup) {
-                    env->hstatus = set_field(env->hstatus, HSTATUS_SPV,
-                                             riscv_cpu_virt_enabled(env));
-                }
+                env->hstatus = set_field(env->hstatus, HSTATUS_SPV, false);
                 htval = env->guest_phys_fault_addr;
             }
         }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      * RISC-V ISA Specification.
      */
 
+    env->two_stage_lookup = false;
 #endif
     cs->exception_index = EXCP_NONE; /* mark handled to qemu */
 }
-- 
2.30.1

From: Bin Meng <bin.meng@windriver.com>

Per SST25VF016B datasheet [1], SST flash requires a dummy byte after
the address bytes. Note only SPI mode is supported by SST flashes.

[1] http://ww1.microchip.com/downloads/en/devicedoc/s71271_04.pdf

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210306060152.7250-1-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/block/m25p80.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@ static void decode_fast_read_cmd(Flash *s)
     s->needed_bytes = get_addr_length(s);
     switch (get_man(s)) {
     /* Dummy cycles - modeled with bytes writes instead of bits */
+    case MAN_SST:
+        s->needed_bytes += 1;
+        break;
     case MAN_WINBOND:
         s->needed_bytes += 8;
         break;
-- 
2.30.1

From: Bin Meng <bin.meng@windriver.com>

Since HSS commit c20a89f8dcac, the Icicle Kit reference design has
been updated to use a register mapped at 0x4f000000 instead of a
GPIO to control whether eMMC or SD card is to be used. With this
support the same HSS image can be used for both eMMC and SD card
boot flow, while previously two different board configurations were
used. This is undocumented but one can take a look at the HSS code
HSS_MMCInit() in services/mmc/mmc_api.c.

With this commit, HSS image built from 2020.12 release boots again.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210322075248.136255-1-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h | 1 +
 hw/riscv/microchip_pfsoc.c         | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_ENVM_DATA,
     MICROCHIP_PFSOC_QSPI_XIP,
     MICROCHIP_PFSOC_IOSCB,
+    MICROCHIP_PFSOC_EMMC_SD_MUX,
     MICROCHIP_PFSOC_DRAM_LO,
     MICROCHIP_PFSOC_DRAM_LO_ALIAS,
     MICROCHIP_PFSOC_DRAM_HI,
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
     [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
     [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,  0x1000000 },
     [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000, 0x10000000 },
+    [MICROCHIP_PFSOC_EMMC_SD_MUX] =     { 0x4f000000,        0x4 },
     [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000, 0x40000000 },
     [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000, 0x40000000 },
     [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,        0x0 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ioscb), 0,
                     memmap[MICROCHIP_PFSOC_IOSCB].base);
 
+    /* eMMC/SD mux */
+    create_unimplemented_device("microchip.pfsoc.emmc_sd_mux",
+        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].base,
+        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].size);
+
     /* QSPI Flash */
     memory_region_init_rom(qspi_xip_mem, OBJECT(dev),
                            "microchip.pfsoc.qspi_xip",
-- 
2.30.1

From: Bin Meng <bin.meng@windriver.com>

This adds the documentation to describe what is supported for the
'microchip-icicle-kit' machine, and how to boot the machine in QEMU.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210322075248.136255-2-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/microchip-icicle-kit.rst | 89 ++++++++++++++++++++++
 docs/system/target-riscv.rst               |  1 +
 2 files changed, 90 insertions(+)
 create mode 100644 docs/system/riscv/microchip-icicle-kit.rst

diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/riscv/microchip-icicle-kit.rst
@@ -XXX,XX +XXX,XX @@
+Microchip PolarFire SoC Icicle Kit (``microchip-icicle-kit``)
+=============================================================
+
+Microchip PolarFire SoC Icicle Kit integrates a PolarFire SoC, with one
+SiFive's E51 plus four U54 cores and many on-chip peripherals and an FPGA.
+
+For more details about Microchip PolarFire SoC, please see:
+https://www.microsemi.com/product-directory/soc-fpgas/5498-polarfire-soc-fpga
+
+The Icicle Kit board information can be found here:
+https://www.microsemi.com/existing-parts/parts/152514
+
+Supported devices
+-----------------
+
+The ``microchip-icicle-kit`` machine supports the following devices:
+
+ * 1 E51 core
+ * 4 U54 cores
+ * Core Level Interruptor (CLINT)
+ * Platform-Level Interrupt Controller (PLIC)
+ * L2 Loosely Integrated Memory (L2-LIM)
+ * DDR memory controller
+ * 5 MMUARTs
+ * 1 DMA controller
+ * 2 GEM Ethernet controllers
+ * 1 SDHC storage controller
+
+Boot options
+------------
+
+The ``microchip-icicle-kit`` machine can start using the standard -bios
+functionality for loading its BIOS image, aka Hart Software Services (HSS_).
+HSS loads the second stage bootloader U-Boot from an SD card. It does not
+support direct kernel loading via the -kernel option. One has to load kernel
+from U-Boot.
+
+The memory is set to 1537 MiB by default which is the minimum required high
+memory size by HSS. A sanity check on ram size is performed in the machine
+init routine to prompt user to increase the RAM size to > 1537 MiB when less
+than 1537 MiB ram is detected.
+
+Boot the machine
+----------------
+
+HSS 2020.12 release is tested at the time of writing. To build an HSS image
+that can be booted by the ``microchip-icicle-kit`` machine, type the following
+in the HSS source tree:
+
+.. code-block:: bash
+
+  $ export CROSS_COMPILE=riscv64-linux-
+  $ cp boards/mpfs-icicle-kit-es/def_config .config
+  $ make BOARD=mpfs-icicle-kit-es
+
+Download the official SD card image released by Microchip and prepare it for
+QEMU usage:
+
+.. code-block:: bash
+
+  $ wget ftp://ftpsoc.microsemi.com/outgoing/core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
+  $ gunzip core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic.gz
+  $ qemu-img resize core-image-minimal-dev-icicle-kit-es-sd-20201009141623.rootfs.wic 4G
+
+Then we can boot the machine by:
+
+.. code-block:: bash
+
+  $ qemu-system-riscv64 -M microchip-icicle-kit -smp 5 \
+      -bios path/to/hss.bin -sd path/to/sdcard.img \
+      -nic user,model=cadence_gem \
+      -nic tap,ifname=tap,model=cadence_gem,script=no \
+      -display none -serial stdio \
+      -chardev socket,id=serial1,path=serial1.sock,server=on,wait=on \
+      -serial chardev:serial1
+
+With above command line, current terminal session will be used for the first
+serial port. Open another terminal window, and use `minicom` to connect the
+second serial port.
+
+.. code-block:: bash
+
+  $ minicom -D unix\#serial1.sock
+
+HSS output is on the first serial port (stdio) and U-Boot outputs on the
+second serial port. U-Boot will automatically load the Linux kernel from
+the SD card image.
+
+.. _HSS: https://github.com/polarfire-soc/hart-software-services
diff --git a/docs/system/target-riscv.rst b/docs/system/target-riscv.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-riscv.rst
+++ b/docs/system/target-riscv.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
 .. toctree::
    :maxdepth: 1
 
+   riscv/microchip-icicle-kit
    riscv/sifive_u
 
 RISC-V CPU features
-- 
2.30.1

From: Georg Kotheimer <georg.kotheimer@kernkonzept.com>

When decode_insn16() fails, we fall back to decode_RV32_64C() for
further compressed instruction decoding. However, prior to this change,
we did not raise an illegal instruction exception, if decode_RV32_64C()
fails to decode the instruction. This means that we skipped illegal
compressed instructions instead of raising an illegal instruction
exception.

Instead of patching decode_RV32_64C(), we can just remove it,
as it is dead code since f330433b363 anyway.

Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210322121609.3097928-1-georg.kotheimer@kernkonzept.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c | 179 +--------------------------------------
 1 file changed, 1 insertion(+), 178 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     CPUState *cs;
 } DisasContext;
 
-#ifdef TARGET_RISCV64
-/* convert riscv funct3 to qemu memop for load/store */
-static const int tcg_memop_lookup[8] = {
-    [0 ... 7] = -1,
-    [0] = MO_SB,
-    [1] = MO_TESW,
-    [2] = MO_TESL,
-    [3] = MO_TEQ,
-    [4] = MO_UB,
-    [5] = MO_TEUW,
-    [6] = MO_TEUL,
-};
-#endif
-
 #ifdef TARGET_RISCV64
 #define CASE_OP_32_64(X) case X: case glue(X, W)
 #else
@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
-#ifdef TARGET_RISCV64
-static void gen_load_c(DisasContext *ctx, uint32_t opc, int rd, int rs1,
-        target_long imm)
-{
-    TCGv t0 = tcg_temp_new();
-    TCGv t1 = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
-
-    if (memop < 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    tcg_gen_qemu_ld_tl(t1, t0, ctx->mem_idx, memop);
-    gen_set_gpr(rd, t1);
-    tcg_temp_free(t0);
-    tcg_temp_free(t1);
-}
-
-static void gen_store_c(DisasContext *ctx, uint32_t opc, int rs1, int rs2,
-        target_long imm)
-{
-    TCGv t0 = tcg_temp_new();
-    TCGv dat = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-    gen_get_gpr(dat, rs2);
-    int memop = tcg_memop_lookup[(opc >> 12) & 0x7];
-
-    if (memop < 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    tcg_gen_qemu_st_tl(dat, t0, ctx->mem_idx, memop);
-    tcg_temp_free(t0);
-    tcg_temp_free(dat);
-}
-#endif
-
 #ifndef CONFIG_USER_ONLY
 /* The states of mstatus_fs are:
  * 0 = disabled, 1 = initial, 2 = clean, 3 = dirty
@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
 static inline void mark_fs_dirty(DisasContext *ctx) { }
 #endif
 
-#if !defined(TARGET_RISCV64)
-static void gen_fp_load(DisasContext *ctx, uint32_t opc, int rd,
-        int rs1, target_long imm)
-{
-    TCGv t0;
-
-    if (ctx->mstatus_fs == 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    t0 = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-
-    switch (opc) {
-    case OPC_RISC_FLW:
-        if (!has_ext(ctx, RVF)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEUL);
-        /* RISC-V requires NaN-boxing of narrower width floating point values */
-        tcg_gen_ori_i64(cpu_fpr[rd], cpu_fpr[rd], 0xffffffff00000000ULL);
-        break;
-    case OPC_RISC_FLD:
-        if (!has_ext(ctx, RVD)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_ld_i64(cpu_fpr[rd], t0, ctx->mem_idx, MO_TEQ);
-        break;
-    do_illegal:
-    default:
-        gen_exception_illegal(ctx);
-        break;
-    }
-    tcg_temp_free(t0);
-
-    mark_fs_dirty(ctx);
-}
-
-static void gen_fp_store(DisasContext *ctx, uint32_t opc, int rs1,
-        int rs2, target_long imm)
-{
-    TCGv t0;
-
-    if (ctx->mstatus_fs == 0) {
-        gen_exception_illegal(ctx);
-        return;
-    }
-
-    t0 = tcg_temp_new();
-    gen_get_gpr(t0, rs1);
-    tcg_gen_addi_tl(t0, t0, imm);
-
-    switch (opc) {
-    case OPC_RISC_FSW:
-        if (!has_ext(ctx, RVF)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEUL);
-        break;
-    case OPC_RISC_FSD:
-        if (!has_ext(ctx, RVD)) {
-            goto do_illegal;
-        }
-        tcg_gen_qemu_st_i64(cpu_fpr[rs2], t0, ctx->mem_idx, MO_TEQ);
-        break;
-    do_illegal:
-    default:
-        gen_exception_illegal(ctx);
-        break;
-    }
-
-    tcg_temp_free(t0);
-}
-#endif
-
 static void gen_set_rm(DisasContext *ctx, int rm)
 {
     TCGv_i32 t0;
@@ -XXX,XX +XXX,XX @@ static void gen_set_rm(DisasContext *ctx, int rm)
     tcg_temp_free_i32(t0);
 }
 
-static void decode_RV32_64C0(DisasContext *ctx, uint16_t opcode)
-{
-    uint8_t funct3 = extract16(opcode, 13, 3);
-    uint8_t rd_rs2 = GET_C_RS2S(opcode);
-    uint8_t rs1s = GET_C_RS1S(opcode);
-
-    switch (funct3) {
-    case 3:
-#if defined(TARGET_RISCV64)
-        /* C.LD(RV64/128) -> ld rd', offset[7:3](rs1')*/
-        gen_load_c(ctx, OPC_RISC_LD, rd_rs2, rs1s,
-                 GET_C_LD_IMM(opcode));
-#else
-        /* C.FLW (RV32) -> flw rd', offset[6:2](rs1')*/
-        gen_fp_load(ctx, OPC_RISC_FLW, rd_rs2, rs1s,
-                    GET_C_LW_IMM(opcode));
-#endif
-        break;
-    case 7:
-#if defined(TARGET_RISCV64)
-        /* C.SD (RV64/128) -> sd rs2', offset[7:3](rs1')*/
-        gen_store_c(ctx, OPC_RISC_SD, rs1s, rd_rs2,
-                  GET_C_LD_IMM(opcode));
-#else
-        /* C.FSW (RV32) -> fsw rs2', offset[6:2](rs1')*/
-        gen_fp_store(ctx, OPC_RISC_FSW, rs1s, rd_rs2,
-                     GET_C_LW_IMM(opcode));
-#endif
-        break;
-    }
-}
-
-static void decode_RV32_64C(DisasContext *ctx, uint16_t opcode)
-{
-    uint8_t op = extract16(opcode, 0, 2);
-
-    switch (op) {
-    case 0:
-        decode_RV32_64C0(ctx, opcode);
-        break;
-    }
-}
-
 static int ex_plus_1(DisasContext *ctx, int nf)
 {
     return nf + 1;
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
         } else {
             ctx->pc_succ_insn = ctx->base.pc_next + 2;
             if (!decode_insn16(ctx, opcode)) {
-                /* fall back to old decoder */
-                decode_RV32_64C(ctx, opcode);
+                gen_exception_illegal(ctx);
             }
         }
     } else {
-- 
2.30.1

From: Alistair Francis <alistair.francis@wdc.com>

The following changes since commit 99d6b11b5b44d7dd64f4cb1973184e40a4a174f8:

Merge tag 'pull-target-arm-20220922' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2022-09-26 13:38:26 -0400)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20220927

for you to fetch changes up to a3ab69f9f6c000481c439923d16416b8941d5b37:

target/riscv: rvv-1.0: vf[w]redsum distinguish between ordered/unordered (2022-09-27 11:23:57 +1000)

----------------------------------------------------------------
Second RISC-V PR for QEMU 7.2

* Fixup typos and register addresses for Ibex SPI
* Cleanup the RISC-V virt machine documentation
* Remove the sideleg and sedeleg CSR macros
* Fix the CSR check for cycle{h}, instret{h}, time{h}, hpmcounter3-31{h}
* Remove fixed numbering from GDB xml feature files
* Allow setting the resetvec for the OpenTitan machine
* Check the correct exception cause in vector GDB stub
* Fix inheritance of SiFiveEState
* Improvements to the RISC-V debugger spec
* Simplify some vector code

----------------------------------------------------------------
Alex Bennée (1):
      docs/system: clean up code escape for riscv virt platform

Alistair Francis (3):
      target/riscv: Set the CPU resetvec directly
      hw/riscv: opentitan: Fixup resetvec
      hw/riscv: opentitan: Expose the resetvec as a SoC property

Andrew Burgess (2):
      target/riscv: remove fflags, frm, and fcsr from riscv-*-fpu.xml
      target/riscv: remove fixed numbering from GDB xml feature files

Bernhard Beschow (1):
      hw/riscv/sifive_e: Fix inheritance of SiFiveEState

Frank Chang (9):
      target/riscv: Check the correct exception cause in vector GDB stub
      target/riscv: debug: Determine the trigger type from tdata1.type
      target/riscv: debug: Introduce build_tdata1() to build tdata1 register content
      target/riscv: debug: Introduce tdata1, tdata2, and tdata3 CSRs
      target/riscv: debug: Restrict the range of tselect value can be written
      target/riscv: debug: Introduce tinfo CSR
      target/riscv: debug: Create common trigger actions function
      target/riscv: debug: Check VU/VS modes for type 2 trigger
      target/riscv: debug: Add initial support of type 6 trigger

Rahul Pathak (1):
      target/riscv: Remove sideleg and sedeleg

Weiwei Li (1):
      target/riscv: fix csr check for cycle{h}, instret{h}, time{h}, hpmcounter3-31{h}

Wilfred Mallawa (2):
      hw/ssi: ibex_spi: fixup typos in ibex_spi_host
      hw/ssi: ibex_spi: update reg addr

Yang Liu (2):
      target/riscv: rvv-1.0: Simplify vfwredsum code
      target/riscv: rvv-1.0: vf[w]redsum distinguish between ordered/unordered

From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

This patch fixes up minor typos in ibex_spi_host

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-Id: <20220823061201.132342-2-wilfred.mallawa@opensource.wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/ssi/ibex_spi_host.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/ssi/ibex_spi_host.c b/hw/ssi/ibex_spi_host.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/ibex_spi_host.c
+++ b/hw/ssi/ibex_spi_host.c
@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_irq(IbexSPIHostState *s)
                         & R_INTR_STATE_SPI_EVENT_MASK;
     int err_irq = 0, event_irq = 0;
 
-    /* Error IRQ enabled and Error IRQ Cleared*/
+    /* Error IRQ enabled and Error IRQ Cleared */
     if (error_en && !err_pending) {
         /* Event enabled, Interrupt Test Error */
         if (s->regs[IBEX_SPI_HOST_INTR_TEST] & R_INTR_TEST_ERROR_MASK) {
@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_write(void *opaque, hwaddr addr,
     case IBEX_SPI_HOST_TXDATA:
         /*
          * This is a hardware `feature` where
-         * the first word written TXDATA after init is omitted entirely
+         * the first word written to TXDATA after init is omitted entirely
          */
         if (s->init_status) {
             s->init_status = false;
@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_write(void *opaque, hwaddr addr,
         break;
     case IBEX_SPI_HOST_ERROR_STATUS:
     /*
-     *  Indicates that any errors that have occurred.
+     *  Indicates any errors that have occurred.
      *  When an error occurs, the corresponding bit must be cleared
      *  here before issuing any further commands
      */
-- 
2.37.3

From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

Updates the `EVENT_ENABLE` register to offset `0x34` as per
OpenTitan spec [1].

[1] https://docs.opentitan.org/hw/ip/spi_host/doc/#Reg_event_enable

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220823061201.132342-5-wilfred.mallawa@opensource.wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/ssi/ibex_spi_host.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ssi/ibex_spi_host.c b/hw/ssi/ibex_spi_host.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/ibex_spi_host.c
+++ b/hw/ssi/ibex_spi_host.c
@@ -XXX,XX +XXX,XX @@ REG32(ERROR_STATUS, 0x30)
     FIELD(ERROR_STATUS, CMDINVAL, 3, 1)
     FIELD(ERROR_STATUS, CSIDINVAL, 4, 1)
     FIELD(ERROR_STATUS, ACCESSINVAL, 5, 1)
-REG32(EVENT_ENABLE, 0x30)
+REG32(EVENT_ENABLE, 0x34)
     FIELD(EVENT_ENABLE, RXFULL, 0, 1)
     FIELD(EVENT_ENABLE, TXEMPTY, 1, 1)
     FIELD(EVENT_ENABLE, RXWM, 2, 1)
-- 
2.37.3

From: Alex Bennée <alex.bennee@linaro.org>

The example code is rendered slightly mangled due to missing code
block. Properly escape the code block and add shell prompt and qemu to
fit in with the other examples on the page.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220905163939.1599368-1-alex.bennee@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/virt.rst | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ Enabling TPM
 
 A TPM device can be connected to the virt board by following the steps below.
 
-First launch the TPM emulator
+First launch the TPM emulator:
 
-    swtpm socket --tpm2 -t -d --tpmstate dir=/tmp/tpm \
+.. code-block:: bash
+
+  $ swtpm socket --tpm2 -t -d --tpmstate dir=/tmp/tpm \
         --ctrl type=unixio,path=swtpm-sock
 
-Then launch QEMU with:
+Then launch QEMU with some additional arguments to link a TPM device to the backend:
+
+.. code-block:: bash
 
-    ...
+  $ qemu-system-riscv64 \
+    ... other args .... \
     -chardev socket,id=chrtpm,path=swtpm-sock \
     -tpmdev emulator,id=tpm0,chardev=chrtpm \
     -device tpm-tis-device,tpmdev=tpm0
-- 
2.37.3

From: Rahul Pathak <rpathak@ventanamicro.com>

sideleg and sedeleg csrs are not part of riscv isa spec
anymore, these csrs were part of N extension which
is removed from the riscv isa specification.

These commits removed all traces of these csrs from
riscv spec (https://github.com/riscv/riscv-isa-manual) -

commit f8d27f805b65 ("Remove or downgrade more references to N extension (#674)")
commit b6cade07034d ("Remove N extension chapter for now")

Signed-off-by: Rahul Pathak <rpathak@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220824145255.400040-1-rpathak@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h | 2 --
 disas/riscv.c           | 2 --
 2 files changed, 4 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 
 /* Supervisor Trap Setup */
 #define CSR_SSTATUS         0x100
-#define CSR_SEDELEG         0x102
-#define CSR_SIDELEG         0x103
 #define CSR_SIE             0x104
 #define CSR_STVEC           0x105
 #define CSR_SCOUNTEREN      0x106
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
     case 0x0043: return "utval";
     case 0x0044: return "uip";
     case 0x0100: return "sstatus";
-    case 0x0102: return "sedeleg";
-    case 0x0103: return "sideleg";
     case 0x0104: return "sie";
     case 0x0105: return "stvec";
     case 0x0106: return "scounteren";
-- 
2.37.3

From: Weiwei Li <liweiwei@iscas.ac.cn>

- modify check for mcounteren to work in all less-privilege mode
- modify check for scounteren to work only when S mode is enabled
- distinguish the exception type raised by check for scounteren between U
and VU mode

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220817083756.12471-1-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 
 skip_ext_pmu_check:
 
-    if (((env->priv == PRV_S) && (!get_field(env->mcounteren, ctr_mask))) ||
-        ((env->priv == PRV_U) && (!get_field(env->scounteren, ctr_mask)))) {
+    if (env->priv < PRV_M && !get_field(env->mcounteren, ctr_mask)) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
     if (riscv_cpu_virt_enabled(env)) {
-        if (!get_field(env->hcounteren, ctr_mask) &&
-            get_field(env->mcounteren, ctr_mask)) {
+        if (!get_field(env->hcounteren, ctr_mask) ||
+            (env->priv == PRV_U && !get_field(env->scounteren, ctr_mask))) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
     }
+
+    if (riscv_has_ext(env, RVS) && env->priv == PRV_U &&
+        !get_field(env->scounteren, ctr_mask)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
 #endif
     return RISCV_EXCP_NONE;
 }
-- 
2.37.3

From: Andrew Burgess <aburgess@redhat.com>

While testing some changes to GDB's handling for the RISC-V registers
fcsr, fflags, and frm, I spotted that QEMU includes these registers
twice in the target description it sends to GDB, once in the fpu
feature, and once in the csr feature.

Right now things basically work OK, QEMU maps these registers onto two
different register numbers, e.g. fcsr maps to both 68 and 73, and GDB
can use either of these to access the register.

However, GDB's target descriptions don't really work this way, each
register should appear just once in a target description, mapping the
register name onto the number GDB should use when accessing the
register on the target.  Duplicate register names actually result in
duplicate registers on the GDB side, however, as the registers have
the same name, the user can only access one of these registers.

Currently GDB has a hack in place, specifically for RISC-V, to spot
the duplicate copies of these three registers, and hide them from the
user, ensuring the user only ever sees a single copy of each.

In this commit I propose fixing this issue on the QEMU side, and in
the process, simplify the fpu register handling a little.

I think we should, remove fflags, frm, and fcsr from the two (32-bit
and 64-bit) fpu feature xml files.  These files will only contain the
32 core floating point register f0 to f31.  The fflags, frm, and fcsr
registers will continue to be advertised in the csr feature as they
currently are.

With that change made, I will simplify riscv_gdb_get_fpu and
riscv_gdb_set_fpu, removing the extra handling for the 3 status
registers.

Signed-off-by: Andrew Burgess <aburgess@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <0fbf2a5b12e3210ff3867d5cf7022b3f3462c9c8.1661934573.git.aburgess@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/gdbstub.c      | 32 ++------------------------------
 gdb-xml/riscv-32bit-fpu.xml |  4 ----
 gdb-xml/riscv-64bit-fpu.xml |  4 ----
 3 files changed, 2 insertions(+), 38 deletions(-)

diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_get_fpu(CPURISCVState *env, GByteArray *buf, int n)
         if (env->misa_ext & RVF) {
             return gdb_get_reg32(buf, env->fpr[n]);
         }
-    /* there is hole between ft11 and fflags in fpu.xml */
-    } else if (n < 36 && n > 32) {
-        target_ulong val = 0;
-        int result;
-        /*
-         * CSR_FFLAGS is at index 1 in csr_register, and gdb says it is FP
-         * register 33, so we recalculate the map index.
-         * This also works for CSR_FRM and CSR_FCSR.
-         */
-        result = riscv_csrrw_debug(env, n - 32, &val,
-                                   0, 0);
-        if (result == RISCV_EXCP_NONE) {
-            return gdb_get_regl(buf, val);
-        }
     }
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ static int riscv_gdb_set_fpu(CPURISCVState *env, uint8_t *mem_buf, int n)
     if (n < 32) {
         env->fpr[n] = ldq_p(mem_buf); /* always 64-bit */
         return sizeof(uint64_t);
-    /* there is hole between ft11 and fflags in fpu.xml */
-    } else if (n < 36 && n > 32) {
-        target_ulong val = ldtul_p(mem_buf);
-        int result;
-        /*
-         * CSR_FFLAGS is at index 1 in csr_register, and gdb says it is FP
-         * register 33, so we recalculate the map index.
-         * This also works for CSR_FRM and CSR_FCSR.
-         */
-        result = riscv_csrrw_debug(env, n - 32, NULL,
-                                   val, -1);
-        if (result == RISCV_EXCP_NONE) {
-            return sizeof(target_ulong);
-        }
     }
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
     CPURISCVState *env = &cpu->env;
     if (env->misa_ext & RVD) {
         gdb_register_coprocessor(cs, riscv_gdb_get_fpu, riscv_gdb_set_fpu,
-                                 36, "riscv-64bit-fpu.xml", 0);
+                                 32, "riscv-64bit-fpu.xml", 0);
     } else if (env->misa_ext & RVF) {
         gdb_register_coprocessor(cs, riscv_gdb_get_fpu, riscv_gdb_set_fpu,
-                                 36, "riscv-32bit-fpu.xml", 0);
+                                 32, "riscv-32bit-fpu.xml", 0);
     }
     if (env->misa_ext & RVV) {
         gdb_register_coprocessor(cs, riscv_gdb_get_vector, riscv_gdb_set_vector,
diff --git a/gdb-xml/riscv-32bit-fpu.xml b/gdb-xml/riscv-32bit-fpu.xml
index XXXXXXX..XXXXXXX 100644
--- a/gdb-xml/riscv-32bit-fpu.xml
+++ b/gdb-xml/riscv-32bit-fpu.xml
@@ -XXX,XX +XXX,XX @@
   <reg name="ft9" bitsize="32" type="ieee_single"/>
   <reg name="ft10" bitsize="32" type="ieee_single"/>
   <reg name="ft11" bitsize="32" type="ieee_single"/>
-
-  <reg name="fflags" bitsize="32" type="int" regnum="66"/>
-  <reg name="frm" bitsize="32" type="int" regnum="67"/>
-  <reg name="fcsr" bitsize="32" type="int" regnum="68"/>
 </feature>
diff --git a/gdb-xml/riscv-64bit-fpu.xml b/gdb-xml/riscv-64bit-fpu.xml
index XXXXXXX..XXXXXXX 100644
--- a/gdb-xml/riscv-64bit-fpu.xml
+++ b/gdb-xml/riscv-64bit-fpu.xml
@@ -XXX,XX +XXX,XX @@
   <reg name="ft9" bitsize="64" type="riscv_double"/>
   <reg name="ft10" bitsize="64" type="riscv_double"/>
   <reg name="ft11" bitsize="64" type="riscv_double"/>
-
-  <reg name="fflags" bitsize="32" type="int" regnum="66"/>
-  <reg name="frm" bitsize="32" type="int" regnum="67"/>
-  <reg name="fcsr" bitsize="32" type="int" regnum="68"/>
 </feature>
-- 
2.37.3

From: Andrew Burgess <aburgess@redhat.com>

The fixed register numbering in the various GDB feature files for
RISC-V only exists because these files were originally copied from the
GDB source tree.

However, the fixed numbering only exists in the GDB source tree so
that GDB, when it connects to a target that doesn't provide a target
description, will use a specific numbering scheme.

That numbering scheme is designed to be compatible with the first
versions of QEMU (for RISC-V), that didn't send a target description,
and relied on a fixed numbering scheme.

Because of the way that QEMU manages its target descriptions,
recording the number of registers in each feature, and just relying on
GDB's numbering starting from 0, then I propose that we remove all the
fixed numbering from the RISC-V feature xml files, and just rely on
the standard numbering scheme.  Plenty of other targets manage their
xml files this way, e.g. ARM, AArch64, Loongarch, m68k, rx, and s390.

Signed-off-by: Andrew Burgess <aburgess@redhat.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Palmer Dabbelt <palmer@rivosinc.com>
Message-Id: <6069395f90e6fc24dac92197be815fedf42f5974.1661934573.git.aburgess@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 gdb-xml/riscv-32bit-cpu.xml | 6 +-----
 gdb-xml/riscv-32bit-fpu.xml | 6 +-----
 gdb-xml/riscv-64bit-cpu.xml | 6 +-----
 gdb-xml/riscv-64bit-fpu.xml | 6 +-----
 4 files changed, 4 insertions(+), 20 deletions(-)

diff --git a/gdb-xml/riscv-32bit-cpu.xml b/gdb-xml/riscv-32bit-cpu.xml
index XXXXXXX..XXXXXXX 100644
--- a/gdb-xml/riscv-32bit-cpu.xml
+++ b/gdb-xml/riscv-32bit-cpu.xml
@@ -XXX,XX +XXX,XX @@
      are permitted in any medium without royalty provided the copyright
      notice and this notice are preserved.  -->
 
-
-
 <!DOCTYPE feature SYSTEM "gdb-target.dtd">
 <feature name="org.gnu.gdb.riscv.cpu">
-  <reg name="zero" bitsize="32" type="int" regnum="0"/>
+  <reg name="zero" bitsize="32" type="int"/>
   <reg name="ra" bitsize="32" type="code_ptr"/>
   <reg name="sp" bitsize="32" type="data_ptr"/>
   <reg name="gp" bitsize="32" type="data_ptr"/>
diff --git a/gdb-xml/riscv-32bit-fpu.xml b/gdb-xml/riscv-32bit-fpu.xml
index XXXXXXX..XXXXXXX 100644
--- a/gdb-xml/riscv-32bit-fpu.xml
+++ b/gdb-xml/riscv-32bit-fpu.xml
@@ -XXX,XX +XXX,XX @@
      are permitted in any medium without royalty provided the copyright
      notice and this notice are preserved.  -->
 
-
-
 <!DOCTYPE feature SYSTEM "gdb-target.dtd">
 <feature name="org.gnu.gdb.riscv.fpu">
-  <reg name="ft0" bitsize="32" type="ieee_single" regnum="33"/>
+  <reg name="ft0" bitsize="32" type="ieee_single"/>
   <reg name="ft1" bitsize="32" type="ieee_single"/>
   <reg name="ft2" bitsize="32" type="ieee_single"/>
   <reg name="ft3" bitsize="32" type="ieee_single"/>
diff --git a/gdb-xml/riscv-64bit-cpu.xml b/gdb-xml/riscv-64bit-cpu.xml
index XXXXXXX..XXXXXXX 100644
--- a/gdb-xml/riscv-64bit-cpu.xml
+++ b/gdb-xml/riscv-64bit-cpu.xml
@@ -XXX,XX +XXX,XX @@
      are permitted in any medium without royalty provided the copyright
      notice and this notice are preserved.  -->
 
-
-
 <!DOCTYPE feature SYSTEM "gdb-target.dtd">
 <feature name="org.gnu.gdb.riscv.cpu">
-  <reg name="zero" bitsize="64" type="int" regnum="0"/>
+  <reg name="zero" bitsize="64" type="int"/>
   <reg name="ra" bitsize="64" type="code_ptr"/>
   <reg name="sp" bitsize="64" type="data_ptr"/>
   <reg name="gp" bitsize="64" type="data_ptr"/>
diff --git a/gdb-xml/riscv-64bit-fpu.xml b/gdb-xml/riscv-64bit-fpu.xml
index XXXXXXX..XXXXXXX 100644
--- a/gdb-xml/riscv-64bit-fpu.xml
+++ b/gdb-xml/riscv-64bit-fpu.xml
@@ -XXX,XX +XXX,XX @@
      are permitted in any medium without royalty provided the copyright
      notice and this notice are preserved.  -->
 
-
-
 <!DOCTYPE feature SYSTEM "gdb-target.dtd">
 <feature name="org.gnu.gdb.riscv.fpu">
 
@@ -XXX,XX +XXX,XX @@
     <field name="double" type="ieee_double"/>
   </union>
 
-  <reg name="ft0" bitsize="64" type="riscv_double" regnum="33"/>
+  <reg name="ft0" bitsize="64" type="riscv_double"/>
   <reg name="ft1" bitsize="64" type="riscv_double"/>
   <reg name="ft2" bitsize="64" type="riscv_double"/>
   <reg name="ft3" bitsize="64" type="riscv_double"/>
-- 
2.37.3

From: Alistair Francis <alistair.francis@wdc.com>

Instead of using our properties to set a config value which then might
be used to set the resetvec (depending on your timing), let's instead
just set the resetvec directly in the env struct.

This allows us to set the reset vec from the command line with:
    -global driver=riscv.hart_array,property=resetvec,value=0x20000400

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20220914101108.82571-2-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h     |  3 +--
 target/riscv/cpu.c     | 13 +++----------
 target/riscv/machine.c |  6 +++---
 3 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     /* This contains QEMU specific information about the virt state. */
     target_ulong virt;
     target_ulong geilen;
-    target_ulong resetvec;
+    uint64_t resetvec;
 
     target_ulong mhartid;
     /*
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool pmp;
     bool epmp;
     bool debug;
-    uint64_t resetvec;
 
     bool short_isa_string;
 };
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void set_vext_version(CPURISCVState *env, int vext_ver)
     env->vext_ver = vext_ver;
 }
 
-static void set_resetvec(CPURISCVState *env, target_ulong resetvec)
-{
-#ifndef CONFIG_USER_ONLY
-    env->resetvec = resetvec;
-#endif
-}
-
 static void riscv_any_cpu_init(Object *obj)
 {
     CPURISCVState *env = &RISCV_CPU(obj)->env;
@@ -XXX,XX +XXX,XX @@ static void rv32_imafcu_nommu_cpu_init(Object *obj)
 
     set_misa(env, MXL_RV32, RVI | RVM | RVA | RVF | RVC | RVU);
     set_priv_version(env, PRIV_VERSION_1_10_0);
-    set_resetvec(env, DEFAULT_RSTVEC);
     cpu->cfg.mmu = false;
 }
 #endif
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         riscv_set_feature(env, RISCV_FEATURE_DEBUG);
     }
 
-    set_resetvec(env, cpu->cfg.resetvec);
 
 #ifndef CONFIG_USER_ONLY
     if (cpu->cfg.ext_sstc) {
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
     DEFINE_PROP_UINT64("mimpid", RISCVCPU, cfg.mimpid, RISCV_CPU_MIMPID),
 
-    DEFINE_PROP_UINT64("resetvec", RISCVCPU, cfg.resetvec, DEFAULT_RSTVEC),
+#ifndef CONFIG_USER_ONLY
+    DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
+#endif
 
     DEFINE_PROP_BOOL("short-isa-string", RISCVCPU, cfg.short_isa_string, false),
 
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pmu_ctr_state = {
 
 const VMStateDescription vmstate_riscv_cpu = {
     .name = "cpu",
-    .version_id = 4,
-    .minimum_version_id = 4,
+    .version_id = 5,
+    .minimum_version_id = 5,
     .post_load = riscv_cpu_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINTTL_ARRAY(env.gpr, RISCVCPU, 32),
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
         VMSTATE_UINT32(env.features, RISCVCPU),
         VMSTATE_UINTTL(env.priv, RISCVCPU),
         VMSTATE_UINTTL(env.virt, RISCVCPU),
-        VMSTATE_UINTTL(env.resetvec, RISCVCPU),
+        VMSTATE_UINT64(env.resetvec, RISCVCPU),
         VMSTATE_UINTTL(env.mhartid, RISCVCPU),
         VMSTATE_UINT64(env.mstatus, RISCVCPU),
         VMSTATE_UINT64(env.mip, RISCVCPU),
-- 
2.37.3

From: Alistair Francis <alistair.francis@wdc.com>

The resetvec for the OpenTitan machine ended up being set to an out of
date value, so let's fix that and bump it to the correct start address
(after the boot ROM)

Fixes: bf8803c64d75 "hw/riscv: opentitan: bump opentitan version"
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220914101108.82571-3-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/opentitan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
                             &error_abort);
     object_property_set_int(OBJECT(&s->cpus), "num-harts", ms->smp.cpus,
                             &error_abort);
-    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x20000490,
+    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x20000400,
                             &error_abort);
     sysbus_realize(SYS_BUS_DEVICE(&s->cpus), &error_fatal);
 
-- 
2.37.3

From: Alistair Francis <alistair.francis@wdc.com>

On the OpenTitan hardware the resetvec is fixed at the start of ROM. In
QEMU we don't run the ROM code and instead just jump to the next stage.
This means we need to be a little more flexible about what the resetvec
is.

This patch allows us to set the resetvec from the command line with
something like this:
    -global driver=riscv.lowrisc.ibex.soc,property=resetvec,value=0x20000400

This way as the next stage changes we can update the resetvec.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20220914101108.82571-4-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/opentitan.h | 2 ++
 hw/riscv/opentitan.c         | 8 +++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/include/hw/riscv/opentitan.h b/include/hw/riscv/opentitan.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/opentitan.h
+++ b/include/hw/riscv/opentitan.h
@@ -XXX,XX +XXX,XX @@ struct LowRISCIbexSoCState {
     IbexTimerState timer;
     IbexSPIHostState spi_host[OPENTITAN_NUM_SPI_HOSTS];
 
+    uint32_t resetvec;
+
     MemoryRegion flash_mem;
     MemoryRegion rom;
     MemoryRegion flash_alias;
diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
                             &error_abort);
     object_property_set_int(OBJECT(&s->cpus), "num-harts", ms->smp.cpus,
                             &error_abort);
-    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x20000400,
+    object_property_set_int(OBJECT(&s->cpus), "resetvec", s->resetvec,
                             &error_abort);
     sysbus_realize(SYS_BUS_DEVICE(&s->cpus), &error_fatal);
 
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
         memmap[IBEX_DEV_PERI].base, memmap[IBEX_DEV_PERI].size);
 }
 
+static Property lowrisc_ibex_soc_props[] = {
+    DEFINE_PROP_UINT32("resetvec", LowRISCIbexSoCState, resetvec, 0x20000400),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void lowrisc_ibex_soc_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    device_class_set_props(dc, lowrisc_ibex_soc_props);
     dc->realize = lowrisc_ibex_soc_realize;
     /* Reason: Uses serial_hds in realize function, thus can't be used twice */
     dc->user_creatable = false;
-- 
2.37.3

From: Frank Chang <frank.chang@sifive.com>

After RISCVException enum is introduced, riscv_csrrw_debug() returns
RISCV_EXCP_NONE to indicate there's no error. RISC-V vector GDB stub
should check the result against RISCV_EXCP_NONE instead of value 0.
Otherwise, 'E14' packet would be incorrectly reported for vector CSRs
when using "info reg vector" GDB command.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-Id: <20220918083245.13028-1-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/gdbstub.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

From: Bernhard Beschow <shentey@gmail.com>

SiFiveEState inherits from SysBusDevice while it's TypeInfo claims it to
inherit from TYPE_MACHINE. This is an inconsistency which can cause
undefined behavior such as memory corruption.

Change SiFiveEState to inherit from MachineState since it is registered
as a machine.

Fixes: 0869490b1c ("riscv: sifive_e: Manually define the machine")

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20220922075232.33653-1-shentey@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/sifive_e.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_e.h
+++ b/include/hw/riscv/sifive_e.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/sifive_cpu.h"
 #include "hw/gpio/sifive_gpio.h"
+#include "hw/boards.h"
 
 #define TYPE_RISCV_E_SOC "riscv.sifive.e.soc"
 #define RISCV_E_SOC(obj) \
@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveESoCState {
 
 typedef struct SiFiveEState {
     /*< private >*/
-    SysBusDevice parent_obj;
+    MachineState parent_obj;
 
     /*< public >*/
     SiFiveESoCState soc;
-- 
2.37.3

From: Frank Chang <frank.chang@sifive.com>

Current RISC-V debug assumes that only type 2 trigger is supported.
To allow more types of triggers to be supported in the future
(e.g. type 6 trigger, which is similar to type 2 trigger with additional
 functionality), we should determine the trigger type from tdata1.type.

RV_MAX_TRIGGERS is also introduced in replacement of TRIGGER_TYPE2_NUM.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
[bmeng: fixed MXL_RV128 case, and moved macros to the following patch]
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20220909134215.1843865-2-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h     |   2 +-
 target/riscv/debug.h   |  13 +--
 target/riscv/csr.c     |   2 +-
 target/riscv/debug.c   | 188 +++++++++++++++++++++++++++++------------
 target/riscv/machine.c |   2 +-
 5 files changed, 140 insertions(+), 67 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
 
     /* trigger module */
     target_ulong trigger_cur;
-    type2_trigger_t type2_trig[TRIGGER_TYPE2_NUM];
+    type2_trigger_t type2_trig[RV_MAX_TRIGGERS];
 
     /* machine specific rdtime callback */
     uint64_t (*rdtime_fn)(void *);
diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@
 #ifndef RISCV_DEBUG_H
 #define RISCV_DEBUG_H
 
-/* trigger indexes implemented */
-enum {
-    TRIGGER_TYPE2_IDX_0 = 0,
-    TRIGGER_TYPE2_IDX_1,
-    TRIGGER_TYPE2_NUM,
-    TRIGGER_NUM = TRIGGER_TYPE2_NUM
-};
+#define RV_MAX_TRIGGERS         2
 
 /* register index of tdata CSRs */
 enum {
@@ -XXX,XX +XXX,XX @@ typedef enum {
     TRIGGER_TYPE_EXCP = 5,          /* exception trigger */
     TRIGGER_TYPE_AD_MATCH6 = 6,     /* new address/data match trigger */
     TRIGGER_TYPE_EXT_SRC = 7,       /* external source trigger */
-    TRIGGER_TYPE_UNAVAIL = 15       /* trigger exists, but unavailable */
+    TRIGGER_TYPE_UNAVAIL = 15,      /* trigger exists, but unavailable */
+    TRIGGER_TYPE_NUM
 } trigger_type_t;
 
 typedef struct {
@@ -XXX,XX +XXX,XX @@ typedef struct {
     struct CPUWatchpoint *wp;
 } type2_trigger_t;
 
-/* tdata field masks */
+/* tdata1 field masks */
 
 #define RV32_TYPE(t)    ((uint32_t)(t) << 28)
 #define RV32_TYPE_MASK  (0xf << 28)
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException read_tdata(CPURISCVState *env, int csrno,
                                  target_ulong *val)
 {
     /* return 0 in tdata1 to end the trigger enumeration */
-    if (env->trigger_cur >= TRIGGER_NUM && csrno == CSR_TDATA1) {
+    if (env->trigger_cur >= RV_MAX_TRIGGERS && csrno == CSR_TDATA1) {
         *val = 0;
         return RISCV_EXCP_NONE;
     }
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@
 /* tdata availability of a trigger */
 typedef bool tdata_avail[TDATA_NUM];
 
-static tdata_avail tdata_mapping[TRIGGER_NUM] = {
-    [TRIGGER_TYPE2_IDX_0 ... TRIGGER_TYPE2_IDX_1] = { true, true, false },
+static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = {
+    [TRIGGER_TYPE_NO_EXIST] = { false, false, false },
+    [TRIGGER_TYPE_AD_MATCH] = { true, true, true },
+    [TRIGGER_TYPE_INST_CNT] = { true, false, true },
+    [TRIGGER_TYPE_INT] = { true, true, true },
+    [TRIGGER_TYPE_EXCP] = { true, true, true },
+    [TRIGGER_TYPE_AD_MATCH6] = { true, true, true },
+    [TRIGGER_TYPE_EXT_SRC] = { true, false, false },
+    [TRIGGER_TYPE_UNAVAIL] = { true, true, true }
 };
 
 /* only breakpoint size 1/2/4/8 supported */
@@ -XXX,XX +XXX,XX @@ static int access_size[SIZE_NUM] = {
     [6 ... 15] = -1,
 };
 
+static inline target_ulong extract_trigger_type(CPURISCVState *env,
+                                                target_ulong tdata1)
+{
+    switch (riscv_cpu_mxl(env)) {
+    case MXL_RV32:
+        return extract32(tdata1, 28, 4);
+    case MXL_RV64:
+    case MXL_RV128:
+        return extract64(tdata1, 60, 4);
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static inline target_ulong get_trigger_type(CPURISCVState *env,
+                                            target_ulong trigger_index)
+{
+    target_ulong tdata1 = env->type2_trig[trigger_index].mcontrol;
+    return extract_trigger_type(env, tdata1);
+}
+
 static inline target_ulong trigger_type(CPURISCVState *env,
                                         trigger_type_t type)
 {
@@ -XXX,XX +XXX,XX @@ static inline target_ulong trigger_type(CPURISCVState *env,
 
 bool tdata_available(CPURISCVState *env, int tdata_index)
 {
+    int trigger_type = get_trigger_type(env, env->trigger_cur);
+
     if (unlikely(tdata_index >= TDATA_NUM)) {
         return false;
     }
 
-    if (unlikely(env->trigger_cur >= TRIGGER_NUM)) {
+    if (unlikely(env->trigger_cur >= RV_MAX_TRIGGERS)) {
         return false;
     }
 
-    return tdata_mapping[env->trigger_cur][tdata_index];
+    return tdata_mapping[trigger_type][tdata_index];
 }
 
 target_ulong tselect_csr_read(CPURISCVState *env)
@@ -XXX,XX +XXX,XX @@ static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
         qemu_log_mask(LOG_GUEST_ERROR,
                       "ignoring type write to tdata1 register\n");
     }
+
     if (dmode != 0) {
         qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n");
     }
@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
 }
 
 static target_ulong type2_reg_read(CPURISCVState *env,
-                                   target_ulong trigger_index, int tdata_index)
+                                   target_ulong index, int tdata_index)
 {
-    uint32_t index = trigger_index - TRIGGER_TYPE2_IDX_0;
     target_ulong tdata;
 
     switch (tdata_index) {
@@ -XXX,XX +XXX,XX @@ static target_ulong type2_reg_read(CPURISCVState *env,
     return tdata;
 }
 
-static void type2_reg_write(CPURISCVState *env, target_ulong trigger_index,
+static void type2_reg_write(CPURISCVState *env, target_ulong index,
                             int tdata_index, target_ulong val)
 {
-    uint32_t index = trigger_index - TRIGGER_TYPE2_IDX_0;
     target_ulong new_val;
 
     switch (tdata_index) {
@@ -XXX,XX +XXX,XX @@ static void type2_reg_write(CPURISCVState *env, target_ulong trigger_index,
     return;
 }
 
-typedef target_ulong (*tdata_read_func)(CPURISCVState *env,
-                                        target_ulong trigger_index,
-                                        int tdata_index);
-
-static tdata_read_func trigger_read_funcs[TRIGGER_NUM] = {
-    [TRIGGER_TYPE2_IDX_0 ... TRIGGER_TYPE2_IDX_1] = type2_reg_read,
-};
-
-typedef void (*tdata_write_func)(CPURISCVState *env,
-                                 target_ulong trigger_index,
-                                 int tdata_index,
-                                 target_ulong val);
-
-static tdata_write_func trigger_write_funcs[TRIGGER_NUM] = {
-    [TRIGGER_TYPE2_IDX_0 ... TRIGGER_TYPE2_IDX_1] = type2_reg_write,
-};
-
 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
 {
-    tdata_read_func read_func = trigger_read_funcs[env->trigger_cur];
+    int trigger_type = get_trigger_type(env, env->trigger_cur);
+
+    switch (trigger_type) {
+    case TRIGGER_TYPE_AD_MATCH:
+        return type2_reg_read(env, env->trigger_cur, tdata_index);
+        break;
+    case TRIGGER_TYPE_INST_CNT:
+    case TRIGGER_TYPE_INT:
+    case TRIGGER_TYPE_EXCP:
+    case TRIGGER_TYPE_AD_MATCH6:
+    case TRIGGER_TYPE_EXT_SRC:
+        qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
+                      trigger_type);
+        break;
+    case TRIGGER_TYPE_NO_EXIST:
+    case TRIGGER_TYPE_UNAVAIL:
+        qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
+                      trigger_type);
+        break;
+    default:
+        g_assert_not_reached();
+    }
 
-    return read_func(env, env->trigger_cur, tdata_index);
+    return 0;
 }
 
 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
 {
-    tdata_write_func write_func = trigger_write_funcs[env->trigger_cur];
+    int trigger_type;
 
-    return write_func(env, env->trigger_cur, tdata_index, val);
+    if (tdata_index == TDATA1) {
+        trigger_type = extract_trigger_type(env, val);
+    } else {
+        trigger_type = get_trigger_type(env, env->trigger_cur);
+    }
+
+    switch (trigger_type) {
+    case TRIGGER_TYPE_AD_MATCH:
+        type2_reg_write(env, env->trigger_cur, tdata_index, val);
+        break;
+    case TRIGGER_TYPE_INST_CNT:
+    case TRIGGER_TYPE_INT:
+    case TRIGGER_TYPE_EXCP:
+    case TRIGGER_TYPE_AD_MATCH6:
+    case TRIGGER_TYPE_EXT_SRC:
+        qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
+                      trigger_type);
+        break;
+    case TRIGGER_TYPE_NO_EXIST:
+    case TRIGGER_TYPE_UNAVAIL:
+        qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
+                      trigger_type);
+        break;
+    default:
+        g_assert_not_reached();
+    }
 }
 
 void riscv_cpu_debug_excp_handler(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
     CPUBreakpoint *bp;
     target_ulong ctrl;
     target_ulong pc;
+    int trigger_type;
     int i;
 
     QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
-        for (i = 0; i < TRIGGER_TYPE2_NUM; i++) {
-            ctrl = env->type2_trig[i].mcontrol;
-            pc = env->type2_trig[i].maddress;
-
-            if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
-                /* check U/S/M bit against current privilege level */
-                if ((ctrl >> 3) & BIT(env->priv)) {
-                    return true;
+        for (i = 0; i < RV_MAX_TRIGGERS; i++) {
+            trigger_type = get_trigger_type(env, i);
+
+            switch (trigger_type) {
+            case TRIGGER_TYPE_AD_MATCH:
+                ctrl = env->type2_trig[i].mcontrol;
+                pc = env->type2_trig[i].maddress;
+
+                if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
+                    /* check U/S/M bit against current privilege level */
+                    if ((ctrl >> 3) & BIT(env->priv)) {
+                        return true;
+                    }
                 }
+                break;
+            default:
+                /* other trigger types are not supported or irrelevant */
+                break;
             }
         }
     }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
     CPURISCVState *env = &cpu->env;
     target_ulong ctrl;
     target_ulong addr;
+    int trigger_type;
     int flags;
     int i;
 
-    for (i = 0; i < TRIGGER_TYPE2_NUM; i++) {
-        ctrl = env->type2_trig[i].mcontrol;
-        addr = env->type2_trig[i].maddress;
-        flags = 0;
+    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
+        trigger_type = get_trigger_type(env, i);
 
-        if (ctrl & TYPE2_LOAD) {
-            flags |= BP_MEM_READ;
-        }
-        if (ctrl & TYPE2_STORE) {
-            flags |= BP_MEM_WRITE;
-        }
+        switch (trigger_type) {
+        case TRIGGER_TYPE_AD_MATCH:
+            ctrl = env->type2_trig[i].mcontrol;
+            addr = env->type2_trig[i].maddress;
+            flags = 0;
 
-        if ((wp->flags & flags) && (wp->vaddr == addr)) {
-            /* check U/S/M bit against current privilege level */
-            if ((ctrl >> 3) & BIT(env->priv)) {
-                return true;
+            if (ctrl & TYPE2_LOAD) {
+                flags |= BP_MEM_READ;
+            }
+            if (ctrl & TYPE2_STORE) {
+                flags |= BP_MEM_WRITE;
+            }
+
+            if ((wp->flags & flags) && (wp->vaddr == addr)) {
+                /* check U/S/M bit against current privilege level */
+                if ((ctrl >> 3) & BIT(env->priv)) {
+                    return true;
+                }
             }
+            break;
+        default:
+            /* other trigger types are not supported */
+            break;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 
 void riscv_trigger_init(CPURISCVState *env)
 {
-    target_ulong type2 = trigger_type(env, TRIGGER_TYPE_AD_MATCH);
+    target_ulong tdata1 = trigger_type(env, TRIGGER_TYPE_AD_MATCH);
     int i;
 
-    /* type 2 triggers */
-    for (i = 0; i < TRIGGER_TYPE2_NUM; i++) {
+    /* init to type 2 triggers */
+    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
         /*
          * type = TRIGGER_TYPE_AD_MATCH
          * dmode = 0 (both debug and M-mode can write tdata)
@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
          * chain = 0 (unimplemented, always 0)
          * match = 0 (always 0, when any compare value equals tdata2)
          */
-        env->type2_trig[i].mcontrol = type2;
+        env->type2_trig[i].mcontrol = tdata1;
         env->type2_trig[i].maddress = 0;
         env->type2_trig[i].bp = NULL;
         env->type2_trig[i].wp = NULL;
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_debug = {
     .needed = debug_needed,
     .fields = (VMStateField[]) {
         VMSTATE_UINTTL(env.trigger_cur, RISCVCPU),
-        VMSTATE_STRUCT_ARRAY(env.type2_trig, RISCVCPU, TRIGGER_TYPE2_NUM,
+        VMSTATE_STRUCT_ARRAY(env.type2_trig, RISCVCPU, RV_MAX_TRIGGERS,
                              0, vmstate_debug_type2, type2_trigger_t),
         VMSTATE_END_OF_LIST()
     }
-- 
2.37.3

From: Frank Chang <frank.chang@sifive.com>

Introduce build_tdata1() to build tdata1 register content, which can be
shared among all types of triggers.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
[bmeng: moved RV{32,64}_DATA_MASK definition to this patch]
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20220909134215.1843865-3-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.h |  2 ++
 target/riscv/debug.c | 15 ++++++++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 #define RV32_TYPE(t)    ((uint32_t)(t) << 28)
 #define RV32_TYPE_MASK  (0xf << 28)
 #define RV32_DMODE      BIT(27)
+#define RV32_DATA_MASK  0x7ffffff
 #define RV64_TYPE(t)    ((uint64_t)(t) << 60)
 #define RV64_TYPE_MASK  (0xfULL << 60)
 #define RV64_DMODE      BIT_ULL(59)
+#define RV64_DATA_MASK  0x7ffffffffffffff
 
 /* mcontrol field masks */
 
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ static inline target_ulong get_trigger_type(CPURISCVState *env,
     return extract_trigger_type(env, tdata1);
 }
 
-static inline target_ulong trigger_type(CPURISCVState *env,
-                                        trigger_type_t type)
+static inline target_ulong build_tdata1(CPURISCVState *env,
+                                        trigger_type_t type,
+                                        bool dmode, target_ulong data)
 {
     target_ulong tdata1;
 
     switch (riscv_cpu_mxl(env)) {
     case MXL_RV32:
-        tdata1 = RV32_TYPE(type);
+        tdata1 = RV32_TYPE(type) |
+                 (dmode ? RV32_DMODE : 0) |
+                 (data & RV32_DATA_MASK);
         break;
     case MXL_RV64:
     case MXL_RV128:
-        tdata1 = RV64_TYPE(type);
+        tdata1 = RV64_TYPE(type) |
+                 (dmode ? RV64_DMODE : 0) |
+                 (data & RV64_DATA_MASK);
         break;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 
 void riscv_trigger_init(CPURISCVState *env)
 {
-    target_ulong tdata1 = trigger_type(env, TRIGGER_TYPE_AD_MATCH);
+    target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
     int i;
 
     /* init to type 2 triggers */
-- 
2.37.3

From: Frank Chang <frank.chang@sifive.com>

Replace type2_trigger_t with the real tdata1, tdata2, and tdata3 CSRs,
which allows us to support more types of triggers in the future.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-Id: <20220909134215.1843865-4-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h     |   6 ++-
 target/riscv/debug.h   |   7 ---
 target/riscv/debug.c   | 103 +++++++++++++++--------------------------
 target/riscv/machine.c |  20 ++------
 4 files changed, 48 insertions(+), 88 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
 
     /* trigger module */
     target_ulong trigger_cur;
-    type2_trigger_t type2_trig[RV_MAX_TRIGGERS];
+    target_ulong tdata1[RV_MAX_TRIGGERS];
+    target_ulong tdata2[RV_MAX_TRIGGERS];
+    target_ulong tdata3[RV_MAX_TRIGGERS];
+    struct CPUBreakpoint *cpu_breakpoint[RV_MAX_TRIGGERS];
+    struct CPUWatchpoint *cpu_watchpoint[RV_MAX_TRIGGERS];
 
     /* machine specific rdtime callback */
     uint64_t (*rdtime_fn)(void *);
diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
     TRIGGER_TYPE_NUM
 } trigger_type_t;
 
-typedef struct {
-    target_ulong mcontrol;
-    target_ulong maddress;
-    struct CPUBreakpoint *bp;
-    struct CPUWatchpoint *wp;
-} type2_trigger_t;
-
 /* tdata1 field masks */
 
 #define RV32_TYPE(t)    ((uint32_t)(t) << 28)
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ static inline target_ulong extract_trigger_type(CPURISCVState *env,
 static inline target_ulong get_trigger_type(CPURISCVState *env,
                                             target_ulong trigger_index)
 {
-    target_ulong tdata1 = env->type2_trig[trigger_index].mcontrol;
-    return extract_trigger_type(env, tdata1);
+    return extract_trigger_type(env, env->tdata1[trigger_index]);
 }
 
 static inline target_ulong build_tdata1(CPURISCVState *env,
@@ -XXX,XX +XXX,XX @@ static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
     }
 }
 
+/* type 2 trigger */
+
 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
 {
     uint32_t size, sizelo, sizehi = 0;
@@ -XXX,XX +XXX,XX @@ static target_ulong type2_mcontrol_validate(CPURISCVState *env,
 
 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
 {
-    target_ulong ctrl = env->type2_trig[index].mcontrol;
-    target_ulong addr = env->type2_trig[index].maddress;
+    target_ulong ctrl = env->tdata1[index];
+    target_ulong addr = env->tdata2[index];
     bool enabled = type2_breakpoint_enabled(ctrl);
     CPUState *cs = env_cpu(env);
     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
     }
 
     if (ctrl & TYPE2_EXEC) {
-        cpu_breakpoint_insert(cs, addr, flags, &env->type2_trig[index].bp);
+        cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
     }
 
     if (ctrl & TYPE2_LOAD) {
@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
         size = type2_breakpoint_size(env, ctrl);
         if (size != 0) {
             cpu_watchpoint_insert(cs, addr, size, flags,
-                                  &env->type2_trig[index].wp);
+                                  &env->cpu_watchpoint[index]);
         } else {
             cpu_watchpoint_insert(cs, addr, 8, flags,
-                                  &env->type2_trig[index].wp);
+                                  &env->cpu_watchpoint[index]);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
 {
     CPUState *cs = env_cpu(env);
 
-    if (env->type2_trig[index].bp) {
-        cpu_breakpoint_remove_by_ref(cs, env->type2_trig[index].bp);
-        env->type2_trig[index].bp = NULL;
+    if (env->cpu_breakpoint[index]) {
+        cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]);
+        env->cpu_breakpoint[index] = NULL;
     }
 
-    if (env->type2_trig[index].wp) {
-        cpu_watchpoint_remove_by_ref(cs, env->type2_trig[index].wp);
-        env->type2_trig[index].wp = NULL;
+    if (env->cpu_watchpoint[index]) {
+        cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]);
+        env->cpu_watchpoint[index] = NULL;
     }
 }
 
-static target_ulong type2_reg_read(CPURISCVState *env,
-                                   target_ulong index, int tdata_index)
-{
-    target_ulong tdata;
-
-    switch (tdata_index) {
-    case TDATA1:
-        tdata = env->type2_trig[index].mcontrol;
-        break;
-    case TDATA2:
-        tdata = env->type2_trig[index].maddress;
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
-    return tdata;
-}
-
 static void type2_reg_write(CPURISCVState *env, target_ulong index,
                             int tdata_index, target_ulong val)
 {
@@ -XXX,XX +XXX,XX @@ static void type2_reg_write(CPURISCVState *env, target_ulong index,
     switch (tdata_index) {
     case TDATA1:
         new_val = type2_mcontrol_validate(env, val);
-        if (new_val != env->type2_trig[index].mcontrol) {
-            env->type2_trig[index].mcontrol = new_val;
+        if (new_val != env->tdata1[index]) {
+            env->tdata1[index] = new_val;
             type2_breakpoint_remove(env, index);
             type2_breakpoint_insert(env, index);
         }
         break;
     case TDATA2:
-        if (val != env->type2_trig[index].maddress) {
-            env->type2_trig[index].maddress = val;
+        if (val != env->tdata2[index]) {
+            env->tdata2[index] = val;
             type2_breakpoint_remove(env, index);
             type2_breakpoint_insert(env, index);
         }
         break;
+    case TDATA3:
+        qemu_log_mask(LOG_UNIMP,
+                      "tdata3 is not supported for type 2 trigger\n");
+        break;
     default:
         g_assert_not_reached();
     }
@@ -XXX,XX +XXX,XX @@ static void type2_reg_write(CPURISCVState *env, target_ulong index,
 
 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
 {
-    int trigger_type = get_trigger_type(env, env->trigger_cur);
-
-    switch (trigger_type) {
-    case TRIGGER_TYPE_AD_MATCH:
-        return type2_reg_read(env, env->trigger_cur, tdata_index);
-        break;
-    case TRIGGER_TYPE_INST_CNT:
-    case TRIGGER_TYPE_INT:
-    case TRIGGER_TYPE_EXCP:
-    case TRIGGER_TYPE_AD_MATCH6:
-    case TRIGGER_TYPE_EXT_SRC:
-        qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
-                      trigger_type);
-        break;
-    case TRIGGER_TYPE_NO_EXIST:
-    case TRIGGER_TYPE_UNAVAIL:
-        qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
-                      trigger_type);
-        break;
+    switch (tdata_index) {
+    case TDATA1:
+        return env->tdata1[env->trigger_cur];
+    case TDATA2:
+        return env->tdata2[env->trigger_cur];
+    case TDATA3:
+        return env->tdata3[env->trigger_cur];
     default:
         g_assert_not_reached();
     }
-
-    return 0;
 }
 
 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
 
             switch (trigger_type) {
             case TRIGGER_TYPE_AD_MATCH:
-                ctrl = env->type2_trig[i].mcontrol;
-                pc = env->type2_trig[i].maddress;
+                ctrl = env->tdata1[i];
+                pc = env->tdata2[i];
 
                 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
                     /* check U/S/M bit against current privilege level */
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 
         switch (trigger_type) {
         case TRIGGER_TYPE_AD_MATCH:
-            ctrl = env->type2_trig[i].mcontrol;
-            addr = env->type2_trig[i].maddress;
+            ctrl = env->tdata1[i];
+            addr = env->tdata2[i];
             flags = 0;
 
             if (ctrl & TYPE2_LOAD) {
@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
          * chain = 0 (unimplemented, always 0)
          * match = 0 (always 0, when any compare value equals tdata2)
          */
-        env->type2_trig[i].mcontrol = tdata1;
-        env->type2_trig[i].maddress = 0;
-        env->type2_trig[i].bp = NULL;
-        env->type2_trig[i].wp = NULL;
+        env->tdata1[i] = tdata1;
+        env->tdata2[i] = 0;
+        env->tdata3[i] = 0;
+        env->cpu_breakpoint[i] = NULL;
+        env->cpu_watchpoint[i] = NULL;
     }
 }
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static bool debug_needed(void *opaque)
     return riscv_feature(env, RISCV_FEATURE_DEBUG);
 }
 
-static const VMStateDescription vmstate_debug_type2 = {
-    .name = "cpu/debug/type2",
-    .version_id = 1,
-    .minimum_version_id = 1,
-    .fields = (VMStateField[]) {
-        VMSTATE_UINTTL(mcontrol, type2_trigger_t),
-        VMSTATE_UINTTL(maddress, type2_trigger_t),
-        VMSTATE_END_OF_LIST()
-   }
-};
-
 static const VMStateDescription vmstate_debug = {
     .name = "cpu/debug",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .needed = debug_needed,
     .fields = (VMStateField[]) {
         VMSTATE_UINTTL(env.trigger_cur, RISCVCPU),
-        VMSTATE_STRUCT_ARRAY(env.type2_trig, RISCVCPU, RV_MAX_TRIGGERS,
-                             0, vmstate_debug_type2, type2_trigger_t),
+        VMSTATE_UINTTL_ARRAY(env.tdata1, RISCVCPU, RV_MAX_TRIGGERS),
+        VMSTATE_UINTTL_ARRAY(env.tdata2, RISCVCPU, RV_MAX_TRIGGERS),
+        VMSTATE_UINTTL_ARRAY(env.tdata3, RISCVCPU, RV_MAX_TRIGGERS),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.37.3

From: Frank Chang <frank.chang@sifive.com>

The value of tselect CSR can be written should be limited within the
range of supported triggers number.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-Id: <20220909134215.1843865-5-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool tdata_available(CPURISCVState *env, int tdata_index)
         return false;
     }
 
-    if (unlikely(env->trigger_cur >= RV_MAX_TRIGGERS)) {
-        return false;
-    }
-
     return tdata_mapping[trigger_type][tdata_index];
 }
 
@@ -XXX,XX +XXX,XX @@ target_ulong tselect_csr_read(CPURISCVState *env)
 
 void tselect_csr_write(CPURISCVState *env, target_ulong val)
 {
-    /* all target_ulong bits of tselect are implemented */
-    env->trigger_cur = val;
+    if (val < RV_MAX_TRIGGERS) {
+        env->trigger_cur = val;
+    }
 }
 
 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
-- 
2.37.3

From: Frank Chang <frank.chang@sifive.com>

tinfo.info:
  One bit for each possible type enumerated in tdata1.
  If the bit is set, then that type is supported by the currently
  selected trigger.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-Id: <20220909134215.1843865-6-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h |  1 +
 target/riscv/debug.h    |  2 ++
 target/riscv/csr.c      |  8 ++++++++
 target/riscv/debug.c    | 10 +++++++---
 4 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define CSR_TDATA1          0x7a1
 #define CSR_TDATA2          0x7a2
 #define CSR_TDATA3          0x7a3
+#define CSR_TINFO           0x7a4
 
 /* Debug Mode Registers */
 #define CSR_DCSR            0x7b0
diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ void tselect_csr_write(CPURISCVState *env, target_ulong val);
 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index);
 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val);
 
+target_ulong tinfo_csr_read(CPURISCVState *env);
+
 void riscv_cpu_debug_excp_handler(CPUState *cs);
 bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_tdata(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+static RISCVException read_tinfo(CPURISCVState *env, int csrno,
+                                 target_ulong *val)
+{
+    *val = tinfo_csr_read(env);
+    return RISCV_EXCP_NONE;
+}
+
 /*
  * Functions to access Pointer Masking feature registers
  * We have to check if current priv lvl could modify
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_TDATA1]    =  { "tdata1",  debug, read_tdata,   write_tdata   },
     [CSR_TDATA2]    =  { "tdata2",  debug, read_tdata,   write_tdata   },
     [CSR_TDATA3]    =  { "tdata3",  debug, read_tdata,   write_tdata   },
+    [CSR_TINFO]     =  { "tinfo",   debug, read_tinfo,   write_ignore  },
 
     /* User Pointer Masking */
     [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,  write_umte },
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@
  * - tdata1
  * - tdata2
  * - tdata3
- *
- * We don't support writable 'type' field in the tdata1 register, so there is
- * no need to implement the "tinfo" CSR.
+ * - tinfo
  *
  * The following triggers are implemented:
  *
@@ -XXX,XX +XXX,XX @@ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
     }
 }
 
+target_ulong tinfo_csr_read(CPURISCVState *env)
+{
+    /* assume all triggers support the same types of triggers */
+    return BIT(TRIGGER_TYPE_AD_MATCH);
+}
+
 void riscv_cpu_debug_excp_handler(CPUState *cs)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
-- 
2.37.3

From: Frank Chang <frank.chang@sifive.com>

Trigger actions are shared among all triggers. Extract to a common
function.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
[bmeng: handle the DBG_ACTION_NONE case]
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20220909134215.1843865-7-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.h | 13 ++++++++++
 target/riscv/debug.c | 59 ++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 70 insertions(+), 2 deletions(-)

diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
     TRIGGER_TYPE_NUM
 } trigger_type_t;
 
+/* actions */
+typedef enum {
+    DBG_ACTION_NONE = -1,           /* sentinel value */
+    DBG_ACTION_BP = 0,
+    DBG_ACTION_DBG_MODE,
+    DBG_ACTION_TRACE0,
+    DBG_ACTION_TRACE1,
+    DBG_ACTION_TRACE2,
+    DBG_ACTION_TRACE3,
+    DBG_ACTION_EXT_DBG0 = 8,
+    DBG_ACTION_EXT_DBG1
+} trigger_action_t;
+
 /* tdata1 field masks */
 
 #define RV32_TYPE(t)    ((uint32_t)(t) << 28)
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ static inline target_ulong get_trigger_type(CPURISCVState *env,
     return extract_trigger_type(env, env->tdata1[trigger_index]);
 }
 
+static trigger_action_t get_trigger_action(CPURISCVState *env,
+                                           target_ulong trigger_index)
+{
+    target_ulong tdata1 = env->tdata1[trigger_index];
+    int trigger_type = get_trigger_type(env, trigger_index);
+    trigger_action_t action = DBG_ACTION_NONE;
+
+    switch (trigger_type) {
+    case TRIGGER_TYPE_AD_MATCH:
+        action = (tdata1 & TYPE2_ACTION) >> 12;
+        break;
+    case TRIGGER_TYPE_INST_CNT:
+    case TRIGGER_TYPE_INT:
+    case TRIGGER_TYPE_EXCP:
+    case TRIGGER_TYPE_AD_MATCH6:
+    case TRIGGER_TYPE_EXT_SRC:
+        qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
+                      trigger_type);
+        break;
+    case TRIGGER_TYPE_NO_EXIST:
+    case TRIGGER_TYPE_UNAVAIL:
+        qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
+                      trigger_type);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    return action;
+}
+
 static inline target_ulong build_tdata1(CPURISCVState *env,
                                         trigger_type_t type,
                                         bool dmode, target_ulong data)
@@ -XXX,XX +XXX,XX @@ static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
     }
 }
 
+static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
+{
+    trigger_action_t action = get_trigger_action(env, trigger_index);
+
+    switch (action) {
+    case DBG_ACTION_NONE:
+        break;
+    case DBG_ACTION_BP:
+        riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
+        break;
+    case DBG_ACTION_DBG_MODE:
+    case DBG_ACTION_TRACE0:
+    case DBG_ACTION_TRACE1:
+    case DBG_ACTION_TRACE2:
+    case DBG_ACTION_TRACE3:
+    case DBG_ACTION_EXT_DBG0:
+    case DBG_ACTION_EXT_DBG1:
+        qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 /* type 2 trigger */
 
 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs)
     if (cs->watchpoint_hit) {
         if (cs->watchpoint_hit->flags & BP_CPU) {
             cs->watchpoint_hit = NULL;
-            riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
+            do_trigger_action(env, DBG_ACTION_BP);
         }
     } else {
         if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) {
-            riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
+            do_trigger_action(env, DBG_ACTION_BP);
         }
     }
 }
-- 
2.37.3

From: Frank Chang <frank.chang@sifive.com>

Type 2 trigger cannot be fired in VU/VS modes.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20220909134215.1843865-8-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
 
             switch (trigger_type) {
             case TRIGGER_TYPE_AD_MATCH:
+                /* type 2 trigger cannot be fired in VU/VS mode */
+                if (riscv_cpu_virt_enabled(env)) {
+                    return false;
+                }
+
                 ctrl = env->tdata1[i];
                 pc = env->tdata2[i];
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 
         switch (trigger_type) {
         case TRIGGER_TYPE_AD_MATCH:
+            /* type 2 trigger cannot be fired in VU/VS mode */
+            if (riscv_cpu_virt_enabled(env)) {
+                return false;
+            }
+
             ctrl = env->tdata1[i];
             addr = env->tdata2[i];
             flags = 0;
-- 
2.37.3

From: Frank Chang <frank.chang@sifive.com>

Type 6 trigger is similar to a type 2 trigger, but provides additional
functionality and should be used instead of type 2 in newer
implementations.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20220909134215.1843865-9-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.h |  18 +++++
 target/riscv/debug.c | 174 ++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 188 insertions(+), 4 deletions(-)

diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define TYPE2_HIT       BIT(20)
 #define TYPE2_SIZEHI    (0x3 << 21) /* RV64 only */
 
+/* mcontrol6 field masks */
+
+#define TYPE6_LOAD      BIT(0)
+#define TYPE6_STORE     BIT(1)
+#define TYPE6_EXEC      BIT(2)
+#define TYPE6_U         BIT(3)
+#define TYPE6_S         BIT(4)
+#define TYPE6_M         BIT(6)
+#define TYPE6_MATCH     (0xf << 7)
+#define TYPE6_CHAIN     BIT(11)
+#define TYPE6_ACTION    (0xf << 12)
+#define TYPE6_SIZE      (0xf << 16)
+#define TYPE6_TIMING    BIT(20)
+#define TYPE6_SELECT    BIT(21)
+#define TYPE6_HIT       BIT(22)
+#define TYPE6_VU        BIT(23)
+#define TYPE6_VS        BIT(24)
+
 /* access size */
 enum {
     SIZE_ANY = 0,
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@
  * - tdata3
  * - tinfo
  *
- * The following triggers are implemented:
+ * The following triggers are initialized by default:
  *
  * Index | Type |          tdata mapping | Description
  * ------+------+------------------------+------------
@@ -XXX,XX +XXX,XX @@ static trigger_action_t get_trigger_action(CPURISCVState *env,
     case TRIGGER_TYPE_AD_MATCH:
         action = (tdata1 & TYPE2_ACTION) >> 12;
         break;
+    case TRIGGER_TYPE_AD_MATCH6:
+        action = (tdata1 & TYPE6_ACTION) >> 12;
+        break;
     case TRIGGER_TYPE_INST_CNT:
     case TRIGGER_TYPE_INT:
     case TRIGGER_TYPE_EXCP:
-    case TRIGGER_TYPE_AD_MATCH6:
     case TRIGGER_TYPE_EXT_SRC:
         qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
                       trigger_type);
@@ -XXX,XX +XXX,XX @@ static void type2_reg_write(CPURISCVState *env, target_ulong index,
     return;
 }
 
+/* type 6 trigger */
+
+static inline bool type6_breakpoint_enabled(target_ulong ctrl)
+{
+    bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M));
+    bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
+
+    return mode && rwx;
+}
+
+static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
+                                             target_ulong ctrl)
+{
+    target_ulong val;
+    uint32_t size;
+
+    /* validate the generic part first */
+    val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6);
+
+    /* validate unimplemented (always zero) bits */
+    warn_always_zero_bit(ctrl, TYPE6_MATCH, "match");
+    warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain");
+    warn_always_zero_bit(ctrl, TYPE6_ACTION, "action");
+    warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing");
+    warn_always_zero_bit(ctrl, TYPE6_SELECT, "select");
+    warn_always_zero_bit(ctrl, TYPE6_HIT, "hit");
+
+    /* validate size encoding */
+    size = extract32(ctrl, 16, 4);
+    if (access_size[size] == -1) {
+        qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
+                      size);
+    } else {
+        val |= (ctrl & TYPE6_SIZE);
+    }
+
+    /* keep the mode and attribute bits */
+    val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M |
+                    TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
+
+    return val;
+}
+
+static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
+{
+    target_ulong ctrl = env->tdata1[index];
+    target_ulong addr = env->tdata2[index];
+    bool enabled = type6_breakpoint_enabled(ctrl);
+    CPUState *cs = env_cpu(env);
+    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
+    uint32_t size;
+
+    if (!enabled) {
+        return;
+    }
+
+    if (ctrl & TYPE6_EXEC) {
+        cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
+    }
+
+    if (ctrl & TYPE6_LOAD) {
+        flags |= BP_MEM_READ;
+    }
+
+    if (ctrl & TYPE6_STORE) {
+        flags |= BP_MEM_WRITE;
+    }
+
+    if (flags & BP_MEM_ACCESS) {
+        size = extract32(ctrl, 16, 4);
+        if (size != 0) {
+            cpu_watchpoint_insert(cs, addr, size, flags,
+                                  &env->cpu_watchpoint[index]);
+        } else {
+            cpu_watchpoint_insert(cs, addr, 8, flags,
+                                  &env->cpu_watchpoint[index]);
+        }
+    }
+}
+
+static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index)
+{
+    type2_breakpoint_remove(env, index);
+}
+
+static void type6_reg_write(CPURISCVState *env, target_ulong index,
+                            int tdata_index, target_ulong val)
+{
+    target_ulong new_val;
+
+    switch (tdata_index) {
+    case TDATA1:
+        new_val = type6_mcontrol6_validate(env, val);
+        if (new_val != env->tdata1[index]) {
+            env->tdata1[index] = new_val;
+            type6_breakpoint_remove(env, index);
+            type6_breakpoint_insert(env, index);
+        }
+        break;
+    case TDATA2:
+        if (val != env->tdata2[index]) {
+            env->tdata2[index] = val;
+            type6_breakpoint_remove(env, index);
+            type6_breakpoint_insert(env, index);
+        }
+        break;
+    case TDATA3:
+        qemu_log_mask(LOG_UNIMP,
+                      "tdata3 is not supported for type 6 trigger\n");
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    return;
+}
+
 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
 {
     switch (tdata_index) {
@@ -XXX,XX +XXX,XX @@ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
     case TRIGGER_TYPE_AD_MATCH:
         type2_reg_write(env, env->trigger_cur, tdata_index, val);
         break;
+    case TRIGGER_TYPE_AD_MATCH6:
+        type6_reg_write(env, env->trigger_cur, tdata_index, val);
+        break;
     case TRIGGER_TYPE_INST_CNT:
     case TRIGGER_TYPE_INT:
     case TRIGGER_TYPE_EXCP:
-    case TRIGGER_TYPE_AD_MATCH6:
     case TRIGGER_TYPE_EXT_SRC:
         qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
                       trigger_type);
@@ -XXX,XX +XXX,XX @@ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
 target_ulong tinfo_csr_read(CPURISCVState *env)
 {
     /* assume all triggers support the same types of triggers */
-    return BIT(TRIGGER_TYPE_AD_MATCH);
+    return BIT(TRIGGER_TYPE_AD_MATCH) |
+           BIT(TRIGGER_TYPE_AD_MATCH6);
 }
 
 void riscv_cpu_debug_excp_handler(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                     }
                 }
                 break;
+            case TRIGGER_TYPE_AD_MATCH6:
+                ctrl = env->tdata1[i];
+                pc = env->tdata2[i];
+
+                if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) {
+                    if (riscv_cpu_virt_enabled(env)) {
+                        /* check VU/VS bit against current privilege level */
+                        if ((ctrl >> 23) & BIT(env->priv)) {
+                            return true;
+                        }
+                    } else {
+                        /* check U/S/M bit against current privilege level */
+                        if ((ctrl >> 3) & BIT(env->priv)) {
+                            return true;
+                        }
+                    }
+                }
+                break;
             default:
                 /* other trigger types are not supported or irrelevant */
                 break;
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
                 }
             }
             break;
+        case TRIGGER_TYPE_AD_MATCH6:
+            ctrl = env->tdata1[i];
+            addr = env->tdata2[i];
+            flags = 0;
+
+            if (ctrl & TYPE6_LOAD) {
+                flags |= BP_MEM_READ;
+            }
+            if (ctrl & TYPE6_STORE) {
+                flags |= BP_MEM_WRITE;
+            }
+
+            if ((wp->flags & flags) && (wp->vaddr == addr)) {
+                if (riscv_cpu_virt_enabled(env)) {
+                    /* check VU/VS bit against current privilege level */
+                    if ((ctrl >> 23) & BIT(env->priv)) {
+                        return true;
+                    }
+                } else {
+                    /* check U/S/M bit against current privilege level */
+                    if ((ctrl >> 3) & BIT(env->priv)) {
+                        return true;
+                    }
+                }
+            }
+            break;
         default:
             /* other trigger types are not supported */
             break;
-- 
2.37.3

From: Yang Liu <liuyang22@iscas.ac.cn>

Remove duplicate code by wrapping vfwredsum_vs's OP function.

Signed-off-by: Yang Liu <liuyang22@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-Id: <20220817074802.20765-1-liuyang22@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 56 +++++++-----------------------------
 1 file changed, 10 insertions(+), 46 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_FRED(vfredmin_vs_h, uint16_t, uint16_t, H2, H2, float16_minimum_number)
 GEN_VEXT_FRED(vfredmin_vs_w, uint32_t, uint32_t, H4, H4, float32_minimum_number)
 GEN_VEXT_FRED(vfredmin_vs_d, uint64_t, uint64_t, H8, H8, float64_minimum_number)
 
-/* Vector Widening Floating-Point Reduction Instructions */
-/* Unordered reduce 2*SEW = 2*SEW + sum(promote(SEW)) */
-void HELPER(vfwredsum_vs_h)(void *vd, void *v0, void *vs1,
-                            void *vs2, CPURISCVState *env, uint32_t desc)
+/* Vector Widening Floating-Point Add Instructions */
+static uint32_t fwadd16(uint32_t a, uint16_t b, float_status *s)
 {
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t esz = sizeof(uint32_t);
-    uint32_t vlenb = simd_maxsz(desc);
-    uint32_t vta = vext_vta(desc);
-    uint32_t i;
-    uint32_t s1 =  *((uint32_t *)vs1 + H4(0));
-
-    for (i = env->vstart; i < vl; i++) {
-        uint16_t s2 = *((uint16_t *)vs2 + H2(i));
-        if (!vm && !vext_elem_mask(v0, i)) {
-            continue;
-        }
-        s1 = float32_add(s1, float16_to_float32(s2, true, &env->fp_status),
-                         &env->fp_status);
-    }
-    *((uint32_t *)vd + H4(0)) = s1;
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, esz, vlenb);
+    return float32_add(a, float16_to_float32(b, true, s), s);
 }
 
-void HELPER(vfwredsum_vs_w)(void *vd, void *v0, void *vs1,
-                            void *vs2, CPURISCVState *env, uint32_t desc)
+static uint64_t fwadd32(uint64_t a, uint32_t b, float_status *s)
 {
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t esz = sizeof(uint64_t);
-    uint32_t vlenb = simd_maxsz(desc);
-    uint32_t vta = vext_vta(desc);
-    uint32_t i;
-    uint64_t s1 =  *((uint64_t *)vs1);
-
-    for (i = env->vstart; i < vl; i++) {
-        uint32_t s2 = *((uint32_t *)vs2 + H4(i));
-        if (!vm && !vext_elem_mask(v0, i)) {
-            continue;
-        }
-        s1 = float64_add(s1, float32_to_float64(s2, &env->fp_status),
-                         &env->fp_status);
-    }
-    *((uint64_t *)vd) = s1;
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, esz, vlenb);
+    return float64_add(a, float32_to_float64(b, s), s);
 }
 
+/* Vector Widening Floating-Point Reduction Instructions */
+/* Unordered reduce 2*SEW = 2*SEW + sum(promote(SEW)) */
+GEN_VEXT_FRED(vfwredsum_vs_h, uint32_t, uint16_t, H4, H2, fwadd16)
+GEN_VEXT_FRED(vfwredsum_vs_w, uint64_t, uint32_t, H8, H4, fwadd32)
+
 /*
  *** Vector Mask Operations
  */
-- 
2.37.3

From: Yang Liu <liuyang22@iscas.ac.cn>

Starting with RVV1.0, the original vf[w]redsum_vs instruction was renamed
to vf[w]redusum_vs. The distinction between ordered and unordered is also
more consistent with other instructions, although there is no difference
in implementation between the two for QEMU.

Signed-off-by: Yang Liu <liuyang22@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-Id: <20220817074802.20765-2-liuyang22@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                   | 15 ++++++++++-----
 target/riscv/insn32.decode              |  6 ++++--
 target/riscv/vector_helper.c            | 19 +++++++++++++------
 target/riscv/insn_trans/trans_rvv.c.inc |  6 ++++--
 4 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vwredsum_vs_b, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vwredsum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vwredsum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
 
-DEF_HELPER_6(vfredsum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_6(vfredsum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_6(vfredsum_vs_d, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfredusum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfredusum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfredusum_vs_d, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfredosum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfredosum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfredosum_vs_d, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vfredmax_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vfredmax_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vfredmax_vs_d, void, ptr, ptr, ptr, ptr, env, i32)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vfredmin_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vfredmin_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vfredmin_vs_d, void, ptr, ptr, ptr, ptr, env, i32)
 
-DEF_HELPER_6(vfwredsum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
-DEF_HELPER_6(vfwredsum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfwredusum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfwredusum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfwredosum_vs_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vfwredosum_vs_w, void, ptr, ptr, ptr, ptr, env, i32)
 
 DEF_HELPER_6(vmand_mm, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vmnand_mm, void, ptr, ptr, ptr, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vredmax_vs      000111 . ..... ..... 010 ..... 1010111 @r_vm
 vwredsumu_vs    110000 . ..... ..... 000 ..... 1010111 @r_vm
 vwredsum_vs     110001 . ..... ..... 000 ..... 1010111 @r_vm
 # Vector ordered and unordered reduction sum
-vfredsum_vs     0000-1 . ..... ..... 001 ..... 1010111 @r_vm
+vfredusum_vs    000001 . ..... ..... 001 ..... 1010111 @r_vm
+vfredosum_vs    000011 . ..... ..... 001 ..... 1010111 @r_vm
 vfredmin_vs     000101 . ..... ..... 001 ..... 1010111 @r_vm
 vfredmax_vs     000111 . ..... ..... 001 ..... 1010111 @r_vm
 # Vector widening ordered and unordered float reduction sum
-vfwredsum_vs    1100-1 . ..... ..... 001 ..... 1010111 @r_vm
+vfwredusum_vs   110001 . ..... ..... 001 ..... 1010111 @r_vm
+vfwredosum_vs   110011 . ..... ..... 001 ..... 1010111 @r_vm
 vmand_mm        011001 - ..... ..... 010 ..... 1010111 @r
 vmnand_mm       011101 - ..... ..... 010 ..... 1010111 @r
 vmandn_mm       011000 - ..... ..... 010 ..... 1010111 @r
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,           \
 }
 
 /* Unordered sum */
-GEN_VEXT_FRED(vfredsum_vs_h, uint16_t, uint16_t, H2, H2, float16_add)
-GEN_VEXT_FRED(vfredsum_vs_w, uint32_t, uint32_t, H4, H4, float32_add)
-GEN_VEXT_FRED(vfredsum_vs_d, uint64_t, uint64_t, H8, H8, float64_add)
+GEN_VEXT_FRED(vfredusum_vs_h, uint16_t, uint16_t, H2, H2, float16_add)
+GEN_VEXT_FRED(vfredusum_vs_w, uint32_t, uint32_t, H4, H4, float32_add)
+GEN_VEXT_FRED(vfredusum_vs_d, uint64_t, uint64_t, H8, H8, float64_add)
+
+/* Ordered sum */
+GEN_VEXT_FRED(vfredosum_vs_h, uint16_t, uint16_t, H2, H2, float16_add)
+GEN_VEXT_FRED(vfredosum_vs_w, uint32_t, uint32_t, H4, H4, float32_add)
+GEN_VEXT_FRED(vfredosum_vs_d, uint64_t, uint64_t, H8, H8, float64_add)
 
 /* Maximum value */
 GEN_VEXT_FRED(vfredmax_vs_h, uint16_t, uint16_t, H2, H2, float16_maximum_number)
@@ -XXX,XX +XXX,XX @@ static uint64_t fwadd32(uint64_t a, uint32_t b, float_status *s)
 }
 
 /* Vector Widening Floating-Point Reduction Instructions */
-/* Unordered reduce 2*SEW = 2*SEW + sum(promote(SEW)) */
-GEN_VEXT_FRED(vfwredsum_vs_h, uint32_t, uint16_t, H4, H2, fwadd16)
-GEN_VEXT_FRED(vfwredsum_vs_w, uint64_t, uint32_t, H8, H4, fwadd32)
+/* Ordered/unordered reduce 2*SEW = 2*SEW + sum(promote(SEW)) */
+GEN_VEXT_FRED(vfwredusum_vs_h, uint32_t, uint16_t, H4, H2, fwadd16)
+GEN_VEXT_FRED(vfwredusum_vs_w, uint64_t, uint32_t, H8, H4, fwadd32)
+GEN_VEXT_FRED(vfwredosum_vs_h, uint32_t, uint16_t, H4, H2, fwadd16)
+GEN_VEXT_FRED(vfwredosum_vs_w, uint64_t, uint32_t, H8, H4, fwadd32)
 
 /*
  *** Vector Mask Operations
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool freduction_check(DisasContext *s, arg_rmrr *a)
            require_zve64f(s);
 }
 
-GEN_OPFVV_TRANS(vfredsum_vs, freduction_check)
+GEN_OPFVV_TRANS(vfredusum_vs, freduction_check)
+GEN_OPFVV_TRANS(vfredosum_vs, freduction_check)
 GEN_OPFVV_TRANS(vfredmax_vs, freduction_check)
 GEN_OPFVV_TRANS(vfredmin_vs, freduction_check)
 
@@ -XXX,XX +XXX,XX @@ static bool freduction_widen_check(DisasContext *s, arg_rmrr *a)
            (s->sew != MO_8);
 }
 
-GEN_OPFVV_WIDEN_TRANS(vfwredsum_vs, freduction_widen_check)
+GEN_OPFVV_WIDEN_TRANS(vfwredusum_vs, freduction_widen_check)
+GEN_OPFVV_WIDEN_TRANS(vfwredosum_vs, freduction_widen_check)
 
 /*
  *** Vector Mask Operations
-- 
2.37.3