Series comparison

-[PULL 00/21] riscv-to-apply queue
+[PULL v2 00/45] riscv-to-apply queue
-From: Alistair Francis <alistair.francis@wdc.com>
+The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:
-The following changes since commit d1fe59377bbbf91dfded1f08ffe3c636e9db8dc0:
+  Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)
   Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-for-6.2-pull-request' into staging (2021-09-16 16:02:31 +0100)
 are available in the Git repository at:
-  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210917
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230911
-for you to fetch changes up to c14620db9b66de88bb4fef1d0cfc283bb3d53f85:
+for you to fetch changes up to e7a03409f29e2da59297d55afbaec98c96e43e3a:
-  hw/riscv: opentitan: Correct the USB Dev address (2021-09-17 07:43:55 +1000)
+  target/riscv: don't read CSR in riscv_csrrw_do64 (2023-09-11 11:45:55 +1000)
 ----------------------------------------------------------------
-Second RISC-V PR for QEMU 6.2
+First RISC-V PR for 8.2
- - ePMP CSR address updates
+ * Remove 'host' CPU from TCG
- - Convert internal interrupts to use QEMU GPIO lines
+ * riscv_htif Fixup printing on big endian hosts
- - SiFive PWM support
+ * Add zmmul isa string
- - Support for RISC-V ACLINT
+ * Add smepmp isa string
- - SiFive PDMA fixes
+ * Fix page_check_range use in fault-only-first
- - Update to u-boot instructions for sifive_u
+ * Use existing lookup tables for MixColumns
- - mstatus.SD bug fix for hypervisor extensions
+ * Add RISC-V vector cryptographic instruction set support
- - OpenTitan fix for USB dev address
+ * Implement WARL behaviour for mcountinhibit/mcounteren
  * Add Zihintntl extension ISA string to DTS
  * Fix zfa fleq.d and fltq.d
  * Fix upper/lower mtime write calculation
  * Make rtc variable names consistent
  * Use abi type for linux-user target_ucontext
  * Add RISC-V KVM AIA Support
  * Fix riscv,pmu DT node path in the virt machine
  * Update CSR bits name for svadu extension
  * Mark zicond non-experimental
  * Fix satp_mode_finalize() when satp_mode.supported = 0
  * Fix non-KVM --enable-debug build
  * Add new extensions to hwprobe
  * Use accelerated helper for AES64KS1I
  * Allocate itrigger timers only once
  * Respect mseccfg.RLB for pmpaddrX changes
  * Align the AIA model to v1.0 ratified spec
  * Don't read the CSR in riscv_csrrw_do64
 ----------------------------------------------------------------
-Alistair Francis (9):
+Akihiko Odaki (1):
-      target/riscv: Update the ePMP CSR address
+      target/riscv: Allocate itrigger timers only once
       target/riscv: Expose interrupt pending bits as GPIO lines
       hw/intc: sifive_clint: Use RISC-V CPU GPIO lines
       hw/intc: ibex_plic: Convert the PLIC to use RISC-V CPU GPIO lines
       hw/intc: sifive_plic: Convert the PLIC to use RISC-V CPU GPIO lines
       hw/intc: ibex_timer: Convert the timer to use RISC-V CPU GPIO lines
       hw/timer: Add SiFive PWM support
       sifive_u: Connect the SiFive PWM device
       hw/riscv: opentitan: Correct the USB Dev address
-Anup Patel (4):
+Ard Biesheuvel (2):
-      hw/intc: Rename sifive_clint sources to riscv_aclint sources
+      target/riscv: Use existing lookup tables for MixColumns
-      hw/intc: Upgrade the SiFive CLINT implementation to RISC-V ACLINT
+      target/riscv: Use accelerated helper for AES64KS1I
       hw/riscv: virt: Re-factor FDT generation
       hw/riscv: virt: Add optional ACLINT support to virt machine
-Bin Meng (2):
+Conor Dooley (1):
-      docs/system/riscv: sifive_u: Update U-Boot instructions
+      hw/riscv: virt: Fix riscv,pmu DT node path
       target/riscv: csr: Rename HCOUNTEREN_CY and friends
-Frank Chang (4):
+Daniel Henrique Barboza (6):
-      hw/dma: sifive_pdma: reset Next* registers when Control.claim is set
+      target/riscv/cpu.c: do not run 'host' CPU with TCG
-      hw/dma: sifive_pdma: claim bit must be set before DMA transactions
+      target/riscv/cpu.c: add zmmul isa string
-      hw/dma: sifive_pdma: don't set Control.error if 0 bytes to transfer
+      target/riscv/cpu.c: add smepmp isa string
-      target/riscv: Backup/restore mstatus.SD bit when virtual register swapped
+      target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
       hw/riscv/virt.c: fix non-KVM --enable-debug build
       hw/intc/riscv_aplic.c fix non-KVM --enable-debug build
-Green Wan (1):
+Dickon Hood (2):
-      hw/dma: sifive_pdma: allow non-multiple transaction size transactions
+      target/riscv: Refactor translation of vector-widening instruction
       target/riscv: Add Zvbb ISA extension support
-LIU Zhiwei (1):
+Jason Chien (3):
-      target/riscv: Fix satp write
+      target/riscv: Add Zihintntl extension ISA string to DTS
       hw/intc: Fix upper/lower mtime write calculation
       hw/intc: Make rtc variable names consistent
- docs/system/riscv/sifive_u.rst |  50 ++--
+Kiran Ostrolenk (4):
- docs/system/riscv/virt.rst     |  10 +
+      target/riscv: Refactor some of the generic vector functionality
- include/hw/intc/ibex_plic.h    |   2 +
+      target/riscv: Refactor vector-vector translation macro
- include/hw/intc/riscv_aclint.h |  80 +++++
+      target/riscv: Refactor some of the generic vector functionality
- include/hw/intc/sifive_clint.h |  60 ----
+      target/riscv: Add Zvknh ISA extension support
  include/hw/intc/sifive_plic.h  |   4 +
  include/hw/riscv/sifive_u.h    |  14 +-
  include/hw/riscv/virt.h        |   2 +
  include/hw/timer/ibex_timer.h  |   2 +
  include/hw/timer/sifive_pwm.h  |  62 ++++
  target/riscv/cpu_bits.h        |  12 +-
  hw/dma/sifive_pdma.c           |  54 +++-
  hw/intc/ibex_plic.c            |  17 +-
  hw/intc/riscv_aclint.c         | 460 +++++++++++++++++++++++++++++
  hw/intc/sifive_clint.c         | 287 ------------------
  hw/intc/sifive_plic.c          |  30 +-
  hw/riscv/microchip_pfsoc.c     |  13 +-
  hw/riscv/opentitan.c           |  13 +-
  hw/riscv/shakti_c.c            |  16 +-
  hw/riscv/sifive_e.c            |  15 +-
  hw/riscv/sifive_u.c            |  68 ++++-
  hw/riscv/spike.c               |  16 +-
  hw/riscv/virt.c                | 654 ++++++++++++++++++++++++++++-------------
  hw/timer/ibex_timer.c          |  17 +-
  hw/timer/sifive_pwm.c          | 468 +++++++++++++++++++++++++++++
  target/riscv/cpu.c             |  31 ++
  target/riscv/cpu_helper.c      |   3 +-
  target/riscv/csr.c             |  26 +-
  hw/intc/Kconfig                |   2 +-
  hw/intc/meson.build            |   2 +-
  hw/riscv/Kconfig               |  13 +-
  hw/timer/Kconfig               |   3 +
  hw/timer/meson.build           |   1 +
  hw/timer/trace-events          |   6 +
 files changed, 1844 insertions(+), 669 deletions(-)
  create mode 100644 include/hw/intc/riscv_aclint.h
  delete mode 100644 include/hw/intc/sifive_clint.h
  create mode 100644 include/hw/timer/sifive_pwm.h
  create mode 100644 hw/intc/riscv_aclint.c
  delete mode 100644 hw/intc/sifive_clint.c
  create mode 100644 hw/timer/sifive_pwm.c
+LIU Zhiwei (3):
+      target/riscv: Fix page_check_range use in fault-only-first
+      target/riscv: Fix zfa fleq.d and fltq.d
+      linux-user/riscv: Use abi type for target_ucontext
+Lawrence Hunter (2):
+      target/riscv: Add Zvbc ISA extension support
+      target/riscv: Add Zvksh ISA extension support
+Leon Schuermann (1):
+      target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes
+Max Chou (3):
+      crypto: Create sm4_subword
+      crypto: Add SM4 constant parameter CK
+      target/riscv: Add Zvksed ISA extension support
+Nazar Kazakov (4):
+      target/riscv: Remove redundant "cpu_vl == 0" checks
+      target/riscv: Move vector translation checks
+      target/riscv: Add Zvkned ISA extension support
+      target/riscv: Add Zvkg ISA extension support
+Nikita Shubin (1):
+      target/riscv: don't read CSR in riscv_csrrw_do64
+Rob Bradford (1):
+      target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren
+Robbin Ehn (1):
+      linux-user/riscv: Add new extensions to hwprobe
+Thomas Huth (2):
+      hw/char/riscv_htif: Fix printing of console characters on big endian hosts
+      hw/char/riscv_htif: Fix the console syscall on big endian hosts
+Tommy Wu (1):
+      target/riscv: Align the AIA model to v1.0 ratified spec
+Vineet Gupta (1):
+      riscv: zicond: make non-experimental
+Weiwei Li (1):
+      target/riscv: Update CSR bits name for svadu extension
+Yong-Xuan Wang (5):
+      target/riscv: support the AIA device emulation with KVM enabled
+      target/riscv: check the in-kernel irqchip support
+      target/riscv: Create an KVM AIA irqchip
+      target/riscv: update APLIC and IMSIC to support KVM AIA
+      target/riscv: select KVM AIA in riscv virt machine
+ include/crypto/aes.h                      |   7 +
+ include/crypto/sm4.h                      |   9 +
+ target/riscv/cpu_bits.h                   |   8 +-
+ target/riscv/cpu_cfg.h                    |   9 +
+ target/riscv/debug.h                      |   3 +-
+ target/riscv/helper.h                     |  98 +++
+ target/riscv/kvm_riscv.h                  |   5 +
+ target/riscv/vector_internals.h           | 228 +++++++
+ target/riscv/insn32.decode                |  58 ++
+ crypto/aes.c                              |   4 +-
+ crypto/sm4.c                              |  10 +
+ hw/char/riscv_htif.c                      |  12 +-
+ hw/intc/riscv_aclint.c                    |  11 +-
+ hw/intc/riscv_aplic.c                     |  52 +-
+ hw/intc/riscv_imsic.c                     |  25 +-
+ hw/riscv/virt.c                           | 374 ++++++------
+ linux-user/riscv/signal.c                 |   4 +-
+ linux-user/syscall.c                      |  14 +-
+ target/arm/tcg/crypto_helper.c            |  10 +-
+ target/riscv/cpu.c                        |  83 ++-
+ target/riscv/cpu_helper.c                 |   6 +-
+ target/riscv/crypto_helper.c              |  51 +-
+ target/riscv/csr.c                        |  54 +-
+ target/riscv/debug.c                      |  15 +-
+ target/riscv/kvm.c                        | 201 ++++++-
+ target/riscv/pmp.c                        |   4 +
+ target/riscv/translate.c                  |   1 +
+ target/riscv/vcrypto_helper.c             | 970 ++++++++++++++++++++++++++++++
+ target/riscv/vector_helper.c              | 245 +-------
+ target/riscv/vector_internals.c           |  81 +++
+ target/riscv/insn_trans/trans_rvv.c.inc   | 171 +++---
+ target/riscv/insn_trans/trans_rvvk.c.inc  | 606 +++++++++++++++++++
+ target/riscv/insn_trans/trans_rvzfa.c.inc |   4 +-
+ target/riscv/meson.build                  |   4 +-
+files changed, 2785 insertions(+), 652 deletions(-)
+ create mode 100644 target/riscv/vector_internals.h
+ create mode 100644 target/riscv/vcrypto_helper.c
+ create mode 100644 target/riscv/vector_internals.c
+ create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc

-[PULL 16/21] hw/dma: sifive_pdma: allow non-multiple transaction size transactions
+[PULL v2 01/45] target/riscv/cpu.c: do not run 'host' CPU with TCG
-From: Green Wan <green.wan@sifive.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Real PDMA is able to deal with non-multiple transaction size transactions.
+The 'host' CPU is available in a CONFIG_KVM build and it's currently
 available for all accels, but is a KVM only CPU. This means that in a
 RISC-V KVM capable host we can do things like this:
-The following result is PDMA tested in U-Boot on Unmatched board:
+$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
 qemu-system-riscv64: H extension requires priv spec 1.12.0
-=> mw.l 0x3000000 0x0                      <= Disclaim channel 0
+This CPU does not have a priv spec because we don't filter its extensions
-=> mw.l 0x3000000 0x1                      <= Claim channel 0
+via priv spec. We shouldn't be reaching riscv_cpu_realize_tcg() at all
-=> mw.l 0x3000004 0x11000000               <= wsize = rsize = 1 (2^1 = 2 bytes)
+with the 'host' CPU.
 => mw.q 0x3000008 0x3                      <= NextBytes = 3
 => mw.q 0x3000010 0x84000000               <= NextDestination = 0x84000000
 => mw.q 0x3000018 0x84001000               <= NextSource = 0x84001000
 => mw.l 0x84000000 0x87654321              <= Fill test data to dst
 => mw.l 0x84001000 0x12345678              <= Fill test data to src
 => md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
 84000000: 87654321                               !Ce.
 84001000: 12345678                               xV4.
 => md.l 0x3000000 8                        <= Dump PDMA status
 03000000: 00000001 11000000 00000003 00000000    ................
 03000010: 84000000 00000000 84001000 00000000    ................
 => mw.l 0x3000000 0x3                      <= Set channel 0 run and claim bits
 => md.l 0x3000000 8                        <= Dump PDMA status
 03000000: 40000001 11000000 00000003 00000000    ...@............
 03000010: 84000000 00000000 84001000 00000000    ................
 => md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
 84000000: 87345678                               xV4.
 84001000: 12345678                               xV4.
-Signed-off-by: Green Wan <green.wan@sifive.com>
+We don't have a way to filter the 'host' CPU out of the available CPU
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
+options (-cpu help) if the build includes both KVM and TCG. What we can
-Tested-by: Max Hsu <max.hsu@sifive.com>
+do is to error out during riscv_cpu_realize_tcg() if the user chooses
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+the 'host' CPU with accel=tcg:
-Tested-by: Bin Meng <bmeng.cn@gmail.com>
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
-Message-id: 20210912130553.179501-4-frank.chang@sifive.com
+qemu-system-riscv64: 'host' CPU is not compatible with TCG acceleration
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-Id: <20230721133411.474105-1-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/dma/sifive_pdma.c | 16 ++++++++++------
+ target/riscv/cpu.c | 5 +++++
-file changed, 10 insertions(+), 6 deletions(-)
+file changed, 5 insertions(+)
-diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/sifive_pdma.c
+--- a/target/riscv/cpu.c
-+++ b/hw/dma/sifive_pdma.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
-     uint64_t dst = s->chan[ch].next_dst;
+     CPURISCVState *env = &cpu->env;
-     uint64_t src = s->chan[ch].next_src;
+     Error *local_err = NULL;
-     uint32_t config = s->chan[ch].next_config;
--    int wsize, rsize, size;
++    if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_CPU_HOST)) {
-+    int wsize, rsize, size, remainder;
++        error_setg(errp, "'host' CPU is not compatible with TCG acceleration");
-     uint8_t buf[64];
++        return;
      int n;
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
          size = 6;
      }
      size = 1 << size;
 -
 -    /* the bytes to transfer should be multiple of transaction size */
 -    if (bytes % size) {
 -        goto error;
 -    }
 +    remainder = bytes % size;
      /* indicate a DMA transfer is started */
      s->chan[ch].state = DMA_CHAN_STATE_STARTED;
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
          s->chan[ch].exec_bytes -= size;
      }
 +    if (remainder) {
 +        cpu_physical_memory_read(s->chan[ch].exec_src, buf, remainder);
 +        cpu_physical_memory_write(s->chan[ch].exec_dst, buf, remainder);
 +        s->chan[ch].exec_src += remainder;
 +        s->chan[ch].exec_dst += remainder;
 +        s->chan[ch].exec_bytes -= remainder;
 +    }
 +
-     /* indicate a DMA transfer is done */
+     riscv_cpu_validate_misa_mxl(cpu, &local_err);
-     s->chan[ch].state = DMA_CHAN_STATE_DONE;
+     if (local_err != NULL) {
-     s->chan[ch].control &= ~CONTROL_RUN;
+         error_propagate(errp, local_err);
 --
-.31.1
+.41.0

-[PULL 19/21] target/riscv: Backup/restore mstatus.SD bit when virtual register swapped
+[PULL v2 02/45] hw/char/riscv_htif: Fix printing of console characters on big endian hosts
-From: Frank Chang <frank.chang@sifive.com>
+From: Thomas Huth <thuth@redhat.com>
-When virtual registers are swapped, mstatus.SD bit should also be
+The character that should be printed is stored in the 64 bit "payload"
-backed up/restored. Otherwise, mstatus.SD bit will be incorrectly kept
+variable. The code currently tries to print it by taking the address
-across the world switches.
+of the variable and passing this pointer to qemu_chr_fe_write(). However,
 this only works on little endian hosts where the least significant bits
 are stored on the lowest address. To do this in a portable way, we have
 to store the value in an uint8_t variable instead.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Fixes: 5033606780 ("RISC-V HTIF Console")
-Reviewed-by: Vincent Chen <vincent.chen@sifive.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210914013717.881430-1-frank.chang@sifive.com
+Reviewed-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-Id: <20230721094720.902454-2-thuth@redhat.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 3 ++-
+ hw/char/riscv_htif.c | 3 ++-
 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/hw/char/riscv_htif.c
-+++ b/target/riscv/cpu_helper.c
++++ b/hw/char/riscv_htif.c
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_fp_enabled(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
+             s->tohost = 0; /* clear to indicate we read */
- void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
+             return;
- {
+         } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
-+    target_ulong sd = riscv_cpu_is_32bit(env) ? MSTATUS32_SD : MSTATUS64_SD;
+-            qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1);
-     uint64_t mstatus_mask = MSTATUS_MXR | MSTATUS_SUM | MSTATUS_FS |
++            uint8_t ch = (uint8_t)payload;
-                             MSTATUS_SPP | MSTATUS_SPIE | MSTATUS_SIE |
++            qemu_chr_fe_write(&s->chr, &ch, 1);
--                            MSTATUS64_UXL;
+             resp = 0x100 | (uint8_t)payload;
-+                            MSTATUS64_UXL | sd;
+         } else {
-     bool current_virt = riscv_cpu_virt_enabled(env);
+             qemu_log("HTIF device %d: unknown command\n", device);
      g_assert(riscv_has_ext(env, RVH));
 --
-.31.1
+.41.0

-New patch
+[PULL v2 03/45] hw/char/riscv_htif: Fix the console syscall on big endian hosts
+From: Thomas Huth <thuth@redhat.com>
+Values that have been read via cpu_physical_memory_read() from the
+guest's memory have to be swapped in case the host endianess differs
+from the guest.
+Fixes: a6e13e31d5 ("riscv_htif: Support console output via proxy syscall")
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Bin Meng <bmeng@tinylab.org>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-Id: <20230721094720.902454-3-thuth@redhat.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/char/riscv_htif.c | 9 +++++----
+file changed, 5 insertions(+), 4 deletions(-)
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/char/riscv_htif.c
++++ b/hw/char/riscv_htif.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/timer.h"
+ #include "qemu/error-report.h"
+ #include "exec/address-spaces.h"
++#include "exec/tswap.h"
+ #include "sysemu/dma.h"
+ #define RISCV_DEBUG_HTIF 0
+@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
+             } else {
+                 uint64_t syscall[8];
+                 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
+-                if (syscall[0] == PK_SYS_WRITE &&
+-                    syscall[1] == HTIF_DEV_CONSOLE &&
+-                    syscall[3] == HTIF_CONSOLE_CMD_PUTC) {
++                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
++                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
++                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
+                     uint8_t ch;
+-                    cpu_physical_memory_read(syscall[2], &ch, 1);
++                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
+                     qemu_chr_fe_write(&s->chr, &ch, 1);
+                     resp = 0x100 | (uint8_t)payload;
+                 } else {
+--
+.41.0

-New patch
+[PULL v2 04/45] target/riscv/cpu.c: add zmmul isa string
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+zmmul was promoted from experimental to ratified in commit 6d00ffad4e95.
+Add a riscv,isa string for it.
+Fixes: 6d00ffad4e95 ("target/riscv: move zmmul out of the experimental properties")
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230720132424.371132-2-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
++    ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
+     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
+     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
+--
+.41.0

-New patch
+[PULL v2 05/45] target/riscv/cpu.c: add smepmp isa string
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+The cpu->cfg.epmp extension is still experimental, but it already has a
+'smepmp' riscv,isa string. Add it.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-Id: <20230720132424.371132-3-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
++    ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, epmp),
+     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
+     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
+     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
+--
+.41.0

-New patch
+[PULL v2 06/45] target/riscv: Fix page_check_range use in fault-only-first
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Commit bef6f008b98(accel/tcg: Return bool from page_check_range) converts
+integer return value to bool type. However, it wrongly converted the use
+of the API in riscv fault-only-first, where page_check_range < = 0, should
+be converted to !page_check_range.
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20230729031618.821-1-zhiwei_liu@linux.alibaba.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/vector_helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vector_helper.c
++++ b/target/riscv/vector_helper.c
+@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
+                                          cpu_mmu_index(env, false));
+                 if (host) {
+ #ifdef CONFIG_USER_ONLY
+-                    if (page_check_range(addr, offset, PAGE_READ)) {
++                    if (!page_check_range(addr, offset, PAGE_READ)) {
+                         vl = i;
+                         goto ProbeSuccess;
+                     }
+--
+.41.0

-[PULL 05/21] hw/intc: ibex_plic: Convert the PLIC to use RISC-V CPU GPIO lines
+[PULL v2 07/45] target/riscv: Use existing lookup tables for MixColumns
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Ard Biesheuvel <ardb@kernel.org>
-Instead of using riscv_cpu_update_mip() let's instead use the new RISC-V
+The AES MixColumns and InvMixColumns operations are relatively
-CPU GPIO lines to set the external MIP bits.
+expensive 4x4 matrix multiplications in GF(2^8), which is why C
 implementations usually rely on precomputed lookup tables rather than
 performing the calculations on demand.
+Given that we already carry those tables in QEMU, we can just grab the
+right value in the implementation of the RISC-V AES32 instructions. Note
+that the tables in question are permuted according to the respective
+Sbox, so we can omit the Sbox lookup as well in this case.
+Cc: Richard Henderson <richard.henderson@linaro.org>
+Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
+Cc: Zewen Ye <lustrew@foxmail.com>
+Cc: Weiwei Li <liweiwei@iscas.ac.cn>
+Cc: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20230731084043.1791984-1-ardb@kernel.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 0a76946981852f5bd15f0c37ab35b253371027a8.1630301632.git.alistair.francis@wdc.com
 ---
- include/hw/intc/ibex_plic.h |  2 ++
+ include/crypto/aes.h         |  7 +++++++
- hw/intc/ibex_plic.c         | 17 ++++++-----------
+ crypto/aes.c                 |  4 ++--
- hw/riscv/opentitan.c        |  8 ++++++++
+ target/riscv/crypto_helper.c | 34 ++++------------------------------
-files changed, 16 insertions(+), 11 deletions(-)
+files changed, 13 insertions(+), 32 deletions(-)
-diff --git a/include/hw/intc/ibex_plic.h b/include/hw/intc/ibex_plic.h
+diff --git a/include/crypto/aes.h b/include/crypto/aes.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/ibex_plic.h
+--- a/include/crypto/aes.h
-+++ b/include/hw/intc/ibex_plic.h
++++ b/include/crypto/aes.h
-@@ -XXX,XX +XXX,XX @@ struct IbexPlicState {
+@@ -XXX,XX +XXX,XX @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
-     uint32_t threshold_base;
+ extern const uint8_t AES_sbox[256];
+ extern const uint8_t AES_isbox[256];
-     uint32_t claim_base;
 +/*
 +AES_Te0[x] = S [x].[02, 01, 01, 03];
 +AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
 +*/
 +
-+    qemu_irq *external_irqs;
++extern const uint32_t AES_Te0[256], AES_Td0[256];
 +
  #endif
 diff --git a/crypto/aes.c b/crypto/aes.c
 index XXXXXXX..XXXXXXX 100644
 --- a/crypto/aes.c
 +++ b/crypto/aes.c
@@ -XXX,XX +XXX,XX @@ AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
  AES_Td4[x] = Si[x].[01, 01, 01, 01];
  */
 -static const uint32_t AES_Te0[256] = {
 +const uint32_t AES_Te0[256] = {
 xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
 xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
 x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
@@ -XXX,XX +XXX,XX @@ static const uint32_t AES_Te4[256] = {
 xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
  };
- #endif /* HW_IBEX_PLIC_H */
+-static const uint32_t AES_Td0[256] = {
-diff --git a/hw/intc/ibex_plic.c b/hw/intc/ibex_plic.c
++const uint32_t AES_Td0[256] = {
 x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
 x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
 x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
 diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/ibex_plic.c
+--- a/target/riscv/crypto_helper.c
-+++ b/hw/intc/ibex_plic.c
++++ b/target/riscv/crypto_helper.c
 @@ -XXX,XX +XXX,XX @@
- #include "target/riscv/cpu_bits.h"
+ #include "crypto/aes-round.h"
- #include "target/riscv/cpu.h"
+ #include "crypto/sm4.h"
- #include "hw/intc/ibex_plic.h"
-+#include "hw/irq.h"
+-#define AES_XTIME(a) \
+-    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
- static bool addr_between(uint32_t addr, uint32_t base, uint32_t num)
+-
 -#define AES_GFMUL(a, b) (( \
 -    (((b) & 0x1) ? (a) : 0) ^ \
 -    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
 -    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
 -    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
 -
 -static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
 -{
 -    uint32_t u;
 -
 -    if (fwd) {
 -        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
 -            (AES_GFMUL(x, 2) << 0);
 -    } else {
 -        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
 -            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
 -    }
 -    return u;
 -}
 -
  #define sext32_xlen(x) (target_ulong)(int32_t)(x)
  static inline target_ulong aes32_operation(target_ulong shamt,
@@ -XXX,XX +XXX,XX @@ static inline target_ulong aes32_operation(target_ulong shamt,
                                             bool enc, bool mix)
  {
-@@ -XXX,XX +XXX,XX @@ static bool ibex_plic_irqs_pending(IbexPlicState *s, uint32_t context)
+     uint8_t si = rs2 >> shamt;
+-    uint8_t so;
- static void ibex_plic_update(IbexPlicState *s)
+     uint32_t mixed;
- {
+     target_ulong res;
--    CPUState *cpu;
--    int level, i;
+     if (enc) {
-+    int i;
+-        so = AES_sbox[si];
+         if (mix) {
-     for (i = 0; i < s->num_cpus; i++) {
+-            mixed = aes_mixcolumn_byte(so, true);
--        cpu = qemu_get_cpu(i);
++            mixed = be32_to_cpu(AES_Te0[si]);
--
+         } else {
--        if (!cpu) {
+-            mixed = so;
--            continue;
++            mixed = AES_sbox[si];
--        }
+         }
--
+     } else {
--        level = ibex_plic_irqs_pending(s, 0);
+-        so = AES_isbox[si];
--
+         if (mix) {
--        riscv_cpu_update_mip(RISCV_CPU(cpu), MIP_MEIP, BOOL_TO_MASK(level));
+-            mixed = aes_mixcolumn_byte(so, false);
-+        qemu_set_irq(s->external_irqs[i], ibex_plic_irqs_pending(s, 0));
++            mixed = be32_to_cpu(AES_Td0[si]);
          } else {
 -            mixed = so;
 +            mixed = AES_isbox[si];
          }
      }
- }
+     mixed = rol32(mixed, shamt);
@@ -XXX,XX +XXX,XX @@ static void ibex_plic_realize(DeviceState *dev, Error **errp)
      qdev_init_gpio_in(dev, ibex_plic_irq_request, s->num_sources);
 +    s->external_irqs = g_malloc(sizeof(qemu_irq) * s->num_cpus);
 +    qdev_init_gpio_out(dev, s->external_irqs, s->num_cpus);
 +
      /*
       * We can't allow the supervisor to control SEIP as this would allow the
       * supervisor to clear a pending external interrupt which will result in
 diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/opentitan.c
 +++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
      MachineState *ms = MACHINE(qdev_get_machine());
      LowRISCIbexSoCState *s = RISCV_IBEX_SOC(dev_soc);
      MemoryRegion *sys_mem = get_system_memory();
 +    int i;
      object_property_set_str(OBJECT(&s->cpus), "cpu-type", ms->cpu_type,
                              &error_abort);
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
      }
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->plic), 0, memmap[IBEX_DEV_PLIC].base);
 +    for (i = 0; i < ms->smp.cpus; i++) {
 +        CPUState *cpu = qemu_get_cpu(i);
 +
 +        qdev_connect_gpio_out(DEVICE(&s->plic), i,
 +                              qdev_get_gpio_in(DEVICE(cpu), IRQ_M_EXT));
 +    }
 +
      /* UART */
      qdev_prop_set_chr(DEVICE(&(s->uart)), "chardev", serial_hd(0));
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->uart), errp)) {
 --
-.31.1
+.41.0

-New patch
+[PULL v2 08/45] target/riscv: Refactor some of the generic vector functionality
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Take some functions/macros out of `vector_helper` and put them in a new
+module called `vector_internals`. This ensures they can be used by both
+vector and vector-crypto helpers (latter implemented in proceeding
+commits).
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230711165917.2629866-2-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/vector_internals.h | 182 +++++++++++++++++++++++++++++
+ target/riscv/vector_helper.c    | 201 +-------------------------------
+ target/riscv/vector_internals.c |  81 +++++++++++++
+ target/riscv/meson.build        |   1 +
+files changed, 265 insertions(+), 200 deletions(-)
+ create mode 100644 target/riscv/vector_internals.h
+ create mode 100644 target/riscv/vector_internals.c
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/target/riscv/vector_internals.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ * RISC-V Vector Extension Internals
++ *
++ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2 or later, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License along with
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#ifndef TARGET_RISCV_VECTOR_INTERNALS_H
++#define TARGET_RISCV_VECTOR_INTERNALS_H
++
++#include "qemu/osdep.h"
++#include "qemu/bitops.h"
++#include "cpu.h"
++#include "tcg/tcg-gvec-desc.h"
++#include "internals.h"
++
++static inline uint32_t vext_nf(uint32_t desc)
++{
++    return FIELD_EX32(simd_data(desc), VDATA, NF);
++}
++
++/*
++ * Note that vector data is stored in host-endian 64-bit chunks,
++ * so addressing units smaller than that needs a host-endian fixup.
++ */
++#if HOST_BIG_ENDIAN
++#define H1(x)   ((x) ^ 7)
++#define H1_2(x) ((x) ^ 6)
++#define H1_4(x) ((x) ^ 4)
++#define H2(x)   ((x) ^ 3)
++#define H4(x)   ((x) ^ 1)
++#define H8(x)   ((x))
++#else
++#define H1(x)   (x)
++#define H1_2(x) (x)
++#define H1_4(x) (x)
++#define H2(x)   (x)
++#define H4(x)   (x)
++#define H8(x)   (x)
++#endif
++
++/*
++ * Encode LMUL to lmul as following:
++ *     LMUL    vlmul    lmul
++ *      1       000       0
++ *      2       001       1
++ *      4       010       2
++ *      8       011       3
++ *      -       100       -
++ *     1/8      101      -3
++ *     1/4      110      -2
++ *     1/2      111      -1
++ */
++static inline int32_t vext_lmul(uint32_t desc)
++{
++    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
++}
++
++static inline uint32_t vext_vm(uint32_t desc)
++{
++    return FIELD_EX32(simd_data(desc), VDATA, VM);
++}
++
++static inline uint32_t vext_vma(uint32_t desc)
++{
++    return FIELD_EX32(simd_data(desc), VDATA, VMA);
++}
++
++static inline uint32_t vext_vta(uint32_t desc)
++{
++    return FIELD_EX32(simd_data(desc), VDATA, VTA);
++}
++
++static inline uint32_t vext_vta_all_1s(uint32_t desc)
++{
++    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
++}
++
++/*
++ * Earlier designs (pre-0.9) had a varying number of bits
++ * per mask value (MLEN). In the 0.9 design, MLEN=1.
++ * (Section 4.5)
++ */
++static inline int vext_elem_mask(void *v0, int index)
++{
++    int idx = index / 64;
++    int pos = index  % 64;
++    return (((uint64_t *)v0)[idx] >> pos) & 1;
++}
++
++/*
++ * Get number of total elements, including prestart, body and tail elements.
++ * Note that when LMUL < 1, the tail includes the elements past VLMAX that
++ * are held in the same vector register.
++ */
++static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
++                                            uint32_t esz)
++{
++    uint32_t vlenb = simd_maxsz(desc);
++    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
++    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
++                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
++    return (vlenb << emul) / esz;
++}
++
++/* set agnostic elements to 1s */
++void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
++                       uint32_t tot);
++
++/* expand macro args before macro */
++#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
++
++/* (TD, T1, T2, TX1, TX2) */
++#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
++#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
++#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
++#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
++
++/* operation of two vector elements */
++typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
++
++#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
++static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
++{                                                               \
++    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
++    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
++    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
++}
++
++void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
++                CPURISCVState *env, uint32_t desc,
++                opivv2_fn *fn, uint32_t esz);
++
++/* generate the helpers for OPIVV */
++#define GEN_VEXT_VV(NAME, ESZ)                            \
++void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
++                  void *vs2, CPURISCVState *env,          \
++                  uint32_t desc)                          \
++{                                                         \
++    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
++               do_##NAME, ESZ);                           \
++}
++
++typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
++
++/*
++ * (T1)s1 gives the real operator type.
++ * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
++ */
++#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
++static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
++{                                                                   \
++    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
++    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
++}
++
++void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
++                CPURISCVState *env, uint32_t desc,
++                opivx2_fn fn, uint32_t esz);
++
++/* generate the helpers for OPIVX */
++#define GEN_VEXT_VX(NAME, ESZ)                            \
++void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
++                  void *vs2, CPURISCVState *env,          \
++                  uint32_t desc)                          \
++{                                                         \
++    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
++               do_##NAME, ESZ);                           \
++}
++
++#endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vector_helper.c
++++ b/target/riscv/vector_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "fpu/softfloat.h"
+ #include "tcg/tcg-gvec-desc.h"
+ #include "internals.h"
++#include "vector_internals.h"
+ #include <math.h>
+ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
+@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
+     return vl;
+ }
+-/*
+- * Note that vector data is stored in host-endian 64-bit chunks,
+- * so addressing units smaller than that needs a host-endian fixup.
+- */
+-#if HOST_BIG_ENDIAN
+-#define H1(x)   ((x) ^ 7)
+-#define H1_2(x) ((x) ^ 6)
+-#define H1_4(x) ((x) ^ 4)
+-#define H2(x)   ((x) ^ 3)
+-#define H4(x)   ((x) ^ 1)
+-#define H8(x)   ((x))
+-#else
+-#define H1(x)   (x)
+-#define H1_2(x) (x)
+-#define H1_4(x) (x)
+-#define H2(x)   (x)
+-#define H4(x)   (x)
+-#define H8(x)   (x)
+-#endif
+-
+-static inline uint32_t vext_nf(uint32_t desc)
+-{
+-    return FIELD_EX32(simd_data(desc), VDATA, NF);
+-}
+-
+-static inline uint32_t vext_vm(uint32_t desc)
+-{
+-    return FIELD_EX32(simd_data(desc), VDATA, VM);
+-}
+-
+-/*
+- * Encode LMUL to lmul as following:
+- *     LMUL    vlmul    lmul
+- *      1       000       0
+- *      2       001       1
+- *      4       010       2
+- *      8       011       3
+- *      -       100       -
+- *     1/8      101      -3
+- *     1/4      110      -2
+- *     1/2      111      -1
+- */
+-static inline int32_t vext_lmul(uint32_t desc)
+-{
+-    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
+-}
+-
+-static inline uint32_t vext_vta(uint32_t desc)
+-{
+-    return FIELD_EX32(simd_data(desc), VDATA, VTA);
+-}
+-
+-static inline uint32_t vext_vma(uint32_t desc)
+-{
+-    return FIELD_EX32(simd_data(desc), VDATA, VMA);
+-}
+-
+-static inline uint32_t vext_vta_all_1s(uint32_t desc)
+-{
+-    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
+-}
+-
+ /*
+  * Get the maximum number of elements can be operated.
+  *
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
+     return scale < 0 ? vlenb >> -scale : vlenb << scale;
+ }
+-/*
+- * Get number of total elements, including prestart, body and tail elements.
+- * Note that when LMUL < 1, the tail includes the elements past VLMAX that
+- * are held in the same vector register.
+- */
+-static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
+-                                            uint32_t esz)
+-{
+-    uint32_t vlenb = simd_maxsz(desc);
+-    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
+-    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
+-                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
+-    return (vlenb << emul) / esz;
+-}
+-
+ static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
+ {
+     return (addr & ~env->cur_pmmask) | env->cur_pmbase;
+@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
+     }
+ }
+-/* set agnostic elements to 1s */
+-static void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+-                              uint32_t tot)
+-{
+-    if (is_agnostic == 0) {
+-        /* policy undisturbed */
+-        return;
+-    }
+-    if (tot - cnt == 0) {
+-        return;
+-    }
+-    memset(base + cnt, -1, tot - cnt);
+-}
+-
+ static inline void vext_set_elem_mask(void *v0, int index,
+                                       uint8_t value)
+ {
+@@ -XXX,XX +XXX,XX @@ static inline void vext_set_elem_mask(void *v0, int index,
+     ((uint64_t *)v0)[idx] = deposit64(old, pos, 1, value);
+ }
+-/*
+- * Earlier designs (pre-0.9) had a varying number of bits
+- * per mask value (MLEN). In the 0.9 design, MLEN=1.
+- * (Section 4.5)
+- */
+-static inline int vext_elem_mask(void *v0, int index)
+-{
+-    int idx = index / 64;
+-    int pos = index  % 64;
+-    return (((uint64_t *)v0)[idx] >> pos) & 1;
+-}
+-
+ /* elements operations for load and store */
+ typedef void vext_ldst_elem_fn(CPURISCVState *env, abi_ptr addr,
+                                uint32_t idx, void *vd, uintptr_t retaddr);
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
+  * Vector Integer Arithmetic Instructions
+  */
+-/* expand macro args before macro */
+-#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
+-
+ /* (TD, T1, T2, TX1, TX2) */
+ #define OP_SSS_B int8_t, int8_t, int8_t, int8_t, int8_t
+ #define OP_SSS_H int16_t, int16_t, int16_t, int16_t, int16_t
+ #define OP_SSS_W int32_t, int32_t, int32_t, int32_t, int32_t
+ #define OP_SSS_D int64_t, int64_t, int64_t, int64_t, int64_t
+-#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
+-#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
+-#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
+-#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
+ #define OP_SUS_B int8_t, uint8_t, int8_t, uint8_t, int8_t
+ #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
+ #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
+ #define NOP_UUU_H uint16_t, uint16_t, uint32_t, uint16_t, uint32_t
+ #define NOP_UUU_W uint32_t, uint32_t, uint64_t, uint32_t, uint64_t
+-/* operation of two vector elements */
+-typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
+-
+-#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
+-static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
+-{                                                               \
+-    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
+-    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
+-    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
+-}
+ #define DO_SUB(N, M) (N - M)
+ #define DO_RSUB(N, M) (M - N)
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vsub_vv_h, OP_SSS_H, H2, H2, H2, DO_SUB)
+ RVVCALL(OPIVV2, vsub_vv_w, OP_SSS_W, H4, H4, H4, DO_SUB)
+ RVVCALL(OPIVV2, vsub_vv_d, OP_SSS_D, H8, H8, H8, DO_SUB)
+-static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+-                       CPURISCVState *env, uint32_t desc,
+-                       opivv2_fn *fn, uint32_t esz)
+-{
+-    uint32_t vm = vext_vm(desc);
+-    uint32_t vl = env->vl;
+-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+-    uint32_t vta = vext_vta(desc);
+-    uint32_t vma = vext_vma(desc);
+-    uint32_t i;
+-
+-    for (i = env->vstart; i < vl; i++) {
+-        if (!vm && !vext_elem_mask(v0, i)) {
+-            /* set masked-off elements to 1s */
+-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+-            continue;
+-        }
+-        fn(vd, vs1, vs2, i);
+-    }
+-    env->vstart = 0;
+-    /* set tail elements to 1s */
+-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+-}
+-
+-/* generate the helpers for OPIVV */
+-#define GEN_VEXT_VV(NAME, ESZ)                            \
+-void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
+-                  void *vs2, CPURISCVState *env,          \
+-                  uint32_t desc)                          \
+-{                                                         \
+-    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
+-               do_##NAME, ESZ);                           \
+-}
+-
+ GEN_VEXT_VV(vadd_vv_b, 1)
+ GEN_VEXT_VV(vadd_vv_h, 2)
+ GEN_VEXT_VV(vadd_vv_w, 4)
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV(vsub_vv_h, 2)
+ GEN_VEXT_VV(vsub_vv_w, 4)
+ GEN_VEXT_VV(vsub_vv_d, 8)
+-typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
+-
+-/*
+- * (T1)s1 gives the real operator type.
+- * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
+- */
+-#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
+-static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
+-{                                                                   \
+-    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
+-    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
+-}
+ RVVCALL(OPIVX2, vadd_vx_b, OP_SSS_B, H1, H1, DO_ADD)
+ RVVCALL(OPIVX2, vadd_vx_h, OP_SSS_H, H2, H2, DO_ADD)
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vrsub_vx_h, OP_SSS_H, H2, H2, DO_RSUB)
+ RVVCALL(OPIVX2, vrsub_vx_w, OP_SSS_W, H4, H4, DO_RSUB)
+ RVVCALL(OPIVX2, vrsub_vx_d, OP_SSS_D, H8, H8, DO_RSUB)
+-static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+-                       CPURISCVState *env, uint32_t desc,
+-                       opivx2_fn fn, uint32_t esz)
+-{
+-    uint32_t vm = vext_vm(desc);
+-    uint32_t vl = env->vl;
+-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+-    uint32_t vta = vext_vta(desc);
+-    uint32_t vma = vext_vma(desc);
+-    uint32_t i;
+-
+-    for (i = env->vstart; i < vl; i++) {
+-        if (!vm && !vext_elem_mask(v0, i)) {
+-            /* set masked-off elements to 1s */
+-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+-            continue;
+-        }
+-        fn(vd, s1, vs2, i);
+-    }
+-    env->vstart = 0;
+-    /* set tail elements to 1s */
+-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+-}
+-
+-/* generate the helpers for OPIVX */
+-#define GEN_VEXT_VX(NAME, ESZ)                            \
+-void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
+-                  void *vs2, CPURISCVState *env,          \
+-                  uint32_t desc)                          \
+-{                                                         \
+-    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
+-               do_##NAME, ESZ);                           \
+-}
+-
+ GEN_VEXT_VX(vadd_vx_b, 1)
+ GEN_VEXT_VX(vadd_vx_h, 2)
+ GEN_VEXT_VX(vadd_vx_w, 4)
+diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/target/riscv/vector_internals.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * RISC-V Vector Extension Internals
++ *
++ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2 or later, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * more details.
++ *
++ * You should have received a copy of the GNU General Public License along with
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include "vector_internals.h"
++
++/* set agnostic elements to 1s */
++void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
++                       uint32_t tot)
++{
++    if (is_agnostic == 0) {
++        /* policy undisturbed */
++        return;
++    }
++    if (tot - cnt == 0) {
++        return ;
++    }
++    memset(base + cnt, -1, tot - cnt);
++}
++
++void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
++                CPURISCVState *env, uint32_t desc,
++                opivv2_fn *fn, uint32_t esz)
++{
++    uint32_t vm = vext_vm(desc);
++    uint32_t vl = env->vl;
++    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
++    uint32_t vta = vext_vta(desc);
++    uint32_t vma = vext_vma(desc);
++    uint32_t i;
++
++    for (i = env->vstart; i < vl; i++) {
++        if (!vm && !vext_elem_mask(v0, i)) {
++            /* set masked-off elements to 1s */
++            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
++            continue;
++        }
++        fn(vd, vs1, vs2, i);
++    }
++    env->vstart = 0;
++    /* set tail elements to 1s */
++    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
++}
++
++void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
++                CPURISCVState *env, uint32_t desc,
++                opivx2_fn fn, uint32_t esz)
++{
++    uint32_t vm = vext_vm(desc);
++    uint32_t vl = env->vl;
++    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
++    uint32_t vta = vext_vta(desc);
++    uint32_t vma = vext_vma(desc);
++    uint32_t i;
++
++    for (i = env->vstart; i < vl; i++) {
++        if (!vm && !vext_elem_mask(v0, i)) {
++            /* set masked-off elements to 1s */
++            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
++            continue;
++        }
++        fn(vd, s1, vs2, i);
++    }
++    env->vstart = 0;
++    /* set tail elements to 1s */
++    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
++}
+diff --git a/target/riscv/meson.build b/target/riscv/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/meson.build
++++ b/target/riscv/meson.build
+@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
+   'gdbstub.c',
+   'op_helper.c',
+   'vector_helper.c',
++  'vector_internals.c',
+   'bitmanip_helper.c',
+   'translate.c',
+   'm128_helper.c',
+--
+.41.0

-New patch
+[PULL v2 09/45] target/riscv: Refactor vector-vector translation macro
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Refactor the non SEW-specific stuff out of `GEN_OPIVV_TRANS` into
+function `opivv_trans` (similar to `opivi_trans`). `opivv_trans` will be
+used in proceeding vector-crypto commits.
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-3-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn_trans/trans_rvv.c.inc | 62 +++++++++++++------------
+file changed, 32 insertions(+), 30 deletions(-)
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
+@@ -XXX,XX +XXX,XX @@ GEN_OPIWX_WIDEN_TRANS(vwadd_wx)
+ GEN_OPIWX_WIDEN_TRANS(vwsubu_wx)
+ GEN_OPIWX_WIDEN_TRANS(vwsub_wx)
++static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
++                        gen_helper_gvec_4_ptr *fn, DisasContext *s)
++{
++    uint32_t data = 0;
++    TCGLabel *over = gen_new_label();
++    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
++    tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
++
++    data = FIELD_DP32(data, VDATA, VM, vm);
++    data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
++    data = FIELD_DP32(data, VDATA, VTA, s->vta);
++    data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
++    data = FIELD_DP32(data, VDATA, VMA, s->vma);
++    tcg_gen_gvec_4_ptr(vreg_ofs(s, vd), vreg_ofs(s, 0), vreg_ofs(s, vs1),
++                       vreg_ofs(s, vs2), cpu_env, s->cfg_ptr->vlen / 8,
++                       s->cfg_ptr->vlen / 8, data, fn);
++    mark_vs_dirty(s);
++    gen_set_label(over);
++    return true;
++}
++
+ /* Vector Integer Add-with-Carry / Subtract-with-Borrow Instructions */
+ /* OPIVV without GVEC IR */
+-#define GEN_OPIVV_TRANS(NAME, CHECK)                               \
+-static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+-{                                                                  \
+-    if (CHECK(s, a)) {                                             \
+-        uint32_t data = 0;                                         \
+-        static gen_helper_gvec_4_ptr * const fns[4] = {            \
+-            gen_helper_##NAME##_b, gen_helper_##NAME##_h,          \
+-            gen_helper_##NAME##_w, gen_helper_##NAME##_d,          \
+-        };                                                         \
+-        TCGLabel *over = gen_new_label();                          \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+-        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+-                                                                   \
+-        data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+-        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
+-        data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
+-        data =                                                     \
+-            FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);\
+-        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
+-        tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
+-                           vreg_ofs(s, a->rs1),                    \
+-                           vreg_ofs(s, a->rs2), cpu_env,           \
+-                           s->cfg_ptr->vlen / 8,                   \
+-                           s->cfg_ptr->vlen / 8, data,             \
+-                           fns[s->sew]);                           \
+-        mark_vs_dirty(s);                                          \
+-        gen_set_label(over);                                       \
+-        return true;                                               \
+-    }                                                              \
+-    return false;                                                  \
++#define GEN_OPIVV_TRANS(NAME, CHECK)                                     \
++static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
++{                                                                        \
++    if (CHECK(s, a)) {                                                   \
++        static gen_helper_gvec_4_ptr * const fns[4] = {                  \
++            gen_helper_##NAME##_b, gen_helper_##NAME##_h,                \
++            gen_helper_##NAME##_w, gen_helper_##NAME##_d,                \
++        };                                                               \
++        return opivv_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s);\
++    }                                                                    \
++    return false;                                                        \
+ }
+ /*
+--
+.41.0

-New patch
+[PULL v2 10/45] target/riscv: Remove redundant "cpu_vl == 0" checks
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
+Remove the redundant "vl == 0" check which is already included within the  vstart >= vl check, when vl == 0.
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230711165917.2629866-4-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn_trans/trans_rvv.c.inc | 31 +------------------------
+file changed, 1 insertion(+), 30 deletions(-)
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
+     TCGv_i32 desc;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     dest = tcg_temp_new_ptr();
+@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
+     TCGv_i32 desc;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     dest = tcg_temp_new_ptr();
+@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
+     TCGv_i32 desc;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     dest = tcg_temp_new_ptr();
+@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
+     TCGv_i32 desc;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     dest = tcg_temp_new_ptr();
+@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
+         return false;
+     }
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
+@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
+     uint32_t data = 0;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     dest = tcg_temp_new_ptr();
+@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
+     uint32_t data = 0;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     dest = tcg_temp_new_ptr();
+@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
+     if (checkfn(s, a)) {
+         uint32_t data = 0;
+         TCGLabel *over = gen_new_label();
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         data = FIELD_DP32(data, VDATA, VM, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
+     if (opiwv_widen_check(s, a)) {
+         uint32_t data = 0;
+         TCGLabel *over = gen_new_label();
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         data = FIELD_DP32(data, VDATA, VM, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
+ {
+     uint32_t data = 0;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     data = FIELD_DP32(data, VDATA, VM, vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+             gen_helper_##NAME##_w,                                 \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
+                 gen_helper_vmv_v_v_w, gen_helper_vmv_v_v_d,
+             };
+             TCGLabel *over = gen_new_label();
+-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+             tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
+         vext_check_ss(s, a->rd, 0, 1)) {
+         TCGv s1;
+         TCGLabel *over = gen_new_label();
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         s1 = get_gpr(s, a->rs1, EXT_SIGN);
+@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
+                 gen_helper_vmv_v_x_w, gen_helper_vmv_v_x_d,
+             };
+             TCGLabel *over = gen_new_label();
+-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+             s1 = tcg_constant_i64(simm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm(s, RISCV_FRM_DYN);                              \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
+     TCGv_i64 t1;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     dest = tcg_temp_new_ptr();
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
+         };                                                       \
+         TCGLabel *over = gen_new_label();                        \
+         gen_set_rm(s, RISCV_FRM_DYN);                            \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);        \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);\
+                                                                  \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm(s, RISCV_FRM_DYN);                              \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
+         uint32_t data = 0;
+         TCGLabel *over = gen_new_label();
+         gen_set_rm_chkfrm(s, rm);
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         data = FIELD_DP32(data, VDATA, VM, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
+                 gen_helper_vmv_v_x_d,
+             };
+             TCGLabel *over = gen_new_label();
+-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+             t1 = tcg_temp_new_i64();
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm_chkfrm(s, FRM);                                 \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm(s, RISCV_FRM_DYN);                              \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm_chkfrm(s, FRM);                                 \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm_chkfrm(s, FRM);                                 \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
+         uint32_t data = 0;                                         \
+         gen_helper_gvec_4_ptr *fn = gen_helper_##NAME;             \
+         TCGLabel *over = gen_new_label();                          \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
+@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
+         require_vm(a->vm, a->rd)) {
+         uint32_t data = 0;
+         TCGLabel *over = gen_new_label();
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         data = FIELD_DP32(data, VDATA, VM, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_s_x(DisasContext *s, arg_vmv_s_x *a)
+         TCGv s1;
+         TCGLabel *over = gen_new_label();
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         t1 = tcg_temp_new_i64();
+@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
+         TCGv_i64 t1;
+         TCGLabel *over = gen_new_label();
+-        /* if vl == 0 or vstart >= vl, skip vector register write back */
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
++        /* if vstart >= vl, skip vector register write back */
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         /* NaN-box f[rs1] */
+@@ -XXX,XX +XXX,XX @@ static bool int_ext_op(DisasContext *s, arg_rmr *a, uint8_t seq)
+     uint32_t data = 0;
+     gen_helper_gvec_3_ptr *fn;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     static gen_helper_gvec_3_ptr * const fns[6][4] = {
+--
+.41.0

-[PULL 08/21] hw/timer: Add SiFive PWM support
+[PULL v2 11/45] target/riscv: Add Zvbc ISA extension support
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-This is the initial commit of the SiFive PWM timer. This is used by
+This commit adds support for the Zvbc vector-crypto extension, which
-guest software as a timer and is included in the SiFive FU540 SoC.
+consists of the following instructions:
-Signed-off-by: Justin Restivo <jrestivo@draper.com>
+* vclmulh.[vx,vv]
-Signed-off-by: Alexandra Clifford <aclifford@draper.com>
+* vclmul.[vx,vv]
-Signed-off-by: Amanda Strnad <astrnad@draper.com>
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Co-authored-by: Max Chou <max.chou@sifive.com>
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 [max.chou@sifive.com: Exposed x-zvbc property]
 Message-ID: <20230711165917.2629866-5-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 9f70a210acbfaf0e1ea6ad311ab892ac69134d8b.1631159656.git.alistair.francis@wdc.com
 ---
- include/hw/timer/sifive_pwm.h |  62 +++++
+ target/riscv/cpu_cfg.h                   |  1 +
- hw/timer/sifive_pwm.c         | 468 ++++++++++++++++++++++++++++++++++
+ target/riscv/helper.h                    |  6 +++
- hw/timer/Kconfig              |   3 +
+ target/riscv/insn32.decode               |  6 +++
- hw/timer/meson.build          |   1 +
+ target/riscv/cpu.c                       |  9 ++++
- hw/timer/trace-events         |   6 +
+ target/riscv/translate.c                 |  1 +
-files changed, 540 insertions(+)
+ target/riscv/vcrypto_helper.c            | 59 ++++++++++++++++++++++
- create mode 100644 include/hw/timer/sifive_pwm.h
+ target/riscv/insn_trans/trans_rvvk.c.inc | 62 ++++++++++++++++++++++++
- create mode 100644 hw/timer/sifive_pwm.c
+ target/riscv/meson.build                 |  3 +-
+files changed, 146 insertions(+), 1 deletion(-)
-diff --git a/include/hw/timer/sifive_pwm.h b/include/hw/timer/sifive_pwm.h
+ create mode 100644 target/riscv/vcrypto_helper.c
  create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zve32f;
      bool ext_zve64f;
      bool ext_zve64d;
 +    bool ext_zvbc;
      bool ext_zmmul;
      bool ext_zvfbfmin;
      bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
 +
 +/* Vector crypto functions */
 +DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
  # *** Zvfbfwma Standard Extension ***
  vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
  vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
 +
 +# *** Zvbc vector crypto extension ***
 +vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
 +vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
 +vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
 +vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
      ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
      ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
 +    ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
      ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
      ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
      ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
 +    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
 +        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
 +        return;
 +    }
 +
      if (cpu->cfg.ext_zk) {
          cpu->cfg.ext_zkn = true;
          cpu->cfg.ext_zkr = true;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
      DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
 +    /* Vector cryptography extensions */
 +    DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 +
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
  #include "insn_trans/trans_rvzfa.c.inc"
  #include "insn_trans/trans_rvzfh.c.inc"
  #include "insn_trans/trans_rvk.c.inc"
 +#include "insn_trans/trans_rvvk.c.inc"
  #include "insn_trans/trans_privileged.c.inc"
  #include "insn_trans/trans_svinval.c.inc"
  #include "insn_trans/trans_rvbf16.c.inc"
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/timer/sifive_pwm.h
++++ b/target/riscv/vcrypto_helper.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * SiFive PWM
++ * RISC-V Vector Crypto Extension Helpers for QEMU.
 + *
-+ * Copyright (c) 2020 Western Digital
++ * Copyright (C) 2023 SiFive, Inc.
-+ *
++ * Written by Codethink Ltd and SiFive.
-+ * Author:  Alistair Francis <alistair.francis@wdc.com>
++ *
-+ *
++ * This program is free software; you can redistribute it and/or modify it
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * under the terms and conditions of the GNU General Public License,
-+ * of this software and associated documentation files (the "Software"), to deal
++ * version 2 or later, as published by the Free Software Foundation.
-+ * in the Software without restriction, including without limitation the rights
++ *
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * copies of the Software, and to permit persons to whom the Software is
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * furnished to do so, subject to the following conditions:
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-+ *
++ * more details.
-+ * The above copyright notice and this permission notice shall be included in
++ *
-+ * all copies or substantial portions of the Software.
++ * You should have received a copy of the GNU General Public License along with
-+ *
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
-+#ifndef HW_SIFIVE_PWM_H
++#include "qemu/osdep.h"
-+#define HW_SIFIVE_PWM_H
++#include "qemu/host-utils.h"
-+
++#include "qemu/bitops.h"
-+#include "hw/sysbus.h"
++#include "cpu.h"
-+#include "qemu/timer.h"
++#include "exec/memop.h"
-+#include "qom/object.h"
++#include "exec/exec-all.h"
-+
++#include "exec/helper-proto.h"
-+#define TYPE_SIFIVE_PWM "sifive-pwm"
++#include "internals.h"
-+
++#include "vector_internals.h"
-+#define SIFIVE_PWM(obj) \
++
-+    OBJECT_CHECK(SiFivePwmState, (obj), TYPE_SIFIVE_PWM)
++static uint64_t clmul64(uint64_t y, uint64_t x)
-+
++{
-+#define SIFIVE_PWM_CHANS          4
++    uint64_t result = 0;
-+#define SIFIVE_PWM_IRQS           SIFIVE_PWM_CHANS
++    for (int j = 63; j >= 0; j--) {
-+
++        if ((y >> j) & 1) {
-+typedef struct SiFivePwmState {
++            result ^= (x << j);
-+    /* <private> */
++        }
-+    SysBusDevice parent_obj;
++    }
-+
++    return result;
-+    /* <public> */
++}
-+    MemoryRegion mmio;
++
-+    QEMUTimer timer[SIFIVE_PWM_CHANS];
++static uint64_t clmulh64(uint64_t y, uint64_t x)
-+    /*
++{
-+     * if en bit(s) set, is the number of ticks when pwmcount was 0
++    uint64_t result = 0;
-+     * if en bit(s) not set, is the number of ticks in pwmcount
++    for (int j = 63; j >= 1; j--) {
-+     */
++        if ((y >> j) & 1) {
-+    uint64_t tick_offset;
++            result ^= (x >> (64 - j));
-+    uint64_t freq_hz;
++        }
-+
++    }
-+    uint32_t pwmcfg;
++    return result;
-+    uint32_t pwmcmp[SIFIVE_PWM_CHANS];
++}
 +
-+    qemu_irq irqs[SIFIVE_PWM_IRQS];
++RVVCALL(OPIVV2, vclmul_vv, OP_UUU_D, H8, H8, H8, clmul64)
-+} SiFivePwmState;
++GEN_VEXT_VV(vclmul_vv, 8)
-+
++RVVCALL(OPIVX2, vclmul_vx, OP_UUU_D, H8, H8, clmul64)
-+#endif /* HW_SIFIVE_PWM_H */
++GEN_VEXT_VX(vclmul_vx, 8)
-diff --git a/hw/timer/sifive_pwm.c b/hw/timer/sifive_pwm.c
++RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
 +GEN_VEXT_VV(vclmulh_vv, 8)
 +RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
 +GEN_VEXT_VX(vclmulh_vx, 8)
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/timer/sifive_pwm.c
++++ b/target/riscv/insn_trans/trans_rvvk.c.inc
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * SiFive PWM
++ * RISC-V translation routines for the vector crypto extension.
 + *
-+ * Copyright (c) 2020 Western Digital
++ * Copyright (C) 2023 SiFive, Inc.
-+ *
++ * Written by Codethink Ltd and SiFive.
-+ * Author:  Alistair Francis <alistair.francis@wdc.com>
++ *
-+ *
++ * This program is free software; you can redistribute it and/or modify it
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * under the terms and conditions of the GNU General Public License,
-+ * of this software and associated documentation files (the "Software"), to deal
++ * version 2 or later, as published by the Free Software Foundation.
-+ * in the Software without restriction, including without limitation the rights
++ *
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * copies of the Software, and to permit persons to whom the Software is
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * furnished to do so, subject to the following conditions:
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-+ *
++ * more details.
-+ * The above copyright notice and this permission notice shall be included in
++ *
-+ * all copies or substantial portions of the Software.
++ * You should have received a copy of the GNU General Public License along with
-+ *
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
-+#include "qemu/osdep.h"
++/*
-+#include "trace.h"
++ * Zvbc
-+#include "hw/irq.h"
++ */
-+#include "hw/timer/sifive_pwm.h"
++
-+#include "hw/qdev-properties.h"
++#define GEN_VV_MASKED_TRANS(NAME, CHECK)                     \
-+#include "hw/registerfields.h"
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)   \
-+#include "migration/vmstate.h"
++    {                                                        \
-+#include "qemu/log.h"
++        if (CHECK(s, a)) {                                   \
-+#include "qemu/module.h"
++            return opivv_trans(a->rd, a->rs1, a->rs2, a->vm, \
-+
++                               gen_helper_##NAME, s);        \
-+#define HAS_PWM_EN_BITS(cfg) ((cfg & R_CONFIG_ENONESHOT_MASK) || \
++        }                                                    \
-+                              (cfg & R_CONFIG_ENALWAYS_MASK))
++        return false;                                        \
-+
++    }
-+#define PWMCMP_MASK 0xFFFF
++
-+#define PWMCOUNT_MASK 0x7FFFFFFF
++static bool vclmul_vv_check(DisasContext *s, arg_rmrr *a)
-+
++{
-+REG32(CONFIG,                   0x00)
++    return opivv_check(s, a) &&
-+    FIELD(CONFIG, SCALE,            0, 4)
++           s->cfg_ptr->ext_zvbc == true &&
-+    FIELD(CONFIG, STICKY,           8, 1)
++           s->sew == MO_64;
-+    FIELD(CONFIG, ZEROCMP,          9, 1)
++}
-+    FIELD(CONFIG, DEGLITCH,         10, 1)
++
-+    FIELD(CONFIG, ENALWAYS,         12, 1)
++GEN_VV_MASKED_TRANS(vclmul_vv, vclmul_vv_check)
-+    FIELD(CONFIG, ENONESHOT,        13, 1)
++GEN_VV_MASKED_TRANS(vclmulh_vv, vclmul_vv_check)
-+    FIELD(CONFIG, CMP0CENTER,       16, 1)
++
-+    FIELD(CONFIG, CMP1CENTER,       17, 1)
++#define GEN_VX_MASKED_TRANS(NAME, CHECK)                     \
-+    FIELD(CONFIG, CMP2CENTER,       18, 1)
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)   \
-+    FIELD(CONFIG, CMP3CENTER,       19, 1)
++    {                                                        \
-+    FIELD(CONFIG, CMP0GANG,         24, 1)
++        if (CHECK(s, a)) {                                   \
-+    FIELD(CONFIG, CMP1GANG,         25, 1)
++            return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, \
-+    FIELD(CONFIG, CMP2GANG,         26, 1)
++                               gen_helper_##NAME, s);        \
-+    FIELD(CONFIG, CMP3GANG,         27, 1)
++        }                                                    \
-+    FIELD(CONFIG, CMP0IP,           28, 1)
++        return false;                                        \
-+    FIELD(CONFIG, CMP1IP,           29, 1)
++    }
-+    FIELD(CONFIG, CMP2IP,           30, 1)
++
-+    FIELD(CONFIG, CMP3IP,           31, 1)
++static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
-+REG32(COUNT,                    0x08)
++{
-+REG32(PWMS,                     0x10)
++    return opivx_check(s, a) &&
-+REG32(PWMCMP0,                  0x20)
++           s->cfg_ptr->ext_zvbc == true &&
-+REG32(PWMCMP1,                  0x24)
++           s->sew == MO_64;
-+REG32(PWMCMP2,                  0x28)
++}
-+REG32(PWMCMP3,                  0x2C)
++
-+
++GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
-+static inline uint64_t sifive_pwm_ns_to_ticks(SiFivePwmState *s,
++GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
-+                                                uint64_t time)
+diff --git a/target/riscv/meson.build b/target/riscv/meson.build
-+{
+index XXXXXXX..XXXXXXX 100644
-+    return muldiv64(time, s->freq_hz, NANOSECONDS_PER_SECOND);
+--- a/target/riscv/meson.build
-+}
++++ b/target/riscv/meson.build
-+
+@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
-+static inline uint64_t sifive_pwm_ticks_to_ns(SiFivePwmState *s,
+   'translate.c',
-+                                                uint64_t ticks)
+   'm128_helper.c',
-+{
+   'crypto_helper.c',
-+    return muldiv64(ticks, NANOSECONDS_PER_SECOND, s->freq_hz);
+-  'zce_helper.c'
-+}
++  'zce_helper.c',
-+
++  'vcrypto_helper.c'
-+static inline uint64_t sifive_pwm_compute_scale(SiFivePwmState *s)
+ ))
-+{
+ riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
-+    return s->pwmcfg & R_CONFIG_SCALE_MASK;
 +}
 +
 +static void sifive_pwm_set_alarms(SiFivePwmState *s)
 +{
 +    uint64_t now_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +
 +    if (HAS_PWM_EN_BITS(s->pwmcfg)) {
 +        /*
 +         * Subtract ticks from number of ticks when the timer was zero
 +         * and mask to the register width.
 +         */
 +        uint64_t pwmcount = (sifive_pwm_ns_to_ticks(s, now_ns) -
 +                             s->tick_offset) & PWMCOUNT_MASK;
 +        uint64_t scale = sifive_pwm_compute_scale(s);
 +        /* PWMs only contains PWMCMP_MASK bits starting at scale */
 +        uint64_t pwms = (pwmcount & (PWMCMP_MASK << scale)) >> scale;
 +
 +        for (int i = 0; i < SIFIVE_PWM_CHANS; i++) {
 +            uint64_t pwmcmp = s->pwmcmp[i] & PWMCMP_MASK;
 +            uint64_t pwmcmp_ticks = pwmcmp << scale;
 +
 +            /*
 +             * Per circuit diagram and spec, both cases raises corresponding
 +             * IP bit one clock cycle after time expires.
 +             */
 +            if (pwmcmp > pwms) {
 +                uint64_t offset = pwmcmp_ticks - pwmcount + 1;
 +                uint64_t when_to_fire = now_ns +
 +                                          sifive_pwm_ticks_to_ns(s, offset);
 +
 +                trace_sifive_pwm_set_alarm(when_to_fire, now_ns);
 +                timer_mod(&s->timer[i], when_to_fire);
 +            } else {
 +                /* Schedule interrupt for next cycle */
 +                trace_sifive_pwm_set_alarm(now_ns + 1, now_ns);
 +                timer_mod(&s->timer[i], now_ns + 1);
 +            }
 +
 +        }
 +    } else {
 +        /*
 +         * If timer incrementing disabled, just do pwms > pwmcmp check since
 +         * a write may have happened to PWMs.
 +         */
 +        uint64_t pwmcount = (s->tick_offset) & PWMCOUNT_MASK;
 +        uint64_t scale = sifive_pwm_compute_scale(s);
 +        uint64_t pwms = (pwmcount & (PWMCMP_MASK << scale)) >> scale;
 +
 +        for (int i = 0; i < SIFIVE_PWM_CHANS; i++) {
 +            uint64_t pwmcmp = s->pwmcmp[i] & PWMCMP_MASK;
 +
 +            if (pwms >= pwmcmp) {
 +                trace_sifive_pwm_set_alarm(now_ns + 1, now_ns);
 +                timer_mod(&s->timer[i], now_ns + 1);
 +            } else {
 +                /* Effectively disable timer by scheduling far in future. */
 +                trace_sifive_pwm_set_alarm(0xFFFFFFFFFFFFFF, now_ns);
 +                timer_mod(&s->timer[i], 0xFFFFFFFFFFFFFF);
 +            }
 +        }
 +    }
 +}
 +
 +static void sifive_pwm_interrupt(SiFivePwmState *s, int num)
 +{
 +    uint64_t now = sifive_pwm_ns_to_ticks(s,
 +                                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
 +    bool was_incrementing = HAS_PWM_EN_BITS(s->pwmcfg);
 +
 +    trace_sifive_pwm_interrupt(num);
 +
 +    s->pwmcfg |= R_CONFIG_CMP0IP_MASK << num;
 +    qemu_irq_raise(s->irqs[num]);
 +
 +    /*
 +     * If the zerocmp is set and pwmcmp0 raised the interrupt
 +     * reset the zero ticks.
 +     */
 +    if ((s->pwmcfg & R_CONFIG_ZEROCMP_MASK) && (num == 0)) {
 +        /* If reset signal conditions, disable ENONESHOT. */
 +        s->pwmcfg &= ~R_CONFIG_ENONESHOT_MASK;
 +
 +        if (was_incrementing) {
 +            /* If incrementing, time in ticks is when pwmcount is zero */
 +            s->tick_offset = now;
 +        } else {
 +            /* If not incrementing, pwmcount = 0 */
 +            s->tick_offset = 0;
 +        }
 +    }
 +
 +    /*
 +     * If carryout bit set, which we discern via looking for overflow,
 +     * also reset ENONESHOT.
 +     */
 +    if (was_incrementing &&
 +        ((now & PWMCOUNT_MASK) < (s->tick_offset & PWMCOUNT_MASK))) {
 +        s->pwmcfg &= ~R_CONFIG_ENONESHOT_MASK;
 +    }
 +
 +    /* Schedule or disable interrupts */
 +    sifive_pwm_set_alarms(s);
 +
 +    /* If was enabled, and now not enabled, switch tick rep */
 +    if (was_incrementing && !HAS_PWM_EN_BITS(s->pwmcfg)) {
 +        s->tick_offset = (now - s->tick_offset) & PWMCOUNT_MASK;
 +    }
 +}
 +
 +static void sifive_pwm_interrupt_0(void *opaque)
 +{
 +    SiFivePwmState *s = opaque;
 +
 +    sifive_pwm_interrupt(s, 0);
 +}
 +
 +static void sifive_pwm_interrupt_1(void *opaque)
 +{
 +    SiFivePwmState *s = opaque;
 +
 +    sifive_pwm_interrupt(s, 1);
 +}
 +
 +static void sifive_pwm_interrupt_2(void *opaque)
 +{
 +    SiFivePwmState *s = opaque;
 +
 +    sifive_pwm_interrupt(s, 2);
 +}
 +
 +static void sifive_pwm_interrupt_3(void *opaque)
 +{
 +    SiFivePwmState *s = opaque;
 +
 +    sifive_pwm_interrupt(s, 3);
 +}
 +
 +static uint64_t sifive_pwm_read(void *opaque, hwaddr addr,
 +                                  unsigned int size)
 +{
 +    SiFivePwmState *s = opaque;
 +    uint64_t cur_time, scale;
 +    uint64_t now = sifive_pwm_ns_to_ticks(s,
 +                                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
 +
 +    trace_sifive_pwm_read(addr);
 +
 +    switch (addr) {
 +    case A_CONFIG:
 +        return s->pwmcfg;
 +    case A_COUNT:
 +        cur_time = s->tick_offset;
 +
 +        if (HAS_PWM_EN_BITS(s->pwmcfg)) {
 +            cur_time = now - cur_time;
 +        }
 +
 +        /*
 +         * Return the value in the counter with bit 31 always 0
 +         * This is allowed to wrap around so we don't need to check that.
 +         */
 +        return cur_time & PWMCOUNT_MASK;
 +    case A_PWMS:
 +        cur_time = s->tick_offset;
 +        scale = sifive_pwm_compute_scale(s);
 +
 +        if (HAS_PWM_EN_BITS(s->pwmcfg)) {
 +            cur_time = now - cur_time;
 +        }
 +
 +        return ((cur_time & PWMCOUNT_MASK) >> scale) & PWMCMP_MASK;
 +    case A_PWMCMP0:
 +        return s->pwmcmp[0] & PWMCMP_MASK;
 +    case A_PWMCMP1:
 +        return s->pwmcmp[1] & PWMCMP_MASK;
 +    case A_PWMCMP2:
 +        return s->pwmcmp[2] & PWMCMP_MASK;
 +    case A_PWMCMP3:
 +        return s->pwmcmp[3] & PWMCMP_MASK;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
 +        return 0;
 +    }
 +
 +    return 0;
 +}
 +
 +static void sifive_pwm_write(void *opaque, hwaddr addr,
 +                               uint64_t val64, unsigned int size)
 +{
 +    SiFivePwmState *s = opaque;
 +    uint32_t value = val64;
 +    uint64_t new_offset, scale;
 +    uint64_t now = sifive_pwm_ns_to_ticks(s,
 +                                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
 +
 +    trace_sifive_pwm_write(value, addr);
 +
 +    switch (addr) {
 +    case A_CONFIG:
 +        if (value & (R_CONFIG_CMP0CENTER_MASK | R_CONFIG_CMP1CENTER_MASK |
 +                     R_CONFIG_CMP2CENTER_MASK | R_CONFIG_CMP3CENTER_MASK)) {
 +            qemu_log_mask(LOG_UNIMP, "%s: CMPxCENTER is not supported\n",
 +                          __func__);
 +        }
 +
 +        if (value & (R_CONFIG_CMP0GANG_MASK | R_CONFIG_CMP1GANG_MASK |
 +                     R_CONFIG_CMP2GANG_MASK | R_CONFIG_CMP3GANG_MASK)) {
 +            qemu_log_mask(LOG_UNIMP, "%s: CMPxGANG is not supported\n",
 +                          __func__);
 +        }
 +
 +        if (value & (R_CONFIG_CMP0IP_MASK | R_CONFIG_CMP1IP_MASK |
 +                     R_CONFIG_CMP2IP_MASK | R_CONFIG_CMP3IP_MASK)) {
 +            qemu_log_mask(LOG_UNIMP, "%s: CMPxIP is not supported\n",
 +                          __func__);
 +        }
 +
 +        if (!(value & R_CONFIG_CMP0IP_MASK)) {
 +            qemu_irq_lower(s->irqs[0]);
 +        }
 +
 +        if (!(value & R_CONFIG_CMP1IP_MASK)) {
 +            qemu_irq_lower(s->irqs[1]);
 +        }
 +
 +        if (!(value & R_CONFIG_CMP2IP_MASK)) {
 +            qemu_irq_lower(s->irqs[2]);
 +        }
 +
 +        if (!(value & R_CONFIG_CMP3IP_MASK)) {
 +            qemu_irq_lower(s->irqs[3]);
 +        }
 +
 +        /*
 +         * If this write enables the timer increment
 +         * set the time when pwmcount was zero to be cur_time - pwmcount.
 +         * If this write disables the timer increment
 +         * convert back from pwmcount to the time in ticks
 +         * when pwmcount was zero.
 +         */
 +        if ((!HAS_PWM_EN_BITS(s->pwmcfg) && HAS_PWM_EN_BITS(value)) ||
 +            (HAS_PWM_EN_BITS(s->pwmcfg) && !HAS_PWM_EN_BITS(value))) {
 +            s->tick_offset = (now - s->tick_offset) & PWMCOUNT_MASK;
 +        }
 +
 +        s->pwmcfg = value;
 +        break;
 +    case A_COUNT:
 +        /* The guest changed the counter, updated the offset value. */
 +        new_offset = value;
 +
 +        if (HAS_PWM_EN_BITS(s->pwmcfg)) {
 +            new_offset = now - new_offset;
 +        }
 +
 +        s->tick_offset = new_offset;
 +        break;
 +    case A_PWMS:
 +        scale = sifive_pwm_compute_scale(s);
 +        new_offset = (((value & PWMCMP_MASK) << scale) & PWMCOUNT_MASK);
 +
 +        if (HAS_PWM_EN_BITS(s->pwmcfg)) {
 +            new_offset = now - new_offset;
 +        }
 +
 +        s->tick_offset = new_offset;
 +        break;
 +    case A_PWMCMP0:
 +        s->pwmcmp[0] = value & PWMCMP_MASK;
 +        break;
 +    case A_PWMCMP1:
 +        s->pwmcmp[1] = value & PWMCMP_MASK;
 +        break;
 +    case A_PWMCMP2:
 +        s->pwmcmp[2] = value & PWMCMP_MASK;
 +        break;
 +    case A_PWMCMP3:
 +        s->pwmcmp[3] = value & PWMCMP_MASK;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
 +    }
 +
 +    /* Update the alarms to reflect possible updated values */
 +    sifive_pwm_set_alarms(s);
 +}
 +
 +static void sifive_pwm_reset(DeviceState *dev)
 +{
 +    SiFivePwmState *s = SIFIVE_PWM(dev);
 +    uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +
 +    s->pwmcfg = 0x00000000;
 +    s->pwmcmp[0] = 0x00000000;
 +    s->pwmcmp[1] = 0x00000000;
 +    s->pwmcmp[2] = 0x00000000;
 +    s->pwmcmp[3] = 0x00000000;
 +
 +    s->tick_offset = sifive_pwm_ns_to_ticks(s, now);
 +}
 +
 +static const MemoryRegionOps sifive_pwm_ops = {
 +    .read = sifive_pwm_read,
 +    .write = sifive_pwm_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +};
 +
 +static const VMStateDescription vmstate_sifive_pwm = {
 +    .name = TYPE_SIFIVE_PWM,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_TIMER_ARRAY(timer, SiFivePwmState, 4),
 +        VMSTATE_UINT64(tick_offset, SiFivePwmState),
 +        VMSTATE_UINT32(pwmcfg, SiFivePwmState),
 +        VMSTATE_UINT32_ARRAY(pwmcmp, SiFivePwmState, 4),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static Property sifive_pwm_properties[] = {
 +    /* 0.5Ghz per spec after FSBL */
 +    DEFINE_PROP_UINT64("clock-frequency", struct SiFivePwmState,
 +                       freq_hz, 500000000ULL),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void sifive_pwm_init(Object *obj)
 +{
 +    SiFivePwmState *s = SIFIVE_PWM(obj);
 +    int i;
 +
 +    for (i = 0; i < SIFIVE_PWM_IRQS; i++) {
 +        sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irqs[i]);
 +    }
 +
 +    memory_region_init_io(&s->mmio, obj, &sifive_pwm_ops, s,
 +                          TYPE_SIFIVE_PWM, 0x100);
 +    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 +}
 +
 +static void sifive_pwm_realize(DeviceState *dev, Error **errp)
 +{
 +    SiFivePwmState *s = SIFIVE_PWM(dev);
 +
 +    timer_init_ns(&s->timer[0], QEMU_CLOCK_VIRTUAL,
 +                  sifive_pwm_interrupt_0, s);
 +
 +    timer_init_ns(&s->timer[1], QEMU_CLOCK_VIRTUAL,
 +                  sifive_pwm_interrupt_1, s);
 +
 +    timer_init_ns(&s->timer[2], QEMU_CLOCK_VIRTUAL,
 +                  sifive_pwm_interrupt_2, s);
 +
 +    timer_init_ns(&s->timer[3], QEMU_CLOCK_VIRTUAL,
 +                  sifive_pwm_interrupt_3, s);
 +}
 +
 +static void sifive_pwm_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = sifive_pwm_reset;
 +    device_class_set_props(dc, sifive_pwm_properties);
 +    dc->vmsd = &vmstate_sifive_pwm;
 +    dc->realize = sifive_pwm_realize;
 +}
 +
 +static const TypeInfo sifive_pwm_info = {
 +    .name          = TYPE_SIFIVE_PWM,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(SiFivePwmState),
 +    .instance_init = sifive_pwm_init,
 +    .class_init    = sifive_pwm_class_init,
 +};
 +
 +static void sifive_pwm_register_types(void)
 +{
 +    type_register_static(&sifive_pwm_info);
 +}
 +
 +type_init(sifive_pwm_register_types)
 diff --git a/hw/timer/Kconfig b/hw/timer/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/Kconfig
 +++ b/hw/timer/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10_PIT
      bool
      select PTIMER
 +config SIFIVE_PWM
 +    bool
 +
  config STM32F2XX_TIMER
      bool
 diff --git a/hw/timer/meson.build b/hw/timer/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/meson.build
 +++ b/hw/timer/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_STELLARIS_GPTM', if_true: files('stellaris-gptm.c')
  softmmu_ss.add(when: 'CONFIG_STM32F2XX_TIMER', if_true: files('stm32f2xx_timer.c'))
  softmmu_ss.add(when: 'CONFIG_XILINX', if_true: files('xilinx_timer.c'))
  specific_ss.add(when: 'CONFIG_IBEX', if_true: files('ibex_timer.c'))
 +softmmu_ss.add(when: 'CONFIG_SIFIVE_PWM', if_true: files('sifive_pwm.c'))
  specific_ss.add(when: 'CONFIG_AVR_TIMER16', if_true: files('avr_timer16.c'))
 diff --git a/hw/timer/trace-events b/hw/timer/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/trace-events
 +++ b/hw/timer/trace-events
@@ -XXX,XX +XXX,XX @@ sse_counter_reset(void) "SSE system counter: reset"
  sse_timer_read(uint64_t offset, uint64_t data, unsigned size) "SSE system timer read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
  sse_timer_write(uint64_t offset, uint64_t data, unsigned size) "SSE system timer write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
  sse_timer_reset(void) "SSE system timer: reset"
 +
 +# sifive_pwm.c
 +sifive_pwm_set_alarm(uint64_t alarm, uint64_t now) "Setting alarm to: 0x%" PRIx64 ", now: 0x%" PRIx64
 +sifive_pwm_interrupt(int num) "Interrupt %d"
 +sifive_pwm_read(uint64_t offset) "Read at address: 0x%" PRIx64
 +sifive_pwm_write(uint64_t data, uint64_t offset) "Write 0x%" PRIx64 " at address: 0x%" PRIx64
 --
-.31.1
+.41.0

-New patch
+[PULL v2 12/45] target/riscv: Move vector translation checks
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
+Move the checks out of `do_opiv{v,x,i}_gvec{,_shift}` functions
+and into the corresponding macros. This enables the functions to be
+reused in proceeding commits without check duplication.
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-6-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn_trans/trans_rvv.c.inc | 28 +++++++++++--------------
+file changed, 12 insertions(+), 16 deletions(-)
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
+@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
+               gen_helper_gvec_4_ptr *fn)
+ {
+     TCGLabel *over = gen_new_label();
+-    if (!opivv_check(s, a)) {
+-        return false;
+-    }
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+         gen_helper_##NAME##_b, gen_helper_##NAME##_h,              \
+         gen_helper_##NAME##_w, gen_helper_##NAME##_d,              \
+     };                                                             \
++    if (!opivv_check(s, a)) {                                      \
++        return false;                                              \
++    }                                                              \
+     return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);   \
+ }
+@@ -XXX,XX +XXX,XX @@ static inline bool
+ do_opivx_gvec(DisasContext *s, arg_rmrr *a, GVecGen2sFn *gvec_fn,
+               gen_helper_opivx *fn)
+ {
+-    if (!opivx_check(s, a)) {
+-        return false;
+-    }
+-
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
+         TCGv_i64 src1 = tcg_temp_new_i64();
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+         gen_helper_##NAME##_b, gen_helper_##NAME##_h,              \
+         gen_helper_##NAME##_w, gen_helper_##NAME##_d,              \
+     };                                                             \
++    if (!opivx_check(s, a)) {                                      \
++        return false;                                              \
++    }                                                              \
+     return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);   \
+ }
+@@ -XXX,XX +XXX,XX @@ static inline bool
+ do_opivi_gvec(DisasContext *s, arg_rmrr *a, GVecGen2iFn *gvec_fn,
+               gen_helper_opivx *fn, imm_mode_t imm_mode)
+ {
+-    if (!opivx_check(s, a)) {
+-        return false;
+-    }
+-
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
+         gvec_fn(s->sew, vreg_ofs(s, a->rd), vreg_ofs(s, a->rs2),
+                 extract_imm(s, a->rs1, imm_mode), MAXSZ(s), MAXSZ(s));
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+         gen_helper_##OPIVX##_b, gen_helper_##OPIVX##_h,            \
+         gen_helper_##OPIVX##_w, gen_helper_##OPIVX##_d,            \
+     };                                                             \
++    if (!opivx_check(s, a)) {                                      \
++        return false;                                              \
++    }                                                              \
+     return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF,                 \
+                          fns[s->sew], IMM_MODE);                   \
+ }
+@@ -XXX,XX +XXX,XX @@ static inline bool
+ do_opivx_gvec_shift(DisasContext *s, arg_rmrr *a, GVecGen2sFn32 *gvec_fn,
+                     gen_helper_opivx *fn)
+ {
+-    if (!opivx_check(s, a)) {
+-        return false;
+-    }
+-
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
+         TCGv_i32 src1 = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
+         gen_helper_##NAME##_b, gen_helper_##NAME##_h,                     \
+         gen_helper_##NAME##_w, gen_helper_##NAME##_d,                     \
+     };                                                                    \
+-                                                                          \
++    if (!opivx_check(s, a)) {                                             \
++        return false;                                                     \
++    }                                                                     \
+     return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);    \
+ }
+--
+.41.0

-New patch
+[PULL v2 13/45] target/riscv: Refactor translation of vector-widening instruction
+From: Dickon Hood <dickon.hood@codethink.co.uk>
+Zvbb (implemented in later commit) has a widening instruction, which
+requires an extra check on the enabled extensions.  Refactor
+GEN_OPIVX_WIDEN_TRANS() to take a check function to avoid reimplementing
+it.
+Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-7-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn_trans/trans_rvv.c.inc | 52 +++++++++++--------------
+file changed, 23 insertions(+), 29 deletions(-)
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool opivx_widen_check(DisasContext *s, arg_rmrr *a)
+            vext_check_ds(s, a->rd, a->rs2, a->vm);
+ }
+-static bool do_opivx_widen(DisasContext *s, arg_rmrr *a,
+-                           gen_helper_opivx *fn)
+-{
+-    if (opivx_widen_check(s, a)) {
+-        return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, fn, s);
+-    }
+-    return false;
+-}
+-
+-#define GEN_OPIVX_WIDEN_TRANS(NAME) \
+-static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
+-{                                                            \
+-    static gen_helper_opivx * const fns[3] = {               \
+-        gen_helper_##NAME##_b,                               \
+-        gen_helper_##NAME##_h,                               \
+-        gen_helper_##NAME##_w                                \
+-    };                                                       \
+-    return do_opivx_widen(s, a, fns[s->sew]);                \
++#define GEN_OPIVX_WIDEN_TRANS(NAME, CHECK) \
++static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
++{                                                                         \
++    if (CHECK(s, a)) {                                                    \
++        static gen_helper_opivx * const fns[3] = {                        \
++            gen_helper_##NAME##_b,                                        \
++            gen_helper_##NAME##_h,                                        \
++            gen_helper_##NAME##_w                                         \
++        };                                                                \
++        return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s); \
++    }                                                                     \
++    return false;                                                         \
+ }
+-GEN_OPIVX_WIDEN_TRANS(vwaddu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwadd_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwsubu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwsub_vx)
++GEN_OPIVX_WIDEN_TRANS(vwaddu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwadd_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwsubu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwsub_vx, opivx_widen_check)
+ /* WIDEN OPIVV with WIDEN */
+ static bool opiwv_widen_check(DisasContext *s, arg_rmrr *a)
+@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vrem_vx, opivx_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmul_vv, opivv_widen_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmulu_vv, opivv_widen_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmulsu_vv, opivv_widen_check)
+-GEN_OPIVX_WIDEN_TRANS(vwmul_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwmulu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwmulsu_vx)
++GEN_OPIVX_WIDEN_TRANS(vwmul_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwmulu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwmulsu_vx, opivx_widen_check)
+ /* Vector Single-Width Integer Multiply-Add Instructions */
+ GEN_OPIVV_TRANS(vmacc_vv, opivv_check)
+@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vnmsub_vx, opivx_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmaccu_vv, opivv_widen_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmacc_vv, opivv_widen_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmaccsu_vv, opivv_widen_check)
+-GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwmacc_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx)
++GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwmacc_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx, opivx_widen_check)
+ /* Vector Integer Merge and Move Instructions */
+ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
+--
+.41.0

-New patch
+[PULL v2 14/45] target/riscv: Refactor some of the generic vector functionality
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Move some macros out of `vector_helper` and into `vector_internals`.
+This ensures they can be used by both vector and vector-crypto helpers
+(latter implemented in proceeding commits).
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-8-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/vector_internals.h | 46 +++++++++++++++++++++++++++++++++
+ target/riscv/vector_helper.c    | 42 ------------------------------
+files changed, 46 insertions(+), 42 deletions(-)
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vector_internals.h
++++ b/target/riscv/vector_internals.h
+@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+ /* expand macro args before macro */
+ #define RVVCALL(macro, ...)  macro(__VA_ARGS__)
++/* (TD, T2, TX2) */
++#define OP_UU_B uint8_t, uint8_t, uint8_t
++#define OP_UU_H uint16_t, uint16_t, uint16_t
++#define OP_UU_W uint32_t, uint32_t, uint32_t
++#define OP_UU_D uint64_t, uint64_t, uint64_t
++
+ /* (TD, T1, T2, TX1, TX2) */
+ #define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
+ #define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
+ #define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
+ #define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
++#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
++static void do_##NAME(void *vd, void *vs2, int i)      \
++{                                                      \
++    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
++    *((TD *)vd + HD(i)) = OP(s2);                      \
++}
++
++#define GEN_VEXT_V(NAME, ESZ)                          \
++void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
++                  CPURISCVState *env, uint32_t desc)   \
++{                                                      \
++    uint32_t vm = vext_vm(desc);                       \
++    uint32_t vl = env->vl;                             \
++    uint32_t total_elems =                             \
++        vext_get_total_elems(env, desc, ESZ);          \
++    uint32_t vta = vext_vta(desc);                     \
++    uint32_t vma = vext_vma(desc);                     \
++    uint32_t i;                                        \
++                                                       \
++    for (i = env->vstart; i < vl; i++) {               \
++        if (!vm && !vext_elem_mask(v0, i)) {           \
++            /* set masked-off elements to 1s */        \
++            vext_set_elems_1s(vd, vma, i * ESZ,        \
++                              (i + 1) * ESZ);          \
++            continue;                                  \
++        }                                              \
++        do_##NAME(vd, vs2, i);                         \
++    }                                                  \
++    env->vstart = 0;                                   \
++    /* set tail elements to 1s */                      \
++    vext_set_elems_1s(vd, vta, vl * ESZ,               \
++                      total_elems * ESZ);              \
++}
++
+ /* operation of two vector elements */
+ typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
+@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
+                do_##NAME, ESZ);                           \
+ }
++/* Three of the widening shortening macros: */
++/* (TD, T1, T2, TX1, TX2) */
++#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
++#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
++#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
++
+ #endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vector_helper.c
++++ b/target/riscv/vector_helper.c
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
+ #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
+ #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
+ #define OP_SUS_D int64_t, uint64_t, int64_t, uint64_t, int64_t
+-#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
+-#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
+-#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
+ #define WOP_SSS_B int16_t, int8_t, int8_t, int16_t, int16_t
+ #define WOP_SSS_H int32_t, int16_t, int16_t, int32_t, int32_t
+ #define WOP_SSS_W int64_t, int32_t, int32_t, int64_t, int64_t
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_h, 4)
+ GEN_VEXT_VF(vfwnmsac_vf_w, 8)
+ /* Vector Floating-Point Square-Root Instruction */
+-/* (TD, T2, TX2) */
+-#define OP_UU_H uint16_t, uint16_t, uint16_t
+-#define OP_UU_W uint32_t, uint32_t, uint32_t
+-#define OP_UU_D uint64_t, uint64_t, uint64_t
+-
+ #define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
+ static void do_##NAME(void *vd, void *vs2, int i,      \
+                       CPURISCVState *env)              \
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
+ GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
+ /* Vector Floating-Point Classify Instruction */
+-#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
+-static void do_##NAME(void *vd, void *vs2, int i)      \
+-{                                                      \
+-    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
+-    *((TD *)vd + HD(i)) = OP(s2);                      \
+-}
+-
+-#define GEN_VEXT_V(NAME, ESZ)                          \
+-void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
+-                  CPURISCVState *env, uint32_t desc)   \
+-{                                                      \
+-    uint32_t vm = vext_vm(desc);                       \
+-    uint32_t vl = env->vl;                             \
+-    uint32_t total_elems =                             \
+-        vext_get_total_elems(env, desc, ESZ);          \
+-    uint32_t vta = vext_vta(desc);                     \
+-    uint32_t vma = vext_vma(desc);                     \
+-    uint32_t i;                                        \
+-                                                       \
+-    for (i = env->vstart; i < vl; i++) {               \
+-        if (!vm && !vext_elem_mask(v0, i)) {           \
+-            /* set masked-off elements to 1s */        \
+-            vext_set_elems_1s(vd, vma, i * ESZ,        \
+-                              (i + 1) * ESZ);          \
+-            continue;                                  \
+-        }                                              \
+-        do_##NAME(vd, vs2, i);                         \
+-    }                                                  \
+-    env->vstart = 0;                                   \
+-    /* set tail elements to 1s */                      \
+-    vext_set_elems_1s(vd, vta, vl * ESZ,               \
+-                      total_elems * ESZ);              \
+-}
+-
+ target_ulong fclass_h(uint64_t frs1)
+ {
+     float16 f = frs1;
+--
+.41.0

-[PULL 11/21] hw/intc: Upgrade the SiFive CLINT implementation to RISC-V ACLINT
+[PULL v2 15/45] target/riscv: Add Zvbb ISA extension support
-From: Anup Patel <anup.patel@wdc.com>
+From: Dickon Hood <dickon.hood@codethink.co.uk>
-The RISC-V ACLINT is more modular and backward compatible with
+This commit adds support for the Zvbb vector-crypto extension, which
-original SiFive CLINT so instead of duplicating the original
+consists of the following instructions:
 SiFive CLINT implementation we upgrade the current SiFive CLINT
 implementation to RISC-V ACLINT implementation.
-Signed-off-by: Anup Patel <anup.patel@wdc.com>
+* vrol.[vv,vx]
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+* vror.[vv,vx,vi]
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+* vbrev8.v
-Message-id: 20210831110603.338681-3-anup.patel@wdc.com
+* vrev8.v
 * vandn.[vv,vx]
 * vbrev.v
 * vclz.v
 * vctz.v
 * vcpop.v
 * vwsll.[vv,vx,vi]
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
 Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 [max.chou@sifive.com: Fix imm mode of vror.vi]
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvbb property]
 Message-ID: <20230711165917.2629866-9-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/intc/riscv_aclint.h |  54 +++--
+ target/riscv/cpu_cfg.h                   |   1 +
- hw/intc/riscv_aclint.c         | 373 +++++++++++++++++++++++----------
+ target/riscv/helper.h                    |  62 +++++++++
- hw/riscv/microchip_pfsoc.c     |   9 +-
+ target/riscv/insn32.decode               |  20 +++
- hw/riscv/shakti_c.c            |  11 +-
+ target/riscv/cpu.c                       |  12 ++
- hw/riscv/sifive_e.c            |  11 +-
+ target/riscv/vcrypto_helper.c            | 138 +++++++++++++++++++
- hw/riscv/sifive_u.c            |   9 +-
+ target/riscv/insn_trans/trans_rvvk.c.inc | 164 +++++++++++++++++++++++
- hw/riscv/spike.c               |  14 +-
+files changed, 397 insertions(+)
  hw/riscv/virt.c                |  14 +-
 files changed, 339 insertions(+), 156 deletions(-)
-diff --git a/include/hw/intc/riscv_aclint.h b/include/hw/intc/riscv_aclint.h
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/riscv_aclint.h
+--- a/target/riscv/cpu_cfg.h
-+++ b/include/hw/intc/riscv_aclint.h
++++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zve32f;
      bool ext_zve64f;
      bool ext_zve64d;
 +    bool ext_zvbb;
      bool ext_zvbc;
      bool ext_zmmul;
      bool ext_zvfbfmin;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
  DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vror_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vror_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vror_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vror_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vror_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vrol_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vrol_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_5(vrev8_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_d, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vclz_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_d, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vwsll_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vandn_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
 @@ -XXX,XX +XXX,XX @@
- /*
+ %imm_u    12:s20                 !function=ex_shift_12
-- * SiFive CLINT (Core Local Interruptor) interface
+ %imm_bs   30:2                   !function=ex_shift_3
-+ * RISC-V ACLINT (Advanced Core Local Interruptor) interface
+ %imm_rnum 20:4
-  *
++%imm_z6   26:1 15:5
-  * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
-  * Copyright (c) 2017 SiFive, Inc.
+ # Argument sets:
-+ * Copyright (c) 2021 Western Digital Corporation or its affiliates.
+ &empty
   *
   * This program is free software; you can redistribute it and/or modify it
   * under the terms and conditions of the GNU General Public License,
 @@ -XXX,XX +XXX,XX @@
-  * this program.  If not, see <http://www.gnu.org/licenses/>.
+ @r_vm    ...... vm:1 ..... ..... ... ..... ....... &rmrr %rs2 %rs1 %rd
-  */
+ @r_vm_1  ...... . ..... ..... ... ..... .......    &rmrr vm=1 %rs2 %rs1 %rd
+ @r_vm_0  ...... . ..... ..... ... ..... .......    &rmrr vm=0 %rs2 %rs1 %rd
--#ifndef HW_SIFIVE_CLINT_H
++@r2_zimm6  ..... . vm:1 ..... ..... ... ..... .......  &rmrr %rs2 rs1=%imm_z6 %rd
--#define HW_SIFIVE_CLINT_H
+ @r2_zimm11 . zimm:11  ..... ... ..... ....... %rs1 %rd
-+#ifndef HW_RISCV_ACLINT_H
+ @r2_zimm10 .. zimm:10  ..... ... ..... ....... %rs1 %rd
-+#define HW_RISCV_ACLINT_H
+ @r2_s    .......   ..... ..... ... ..... ....... %rs2 %rs1
+@@ -XXX,XX +XXX,XX @@ vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
- #include "hw/sysbus.h"
+ vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
+ vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
--#define TYPE_SIFIVE_CLINT "riscv.sifive.clint"
+ vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
-+#define TYPE_RISCV_ACLINT_MTIMER "riscv.aclint.mtimer"
++
++# *** Zvbb vector crypto extension ***
--#define SIFIVE_CLINT(obj) \
++vrol_vv     010101 . ..... ..... 000 ..... 1010111 @r_vm
--    OBJECT_CHECK(SiFiveCLINTState, (obj), TYPE_SIFIVE_CLINT)
++vrol_vx     010101 . ..... ..... 100 ..... 1010111 @r_vm
-+#define RISCV_ACLINT_MTIMER(obj) \
++vror_vv     010100 . ..... ..... 000 ..... 1010111 @r_vm
-+    OBJECT_CHECK(RISCVAclintMTimerState, (obj), TYPE_RISCV_ACLINT_MTIMER)
++vror_vx     010100 . ..... ..... 100 ..... 1010111 @r_vm
++vror_vi     01010. . ..... ..... 011 ..... 1010111 @r2_zimm6
--typedef struct SiFiveCLINTState {
++vbrev8_v    010010 . ..... 01000 010 ..... 1010111 @r2_vm
-+typedef struct RISCVAclintMTimerState {
++vrev8_v     010010 . ..... 01001 010 ..... 1010111 @r2_vm
-     /*< private >*/
++vandn_vv    000001 . ..... ..... 000 ..... 1010111 @r_vm
-     SysBusDevice parent_obj;
++vandn_vx    000001 . ..... ..... 100 ..... 1010111 @r_vm
++vbrev_v     010010 . ..... 01010 010 ..... 1010111 @r2_vm
-@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveCLINTState {
++vclz_v      010010 . ..... 01100 010 ..... 1010111 @r2_vm
-     MemoryRegion mmio;
++vctz_v      010010 . ..... 01101 010 ..... 1010111 @r2_vm
-     uint32_t hartid_base;
++vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
-     uint32_t num_harts;
++vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
--    uint32_t sip_base;
++vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
-     uint32_t timecmp_base;
++vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
-     uint32_t time_base;
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
      uint32_t aperture_size;
      uint32_t timebase_freq;
      qemu_irq *timer_irqs;
 -    qemu_irq *soft_irqs;
 -} SiFiveCLINTState;
 +} RISCVAclintMTimerState;
 -DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
 -    uint32_t hartid_base, uint32_t num_harts, uint32_t sip_base,
 +DeviceState *riscv_aclint_mtimer_create(hwaddr addr, hwaddr size,
 +    uint32_t hartid_base, uint32_t num_harts,
      uint32_t timecmp_base, uint32_t time_base, uint32_t timebase_freq,
      bool provide_rdtime);
 -enum {
 -    SIFIVE_SIP_BASE     = 0x0,
 -    SIFIVE_TIMECMP_BASE = 0x4000,
 -    SIFIVE_TIME_BASE    = 0xBFF8
 -};
 +#define TYPE_RISCV_ACLINT_SWI "riscv.aclint.swi"
 +
 +#define RISCV_ACLINT_SWI(obj) \
 +    OBJECT_CHECK(RISCVAclintSwiState, (obj), TYPE_RISCV_ACLINT_SWI)
 +
 +typedef struct RISCVAclintSwiState {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +
 +    /*< public >*/
 +    MemoryRegion mmio;
 +    uint32_t hartid_base;
 +    uint32_t num_harts;
 +    uint32_t sswi;
 +    qemu_irq *soft_irqs;
 +} RISCVAclintSwiState;
 +
 +DeviceState *riscv_aclint_swi_create(hwaddr addr, uint32_t hartid_base,
 +    uint32_t num_harts, bool sswi);
  enum {
 -    SIFIVE_CLINT_TIMEBASE_FREQ = 10000000
 +    RISCV_ACLINT_DEFAULT_MTIMECMP      = 0x0,
 +    RISCV_ACLINT_DEFAULT_MTIME         = 0x7ff8,
 +    RISCV_ACLINT_DEFAULT_MTIMER_SIZE   = 0x8000,
 +    RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ = 10000000,
 +    RISCV_ACLINT_MAX_HARTS             = 4095,
 +    RISCV_ACLINT_SWI_SIZE              = 0x4000
  };
  #endif
 diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/riscv_aclint.c
+--- a/target/riscv/cpu.c
-+++ b/hw/intc/riscv_aclint.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
- /*
+     ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
-- * SiFive CLINT (Core Local Interruptor)
+     ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
-+ * RISC-V ACLINT (Advanced Core Local Interruptor)
+     ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
-+ * URL: https://github.com/riscv/riscv-aclint
++    ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
-  *
+     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
-  * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
+     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
-  * Copyright (c) 2017 SiFive, Inc.
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
-+ * Copyright (c) 2021 Western Digital Corporation or its affiliates.
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-  *
+         return;
-  * This provides real-time clock, timer and interprocessor interrupts.
+     }
-  *
 +    /*
 +     * In principle Zve*x would also suffice here, were they supported
 +     * in qemu
 +     */
 +    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
 +        error_setg(errp,
 +                   "Vector crypto extensions require V or Zve* extensions");
 +        return;
 +    }
 +
      if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
          error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
      /* Vector cryptography extensions */
 +    DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
      DEFINE_PROP_END_OF_LIST(),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
 @@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
- #include "qapi/error.h"
+ #include "qemu/host-utils.h"
- #include "qemu/error-report.h"
+ #include "qemu/bitops.h"
-+#include "qemu/log.h"
++#include "qemu/bswap.h"
- #include "qemu/module.h"
+ #include "cpu.h"
- #include "hw/sysbus.h"
+ #include "exec/memop.h"
- #include "target/riscv/cpu.h"
+ #include "exec/exec-all.h"
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
- #include "qemu/timer.h"
+ GEN_VEXT_VV(vclmulh_vv, 8)
- #include "hw/irq.h"
+ RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
+ GEN_VEXT_VX(vclmulh_vx, 8)
--typedef struct sifive_clint_callback {
++
--    SiFiveCLINTState *s;
++RVVCALL(OPIVV2, vror_vv_b, OP_UUU_B, H1, H1, H1, ror8)
-+typedef struct riscv_aclint_mtimer_callback {
++RVVCALL(OPIVV2, vror_vv_h, OP_UUU_H, H2, H2, H2, ror16)
-+    RISCVAclintMTimerState *s;
++RVVCALL(OPIVV2, vror_vv_w, OP_UUU_W, H4, H4, H4, ror32)
-     int num;
++RVVCALL(OPIVV2, vror_vv_d, OP_UUU_D, H8, H8, H8, ror64)
--} sifive_clint_callback;
++GEN_VEXT_VV(vror_vv_b, 1)
-+} riscv_aclint_mtimer_callback;
++GEN_VEXT_VV(vror_vv_h, 2)
++GEN_VEXT_VV(vror_vv_w, 4)
- static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
++GEN_VEXT_VV(vror_vv_d, 8)
- {
++
-@@ -XXX,XX +XXX,XX @@ static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
++RVVCALL(OPIVX2, vror_vx_b, OP_UUU_B, H1, H1, ror8)
-  * Called when timecmp is written to update the QEMU timer or immediately
++RVVCALL(OPIVX2, vror_vx_h, OP_UUU_H, H2, H2, ror16)
-  * trigger timer interrupt if mtimecmp <= current timer value.
++RVVCALL(OPIVX2, vror_vx_w, OP_UUU_W, H4, H4, ror32)
-  */
++RVVCALL(OPIVX2, vror_vx_d, OP_UUU_D, H8, H8, ror64)
--static void sifive_clint_write_timecmp(SiFiveCLINTState *s, RISCVCPU *cpu,
++GEN_VEXT_VX(vror_vx_b, 1)
--                                       int hartid,
++GEN_VEXT_VX(vror_vx_h, 2)
--                                       uint64_t value,
++GEN_VEXT_VX(vror_vx_w, 4)
--                                       uint32_t timebase_freq)
++GEN_VEXT_VX(vror_vx_d, 8)
-+static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
++
-+                                              RISCVCPU *cpu,
++RVVCALL(OPIVV2, vrol_vv_b, OP_UUU_B, H1, H1, H1, rol8)
-+                                              int hartid,
++RVVCALL(OPIVV2, vrol_vv_h, OP_UUU_H, H2, H2, H2, rol16)
-+                                              uint64_t value,
++RVVCALL(OPIVV2, vrol_vv_w, OP_UUU_W, H4, H4, H4, rol32)
-+                                              uint32_t timebase_freq)
++RVVCALL(OPIVV2, vrol_vv_d, OP_UUU_D, H8, H8, H8, rol64)
- {
++GEN_VEXT_VV(vrol_vv_b, 1)
-     uint64_t next;
++GEN_VEXT_VV(vrol_vv_h, 2)
-     uint64_t diff;
++GEN_VEXT_VV(vrol_vv_w, 4)
-@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write_timecmp(SiFiveCLINTState *s, RISCVCPU *cpu,
++GEN_VEXT_VV(vrol_vv_d, 8)
++
-     cpu->env.timecmp = value;
++RVVCALL(OPIVX2, vrol_vx_b, OP_UUU_B, H1, H1, rol8)
-     if (cpu->env.timecmp <= rtc_r) {
++RVVCALL(OPIVX2, vrol_vx_h, OP_UUU_H, H2, H2, rol16)
--        /* if we're setting an MTIMECMP value in the "past",
++RVVCALL(OPIVX2, vrol_vx_w, OP_UUU_W, H4, H4, rol32)
--           immediately raise the timer interrupt */
++RVVCALL(OPIVX2, vrol_vx_d, OP_UUU_D, H8, H8, rol64)
--        qemu_irq_raise(s->timer_irqs[hartid - s->hartid_base]);
++GEN_VEXT_VX(vrol_vx_b, 1)
-+        /*
++GEN_VEXT_VX(vrol_vx_h, 2)
-+         * If we're setting an MTIMECMP value in the "past",
++GEN_VEXT_VX(vrol_vx_w, 4)
-+         * immediately raise the timer interrupt
++GEN_VEXT_VX(vrol_vx_d, 8)
-+         */
++
-+        qemu_irq_raise(mtimer->timer_irqs[hartid - mtimer->hartid_base]);
++static uint64_t brev8(uint64_t val)
          return;
      }
      /* otherwise, set up the future timer interrupt */
 -    qemu_irq_lower(s->timer_irqs[hartid - s->hartid_base]);
 +    qemu_irq_lower(mtimer->timer_irqs[hartid - mtimer->hartid_base]);
      diff = cpu->env.timecmp - rtc_r;
      /* back to ns (note args switched in muldiv64) */
      uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write_timecmp(SiFiveCLINTState *s, RISCVCPU *cpu,
   * Callback used when the timer set using timer_mod expires.
   * Should raise the timer interrupt line
   */
 -static void sifive_clint_timer_cb(void *opaque)
 +static void riscv_aclint_mtimer_cb(void *opaque)
  {
 -    sifive_clint_callback *state = opaque;
 +    riscv_aclint_mtimer_callback *state = opaque;
      qemu_irq_raise(state->s->timer_irqs[state->num]);
  }
 -/* CPU wants to read rtc or timecmp register */
 -static uint64_t sifive_clint_read(void *opaque, hwaddr addr, unsigned size)
 +/* CPU read MTIMER register */
 +static uint64_t riscv_aclint_mtimer_read(void *opaque, hwaddr addr,
 +    unsigned size)
  {
 -    SiFiveCLINTState *clint = opaque;
 -    if (addr >= clint->sip_base &&
 -        addr < clint->sip_base + (clint->num_harts << 2)) {
 -        size_t hartid = clint->hartid_base + ((addr - clint->sip_base) >> 2);
 -        CPUState *cpu = qemu_get_cpu(hartid);
 -        CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 -        if (!env) {
 -            error_report("clint: invalid timecmp hartid: %zu", hartid);
 -        } else if ((addr & 0x3) == 0) {
 -            return (env->mip & MIP_MSIP) > 0;
 -        } else {
 -            error_report("clint: invalid read: %08x", (uint32_t)addr);
 -            return 0;
 -        }
 -    } else if (addr >= clint->timecmp_base &&
 -        addr < clint->timecmp_base + (clint->num_harts << 3)) {
 -        size_t hartid = clint->hartid_base +
 -            ((addr - clint->timecmp_base) >> 3);
 +    RISCVAclintMTimerState *mtimer = opaque;
 +
 +    if (addr >= mtimer->timecmp_base &&
 +        addr < (mtimer->timecmp_base + (mtimer->num_harts << 3))) {
 +        size_t hartid = mtimer->hartid_base +
 +                        ((addr - mtimer->timecmp_base) >> 3);
          CPUState *cpu = qemu_get_cpu(hartid);
          CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
          if (!env) {
 -            error_report("clint: invalid timecmp hartid: %zu", hartid);
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "aclint-mtimer: invalid hartid: %zu", hartid);
          } else if ((addr & 0x7) == 0) {
              /* timecmp_lo */
              uint64_t timecmp = env->timecmp;
@@ -XXX,XX +XXX,XX @@ static uint64_t sifive_clint_read(void *opaque, hwaddr addr, unsigned size)
              uint64_t timecmp = env->timecmp;
              return (timecmp >> 32) & 0xFFFFFFFF;
          } else {
 -            error_report("clint: invalid read: %08x", (uint32_t)addr);
 +            qemu_log_mask(LOG_UNIMP,
 +                          "aclint-mtimer: invalid read: %08x", (uint32_t)addr);
              return 0;
          }
 -    } else if (addr == clint->time_base) {
 +    } else if (addr == mtimer->time_base) {
          /* time_lo */
 -        return cpu_riscv_read_rtc(clint->timebase_freq) & 0xFFFFFFFF;
 -    } else if (addr == clint->time_base + 4) {
 +        return cpu_riscv_read_rtc(mtimer->timebase_freq) & 0xFFFFFFFF;
 +    } else if (addr == mtimer->time_base + 4) {
          /* time_hi */
 -        return (cpu_riscv_read_rtc(clint->timebase_freq) >> 32) & 0xFFFFFFFF;
 +        return (cpu_riscv_read_rtc(mtimer->timebase_freq) >> 32) & 0xFFFFFFFF;
      }
 -    error_report("clint: invalid read: %08x", (uint32_t)addr);
 +    qemu_log_mask(LOG_UNIMP,
 +                  "aclint-mtimer: invalid read: %08x", (uint32_t)addr);
      return 0;
  }
 -/* CPU wrote to rtc or timecmp register */
 -static void sifive_clint_write(void *opaque, hwaddr addr, uint64_t value,
 -        unsigned size)
 +/* CPU write MTIMER register */
 +static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
 +    uint64_t value, unsigned size)
  {
 -    SiFiveCLINTState *clint = opaque;
 +    RISCVAclintMTimerState *mtimer = opaque;
 -    if (addr >= clint->sip_base &&
 -        addr < clint->sip_base + (clint->num_harts << 2)) {
 -        size_t hartid = clint->hartid_base + ((addr - clint->sip_base) >> 2);
 -        CPUState *cpu = qemu_get_cpu(hartid);
 -        CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 -        if (!env) {
 -            error_report("clint: invalid timecmp hartid: %zu", hartid);
 -        } else if ((addr & 0x3) == 0) {
 -            qemu_set_irq(clint->soft_irqs[hartid - clint->hartid_base], value);
 -        } else {
 -            error_report("clint: invalid sip write: %08x", (uint32_t)addr);
 -        }
 -        return;
 -    } else if (addr >= clint->timecmp_base &&
 -        addr < clint->timecmp_base + (clint->num_harts << 3)) {
 -        size_t hartid = clint->hartid_base +
 -            ((addr - clint->timecmp_base) >> 3);
 +    if (addr >= mtimer->timecmp_base &&
 +        addr < (mtimer->timecmp_base + (mtimer->num_harts << 3))) {
 +        size_t hartid = mtimer->hartid_base +
 +                        ((addr - mtimer->timecmp_base) >> 3);
          CPUState *cpu = qemu_get_cpu(hartid);
          CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
          if (!env) {
 -            error_report("clint: invalid timecmp hartid: %zu", hartid);
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "aclint-mtimer: invalid hartid: %zu", hartid);
          } else if ((addr & 0x7) == 0) {
              /* timecmp_lo */
              uint64_t timecmp_hi = env->timecmp >> 32;
 -            sifive_clint_write_timecmp(clint, RISCV_CPU(cpu), hartid,
 -                timecmp_hi << 32 | (value & 0xFFFFFFFF), clint->timebase_freq);
 +            riscv_aclint_mtimer_write_timecmp(mtimer, RISCV_CPU(cpu), hartid,
 +                timecmp_hi << 32 | (value & 0xFFFFFFFF),
 +                mtimer->timebase_freq);
              return;
          } else if ((addr & 0x7) == 4) {
              /* timecmp_hi */
              uint64_t timecmp_lo = env->timecmp;
 -            sifive_clint_write_timecmp(clint, RISCV_CPU(cpu), hartid,
 -                value << 32 | (timecmp_lo & 0xFFFFFFFF), clint->timebase_freq);
 +            riscv_aclint_mtimer_write_timecmp(mtimer, RISCV_CPU(cpu), hartid,
 +                value << 32 | (timecmp_lo & 0xFFFFFFFF),
 +                mtimer->timebase_freq);
          } else {
 -            error_report("clint: invalid timecmp write: %08x", (uint32_t)addr);
 +            qemu_log_mask(LOG_UNIMP,
 +                          "aclint-mtimer: invalid timecmp write: %08x",
 +                          (uint32_t)addr);
          }
          return;
 -    } else if (addr == clint->time_base) {
 +    } else if (addr == mtimer->time_base) {
          /* time_lo */
 -        error_report("clint: time_lo write not implemented");
 +        qemu_log_mask(LOG_UNIMP,
 +                      "aclint-mtimer: time_lo write not implemented");
          return;
 -    } else if (addr == clint->time_base + 4) {
 +    } else if (addr == mtimer->time_base + 4) {
          /* time_hi */
 -        error_report("clint: time_hi write not implemented");
 +        qemu_log_mask(LOG_UNIMP,
 +                      "aclint-mtimer: time_hi write not implemented");
          return;
      }
 -    error_report("clint: invalid write: %08x", (uint32_t)addr);
 +    qemu_log_mask(LOG_UNIMP,
 +                  "aclint-mtimer: invalid write: %08x", (uint32_t)addr);
  }
 -static const MemoryRegionOps sifive_clint_ops = {
 -    .read = sifive_clint_read,
 -    .write = sifive_clint_write,
 +static const MemoryRegionOps riscv_aclint_mtimer_ops = {
 +    .read = riscv_aclint_mtimer_read,
 +    .write = riscv_aclint_mtimer_write,
      .endianness = DEVICE_LITTLE_ENDIAN,
      .valid = {
          .min_access_size = 4,
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps sifive_clint_ops = {
      }
  };
 -static Property sifive_clint_properties[] = {
 -    DEFINE_PROP_UINT32("hartid-base", SiFiveCLINTState, hartid_base, 0),
 -    DEFINE_PROP_UINT32("num-harts", SiFiveCLINTState, num_harts, 0),
 -    DEFINE_PROP_UINT32("sip-base", SiFiveCLINTState, sip_base, 0),
 -    DEFINE_PROP_UINT32("timecmp-base", SiFiveCLINTState, timecmp_base, 0),
 -    DEFINE_PROP_UINT32("time-base", SiFiveCLINTState, time_base, 0),
 -    DEFINE_PROP_UINT32("aperture-size", SiFiveCLINTState, aperture_size, 0),
 -    DEFINE_PROP_UINT32("timebase-freq", SiFiveCLINTState, timebase_freq, 0),
 +static Property riscv_aclint_mtimer_properties[] = {
 +    DEFINE_PROP_UINT32("hartid-base", RISCVAclintMTimerState,
 +        hartid_base, 0),
 +    DEFINE_PROP_UINT32("num-harts", RISCVAclintMTimerState, num_harts, 1),
 +    DEFINE_PROP_UINT32("timecmp-base", RISCVAclintMTimerState,
 +        timecmp_base, RISCV_ACLINT_DEFAULT_MTIMECMP),
 +    DEFINE_PROP_UINT32("time-base", RISCVAclintMTimerState,
 +        time_base, RISCV_ACLINT_DEFAULT_MTIME),
 +    DEFINE_PROP_UINT32("aperture-size", RISCVAclintMTimerState,
 +        aperture_size, RISCV_ACLINT_DEFAULT_MTIMER_SIZE),
 +    DEFINE_PROP_UINT32("timebase-freq", RISCVAclintMTimerState,
 +        timebase_freq, 0),
      DEFINE_PROP_END_OF_LIST(),
  };
 -static void sifive_clint_realize(DeviceState *dev, Error **errp)
 +static void riscv_aclint_mtimer_realize(DeviceState *dev, Error **errp)
  {
 -    SiFiveCLINTState *s = SIFIVE_CLINT(dev);
 -    memory_region_init_io(&s->mmio, OBJECT(dev), &sifive_clint_ops, s,
 -                          TYPE_SIFIVE_CLINT, s->aperture_size);
 +    RISCVAclintMTimerState *s = RISCV_ACLINT_MTIMER(dev);
 +    int i;
 +
 +    memory_region_init_io(&s->mmio, OBJECT(dev), &riscv_aclint_mtimer_ops,
 +                          s, TYPE_RISCV_ACLINT_MTIMER, s->aperture_size);
      sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
      s->timer_irqs = g_malloc(sizeof(qemu_irq) * s->num_harts);
      qdev_init_gpio_out(dev, s->timer_irqs, s->num_harts);
 -    s->soft_irqs = g_malloc(sizeof(qemu_irq) * s->num_harts);
 -    qdev_init_gpio_out(dev, s->soft_irqs, s->num_harts);
 +    /* Claim timer interrupt bits */
 +    for (i = 0; i < s->num_harts; i++) {
 +        RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(s->hartid_base + i));
 +        if (riscv_cpu_claim_interrupts(cpu, MIP_MTIP) < 0) {
 +            error_report("MTIP already claimed");
 +            exit(1);
 +        }
 +    }
  }
 -static void sifive_clint_class_init(ObjectClass *klass, void *data)
 +static void riscv_aclint_mtimer_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
 -    dc->realize = sifive_clint_realize;
 -    device_class_set_props(dc, sifive_clint_properties);
 +    dc->realize = riscv_aclint_mtimer_realize;
 +    device_class_set_props(dc, riscv_aclint_mtimer_properties);
  }
 -static const TypeInfo sifive_clint_info = {
 -    .name          = TYPE_SIFIVE_CLINT,
 +static const TypeInfo riscv_aclint_mtimer_info = {
 +    .name          = TYPE_RISCV_ACLINT_MTIMER,
      .parent        = TYPE_SYS_BUS_DEVICE,
 -    .instance_size = sizeof(SiFiveCLINTState),
 -    .class_init    = sifive_clint_class_init,
 +    .instance_size = sizeof(RISCVAclintMTimerState),
 +    .class_init    = riscv_aclint_mtimer_class_init,
  };
 -static void sifive_clint_register_types(void)
 -{
 -    type_register_static(&sifive_clint_info);
 -}
 -
 -type_init(sifive_clint_register_types)
 -
  /*
 - * Create CLINT device.
 + * Create ACLINT MTIMER device.
   */
 -DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
 -    uint32_t hartid_base, uint32_t num_harts, uint32_t sip_base,
 +DeviceState *riscv_aclint_mtimer_create(hwaddr addr, hwaddr size,
 +    uint32_t hartid_base, uint32_t num_harts,
      uint32_t timecmp_base, uint32_t time_base, uint32_t timebase_freq,
      bool provide_rdtime)
  {
      int i;
 +    DeviceState *dev = qdev_new(TYPE_RISCV_ACLINT_MTIMER);
 +
 +    assert(num_harts <= RISCV_ACLINT_MAX_HARTS);
 +    assert(!(addr & 0x7));
 +    assert(!(timecmp_base & 0x7));
 +    assert(!(time_base & 0x7));
 -    DeviceState *dev = qdev_new(TYPE_SIFIVE_CLINT);
      qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
      qdev_prop_set_uint32(dev, "num-harts", num_harts);
 -    qdev_prop_set_uint32(dev, "sip-base", sip_base);
      qdev_prop_set_uint32(dev, "timecmp-base", timecmp_base);
      qdev_prop_set_uint32(dev, "time-base", time_base);
      qdev_prop_set_uint32(dev, "aperture-size", size);
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
          CPUState *cpu = qemu_get_cpu(hartid_base + i);
          RISCVCPU *rvcpu = RISCV_CPU(cpu);
          CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 -        sifive_clint_callback *cb = g_malloc0(sizeof(sifive_clint_callback));
 +        riscv_aclint_mtimer_callback *cb =
 +            g_malloc0(sizeof(riscv_aclint_mtimer_callback));
          if (!env) {
              g_free(cb);
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
              riscv_cpu_set_rdtime_fn(env, cpu_riscv_read_rtc, timebase_freq);
          }
 -        cb->s = SIFIVE_CLINT(dev);
 +        cb->s = RISCV_ACLINT_MTIMER(dev);
          cb->num = i;
          env->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 -                                  &sifive_clint_timer_cb, cb);
 +                                  &riscv_aclint_mtimer_cb, cb);
          env->timecmp = 0;
          qdev_connect_gpio_out(dev, i,
                                qdev_get_gpio_in(DEVICE(rvcpu), IRQ_M_TIMER));
 -        qdev_connect_gpio_out(dev, num_harts + i,
 -                              qdev_get_gpio_in(DEVICE(rvcpu), IRQ_M_SOFT));
      }
      return dev;
  }
 +
 +/* CPU read [M|S]SWI register */
 +static uint64_t riscv_aclint_swi_read(void *opaque, hwaddr addr,
 +    unsigned size)
 +{
-+    RISCVAclintSwiState *swi = opaque;
++    val = ((val & 0x5555555555555555ull) << 1) |
-+
++          ((val & 0xAAAAAAAAAAAAAAAAull) >> 1);
-+    if (addr < (swi->num_harts << 2)) {
++    val = ((val & 0x3333333333333333ull) << 2) |
-+        size_t hartid = swi->hartid_base + (addr >> 2);
++          ((val & 0xCCCCCCCCCCCCCCCCull) >> 2);
-+        CPUState *cpu = qemu_get_cpu(hartid);
++    val = ((val & 0x0F0F0F0F0F0F0F0Full) << 4) |
-+        CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
++          ((val & 0xF0F0F0F0F0F0F0F0ull) >> 4);
-+        if (!env) {
++
-+            qemu_log_mask(LOG_GUEST_ERROR,
++    return val;
 +                          "aclint-swi: invalid hartid: %zu", hartid);
 +        } else if ((addr & 0x3) == 0) {
 +            return (swi->sswi) ? 0 : ((env->mip & MIP_MSIP) > 0);
 +        }
 +    }
 +
 +    qemu_log_mask(LOG_UNIMP,
 +                  "aclint-swi: invalid read: %08x", (uint32_t)addr);
 +    return 0;
 +}
 +
-+/* CPU write [M|S]SWI register */
++RVVCALL(OPIVV1, vbrev8_v_b, OP_UU_B, H1, H1, brev8)
-+static void riscv_aclint_swi_write(void *opaque, hwaddr addr, uint64_t value,
++RVVCALL(OPIVV1, vbrev8_v_h, OP_UU_H, H2, H2, brev8)
-+        unsigned size)
++RVVCALL(OPIVV1, vbrev8_v_w, OP_UU_W, H4, H4, brev8)
 +RVVCALL(OPIVV1, vbrev8_v_d, OP_UU_D, H8, H8, brev8)
 +GEN_VEXT_V(vbrev8_v_b, 1)
 +GEN_VEXT_V(vbrev8_v_h, 2)
 +GEN_VEXT_V(vbrev8_v_w, 4)
 +GEN_VEXT_V(vbrev8_v_d, 8)
 +
 +#define DO_IDENTITY(a) (a)
 +RVVCALL(OPIVV1, vrev8_v_b, OP_UU_B, H1, H1, DO_IDENTITY)
 +RVVCALL(OPIVV1, vrev8_v_h, OP_UU_H, H2, H2, bswap16)
 +RVVCALL(OPIVV1, vrev8_v_w, OP_UU_W, H4, H4, bswap32)
 +RVVCALL(OPIVV1, vrev8_v_d, OP_UU_D, H8, H8, bswap64)
 +GEN_VEXT_V(vrev8_v_b, 1)
 +GEN_VEXT_V(vrev8_v_h, 2)
 +GEN_VEXT_V(vrev8_v_w, 4)
 +GEN_VEXT_V(vrev8_v_d, 8)
 +
 +#define DO_ANDN(a, b) ((a) & ~(b))
 +RVVCALL(OPIVV2, vandn_vv_b, OP_UUU_B, H1, H1, H1, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_h, OP_UUU_H, H2, H2, H2, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_w, OP_UUU_W, H4, H4, H4, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_d, OP_UUU_D, H8, H8, H8, DO_ANDN)
 +GEN_VEXT_VV(vandn_vv_b, 1)
 +GEN_VEXT_VV(vandn_vv_h, 2)
 +GEN_VEXT_VV(vandn_vv_w, 4)
 +GEN_VEXT_VV(vandn_vv_d, 8)
 +
 +RVVCALL(OPIVX2, vandn_vx_b, OP_UUU_B, H1, H1, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_h, OP_UUU_H, H2, H2, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_w, OP_UUU_W, H4, H4, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_d, OP_UUU_D, H8, H8, DO_ANDN)
 +GEN_VEXT_VX(vandn_vx_b, 1)
 +GEN_VEXT_VX(vandn_vx_h, 2)
 +GEN_VEXT_VX(vandn_vx_w, 4)
 +GEN_VEXT_VX(vandn_vx_d, 8)
 +
 +RVVCALL(OPIVV1, vbrev_v_b, OP_UU_B, H1, H1, revbit8)
 +RVVCALL(OPIVV1, vbrev_v_h, OP_UU_H, H2, H2, revbit16)
 +RVVCALL(OPIVV1, vbrev_v_w, OP_UU_W, H4, H4, revbit32)
 +RVVCALL(OPIVV1, vbrev_v_d, OP_UU_D, H8, H8, revbit64)
 +GEN_VEXT_V(vbrev_v_b, 1)
 +GEN_VEXT_V(vbrev_v_h, 2)
 +GEN_VEXT_V(vbrev_v_w, 4)
 +GEN_VEXT_V(vbrev_v_d, 8)
 +
 +RVVCALL(OPIVV1, vclz_v_b, OP_UU_B, H1, H1, clz8)
 +RVVCALL(OPIVV1, vclz_v_h, OP_UU_H, H2, H2, clz16)
 +RVVCALL(OPIVV1, vclz_v_w, OP_UU_W, H4, H4, clz32)
 +RVVCALL(OPIVV1, vclz_v_d, OP_UU_D, H8, H8, clz64)
 +GEN_VEXT_V(vclz_v_b, 1)
 +GEN_VEXT_V(vclz_v_h, 2)
 +GEN_VEXT_V(vclz_v_w, 4)
 +GEN_VEXT_V(vclz_v_d, 8)
 +
 +RVVCALL(OPIVV1, vctz_v_b, OP_UU_B, H1, H1, ctz8)
 +RVVCALL(OPIVV1, vctz_v_h, OP_UU_H, H2, H2, ctz16)
 +RVVCALL(OPIVV1, vctz_v_w, OP_UU_W, H4, H4, ctz32)
 +RVVCALL(OPIVV1, vctz_v_d, OP_UU_D, H8, H8, ctz64)
 +GEN_VEXT_V(vctz_v_b, 1)
 +GEN_VEXT_V(vctz_v_h, 2)
 +GEN_VEXT_V(vctz_v_w, 4)
 +GEN_VEXT_V(vctz_v_d, 8)
 +
 +RVVCALL(OPIVV1, vcpop_v_b, OP_UU_B, H1, H1, ctpop8)
 +RVVCALL(OPIVV1, vcpop_v_h, OP_UU_H, H2, H2, ctpop16)
 +RVVCALL(OPIVV1, vcpop_v_w, OP_UU_W, H4, H4, ctpop32)
 +RVVCALL(OPIVV1, vcpop_v_d, OP_UU_D, H8, H8, ctpop64)
 +GEN_VEXT_V(vcpop_v_b, 1)
 +GEN_VEXT_V(vcpop_v_h, 2)
 +GEN_VEXT_V(vcpop_v_w, 4)
 +GEN_VEXT_V(vcpop_v_d, 8)
 +
 +#define DO_SLL(N, M) (N << (M & (sizeof(N) * 8 - 1)))
 +RVVCALL(OPIVV2, vwsll_vv_b, WOP_UUU_B, H2, H1, H1, DO_SLL)
 +RVVCALL(OPIVV2, vwsll_vv_h, WOP_UUU_H, H4, H2, H2, DO_SLL)
 +RVVCALL(OPIVV2, vwsll_vv_w, WOP_UUU_W, H8, H4, H4, DO_SLL)
 +GEN_VEXT_VV(vwsll_vv_b, 2)
 +GEN_VEXT_VV(vwsll_vv_h, 4)
 +GEN_VEXT_VV(vwsll_vv_w, 8)
 +
 +RVVCALL(OPIVX2, vwsll_vx_b, WOP_UUU_B, H2, H1, DO_SLL)
 +RVVCALL(OPIVX2, vwsll_vx_h, WOP_UUU_H, H4, H2, DO_SLL)
 +RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
 +GEN_VEXT_VX(vwsll_vx_b, 2)
 +GEN_VEXT_VX(vwsll_vx_h, 4)
 +GEN_VEXT_VX(vwsll_vx_w, 8)
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
  GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
  GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
 +
 +/*
 + * Zvbb
 + */
 +
 +#define GEN_OPIVI_GVEC_TRANS_CHECK(NAME, IMM_MODE, OPIVX, SUF, CHECK)   \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)              \
 +    {                                                                   \
 +        if (CHECK(s, a)) {                                              \
 +            static gen_helper_opivx *const fns[4] = {                   \
 +                gen_helper_##OPIVX##_b,                                 \
 +                gen_helper_##OPIVX##_h,                                 \
 +                gen_helper_##OPIVX##_w,                                 \
 +                gen_helper_##OPIVX##_d,                                 \
 +            };                                                          \
 +            return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew], \
 +                                 IMM_MODE);                             \
 +        }                                                               \
 +        return false;                                                   \
 +    }
 +
 +#define GEN_OPIVV_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
 +    {                                                                    \
 +        if (CHECK(s, a)) {                                               \
 +            static gen_helper_gvec_4_ptr *const fns[4] = {               \
 +                gen_helper_##NAME##_b,                                   \
 +                gen_helper_##NAME##_h,                                   \
 +                gen_helper_##NAME##_w,                                   \
 +                gen_helper_##NAME##_d,                                   \
 +            };                                                           \
 +            return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
 +        }                                                                \
 +        return false;                                                    \
 +    }
 +
 +#define GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(NAME, SUF, CHECK)       \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
 +    {                                                            \
 +        if (CHECK(s, a)) {                                       \
 +            static gen_helper_opivx *const fns[4] = {            \
 +                gen_helper_##NAME##_b,                           \
 +                gen_helper_##NAME##_h,                           \
 +                gen_helper_##NAME##_w,                           \
 +                gen_helper_##NAME##_d,                           \
 +            };                                                   \
 +            return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, \
 +                                       fns[s->sew]);             \
 +        }                                                        \
 +        return false;                                            \
 +    }
 +
 +static bool zvbb_vv_check(DisasContext *s, arg_rmrr *a)
 +{
-+    RISCVAclintSwiState *swi = opaque;
++    return opivv_check(s, a) && s->cfg_ptr->ext_zvbb == true;
 +
 +    if (addr < (swi->num_harts << 2)) {
 +        size_t hartid = swi->hartid_base + (addr >> 2);
 +        CPUState *cpu = qemu_get_cpu(hartid);
 +        CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 +        if (!env) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "aclint-swi: invalid hartid: %zu", hartid);
 +        } else if ((addr & 0x3) == 0) {
 +            if (value & 0x1) {
 +                qemu_irq_raise(swi->soft_irqs[hartid - swi->hartid_base]);
 +            } else {
 +                if (!swi->sswi) {
 +                    qemu_irq_lower(swi->soft_irqs[hartid - swi->hartid_base]);
 +                }
 +            }
 +            return;
 +        }
 +    }
 +
 +    qemu_log_mask(LOG_UNIMP,
 +                  "aclint-swi: invalid write: %08x", (uint32_t)addr);
 +}
 +
-+static const MemoryRegionOps riscv_aclint_swi_ops = {
++static bool zvbb_vx_check(DisasContext *s, arg_rmrr *a)
 +    .read = riscv_aclint_swi_read,
 +    .write = riscv_aclint_swi_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4
 +    }
 +};
 +
 +static Property riscv_aclint_swi_properties[] = {
 +    DEFINE_PROP_UINT32("hartid-base", RISCVAclintSwiState, hartid_base, 0),
 +    DEFINE_PROP_UINT32("num-harts", RISCVAclintSwiState, num_harts, 1),
 +    DEFINE_PROP_UINT32("sswi", RISCVAclintSwiState, sswi, false),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void riscv_aclint_swi_realize(DeviceState *dev, Error **errp)
 +{
-+    RISCVAclintSwiState *swi = RISCV_ACLINT_SWI(dev);
++    return opivx_check(s, a) && s->cfg_ptr->ext_zvbb == true;
 +    int i;
 +
 +    memory_region_init_io(&swi->mmio, OBJECT(dev), &riscv_aclint_swi_ops, swi,
 +                          TYPE_RISCV_ACLINT_SWI, RISCV_ACLINT_SWI_SIZE);
 +    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &swi->mmio);
 +
 +    swi->soft_irqs = g_malloc(sizeof(qemu_irq) * swi->num_harts);
 +    qdev_init_gpio_out(dev, swi->soft_irqs, swi->num_harts);
 +
 +    /* Claim software interrupt bits */
 +    for (i = 0; i < swi->num_harts; i++) {
 +        RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(swi->hartid_base + i));
 +        /* We don't claim mip.SSIP because it is writeable by software */
 +        if (riscv_cpu_claim_interrupts(cpu, swi->sswi ? 0 : MIP_MSIP) < 0) {
 +            error_report("MSIP already claimed");
 +            exit(1);
 +        }
 +    }
 +}
 +
-+static void riscv_aclint_swi_class_init(ObjectClass *klass, void *data)
++/* vrol.v[vx] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vrol_vv, rotlv, zvbb_vv_check)
 +GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vrol_vx, rotls, zvbb_vx_check)
 +
 +/* vror.v[vxi] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vror_vv, rotrv, zvbb_vv_check)
 +GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vror_vx, rotrs, zvbb_vx_check)
 +GEN_OPIVI_GVEC_TRANS_CHECK(vror_vi, IMM_TRUNC_SEW, vror_vx, rotri, zvbb_vx_check)
 +
 +#define GEN_OPIVX_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
 +    {                                                                    \
 +        if (CHECK(s, a)) {                                               \
 +            static gen_helper_opivx *const fns[4] = {                    \
 +                gen_helper_##NAME##_b,                                   \
 +                gen_helper_##NAME##_h,                                   \
 +                gen_helper_##NAME##_w,                                   \
 +                gen_helper_##NAME##_d,                                   \
 +            };                                                           \
 +            return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
 +        }                                                                \
 +        return false;                                                    \
 +    }
 +
 +/* vandn.v[vx] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vandn_vv, andc, zvbb_vv_check)
 +GEN_OPIVX_GVEC_TRANS_CHECK(vandn_vx, andcs, zvbb_vx_check)
 +
 +#define GEN_OPIV_TRANS(NAME, CHECK)                                        \
 +    static bool trans_##NAME(DisasContext *s, arg_rmr *a)                  \
 +    {                                                                      \
 +        if (CHECK(s, a)) {                                                 \
 +            uint32_t data = 0;                                             \
 +            static gen_helper_gvec_3_ptr *const fns[4] = {                 \
 +                gen_helper_##NAME##_b,                                     \
 +                gen_helper_##NAME##_h,                                     \
 +                gen_helper_##NAME##_w,                                     \
 +                gen_helper_##NAME##_d,                                     \
 +            };                                                             \
 +            TCGLabel *over = gen_new_label();                              \
 +            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);     \
 +                                                                           \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                     \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                 \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                   \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s); \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                   \
 +            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),         \
 +                               vreg_ofs(s, a->rs2), cpu_env,               \
 +                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, \
 +                               data, fns[s->sew]);                         \
 +            mark_vs_dirty(s);                                              \
 +            gen_set_label(over);                                           \
 +            return true;                                                   \
 +        }                                                                  \
 +        return false;                                                      \
 +    }
 +
 +static bool zvbb_opiv_check(DisasContext *s, arg_rmr *a)
 +{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
++    return s->cfg_ptr->ext_zvbb == true &&
-+    dc->realize = riscv_aclint_swi_realize;
++           require_rvv(s) &&
-+    device_class_set_props(dc, riscv_aclint_swi_properties);
++           vext_check_isa_ill(s) &&
 +           vext_check_ss(s, a->rd, a->rs2, a->vm);
 +}
 +
-+static const TypeInfo riscv_aclint_swi_info = {
++GEN_OPIV_TRANS(vbrev8_v, zvbb_opiv_check)
-+    .name          = TYPE_RISCV_ACLINT_SWI,
++GEN_OPIV_TRANS(vrev8_v, zvbb_opiv_check)
-+    .parent        = TYPE_SYS_BUS_DEVICE,
++GEN_OPIV_TRANS(vbrev_v, zvbb_opiv_check)
-+    .instance_size = sizeof(RISCVAclintSwiState),
++GEN_OPIV_TRANS(vclz_v, zvbb_opiv_check)
-+    .class_init    = riscv_aclint_swi_class_init,
++GEN_OPIV_TRANS(vctz_v, zvbb_opiv_check)
-+};
++GEN_OPIV_TRANS(vcpop_v, zvbb_opiv_check)
 +
-+/*
++static bool vwsll_vv_check(DisasContext *s, arg_rmrr *a)
 + * Create ACLINT [M|S]SWI device.
 + */
 +DeviceState *riscv_aclint_swi_create(hwaddr addr, uint32_t hartid_base,
 +    uint32_t num_harts, bool sswi)
 +{
-+    int i;
++    return s->cfg_ptr->ext_zvbb && opivv_widen_check(s, a);
 +    DeviceState *dev = qdev_new(TYPE_RISCV_ACLINT_SWI);
 +
 +    assert(num_harts <= RISCV_ACLINT_MAX_HARTS);
 +    assert(!(addr & 0x3));
 +
 +    qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
 +    qdev_prop_set_uint32(dev, "num-harts", num_harts);
 +    qdev_prop_set_uint32(dev, "sswi", sswi ? true : false);
 +    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +
 +    for (i = 0; i < num_harts; i++) {
 +        CPUState *cpu = qemu_get_cpu(hartid_base + i);
 +        RISCVCPU *rvcpu = RISCV_CPU(cpu);
 +
 +        qdev_connect_gpio_out(dev, i,
 +                              qdev_get_gpio_in(DEVICE(rvcpu),
 +                                  (sswi) ? IRQ_S_SOFT : IRQ_M_SOFT));
 +    }
 +
 +    return dev;
 +}
 +
-+static void riscv_aclint_register_types(void)
++static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
 +{
-+    type_register_static(&riscv_aclint_mtimer_info);
++    return s->cfg_ptr->ext_zvbb && opivx_widen_check(s, a);
 +    type_register_static(&riscv_aclint_swi_info);
 +}
 +
-+type_init(riscv_aclint_register_types)
++/* OPIVI without GVEC IR */
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
++#define GEN_OPIVI_WIDEN_TRANS(NAME, IMM_MODE, OPIVX, CHECK)                  \
-index XXXXXXX..XXXXXXX 100644
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
---- a/hw/riscv/microchip_pfsoc.c
++    {                                                                        \
-+++ b/hw/riscv/microchip_pfsoc.c
++        if (CHECK(s, a)) {                                                   \
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
++            static gen_helper_opivx *const fns[3] = {                        \
-         memmap[MICROCHIP_PFSOC_BUSERR_UNIT4].size);
++                gen_helper_##OPIVX##_b,                                      \
++                gen_helper_##OPIVX##_h,                                      \
-     /* CLINT */
++                gen_helper_##OPIVX##_w,                                      \
--    sifive_clint_create(memmap[MICROCHIP_PFSOC_CLINT].base,
++            };                                                               \
--        memmap[MICROCHIP_PFSOC_CLINT].size, 0, ms->smp.cpus,
++            return opivi_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s, \
--        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
++                               IMM_MODE);                                    \
-+    riscv_aclint_swi_create(memmap[MICROCHIP_PFSOC_CLINT].base,
++        }                                                                    \
-+        0, ms->smp.cpus, false);
++        return false;                                                        \
-+    riscv_aclint_mtimer_create(
++    }
-+        memmap[MICROCHIP_PFSOC_CLINT].base + RISCV_ACLINT_SWI_SIZE,
++
-+        RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
++GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
-+        RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
++GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
-         CLINT_TIMEBASE_FREQ, false);
++GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
      /* L2 cache controller */
 diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/shakti_c.c
 +++ b/hw/riscv/shakti_c.c
@@ -XXX,XX +XXX,XX @@ static void shakti_c_soc_state_realize(DeviceState *dev, Error **errp)
          SHAKTI_C_PLIC_CONTEXT_STRIDE,
          shakti_c_memmap[SHAKTI_C_PLIC].size);
 -    sifive_clint_create(shakti_c_memmap[SHAKTI_C_CLINT].base,
 -        shakti_c_memmap[SHAKTI_C_CLINT].size, 0, 1,
 -        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
 -        SIFIVE_CLINT_TIMEBASE_FREQ, false);
 +    riscv_aclint_swi_create(shakti_c_memmap[SHAKTI_C_CLINT].base,
 +        0, 1, false);
 +    riscv_aclint_mtimer_create(shakti_c_memmap[SHAKTI_C_CLINT].base +
 +            RISCV_ACLINT_SWI_SIZE,
 +        RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, 1,
 +        RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
 +        RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
      qdev_prop_set_chr(DEVICE(&(sss->uart)), "chardev", serial_hd(0));
      if (!sysbus_realize(SYS_BUS_DEVICE(&sss->uart), errp)) {
 diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_e.c
 +++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
          SIFIVE_E_PLIC_CONTEXT_BASE,
          SIFIVE_E_PLIC_CONTEXT_STRIDE,
          memmap[SIFIVE_E_DEV_PLIC].size);
 -    sifive_clint_create(memmap[SIFIVE_E_DEV_CLINT].base,
 -        memmap[SIFIVE_E_DEV_CLINT].size, 0, ms->smp.cpus,
 -        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
 -        SIFIVE_CLINT_TIMEBASE_FREQ, false);
 +    riscv_aclint_swi_create(memmap[SIFIVE_E_DEV_CLINT].base,
 +        0, ms->smp.cpus, false);
 +    riscv_aclint_mtimer_create(memmap[SIFIVE_E_DEV_CLINT].base +
 +            RISCV_ACLINT_SWI_SIZE,
 +        RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
 +        RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
 +        RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
      create_unimplemented_device("riscv.sifive.e.aon",
          memmap[SIFIVE_E_DEV_AON].base, memmap[SIFIVE_E_DEV_AON].size);
      sifive_e_prci_create(memmap[SIFIVE_E_DEV_PRCI].base);
 diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_u.c
 +++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
          serial_hd(0), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_U_UART0_IRQ));
      sifive_uart_create(system_memory, memmap[SIFIVE_U_DEV_UART1].base,
          serial_hd(1), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_U_UART1_IRQ));
 -    sifive_clint_create(memmap[SIFIVE_U_DEV_CLINT].base,
 -        memmap[SIFIVE_U_DEV_CLINT].size, 0, ms->smp.cpus,
 -        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
 +    riscv_aclint_swi_create(memmap[SIFIVE_U_DEV_CLINT].base, 0,
 +        ms->smp.cpus, false);
 +    riscv_aclint_mtimer_create(memmap[SIFIVE_U_DEV_CLINT].base +
 +            RISCV_ACLINT_SWI_SIZE,
 +        RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
 +        RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
          CLINT_TIMEBASE_FREQ, false);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->prci), errp)) {
 diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/spike.c
 +++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
      qemu_fdt_add_subnode(fdt, "/cpus");
      qemu_fdt_setprop_cell(fdt, "/cpus", "timebase-frequency",
 -        SIFIVE_CLINT_TIMEBASE_FREQ);
 +        RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ);
      qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0x0);
      qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 0x1);
      qemu_fdt_add_subnode(fdt, "/cpus/cpu-map");
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
          sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_abort);
          /* Core Local Interruptor (timer and IPI) for each socket */
 -        sifive_clint_create(
 +        riscv_aclint_swi_create(
              memmap[SPIKE_CLINT].base + i * memmap[SPIKE_CLINT].size,
 -            memmap[SPIKE_CLINT].size, base_hartid, hart_count,
 -            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
 -            SIFIVE_CLINT_TIMEBASE_FREQ, false);
 +            base_hartid, hart_count, false);
 +        riscv_aclint_mtimer_create(
 +            memmap[SPIKE_CLINT].base + i * memmap[SPIKE_CLINT].size +
 +                RISCV_ACLINT_SWI_SIZE,
 +            RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
 +            RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
 +            RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
      }
      /* register system main memory (actual RAM) */
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
      qemu_fdt_add_subnode(fdt, "/cpus");
      qemu_fdt_setprop_cell(fdt, "/cpus", "timebase-frequency",
 -                          SIFIVE_CLINT_TIMEBASE_FREQ);
 +                          RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ);
      qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0x0);
      qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 0x1);
      qemu_fdt_add_subnode(fdt, "/cpus/cpu-map");
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
          sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_abort);
          /* Per-socket CLINT */
 -        sifive_clint_create(
 +        riscv_aclint_swi_create(
              memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
 -            memmap[VIRT_CLINT].size, base_hartid, hart_count,
 -            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
 -            SIFIVE_CLINT_TIMEBASE_FREQ, true);
 +            base_hartid, hart_count, false);
 +        riscv_aclint_mtimer_create(
 +            memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size +
 +                RISCV_ACLINT_SWI_SIZE,
 +            RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
 +            RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
 +            RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
          /* Per-socket PLIC hart topology configuration string */
          plic_hart_config = plic_hart_config_string(hart_count);
 --
-.31.1
+.41.0

-New patch
+[PULL v2 16/45] target/riscv: Add Zvkned ISA extension support
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
+This commit adds support for the Zvkned vector-crypto extension, which
+consists of the following instructions:
+* vaesef.[vv,vs]
+* vaesdf.[vv,vs]
+* vaesdm.[vv,vs]
+* vaesz.vs
+* vaesem.[vv,vs]
+* vaeskf1.vi
+* vaeskf2.vi
+Translation functions are defined in
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
+`target/riscv/vcrypto_helper.c`.
+Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
+Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
+[max.chou@sifive.com: Replaced vstart checking by TCG op]
+Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
+Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+[max.chou@sifive.com: Imported aes-round.h and exposed x-zvkned
+property]
+[max.chou@sifive.com: Fixed endian issues and replaced the vstart & vl
+egs checking by helper function]
+[max.chou@sifive.com: Replaced bswap32 calls in aes key expanding]
+Message-ID: <20230711165917.2629866-10-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_cfg.h                   |   1 +
+ target/riscv/helper.h                    |  14 ++
+ target/riscv/insn32.decode               |  14 ++
+ target/riscv/cpu.c                       |   4 +-
+ target/riscv/vcrypto_helper.c            | 202 +++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvvk.c.inc | 147 +++++++++++++++++
+files changed, 381 insertions(+), 1 deletion(-)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_zve64d;
+     bool ext_zvbb;
+     bool ext_zvbc;
++    bool ext_zvkned;
+     bool ext_zmmul;
+     bool ext_zvfbfmin;
+     bool ext_zvfbfwma;
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/helper.h
++++ b/target/riscv/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+ DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+ DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+ DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
++
++DEF_HELPER_2(egs_check, void, i32, env)
++
++DEF_HELPER_4(vaesef_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesef_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdf_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdf_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesem_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesem_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdm_vv, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
++DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
++DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@
+ @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
+ @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
+ @r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
++@r2_vm_1 ...... . ..... ..... ... ..... ....... &rmr vm=1 %rs2 %rd
+ @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
+ @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
+ @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
+@@ -XXX,XX +XXX,XX @@ vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
+ vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
+ vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
+ vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
++
++# *** Zvkned vector crypto extension ***
++vaesef_vv   101000 1 ..... 00011 010 ..... 1110111 @r2_vm_1
++vaesef_vs   101001 1 ..... 00011 010 ..... 1110111 @r2_vm_1
++vaesdf_vv   101000 1 ..... 00001 010 ..... 1110111 @r2_vm_1
++vaesdf_vs   101001 1 ..... 00001 010 ..... 1110111 @r2_vm_1
++vaesem_vv   101000 1 ..... 00010 010 ..... 1110111 @r2_vm_1
++vaesem_vs   101001 1 ..... 00010 010 ..... 1110111 @r2_vm_1
++vaesdm_vv   101000 1 ..... 00000 010 ..... 1110111 @r2_vm_1
++vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
++vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
++vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
++vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
+     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
++    ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+      * In principle Zve*x would also suffice here, were they supported
+      * in qemu
+      */
+-    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
++    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
+         error_setg(errp,
+                    "Vector crypto extensions require V or Zve* extensions");
+         return;
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
+     /* Vector cryptography extensions */
+     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
+     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
++    DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
+     DEFINE_PROP_END_OF_LIST(),
+ };
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vcrypto_helper.c
++++ b/target/riscv/vcrypto_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/bitops.h"
+ #include "qemu/bswap.h"
+ #include "cpu.h"
++#include "crypto/aes.h"
++#include "crypto/aes-round.h"
+ #include "exec/memop.h"
+ #include "exec/exec-all.h"
+ #include "exec/helper-proto.h"
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
+ GEN_VEXT_VX(vwsll_vx_b, 2)
+ GEN_VEXT_VX(vwsll_vx_h, 4)
+ GEN_VEXT_VX(vwsll_vx_w, 8)
++
++void HELPER(egs_check)(uint32_t egs, CPURISCVState *env)
++{
++    uint32_t vl = env->vl;
++    uint32_t vstart = env->vstart;
++
++    if (vl % egs != 0 || vstart % egs != 0) {
++        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
++    }
++}
++
++static inline void xor_round_key(AESState *round_state, AESState *round_key)
++{
++    round_state->v = round_state->v ^ round_key->v;
++}
++
++#define GEN_ZVKNED_HELPER_VV(NAME, ...)                                   \
++    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
++                      uint32_t desc)                                      \
++    {                                                                     \
++        uint32_t vl = env->vl;                                            \
++        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
++        uint32_t vta = vext_vta(desc);                                    \
++                                                                          \
++        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
++            AESState round_key;                                           \
++            round_key.d[0] = *((uint64_t *)vs2 + H8(i * 2 + 0));          \
++            round_key.d[1] = *((uint64_t *)vs2 + H8(i * 2 + 1));          \
++            AESState round_state;                                         \
++            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
++            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
++            __VA_ARGS__;                                                  \
++            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
++            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
++        }                                                                 \
++        env->vstart = 0;                                                  \
++        /* set tail elements to 1s */                                     \
++        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
++    }
++
++#define GEN_ZVKNED_HELPER_VS(NAME, ...)                                   \
++    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
++                      uint32_t desc)                                      \
++    {                                                                     \
++        uint32_t vl = env->vl;                                            \
++        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
++        uint32_t vta = vext_vta(desc);                                    \
++                                                                          \
++        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
++            AESState round_key;                                           \
++            round_key.d[0] = *((uint64_t *)vs2 + H8(0));                  \
++            round_key.d[1] = *((uint64_t *)vs2 + H8(1));                  \
++            AESState round_state;                                         \
++            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
++            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
++            __VA_ARGS__;                                                  \
++            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
++            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
++        }                                                                 \
++        env->vstart = 0;                                                  \
++        /* set tail elements to 1s */                                     \
++        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
++    }
++
++GEN_ZVKNED_HELPER_VV(vaesef_vv, aesenc_SB_SR_AK(&round_state,
++                                                &round_state,
++                                                &round_key,
++                                                false);)
++GEN_ZVKNED_HELPER_VS(vaesef_vs, aesenc_SB_SR_AK(&round_state,
++                                                &round_state,
++                                                &round_key,
++                                                false);)
++GEN_ZVKNED_HELPER_VV(vaesdf_vv, aesdec_ISB_ISR_AK(&round_state,
++                                                  &round_state,
++                                                  &round_key,
++                                                  false);)
++GEN_ZVKNED_HELPER_VS(vaesdf_vs, aesdec_ISB_ISR_AK(&round_state,
++                                                  &round_state,
++                                                  &round_key,
++                                                  false);)
++GEN_ZVKNED_HELPER_VV(vaesem_vv, aesenc_SB_SR_MC_AK(&round_state,
++                                                   &round_state,
++                                                   &round_key,
++                                                   false);)
++GEN_ZVKNED_HELPER_VS(vaesem_vs, aesenc_SB_SR_MC_AK(&round_state,
++                                                   &round_state,
++                                                   &round_key,
++                                                   false);)
++GEN_ZVKNED_HELPER_VV(vaesdm_vv, aesdec_ISB_ISR_AK_IMC(&round_state,
++                                                      &round_state,
++                                                      &round_key,
++                                                      false);)
++GEN_ZVKNED_HELPER_VS(vaesdm_vs, aesdec_ISB_ISR_AK_IMC(&round_state,
++                                                      &round_state,
++                                                      &round_key,
++                                                      false);)
++GEN_ZVKNED_HELPER_VS(vaesz_vs, xor_round_key(&round_state, &round_key);)
++
++void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
++                        CPURISCVState *env, uint32_t desc)
++{
++    uint32_t *vd = vd_vptr;
++    uint32_t *vs2 = vs2_vptr;
++    uint32_t vl = env->vl;
++    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
++    uint32_t vta = vext_vta(desc);
++
++    uimm &= 0b1111;
++    if (uimm > 10 || uimm == 0) {
++        uimm ^= 0b1000;
++    }
++
++    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
++        uint32_t rk[8], tmp;
++        static const uint32_t rcon[] = {
++            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
++            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
++        };
++
++        rk[0] = vs2[i * 4 + H4(0)];
++        rk[1] = vs2[i * 4 + H4(1)];
++        rk[2] = vs2[i * 4 + H4(2)];
++        rk[3] = vs2[i * 4 + H4(3)];
++        tmp = ror32(rk[3], 8);
++
++        rk[4] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
++                         ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
++                         ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
++                         ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
++                      ^ rcon[uimm - 1];
++        rk[5] = rk[1] ^ rk[4];
++        rk[6] = rk[2] ^ rk[5];
++        rk[7] = rk[3] ^ rk[6];
++
++        vd[i * 4 + H4(0)] = rk[4];
++        vd[i * 4 + H4(1)] = rk[5];
++        vd[i * 4 + H4(2)] = rk[6];
++        vd[i * 4 + H4(3)] = rk[7];
++    }
++    env->vstart = 0;
++    /* set tail elements to 1s */
++    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
++}
++
++void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
++                        CPURISCVState *env, uint32_t desc)
++{
++    uint32_t *vd = vd_vptr;
++    uint32_t *vs2 = vs2_vptr;
++    uint32_t vl = env->vl;
++    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
++    uint32_t vta = vext_vta(desc);
++
++    uimm &= 0b1111;
++    if (uimm > 14 || uimm < 2) {
++        uimm ^= 0b1000;
++    }
++
++    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
++        uint32_t rk[12], tmp;
++        static const uint32_t rcon[] = {
++            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
++            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
++        };
++
++        rk[0] = vd[i * 4 + H4(0)];
++        rk[1] = vd[i * 4 + H4(1)];
++        rk[2] = vd[i * 4 + H4(2)];
++        rk[3] = vd[i * 4 + H4(3)];
++        rk[4] = vs2[i * 4 + H4(0)];
++        rk[5] = vs2[i * 4 + H4(1)];
++        rk[6] = vs2[i * 4 + H4(2)];
++        rk[7] = vs2[i * 4 + H4(3)];
++
++        if (uimm % 2 == 0) {
++            tmp = ror32(rk[7], 8);
++            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
++                             ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
++                             ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
++                             ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
++                          ^ rcon[(uimm - 1) / 2];
++        } else {
++            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(rk[7] >> 24) & 0xff] << 24) |
++                             ((uint32_t)AES_sbox[(rk[7] >> 16) & 0xff] << 16) |
++                             ((uint32_t)AES_sbox[(rk[7] >> 8) & 0xff] << 8) |
++                             ((uint32_t)AES_sbox[(rk[7] >> 0) & 0xff] << 0));
++        }
++        rk[9] = rk[1] ^ rk[8];
++        rk[10] = rk[2] ^ rk[9];
++        rk[11] = rk[3] ^ rk[10];
++
++        vd[i * 4 + H4(0)] = rk[8];
++        vd[i * 4 + H4(1)] = rk[9];
++        vd[i * 4 + H4(2)] = rk[10];
++        vd[i * 4 + H4(3)] = rk[11];
++    }
++    env->vstart = 0;
++    /* set tail elements to 1s */
++    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
++}
+diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvvk.c.inc
++++ b/target/riscv/insn_trans/trans_rvvk.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
+ GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
+ GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
+ GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
++
++/*
++ * Zvkned
++ */
++
++#define ZVKNED_EGS 4
++
++#define GEN_V_UNMASKED_TRANS(NAME, CHECK, EGS)                                \
++    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
++    {                                                                         \
++        if (CHECK(s, a)) {                                                    \
++            TCGv_ptr rd_v, rs2_v;                                             \
++            TCGv_i32 desc, egs;                                               \
++            uint32_t data = 0;                                                \
++            TCGLabel *over = gen_new_label();                                 \
++                                                                              \
++            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
++                /* save opcode for unwinding in case we throw an exception */ \
++                decode_save_opc(s);                                           \
++                egs = tcg_constant_i32(EGS);                                  \
++                gen_helper_egs_check(egs, cpu_env);                           \
++                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
++            }                                                                 \
++                                                                              \
++            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
++            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
++            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
++            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
++            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
++            rd_v = tcg_temp_new_ptr();                                        \
++            rs2_v = tcg_temp_new_ptr();                                       \
++            desc = tcg_constant_i32(                                          \
++                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
++            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
++            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
++            gen_helper_##NAME(rd_v, rs2_v, cpu_env, desc);                    \
++            mark_vs_dirty(s);                                                 \
++            gen_set_label(over);                                              \
++            return true;                                                      \
++        }                                                                     \
++        return false;                                                         \
++    }
++
++static bool vaes_check_vv(DisasContext *s, arg_rmr *a)
++{
++    int egw_bytes = ZVKNED_EGS << s->sew;
++    return s->cfg_ptr->ext_zvkned == true &&
++           require_rvv(s) &&
++           vext_check_isa_ill(s) &&
++           MAXSZ(s) >= egw_bytes &&
++           require_align(a->rd, s->lmul) &&
++           require_align(a->rs2, s->lmul) &&
++           s->sew == MO_32;
++}
++
++static bool vaes_check_overlap(DisasContext *s, int vd, int vs2)
++{
++    int8_t op_size = s->lmul <= 0 ? 1 : 1 << s->lmul;
++    return !is_overlapped(vd, op_size, vs2, 1);
++}
++
++static bool vaes_check_vs(DisasContext *s, arg_rmr *a)
++{
++    int egw_bytes = ZVKNED_EGS << s->sew;
++    return vaes_check_overlap(s, a->rd, a->rs2) &&
++           MAXSZ(s) >= egw_bytes &&
++           s->cfg_ptr->ext_zvkned == true &&
++           require_rvv(s) &&
++           vext_check_isa_ill(s) &&
++           require_align(a->rd, s->lmul) &&
++           s->sew == MO_32;
++}
++
++GEN_V_UNMASKED_TRANS(vaesef_vv, vaes_check_vv, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesef_vs, vaes_check_vs, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesdf_vv, vaes_check_vv, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesdf_vs, vaes_check_vs, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesdm_vv, vaes_check_vv, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesdm_vs, vaes_check_vs, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesz_vs, vaes_check_vs, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesem_vv, vaes_check_vv, ZVKNED_EGS)
++GEN_V_UNMASKED_TRANS(vaesem_vs, vaes_check_vs, ZVKNED_EGS)
++
++#define GEN_VI_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
++    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
++    {                                                                         \
++        if (CHECK(s, a)) {                                                    \
++            TCGv_ptr rd_v, rs2_v;                                             \
++            TCGv_i32 uimm_v, desc, egs;                                       \
++            uint32_t data = 0;                                                \
++            TCGLabel *over = gen_new_label();                                 \
++                                                                              \
++            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
++                /* save opcode for unwinding in case we throw an exception */ \
++                decode_save_opc(s);                                           \
++                egs = tcg_constant_i32(EGS);                                  \
++                gen_helper_egs_check(egs, cpu_env);                           \
++                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
++            }                                                                 \
++                                                                              \
++            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
++            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
++            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
++            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
++            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
++                                                                              \
++            rd_v = tcg_temp_new_ptr();                                        \
++            rs2_v = tcg_temp_new_ptr();                                       \
++            uimm_v = tcg_constant_i32(a->rs1);                                \
++            desc = tcg_constant_i32(                                          \
++                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
++            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
++            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
++            gen_helper_##NAME(rd_v, rs2_v, uimm_v, cpu_env, desc);            \
++            mark_vs_dirty(s);                                                 \
++            gen_set_label(over);                                              \
++            return true;                                                      \
++        }                                                                     \
++        return false;                                                         \
++    }
++
++static bool vaeskf1_check(DisasContext *s, arg_vaeskf1_vi *a)
++{
++    int egw_bytes = ZVKNED_EGS << s->sew;
++    return s->cfg_ptr->ext_zvkned == true &&
++           require_rvv(s) &&
++           vext_check_isa_ill(s) &&
++           MAXSZ(s) >= egw_bytes &&
++           s->sew == MO_32 &&
++           require_align(a->rd, s->lmul) &&
++           require_align(a->rs2, s->lmul);
++}
++
++static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
++{
++    int egw_bytes = ZVKNED_EGS << s->sew;
++    return s->cfg_ptr->ext_zvkned == true &&
++           require_rvv(s) &&
++           vext_check_isa_ill(s) &&
++           MAXSZ(s) >= egw_bytes &&
++           s->sew == MO_32 &&
++           require_align(a->rd, s->lmul) &&
++           require_align(a->rs2, s->lmul);
++}
++
++GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
++GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
+--
+.41.0

-New patch
+[PULL v2 17/45] target/riscv: Add Zvknh ISA extension support
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+This commit adds support for the Zvknh vector-crypto extension, which
+consists of the following instructions:
+* vsha2ms.vv
+* vsha2c[hl].vv
+Translation functions are defined in
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
+`target/riscv/vcrypto_helper.c`.
+Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
+Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
+[max.chou@sifive.com: Replaced vstart checking by TCG op]
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
+Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+[max.chou@sifive.com: Exposed x-zvknha & x-zvknhb properties]
+[max.chou@sifive.com: Replaced SEW selection to happened during
+translation]
+Message-ID: <20230711165917.2629866-11-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_cfg.h                   |   2 +
+ target/riscv/helper.h                    |   6 +
+ target/riscv/insn32.decode               |   5 +
+ target/riscv/cpu.c                       |  13 +-
+ target/riscv/vcrypto_helper.c            | 238 +++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvvk.c.inc | 129 ++++++++++++
+files changed, 390 insertions(+), 3 deletions(-)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_zvbb;
+     bool ext_zvbc;
+     bool ext_zvkned;
++    bool ext_zvknha;
++    bool ext_zvknhb;
+     bool ext_zmmul;
+     bool ext_zvfbfmin;
+     bool ext_zvfbfwma;
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/helper.h
++++ b/target/riscv/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
+ DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
+ DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
+ DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
++
++DEF_HELPER_5(vsha2ms_vv, void, ptr, ptr, ptr, env, i32)
++DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
++DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
++DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
++DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@ vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
+ vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
+ vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+ vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
++
++# *** Zvknh vector crypto extension ***
++vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
++vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
++vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
+     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
+     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
++    ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
++    ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
+      * In principle Zve*x would also suffice here, were they supported
+      * in qemu
+      */
+-    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
++    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
++        !cpu->cfg.ext_zve32f) {
+         error_setg(errp,
+                    "Vector crypto extensions require V or Zve* extensions");
+         return;
+     }
+-    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
+-        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
++    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
++        error_setg(
++            errp,
++            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
+     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
+     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
+     DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
++    DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
++    DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
+     DEFINE_PROP_END_OF_LIST(),
+ };
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vcrypto_helper.c
++++ b/target/riscv/vcrypto_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
+     /* set tail elements to 1s */
+     vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
+ }
++
++static inline uint32_t sig0_sha256(uint32_t x)
++{
++    return ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3);
++}
++
++static inline uint32_t sig1_sha256(uint32_t x)
++{
++    return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
++}
++
++static inline uint64_t sig0_sha512(uint64_t x)
++{
++    return ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7);
++}
++
++static inline uint64_t sig1_sha512(uint64_t x)
++{
++    return ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6);
++}
++
++static inline void vsha2ms_e32(uint32_t *vd, uint32_t *vs1, uint32_t *vs2)
++{
++    uint32_t res[4];
++    res[0] = sig1_sha256(vs1[H4(2)]) + vs2[H4(1)] + sig0_sha256(vd[H4(1)]) +
++             vd[H4(0)];
++    res[1] = sig1_sha256(vs1[H4(3)]) + vs2[H4(2)] + sig0_sha256(vd[H4(2)]) +
++             vd[H4(1)];
++    res[2] =
++        sig1_sha256(res[0]) + vs2[H4(3)] + sig0_sha256(vd[H4(3)]) + vd[H4(2)];
++    res[3] =
++        sig1_sha256(res[1]) + vs1[H4(0)] + sig0_sha256(vs2[H4(0)]) + vd[H4(3)];
++    vd[H4(3)] = res[3];
++    vd[H4(2)] = res[2];
++    vd[H4(1)] = res[1];
++    vd[H4(0)] = res[0];
++}
++
++static inline void vsha2ms_e64(uint64_t *vd, uint64_t *vs1, uint64_t *vs2)
++{
++    uint64_t res[4];
++    res[0] = sig1_sha512(vs1[2]) + vs2[1] + sig0_sha512(vd[1]) + vd[0];
++    res[1] = sig1_sha512(vs1[3]) + vs2[2] + sig0_sha512(vd[2]) + vd[1];
++    res[2] = sig1_sha512(res[0]) + vs2[3] + sig0_sha512(vd[3]) + vd[2];
++    res[3] = sig1_sha512(res[1]) + vs1[0] + sig0_sha512(vs2[0]) + vd[3];
++    vd[3] = res[3];
++    vd[2] = res[2];
++    vd[1] = res[1];
++    vd[0] = res[0];
++}
++
++void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
++                        uint32_t desc)
++{
++    uint32_t sew = FIELD_EX64(env->vtype, VTYPE, VSEW);
++    uint32_t esz = sew == MO_32 ? 4 : 8;
++    uint32_t total_elems;
++    uint32_t vta = vext_vta(desc);
++
++    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
++        if (sew == MO_32) {
++            vsha2ms_e32(((uint32_t *)vd) + i * 4, ((uint32_t *)vs1) + i * 4,
++                        ((uint32_t *)vs2) + i * 4);
++        } else {
++            /* If not 32 then SEW should be 64 */
++            vsha2ms_e64(((uint64_t *)vd) + i * 4, ((uint64_t *)vs1) + i * 4,
++                        ((uint64_t *)vs2) + i * 4);
++        }
++    }
++    /* set tail elements to 1s */
++    total_elems = vext_get_total_elems(env, desc, esz);
++    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
++    env->vstart = 0;
++}
++
++static inline uint64_t sum0_64(uint64_t x)
++{
++    return ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39);
++}
++
++static inline uint32_t sum0_32(uint32_t x)
++{
++    return ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22);
++}
++
++static inline uint64_t sum1_64(uint64_t x)
++{
++    return ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41);
++}
++
++static inline uint32_t sum1_32(uint32_t x)
++{
++    return ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25);
++}
++
++#define ch(x, y, z) ((x & y) ^ ((~x) & z))
++
++#define maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
++
++static void vsha2c_64(uint64_t *vs2, uint64_t *vd, uint64_t *vs1)
++{
++    uint64_t a = vs2[3], b = vs2[2], e = vs2[1], f = vs2[0];
++    uint64_t c = vd[3], d = vd[2], g = vd[1], h = vd[0];
++    uint64_t W0 = vs1[0], W1 = vs1[1];
++    uint64_t T1 = h + sum1_64(e) + ch(e, f, g) + W0;
++    uint64_t T2 = sum0_64(a) + maj(a, b, c);
++
++    h = g;
++    g = f;
++    f = e;
++    e = d + T1;
++    d = c;
++    c = b;
++    b = a;
++    a = T1 + T2;
++
++    T1 = h + sum1_64(e) + ch(e, f, g) + W1;
++    T2 = sum0_64(a) + maj(a, b, c);
++    h = g;
++    g = f;
++    f = e;
++    e = d + T1;
++    d = c;
++    c = b;
++    b = a;
++    a = T1 + T2;
++
++    vd[0] = f;
++    vd[1] = e;
++    vd[2] = b;
++    vd[3] = a;
++}
++
++static void vsha2c_32(uint32_t *vs2, uint32_t *vd, uint32_t *vs1)
++{
++    uint32_t a = vs2[H4(3)], b = vs2[H4(2)], e = vs2[H4(1)], f = vs2[H4(0)];
++    uint32_t c = vd[H4(3)], d = vd[H4(2)], g = vd[H4(1)], h = vd[H4(0)];
++    uint32_t W0 = vs1[H4(0)], W1 = vs1[H4(1)];
++    uint32_t T1 = h + sum1_32(e) + ch(e, f, g) + W0;
++    uint32_t T2 = sum0_32(a) + maj(a, b, c);
++
++    h = g;
++    g = f;
++    f = e;
++    e = d + T1;
++    d = c;
++    c = b;
++    b = a;
++    a = T1 + T2;
++
++    T1 = h + sum1_32(e) + ch(e, f, g) + W1;
++    T2 = sum0_32(a) + maj(a, b, c);
++    h = g;
++    g = f;
++    f = e;
++    e = d + T1;
++    d = c;
++    c = b;
++    b = a;
++    a = T1 + T2;
++
++    vd[H4(0)] = f;
++    vd[H4(1)] = e;
++    vd[H4(2)] = b;
++    vd[H4(3)] = a;
++}
++
++void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
++                          uint32_t desc)
++{
++    const uint32_t esz = 4;
++    uint32_t total_elems;
++    uint32_t vta = vext_vta(desc);
++
++    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
++        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
++                  ((uint32_t *)vs1) + 4 * i + 2);
++    }
++
++    /* set tail elements to 1s */
++    total_elems = vext_get_total_elems(env, desc, esz);
++    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
++    env->vstart = 0;
++}
++
++void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
++                          uint32_t desc)
++{
++    const uint32_t esz = 8;
++    uint32_t total_elems;
++    uint32_t vta = vext_vta(desc);
++
++    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
++        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
++                  ((uint64_t *)vs1) + 4 * i + 2);
++    }
++
++    /* set tail elements to 1s */
++    total_elems = vext_get_total_elems(env, desc, esz);
++    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
++    env->vstart = 0;
++}
++
++void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
++                          uint32_t desc)
++{
++    const uint32_t esz = 4;
++    uint32_t total_elems;
++    uint32_t vta = vext_vta(desc);
++
++    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
++        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
++                  (((uint32_t *)vs1) + 4 * i));
++    }
++
++    /* set tail elements to 1s */
++    total_elems = vext_get_total_elems(env, desc, esz);
++    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
++    env->vstart = 0;
++}
++
++void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
++                          uint32_t desc)
++{
++    uint32_t esz = 8;
++    uint32_t total_elems;
++    uint32_t vta = vext_vta(desc);
++
++    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
++        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
++                  (((uint64_t *)vs1) + 4 * i));
++    }
++
++    /* set tail elements to 1s */
++    total_elems = vext_get_total_elems(env, desc, esz);
++    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
++    env->vstart = 0;
++}
+diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvvk.c.inc
++++ b/target/riscv/insn_trans/trans_rvvk.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
+ GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
+ GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
++
++/*
++ * Zvknh
++ */
++
++#define ZVKNH_EGS 4
++
++#define GEN_VV_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
++    {                                                                         \
++        if (CHECK(s, a)) {                                                    \
++            uint32_t data = 0;                                                \
++            TCGLabel *over = gen_new_label();                                 \
++            TCGv_i32 egs;                                                     \
++                                                                              \
++            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
++                /* save opcode for unwinding in case we throw an exception */ \
++                decode_save_opc(s);                                           \
++                egs = tcg_constant_i32(EGS);                                  \
++                gen_helper_egs_check(egs, cpu_env);                           \
++                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
++            }                                                                 \
++                                                                              \
++            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
++            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
++            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
++            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
++            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
++                                                                              \
++            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),       \
++                               vreg_ofs(s, a->rs2), cpu_env,                  \
++                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8,    \
++                               data, gen_helper_##NAME);                      \
++                                                                              \
++            mark_vs_dirty(s);                                                 \
++            gen_set_label(over);                                              \
++            return true;                                                      \
++        }                                                                     \
++        return false;                                                         \
++    }
++
++static bool vsha_check_sew(DisasContext *s)
++{
++    return (s->cfg_ptr->ext_zvknha == true && s->sew == MO_32) ||
++           (s->cfg_ptr->ext_zvknhb == true &&
++            (s->sew == MO_32 || s->sew == MO_64));
++}
++
++static bool vsha_check(DisasContext *s, arg_rmrr *a)
++{
++    int egw_bytes = ZVKNH_EGS << s->sew;
++    int mult = 1 << MAX(s->lmul, 0);
++    return opivv_check(s, a) &&
++           vsha_check_sew(s) &&
++           MAXSZ(s) >= egw_bytes &&
++           !is_overlapped(a->rd, mult, a->rs1, mult) &&
++           !is_overlapped(a->rd, mult, a->rs2, mult) &&
++           s->lmul >= 0;
++}
++
++GEN_VV_UNMASKED_TRANS(vsha2ms_vv, vsha_check, ZVKNH_EGS)
++
++static bool trans_vsha2cl_vv(DisasContext *s, arg_rmrr *a)
++{
++    if (vsha_check(s, a)) {
++        uint32_t data = 0;
++        TCGLabel *over = gen_new_label();
++        TCGv_i32 egs;
++
++        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
++            /* save opcode for unwinding in case we throw an exception */
++            decode_save_opc(s);
++            egs = tcg_constant_i32(ZVKNH_EGS);
++            gen_helper_egs_check(egs, cpu_env);
++            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
++        }
++
++        data = FIELD_DP32(data, VDATA, VM, a->vm);
++        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
++        data = FIELD_DP32(data, VDATA, VTA, s->vta);
++        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
++        data = FIELD_DP32(data, VDATA, VMA, s->vma);
++
++        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
++            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
++            s->cfg_ptr->vlen / 8, data,
++            s->sew == MO_32 ?
++                gen_helper_vsha2cl32_vv : gen_helper_vsha2cl64_vv);
++
++        mark_vs_dirty(s);
++        gen_set_label(over);
++        return true;
++    }
++    return false;
++}
++
++static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
++{
++    if (vsha_check(s, a)) {
++        uint32_t data = 0;
++        TCGLabel *over = gen_new_label();
++        TCGv_i32 egs;
++
++        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
++            /* save opcode for unwinding in case we throw an exception */
++            decode_save_opc(s);
++            egs = tcg_constant_i32(ZVKNH_EGS);
++            gen_helper_egs_check(egs, cpu_env);
++            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
++        }
++
++        data = FIELD_DP32(data, VDATA, VM, a->vm);
++        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
++        data = FIELD_DP32(data, VDATA, VTA, s->vta);
++        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
++        data = FIELD_DP32(data, VDATA, VMA, s->vma);
++
++        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
++            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
++            s->cfg_ptr->vlen / 8, data,
++            s->sew == MO_32 ?
++                gen_helper_vsha2ch32_vv : gen_helper_vsha2ch64_vv);
++
++        mark_vs_dirty(s);
++        gen_set_label(over);
++        return true;
++    }
++    return false;
++}
+--
+.41.0

-New patch
+[PULL v2 18/45] target/riscv: Add Zvksh ISA extension support
+From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 This commit adds support for the Zvksh vector-crypto extension, which
 consists of the following instructions:
 * vsm3me.vv
 * vsm3c.vi
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvksh property]
 Message-ID: <20230711165917.2629866-12-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu_cfg.h                   |   1 +
  target/riscv/helper.h                    |   3 +
  target/riscv/insn32.decode               |   4 +
  target/riscv/cpu.c                       |   6 +-
  target/riscv/vcrypto_helper.c            | 134 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc |  31 ++++++
 files changed, 177 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zvkned;
      bool ext_zvknha;
      bool ext_zvknhb;
 +    bool ext_zvksh;
      bool ext_zmmul;
      bool ext_zvfbfmin;
      bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vsm3me_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
 +# *** Zvksh vector crypto extension ***
 +vsm3me_vv   100000 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
      ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
      ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
 +    ISA_EXT_DATA_ENTRY(zvksh, PRIV_VERSION_1_12_0, ext_zvksh),
      ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
      ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
      ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * In principle Zve*x would also suffice here, were they supported
       * in qemu
       */
 -    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
 -        !cpu->cfg.ext_zve32f) {
 +    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha ||
 +         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
      DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 +    DEFINE_PROP_BOOL("x-zvksh", RISCVCPU, cfg.ext_zvksh, false),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
      vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
      env->vstart = 0;
  }
 +
 +static inline uint32_t p1(uint32_t x)
 +{
 +    return x ^ rol32(x, 15) ^ rol32(x, 23);
 +}
 +
 +static inline uint32_t zvksh_w(uint32_t m16, uint32_t m9, uint32_t m3,
 +                               uint32_t m13, uint32_t m6)
 +{
 +    return p1(m16 ^ m9 ^ rol32(m3, 15)) ^ rol32(m13, 7) ^ m6;
 +}
 +
 +void HELPER(vsm3me_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
 +                       CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t esz = memop_size(FIELD_EX64(env->vtype, VTYPE, VSEW));
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs1 = vs1_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +
 +    for (int i = env->vstart / 8; i < env->vl / 8; i++) {
 +        uint32_t w[24];
 +        for (int j = 0; j < 8; j++) {
 +            w[j] = bswap32(vs1[H4((i * 8) + j)]);
 +            w[j + 8] = bswap32(vs2[H4((i * 8) + j)]);
 +        }
 +        for (int j = 0; j < 8; j++) {
 +            w[j + 16] =
 +                zvksh_w(w[j], w[j + 7], w[j + 13], w[j + 3], w[j + 10]);
 +        }
 +        for (int j = 0; j < 8; j++) {
 +            vd[(i * 8) + j] = bswap32(w[H4(j + 16)]);
 +        }
 +    }
 +    vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +static inline uint32_t ff1(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return x ^ y ^ z;
 +}
 +
 +static inline uint32_t ff2(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return (x & y) | (x & z) | (y & z);
 +}
 +
 +static inline uint32_t ff_j(uint32_t x, uint32_t y, uint32_t z, uint32_t j)
 +{
 +    return (j <= 15) ? ff1(x, y, z) : ff2(x, y, z);
 +}
 +
 +static inline uint32_t gg1(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return x ^ y ^ z;
 +}
 +
 +static inline uint32_t gg2(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return (x & y) | (~x & z);
 +}
 +
 +static inline uint32_t gg_j(uint32_t x, uint32_t y, uint32_t z, uint32_t j)
 +{
 +    return (j <= 15) ? gg1(x, y, z) : gg2(x, y, z);
 +}
 +
 +static inline uint32_t t_j(uint32_t j)
 +{
 +    return (j <= 15) ? 0x79cc4519 : 0x7a879d8a;
 +}
 +
 +static inline uint32_t p_0(uint32_t x)
 +{
 +    return x ^ rol32(x, 9) ^ rol32(x, 17);
 +}
 +
 +static void sm3c(uint32_t *vd, uint32_t *vs1, uint32_t *vs2, uint32_t uimm)
 +{
 +    uint32_t x0, x1;
 +    uint32_t j;
 +    uint32_t ss1, ss2, tt1, tt2;
 +    x0 = vs2[0] ^ vs2[4];
 +    x1 = vs2[1] ^ vs2[5];
 +    j = 2 * uimm;
 +    ss1 = rol32(rol32(vs1[0], 12) + vs1[4] + rol32(t_j(j), j % 32), 7);
 +    ss2 = ss1 ^ rol32(vs1[0], 12);
 +    tt1 = ff_j(vs1[0], vs1[1], vs1[2], j) + vs1[3] + ss2 + x0;
 +    tt2 = gg_j(vs1[4], vs1[5], vs1[6], j) + vs1[7] + ss1 + vs2[0];
 +    vs1[3] = vs1[2];
 +    vd[3] = rol32(vs1[1], 9);
 +    vs1[1] = vs1[0];
 +    vd[1] = tt1;
 +    vs1[7] = vs1[6];
 +    vd[7] = rol32(vs1[5], 19);
 +    vs1[5] = vs1[4];
 +    vd[5] = p_0(tt2);
 +    j = 2 * uimm + 1;
 +    ss1 = rol32(rol32(vd[1], 12) + vd[5] + rol32(t_j(j), j % 32), 7);
 +    ss2 = ss1 ^ rol32(vd[1], 12);
 +    tt1 = ff_j(vd[1], vs1[1], vd[3], j) + vs1[3] + ss2 + x1;
 +    tt2 = gg_j(vd[5], vs1[5], vd[7], j) + vs1[7] + ss1 + vs2[1];
 +    vd[2] = rol32(vs1[1], 9);
 +    vd[0] = tt1;
 +    vd[6] = rol32(vs1[5], 19);
 +    vd[4] = p_0(tt2);
 +}
 +
 +void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
 +                      CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t esz = memop_size(FIELD_EX64(env->vtype, VTYPE, VSEW));
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +    uint32_t v1[8], v2[8], v3[8];
 +
 +    for (int i = env->vstart / 8; i < env->vl / 8; i++) {
 +        for (int k = 0; k < 8; k++) {
 +            v2[k] = bswap32(vd[H4(i * 8 + k)]);
 +            v3[k] = bswap32(vs2[H4(i * 8 + k)]);
 +        }
 +        sm3c(v1, v2, v3, uimm);
 +        for (int k = 0; k < 8; k++) {
 +            vd[i * 8 + k] = bswap32(v1[H4(k)]);
 +        }
 +    }
 +    vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
      }
      return false;
  }
 +
 +/*
 + * Zvksh
 + */
 +
 +#define ZVKSH_EGS 8
 +
 +static inline bool vsm3_check(DisasContext *s, arg_rmrr *a)
 +{
 +    int egw_bytes = ZVKSH_EGS << s->sew;
 +    int mult = 1 << MAX(s->lmul, 0);
 +    return s->cfg_ptr->ext_zvksh == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           !is_overlapped(a->rd, mult, a->rs2, mult) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32;
 +}
 +
 +static inline bool vsm3me_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return vsm3_check(s, a) && vext_check_sss(s, a->rd, a->rs1, a->rs2, a->vm);
 +}
 +
 +static inline bool vsm3c_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return vsm3_check(s, a) && vext_check_ss(s, a->rd, a->rs2, a->vm);
 +}
 +
 +GEN_VV_UNMASKED_TRANS(vsm3me_vv, vsm3me_check, ZVKSH_EGS)
 +GEN_VI_UNMASKED_TRANS(vsm3c_vi, vsm3c_check, ZVKSH_EGS)
 --
 .41.0

-New patch
+[PULL v2 19/45] target/riscv: Add Zvkg ISA extension support
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 This commit adds support for the Zvkg vector-crypto extension, which
 consists of the following instructions:
 * vgmul.vv
 * vghsh.vv
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvkg property]
 [max.chou@sifive.com: Replaced uint by int for cross win32 build]
 Message-ID: <20230711165917.2629866-13-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu_cfg.h                   |  1 +
  target/riscv/helper.h                    |  3 +
  target/riscv/insn32.decode               |  4 ++
  target/riscv/cpu.c                       |  6 +-
  target/riscv/vcrypto_helper.c            | 72 ++++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 30 ++++++++++
 files changed, 114 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zve64d;
      bool ext_zvbb;
      bool ext_zvbc;
 +    bool ext_zvkg;
      bool ext_zvkned;
      bool ext_zvknha;
      bool ext_zvknhb;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsm3me_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
 +
 +DEF_HELPER_5(vghsh_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
  # *** Zvksh vector crypto extension ***
  vsm3me_vv   100000 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
 +# *** Zvkg vector crypto extension ***
 +vghsh_vv    101100 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
      ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
      ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
 +    ISA_EXT_DATA_ENTRY(zvkg, PRIV_VERSION_1_12_0, ext_zvkg),
      ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
      ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
      ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * In principle Zve*x would also suffice here, were they supported
       * in qemu
       */
 -    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha ||
 -         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
 +    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkg || cpu->cfg.ext_zvkned ||
 +         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      /* Vector cryptography extensions */
      DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 +    DEFINE_PROP_BOOL("x-zvkg", RISCVCPU, cfg.ext_zvkg, false),
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
      DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
      vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
      env->vstart = 0;
  }
 +
 +void HELPER(vghsh_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
 +                      CPURISCVState *env, uint32_t desc)
 +{
 +    uint64_t *vd = vd_vptr;
 +    uint64_t *vs1 = vs1_vptr;
 +    uint64_t *vs2 = vs2_vptr;
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint64_t Y[2] = {vd[i * 2 + 0], vd[i * 2 + 1]};
 +        uint64_t H[2] = {brev8(vs2[i * 2 + 0]), brev8(vs2[i * 2 + 1])};
 +        uint64_t X[2] = {vs1[i * 2 + 0], vs1[i * 2 + 1]};
 +        uint64_t Z[2] = {0, 0};
 +
 +        uint64_t S[2] = {brev8(Y[0] ^ X[0]), brev8(Y[1] ^ X[1])};
 +
 +        for (int j = 0; j < 128; j++) {
 +            if ((S[j / 64] >> (j % 64)) & 1) {
 +                Z[0] ^= H[0];
 +                Z[1] ^= H[1];
 +            }
 +            bool reduce = ((H[1] >> 63) & 1);
 +            H[1] = H[1] << 1 | H[0] >> 63;
 +            H[0] = H[0] << 1;
 +            if (reduce) {
 +                H[0] ^= 0x87;
 +            }
 +        }
 +
 +        vd[i * 2 + 0] = brev8(Z[0]);
 +        vd[i * 2 + 1] = brev8(Z[1]);
 +    }
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
 +                      uint32_t desc)
 +{
 +    uint64_t *vd = vd_vptr;
 +    uint64_t *vs2 = vs2_vptr;
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint64_t Y[2] = {brev8(vd[i * 2 + 0]), brev8(vd[i * 2 + 1])};
 +        uint64_t H[2] = {brev8(vs2[i * 2 + 0]), brev8(vs2[i * 2 + 1])};
 +        uint64_t Z[2] = {0, 0};
 +
 +        for (int j = 0; j < 128; j++) {
 +            if ((Y[j / 64] >> (j % 64)) & 1) {
 +                Z[0] ^= H[0];
 +                Z[1] ^= H[1];
 +            }
 +            bool reduce = ((H[1] >> 63) & 1);
 +            H[1] = H[1] << 1 | H[0] >> 63;
 +            H[0] = H[0] << 1;
 +            if (reduce) {
 +                H[0] ^= 0x87;
 +            }
 +        }
 +
 +        vd[i * 2 + 0] = brev8(Z[0]);
 +        vd[i * 2 + 1] = brev8(Z[1]);
 +    }
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static inline bool vsm3c_check(DisasContext *s, arg_rmrr *a)
  GEN_VV_UNMASKED_TRANS(vsm3me_vv, vsm3me_check, ZVKSH_EGS)
  GEN_VI_UNMASKED_TRANS(vsm3c_vi, vsm3c_check, ZVKSH_EGS)
 +
 +/*
 + * Zvkg
 + */
 +
 +#define ZVKG_EGS 4
 +
 +static bool vgmul_check(DisasContext *s, arg_rmr *a)
 +{
 +    int egw_bytes = ZVKG_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkg == true &&
 +           vext_check_isa_ill(s) &&
 +           require_rvv(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           vext_check_ss(s, a->rd, a->rs2, a->vm) &&
 +           s->sew == MO_32;
 +}
 +
 +GEN_V_UNMASKED_TRANS(vgmul_vv, vgmul_check, ZVKG_EGS)
 +
 +static bool vghsh_check(DisasContext *s, arg_rmrr *a)
 +{
 +    int egw_bytes = ZVKG_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkg == true &&
 +           opivv_check(s, a) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32;
 +}
 +
 +GEN_VV_UNMASKED_TRANS(vghsh_vv, vghsh_check, ZVKG_EGS)
 --
 .41.0

-New patch
+[PULL v2 20/45] crypto: Create sm4_subword
+From: Max Chou <max.chou@sifive.com>
+Allows sharing of sm4_subword between different targets.
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-14-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ include/crypto/sm4.h           |  8 ++++++++
+ target/arm/tcg/crypto_helper.c | 10 ++--------
+files changed, 10 insertions(+), 8 deletions(-)
+diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/crypto/sm4.h
++++ b/include/crypto/sm4.h
+@@ -XXX,XX +XXX,XX @@
+ extern const uint8_t sm4_sbox[256];
++static inline uint32_t sm4_subword(uint32_t word)
++{
++    return sm4_sbox[word & 0xff] |
++           sm4_sbox[(word >> 8) & 0xff] << 8 |
++           sm4_sbox[(word >> 16) & 0xff] << 16 |
++           sm4_sbox[(word >> 24) & 0xff] << 24;
++}
++
+ #endif
+diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/crypto_helper.c
++++ b/target/arm/tcg/crypto_helper.c
+@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
+             CR_ST_WORD(d, (i + 3) % 4) ^
+             CR_ST_WORD(n, i);
+-        t = sm4_sbox[t & 0xff] |
+-            sm4_sbox[(t >> 8) & 0xff] << 8 |
+-            sm4_sbox[(t >> 16) & 0xff] << 16 |
+-            sm4_sbox[(t >> 24) & 0xff] << 24;
++        t = sm4_subword(t);
+         CR_ST_WORD(d, i) ^= t ^ rol32(t, 2) ^ rol32(t, 10) ^ rol32(t, 18) ^
+                             rol32(t, 24);
+@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4ekey(uint64_t *rd, uint64_t *rn, uint64_t *rm)
+             CR_ST_WORD(d, (i + 3) % 4) ^
+             CR_ST_WORD(m, i);
+-        t = sm4_sbox[t & 0xff] |
+-            sm4_sbox[(t >> 8) & 0xff] << 8 |
+-            sm4_sbox[(t >> 16) & 0xff] << 16 |
+-            sm4_sbox[(t >> 24) & 0xff] << 24;
++        t = sm4_subword(t);
+         CR_ST_WORD(d, i) ^= t ^ rol32(t, 13) ^ rol32(t, 23);
+     }
+--
+.41.0

-New patch
+[PULL v2 21/45] crypto: Add SM4 constant parameter CK
+From: Max Chou <max.chou@sifive.com>
+Adds sm4_ck constant for use in sm4 cryptography across different targets.
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-15-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ include/crypto/sm4.h |  1 +
+ crypto/sm4.c         | 10 ++++++++++
+files changed, 11 insertions(+)
+diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/crypto/sm4.h
++++ b/include/crypto/sm4.h
+@@ -XXX,XX +XXX,XX @@
+ #define QEMU_SM4_H
+ extern const uint8_t sm4_sbox[256];
++extern const uint32_t sm4_ck[32];
+ static inline uint32_t sm4_subword(uint32_t word)
+ {
+diff --git a/crypto/sm4.c b/crypto/sm4.c
+index XXXXXXX..XXXXXXX 100644
+--- a/crypto/sm4.c
++++ b/crypto/sm4.c
+@@ -XXX,XX +XXX,XX @@ uint8_t const sm4_sbox[] = {
+x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
+ };
++uint32_t const sm4_ck[] = {
++    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
++    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
++    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
++    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
++    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
++    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
++    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
++    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
++};
+--
+.41.0

-New patch
+[PULL v2 22/45] target/riscv: Add Zvksed ISA extension support
+From: Max Chou <max.chou@sifive.com>
 This commit adds support for the Zvksed vector-crypto extension, which
 consists of the following instructions:
 * vsm4k.vi
 * vsm4r.[vv,vs]
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 [lawrence.hunter@codethink.co.uk: Moved SM4 functions from
 crypto_helper.c to vcrypto_helper.c]
 [nazar.kazakov@codethink.co.uk: Added alignment checks, refactored code to
 use macros, and minor style changes]
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-16-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu_cfg.h                   |   1 +
  target/riscv/helper.h                    |   4 +
  target/riscv/insn32.decode               |   5 +
  target/riscv/cpu.c                       |   5 +-
  target/riscv/vcrypto_helper.c            | 127 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc |  43 ++++++++
 files changed, 184 insertions(+), 1 deletion(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zvkned;
      bool ext_zvknha;
      bool ext_zvknhb;
 +    bool ext_zvksed;
      bool ext_zvksh;
      bool ext_zmmul;
      bool ext_zvfbfmin;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
  DEF_HELPER_5(vghsh_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vsm4k_vi, void, ptr, ptr, i32, env, i32)
 +DEF_HELPER_4(vsm4r_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vsm4r_vs, void, ptr, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
  # *** Zvkg vector crypto extension ***
  vghsh_vv    101100 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
 +
 +# *** Zvksed vector crypto extension ***
 +vsm4k_vi    100001 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsm4r_vv    101000 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 +vsm4r_vs    101001 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
      ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
      ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
 +    ISA_EXT_DATA_ENTRY(zvksed, PRIV_VERSION_1_12_0, ext_zvksed),
      ISA_EXT_DATA_ENTRY(zvksh, PRIV_VERSION_1_12_0, ext_zvksh),
      ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
      ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * in qemu
       */
      if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkg || cpu->cfg.ext_zvkned ||
 -         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
 +         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksed || cpu->cfg.ext_zvksh) &&
 +        !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
      DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 +    DEFINE_PROP_BOOL("x-zvksed", RISCVCPU, cfg.ext_zvksed, false),
      DEFINE_PROP_BOOL("x-zvksh", RISCVCPU, cfg.ext_zvksh, false),
      DEFINE_PROP_END_OF_LIST(),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "crypto/aes.h"
  #include "crypto/aes-round.h"
 +#include "crypto/sm4.h"
  #include "exec/memop.h"
  #include "exec/exec-all.h"
  #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
      vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
      env->vstart = 0;
  }
 +
 +void HELPER(vsm4k_vi)(void *vd, void *vs2, uint32_t uimm5, CPURISCVState *env,
 +                      uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t rnd = uimm5 & 0x7;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            rk[j - vstart] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            tmp[j] = rk[j];
 +        }
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            uint32_t b, s;
 +            b = tmp[j + 1] ^ tmp[j + 2] ^ tmp[j + 3] ^ sm4_ck[rnd * 4 + j];
 +
 +            s = sm4_subword(b);
 +
 +            tmp[j + 4] = tmp[j] ^ (s ^ rol32(s, 13) ^ rol32(s, 23));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 +
 +static void do_sm4_round(uint32_t *rk, uint32_t *buf)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t s, b;
 +
 +    for (uint32_t j = egs; j < egs * 2; ++j) {
 +        b = buf[j - 3] ^ buf[j - 2] ^ buf[j - 1] ^ rk[j - 4];
 +
 +        s = sm4_subword(b);
 +
 +        buf[j] = buf[j - 4] ^ (s ^ rol32(s, 2) ^ rol32(s, 10) ^ rol32(s, 18) ^
 +                               rol32(s, 24));
 +    }
 +}
 +
 +void HELPER(vsm4r_vv)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            rk[j - vstart] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            tmp[j - vstart] = *((uint32_t *)vd + H4(j));
 +        }
 +
 +        do_sm4_round(rk, tmp);
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 +
 +void HELPER(vsm4r_vs)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            rk[j] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            tmp[j - vstart] = *((uint32_t *)vd + H4(j));
 +        }
 +
 +        do_sm4_round(rk, tmp);
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vghsh_check(DisasContext *s, arg_rmrr *a)
  }
  GEN_VV_UNMASKED_TRANS(vghsh_vv, vghsh_check, ZVKG_EGS)
 +
 +/*
 + * Zvksed
 + */
 +
 +#define ZVKSED_EGS 4
 +
 +static bool zvksed_check(DisasContext *s)
 +{
 +    int egw_bytes = ZVKSED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvksed == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32;
 +}
 +
 +static bool vsm4k_vi_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return zvksed_check(s) &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +GEN_VI_UNMASKED_TRANS(vsm4k_vi, vsm4k_vi_check, ZVKSED_EGS)
 +
 +static bool vsm4r_vv_check(DisasContext *s, arg_rmr *a)
 +{
 +    return zvksed_check(s) &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +GEN_V_UNMASKED_TRANS(vsm4r_vv, vsm4r_vv_check, ZVKSED_EGS)
 +
 +static bool vsm4r_vs_check(DisasContext *s, arg_rmr *a)
 +{
 +    return zvksed_check(s) &&
 +           !is_overlapped(a->rd, 1 << MAX(s->lmul, 0), a->rs2, 1) &&
 +           require_align(a->rd, s->lmul);
 +}
 +
 +GEN_V_UNMASKED_TRANS(vsm4r_vs, vsm4r_vs_check, ZVKSED_EGS)
 --
 .41.0

-New patch
+[PULL v2 23/45] target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren
+From: Rob Bradford <rbradford@rivosinc.com>
+These are WARL fields - zero out the bits for unavailable counters and
+special case the TM bit in mcountinhibit which is hardwired to zero.
+This patch achieves this by modifying the value written so that any use
+of the field will see the correctly masked bits.
+Tested by modifying OpenSBI to write max value to these CSRs and upon
+subsequent read the appropriate number of bits for number of PMUs is
+enabled and the TM bit is zero in mcountinhibit.
+Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Atish Patra <atishp@rivosinc.com>
+Message-ID: <20230802124906.24197-1-rbradford@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/csr.c | 11 +++++++++--
+file changed, 9 insertions(+), 2 deletions(-)
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/csr.c
++++ b/target/riscv/csr.c
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
+ {
+     int cidx;
+     PMUCTRState *counter;
++    RISCVCPU *cpu = env_archcpu(env);
+-    env->mcountinhibit = val;
++    /* WARL register - disable unavailable counters; TM bit is always 0 */
++    env->mcountinhibit =
++        val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR);
+     /* Check if any other counter is also monitoring cycles/instructions */
+     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
+ static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
+                                        target_ulong val)
+ {
+-    env->mcounteren = val;
++    RISCVCPU *cpu = env_archcpu(env);
++
++    /* WARL register - disable unavailable counters */
++    env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
++                             COUNTEREN_IR);
+     return RISCV_EXCP_NONE;
+ }
+--
+.41.0

-New patch
+[PULL v2 24/45] target/riscv: Add Zihintntl extension ISA string to DTS
+From: Jason Chien <jason.chien@sifive.com>
+RVA23 Profiles states:
+The RVA23 profiles are intended to be used for 64-bit application
+processors that will run rich OS stacks from standard binary OS
+distributions and with a substantial number of third-party binary user
+applications that will be supported over a considerable length of time
+in the field.
+The chapter 4 of the unprivileged spec introduces the Zihintntl extension
+and Zihintntl is a mandatory extension presented in RVA23 Profiles, whose
+purpose is to enable application and operating system portability across
+different implementations. Thus the DTS should contain the Zihintntl ISA
+string in order to pass to software.
+The unprivileged spec states:
+Like any HINTs, these instructions may be freely ignored. Hence, although
+they are described in terms of cache-based memory hierarchies, they do not
+mandate the provision of caches.
+These instructions are encoded with non-used opcode, e.g. ADD x0, x0, x2,
+which QEMU already supports, and QEMU does not emulate cache. Therefore
+these instructions can be considered as a no-op, and we only need to add
+a new property for the Zihintntl extension.
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
+Message-ID: <20230726074049.19505-2-jason.chien@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_cfg.h | 1 +
+ target/riscv/cpu.c     | 2 ++
+files changed, 3 insertions(+)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_icbom;
+     bool ext_icboz;
+     bool ext_zicond;
++    bool ext_zihintntl;
+     bool ext_zihintpause;
+     bool ext_smstateen;
+     bool ext_sstc;
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
+     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
++    ISA_EXT_DATA_ENTRY(zihintntl, PRIV_VERSION_1_10_0, ext_zihintntl),
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
+     ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
+     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
+     DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
+     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
+     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
++    DEFINE_PROP_BOOL("Zihintntl", RISCVCPU, cfg.ext_zihintntl, true),
+     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
+     DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
+     DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
+--
+.41.0

-New patch
+[PULL v2 25/45] target/riscv: Fix zfa fleq.d and fltq.d
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Commit a47842d ("riscv: Add support for the Zfa extension") implemented the zfa extension.
+However, it has some typos for fleq.d and fltq.d. Both of them misused the fltq.s
+helper function.
+Fixes: a47842d ("riscv: Add support for the Zfa extension")
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Message-ID: <20230728003906.768-1-zhiwei_liu@linux.alibaba.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn_trans/trans_rvzfa.c.inc | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_rvzfa.c.inc
++++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
+@@ -XXX,XX +XXX,XX @@ bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
+     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
++    gen_helper_fleq_d(dest, cpu_env, src1, src2);
+     gen_set_gpr(ctx, a->rd, dest);
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
+     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
++    gen_helper_fltq_d(dest, cpu_env, src1, src2);
+     gen_set_gpr(ctx, a->rd, dest);
+     return true;
+ }
+--
+.41.0

-New patch
+[PULL v2 26/45] hw/intc: Fix upper/lower mtime write calculation
+From: Jason Chien <jason.chien@sifive.com>
+When writing the upper mtime, we should keep the original lower mtime
+whose value is given by cpu_riscv_read_rtc() instead of
+cpu_riscv_read_rtc_raw(). The same logic applies to writes to lower mtime.
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230728082502.26439-1-jason.chien@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/intc/riscv_aclint.c | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
+diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/riscv_aclint.c
++++ b/hw/intc/riscv_aclint.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
+         return;
+     } else if (addr == mtimer->time_base || addr == mtimer->time_base + 4) {
+         uint64_t rtc_r = cpu_riscv_read_rtc_raw(mtimer->timebase_freq);
++        uint64_t rtc = cpu_riscv_read_rtc(mtimer);
+         if (addr == mtimer->time_base) {
+             if (size == 4) {
+                 /* time_lo for RV32/RV64 */
+-                mtimer->time_delta = ((rtc_r & ~0xFFFFFFFFULL) | value) - rtc_r;
++                mtimer->time_delta = ((rtc & ~0xFFFFFFFFULL) | value) - rtc_r;
+             } else {
+                 /* time for RV64 */
+                 mtimer->time_delta = value - rtc_r;
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
+         } else {
+             if (size == 4) {
+                 /* time_hi for RV32/RV64 */
+-                mtimer->time_delta = (value << 32 | (rtc_r & 0xFFFFFFFF)) - rtc_r;
++                mtimer->time_delta = (value << 32 | (rtc & 0xFFFFFFFF)) - rtc_r;
+             } else {
+                 qemu_log_mask(LOG_GUEST_ERROR,
+                               "aclint-mtimer: invalid time_hi write: %08x",
+--
+.41.0

-[PULL 18/21] docs/system/riscv: sifive_u: Update U-Boot instructions
+[PULL v2 27/45] hw/intc: Make rtc variable names consistent
-From: Bin Meng <bmeng.cn@gmail.com>
+From: Jason Chien <jason.chien@sifive.com>
-In U-Boot v2021.07 release, there were 2 major changes for the
+The variables whose values are given by cpu_riscv_read_rtc() should be named
-SiFive Unleashed board support:
+"rtc". The variables whose value are given by cpu_riscv_read_rtc_raw()
 should be named "rtc_r".
-- Board config name was changed from sifive_fu540_defconfig to
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
   sifive_unleashed_defconfig
 - The generic binman tool was used to generate the FIT image
   (combination of U-Boot proper, DTB and OpenSBI firmware)
 which make the existing U-Boot instructions out of date.
 Update the doc with latest instructions.
 Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210911153431.10362-1-bmeng.cn@gmail.com
+Message-ID: <20230728082502.26439-2-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- docs/system/riscv/sifive_u.rst | 49 ++++++++++++++++++----------------
+ hw/intc/riscv_aclint.c | 6 +++---
-file changed, 26 insertions(+), 23 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst
+diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/riscv/sifive_u.rst
+--- a/hw/intc/riscv_aclint.c
-+++ b/docs/system/riscv/sifive_u.rst
++++ b/hw/intc/riscv_aclint.c
-@@ -XXX,XX +XXX,XX @@ command line options with ``qemu-system-riscv32``.
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
- Running U-Boot
+     uint64_t next;
- --------------
+     uint64_t diff;
--U-Boot mainline v2021.01 release is tested at the time of writing. To build a
+-    uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
-+U-Boot mainline v2021.07 release is tested at the time of writing. To build a
++    uint64_t rtc = cpu_riscv_read_rtc(mtimer);
- U-Boot mainline bootloader that can be booted by the ``sifive_u`` machine, use
--the sifive_fu540_defconfig with similar commands as described above for Linux:
+     /* Compute the relative hartid w.r.t the socket */
-+the sifive_unleashed_defconfig with similar commands as described above for
+     hartid = hartid - mtimer->hartid_base;
-+Linux:
+     mtimer->timecmp[hartid] = value;
- .. code-block:: bash
+-    if (mtimer->timecmp[hartid] <= rtc_r) {
++    if (mtimer->timecmp[hartid] <= rtc) {
-   $ export CROSS_COMPILE=riscv64-linux-
+         /*
-   $ export OPENSBI=/path/to/opensbi-riscv64-generic-fw_dynamic.bin
+          * If we're setting an MTIMECMP value in the "past",
--  $ make sifive_fu540_defconfig
+          * immediately raise the timer interrupt
-+  $ make sifive_unleashed_defconfig
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
- You will get spl/u-boot-spl.bin and u-boot.itb file in the build tree.
+     /* otherwise, set up the future timer interrupt */
+     qemu_irq_lower(mtimer->timer_irqs[hartid]);
-@@ -XXX,XX +XXX,XX @@ board on QEMU ``sifive_u`` machine out of the box. This allows users to
+-    diff = mtimer->timecmp[hartid] - rtc_r;
- develop and test the recommended RISC-V boot flow with a real world use
++    diff = mtimer->timecmp[hartid] - rtc;
- case: ZSBL (in QEMU) loads U-Boot SPL from SD card or SPI flash to L2LIM,
+     /* back to ns (note args switched in muldiv64) */
- then U-Boot SPL loads the combined payload image of OpenSBI fw_dynamic
+     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
 -firmware and U-Boot proper. However sometimes we want to have a quick test
 -of booting U-Boot on QEMU without the needs of preparing the SPI flash or
 -SD card images, an alternate way can be used, which is to create a U-Boot
 -S-mode image by modifying the configuration of U-Boot:
 +firmware and U-Boot proper.
 +
 +However sometimes we want to have a quick test of booting U-Boot on QEMU
 +without the needs of preparing the SPI flash or SD card images, an alternate
 +way can be used, which is to create a U-Boot S-mode image by modifying the
 +configuration of U-Boot:
  .. code-block:: bash
 +  $ export CROSS_COMPILE=riscv64-linux-
 +  $ make sifive_unleashed_defconfig
    $ make menuconfig
 -then manually select the following configuration in U-Boot:
 -
 -  Device Tree Control > Provider of DTB for DT Control > Prior Stage bootloader DTB
 +then manually select the following configuration:
 -This lets U-Boot to use the QEMU generated device tree blob. During the build,
 -a build error will be seen below:
 +  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
 -.. code-block:: none
 +and unselect the following configuration:
 -  MKIMAGE u-boot.img
 -  ./tools/mkimage: Can't open arch/riscv/dts/hifive-unleashed-a00.dtb: No such file or directory
 -  ./tools/mkimage: failed to build FIT
 -  make: *** [Makefile:1440: u-boot.img] Error 1
 +  * Library routines ---> Allow access to binman information in the device tree
 -The above errors can be safely ignored as we don't run U-Boot SPL under QEMU
 -in this alternate configuration.
 +This changes U-Boot to use the QEMU generated device tree blob, and bypass
 +running the U-Boot SPL stage.
  Boot the 64-bit U-Boot S-mode image directly:
@@ -XXX,XX +XXX,XX @@ It's possible to create a 32-bit U-Boot S-mode image as well.
  .. code-block:: bash
    $ export CROSS_COMPILE=riscv64-linux-
 -  $ make sifive_fu540_defconfig
 +  $ make sifive_unleashed_defconfig
    $ make menuconfig
  then manually update the following configuration in U-Boot:
 -  Device Tree Control > Provider of DTB for DT Control > Prior Stage bootloader DTB
 -  RISC-V architecture > Base ISA > RV32I
 -  Boot images > Text Base > 0x80400000
 +  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
 +  * RISC-V architecture ---> Base ISA ---> RV32I
 +  * Boot options ---> Boot images ---> Text Base ---> 0x80400000
 +
 +and unselect the following configuration:
 +
 +  * Library routines ---> Allow access to binman information in the device tree
  Use the same command line options to boot the 32-bit U-Boot S-mode image:
 --
-.31.1
+.41.0

-[PULL 15/21] hw/dma: sifive_pdma: claim bit must be set before DMA transactions
+[PULL v2 28/45] linux-user/riscv: Use abi type for target_ucontext
-From: Frank Chang <frank.chang@sifive.com>
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Real PDMA must have Control.claim bit to be set before
+We should not use types dependend on host arch for target_ucontext.
-Control.run bit is set to start any DMA transactions.
+This bug is found when run rv32 applications.
 Otherwise nothing will be transferred.
-The following result is PDMA tested in U-Boot on Unmatched board:
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-=> mw.l 0x3000000 0x0                      <= Disclaim channel 0
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-                                              (Channel 0 is not claimed)
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-=> mw.l 0x3000004 0x55000000               <= wsize = rsize = 5 (2^5 = 32 bytes)
+Message-ID: <20230811055438.1945-1-zhiwei_liu@linux.alibaba.com>
 => mw.q 0x3000008 0x2                      <= NextBytes = 2
 => mw.q 0x3000010 0x84000000               <= NextDestination = 0x84000000
 => mw.q 0x3000018 0x84001000               <= NextSource = 0x84001000
 => mw.l 0x84000000 0x87654321              <= Fill test data to dst
 => mw.l 0x84001000 0x12345678              <= Fill test data to src
 => md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
 84000000: 87654321                               !Ce.
 84001000: 12345678                               xV4.
 => md.l 0x3000000 8                        <= Dump PDMA status
 03000000: 00000000 55000000 00000002 00000000    .......U........
 03000010: 84000000 00000000 84001000 00000000    ................
 => mw.l 0x3000000 0x3                      <= Set channel 0 run and claim bits
 => md.l 0x3000000 8                        <= Dump PDMA status
 03000000: 00000001 66000000 00000000 00000000    .......f........
 03000010: 00000000 00000000 00000000 00000000    ................
 => md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
 84000000: 87654321                               !Ce.
 84001000: 12345678                               xV4.
 Signed-off-by: Frank Chang <frank.chang@sifive.com>
 Tested-by: Max Hsu <max.hsu@sifive.com>
 Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
 Tested-by: Bin Meng <bmeng.cn@gmail.com>
 Message-id: 20210912130553.179501-3-frank.chang@sifive.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/dma/sifive_pdma.c | 9 +++++++++
+ linux-user/riscv/signal.c | 4 ++--
-file changed, 9 insertions(+)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
+diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/sifive_pdma.c
+--- a/linux-user/riscv/signal.c
-+++ b/hw/dma/sifive_pdma.c
++++ b/linux-user/riscv/signal.c
-@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_write(void *opaque, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ struct target_sigcontext {
+ }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
-         s->chan[ch].control = value;
+ struct target_ucontext {
-+        /*
+-    unsigned long uc_flags;
-+         * If channel was not claimed before run bit is set,
+-    struct target_ucontext *uc_link;
-+         * DMA won't run.
++    abi_ulong uc_flags;
-+         */
++    abi_ptr uc_link;
-+        if (!claimed) {
+     target_stack_t uc_stack;
-+            s->chan[ch].control &= ~CONTROL_RUN;
+     target_sigset_t uc_sigmask;
-+            return;
+     uint8_t   __unused[1024 / 8 - sizeof(target_sigset_t)];
 +        }
 +
          if (value & CONTROL_RUN) {
              sifive_pdma_run(s, ch);
          }
 --
-.31.1
+.41.0

-[PULL 13/21] hw/riscv: virt: Add optional ACLINT support to virt machine
+[PULL v2 29/45] target/riscv: support the AIA device emulation with KVM enabled
-From: Anup Patel <anup.patel@wdc.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-We extend virt machine to emulate ACLINT devices only when "aclint=on"
+In this patch, we create the APLIC and IMSIC FDT helper functions and
-parameter is passed along with machine name in QEMU command-line.
+remove M mode AIA devices when using KVM acceleration.
-Signed-off-by: Anup Patel <anup.patel@wdc.com>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-id: 20210831110603.338681-5-anup.patel@wdc.com
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20230727102439.22554-2-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- docs/system/riscv/virt.rst |  10 ++++
+ hw/riscv/virt.c | 290 +++++++++++++++++++++++-------------------------
- include/hw/riscv/virt.h    |   2 +
+file changed, 137 insertions(+), 153 deletions(-)
  hw/riscv/virt.c            | 113 ++++++++++++++++++++++++++++++++++++-
 files changed, 124 insertions(+), 1 deletion(-)
-diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/riscv/virt.rst
-+++ b/docs/system/riscv/virt.rst
-@@ -XXX,XX +XXX,XX @@ with the default OpenSBI firmware image as the -bios. It also supports
- the recommended RISC-V bootflow: U-Boot SPL (M-mode) loads OpenSBI fw_dynamic
- firmware and U-Boot proper (S-mode), using the standard -bios functionality.
-+Machine-specific options
-+------------------------
-+
-+The following machine-specific options are supported:
-+
-+- aclint=[on|off]
-+
-+  When this option is "on", ACLINT devices will be emulated instead of
-+  SiFive CLINT. When not specified, this option is assumed to be "off".
-+
- Running Linux kernel
- --------------------
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
-+++ b/include/hw/riscv/virt.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
-     FWCfgState *fw_cfg;
-     int fdt_size;
-+    bool have_aclint;
- };
- enum {
-@@ -XXX,XX +XXX,XX @@ enum {
-     VIRT_TEST,
-     VIRT_RTC,
-     VIRT_CLINT,
-+    VIRT_ACLINT_SSWI,
-     VIRT_PLIC,
-     VIRT_UART0,
-     VIRT_VIRTIO,
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
+@@ -XXX,XX +XXX,XX @@ static uint32_t imsic_num_bits(uint32_t count)
-     [VIRT_TEST] =        {   0x100000,        0x1000 },
+     return ret;
      [VIRT_RTC] =         {   0x101000,        0x1000 },
      [VIRT_CLINT] =       {  0x2000000,       0x10000 },
 +    [VIRT_ACLINT_SSWI] = {  0x2F00000,        0x4000 },
      [VIRT_PCIE_PIO] =    {  0x3000000,       0x10000 },
      [VIRT_PLIC] =        {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
      [VIRT_UART0] =       { 0x10000000,         0x100 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_clint(RISCVVirtState *s,
      g_free(clint_cells);
  }
-+static void create_fdt_socket_aclint(RISCVVirtState *s,
+-static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
-+                                     const MemMapEntry *memmap, int socket,
+-                             uint32_t *phandle, uint32_t *intc_phandles,
-+                                     uint32_t *intc_phandles)
+-                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
 +static void create_fdt_one_imsic(RISCVVirtState *s, hwaddr base_addr,
 +                                 uint32_t *intc_phandles, uint32_t msi_phandle,
 +                                 bool m_mode, uint32_t imsic_guest_bits)
  {
      int cpu, socket;
      char *imsic_name;
      MachineState *ms = MACHINE(s);
      int socket_count = riscv_socket_count(ms);
 -    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
 +    uint32_t imsic_max_hart_per_socket;
      uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
 -    *msi_m_phandle = (*phandle)++;
 -    *msi_s_phandle = (*phandle)++;
      imsic_cells = g_new0(uint32_t, ms->smp.cpus * 2);
      imsic_regs = g_new0(uint32_t, socket_count * 4);
 -    /* M-level IMSIC node */
      for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
          imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
 +        imsic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
      }
 -    imsic_max_hart_per_socket = 0;
 -    for (socket = 0; socket < socket_count; socket++) {
 -        imsic_addr = memmap[VIRT_IMSIC_M].base +
 -                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 -        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
 -        imsic_regs[socket * 4 + 0] = 0;
 -        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
 -        imsic_regs[socket * 4 + 2] = 0;
 -        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
 -        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
 -            imsic_max_hart_per_socket = s->soc[socket].num_harts;
 -        }
 -    }
 -    imsic_name = g_strdup_printf("/soc/imsics@%lx",
 -        (unsigned long)memmap[VIRT_IMSIC_M].base);
 -    qemu_fdt_add_subnode(ms->fdt, imsic_name);
 -    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
 -        "riscv,imsics");
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
 -        FDT_IMSIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
 -        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
 -        socket_count * sizeof(uint32_t) * 4);
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
 -        VIRT_IRQCHIP_NUM_MSIS);
 -    if (socket_count > 1) {
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
 -            imsic_num_bits(imsic_max_hart_per_socket));
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
 -            imsic_num_bits(socket_count));
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
 -            IMSIC_MMIO_GROUP_MIN_SHIFT);
 -    }
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_m_phandle);
 -
 -    g_free(imsic_name);
 -    /* S-level IMSIC node */
 -    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
 -        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 -    }
 -    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
      imsic_max_hart_per_socket = 0;
      for (socket = 0; socket < socket_count; socket++) {
 -        imsic_addr = memmap[VIRT_IMSIC_S].base +
 -                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 +        imsic_addr = base_addr + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
          imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
                       s->soc[socket].num_harts;
          imsic_regs[socket * 4 + 0] = 0;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
              imsic_max_hart_per_socket = s->soc[socket].num_harts;
          }
      }
 -    imsic_name = g_strdup_printf("/soc/imsics@%lx",
 -        (unsigned long)memmap[VIRT_IMSIC_S].base);
 +
 +    imsic_name = g_strdup_printf("/soc/imsics@%lx", (unsigned long)base_addr);
      qemu_fdt_add_subnode(ms->fdt, imsic_name);
 -    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
 -        "riscv,imsics");
 +    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible", "riscv,imsics");
      qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
 -        FDT_IMSIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
 -        NULL, 0);
 +                          FDT_IMSIC_INT_CELLS);
 +    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller", NULL, 0);
      qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
 -        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
 +                     imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
      qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
 -        socket_count * sizeof(uint32_t) * 4);
 +                     socket_count * sizeof(uint32_t) * 4);
      qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
 -        VIRT_IRQCHIP_NUM_MSIS);
 +                     VIRT_IRQCHIP_NUM_MSIS);
 +
      if (imsic_guest_bits) {
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,guest-index-bits",
 -            imsic_guest_bits);
 +                              imsic_guest_bits);
      }
 +
      if (socket_count > 1) {
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
 -            imsic_num_bits(imsic_max_hart_per_socket));
 +                              imsic_num_bits(imsic_max_hart_per_socket));
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
 -            imsic_num_bits(socket_count));
 +                              imsic_num_bits(socket_count));
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
 -            IMSIC_MMIO_GROUP_MIN_SHIFT);
 +                              IMSIC_MMIO_GROUP_MIN_SHIFT);
      }
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_s_phandle);
 -    g_free(imsic_name);
 +    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", msi_phandle);
 +    g_free(imsic_name);
      g_free(imsic_regs);
      g_free(imsic_cells);
  }
 -static void create_fdt_socket_aplic(RISCVVirtState *s,
 -                                    const MemMapEntry *memmap, int socket,
 -                                    uint32_t msi_m_phandle,
 -                                    uint32_t msi_s_phandle,
 -                                    uint32_t *phandle,
 -                                    uint32_t *intc_phandles,
 -                                    uint32_t *aplic_phandles)
 +static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
 +                             uint32_t *phandle, uint32_t *intc_phandles,
 +                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
 +{
-+    int cpu;
++    *msi_m_phandle = (*phandle)++;
-+    char *name;
++    *msi_s_phandle = (*phandle)++;
-+    unsigned long addr;
++
-+    uint32_t aclint_cells_size;
++    if (!kvm_enabled()) {
-+    uint32_t *aclint_mswi_cells;
++        /* M-level IMSIC node */
-+    uint32_t *aclint_sswi_cells;
++        create_fdt_one_imsic(s, memmap[VIRT_IMSIC_M].base, intc_phandles,
-+    uint32_t *aclint_mtimer_cells;
++                             *msi_m_phandle, true, 0);
 +    MachineState *mc = MACHINE(s);
 +
 +    aclint_mswi_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 +    aclint_mtimer_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 +    aclint_sswi_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 +
 +    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 +        aclint_mswi_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 +        aclint_mswi_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_SOFT);
 +        aclint_mtimer_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 +        aclint_mtimer_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_TIMER);
 +        aclint_sswi_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 +        aclint_sswi_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_SOFT);
 +    }
-+    aclint_cells_size = s->soc[socket].num_harts * sizeof(uint32_t) * 2;
++
-+
++    /* S-level IMSIC node */
-+    addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
++    create_fdt_one_imsic(s, memmap[VIRT_IMSIC_S].base, intc_phandles,
-+    name = g_strdup_printf("/soc/mswi@%lx", addr);
++                         *msi_s_phandle, false,
-+    qemu_fdt_add_subnode(mc->fdt, name);
++                         imsic_num_bits(s->aia_guests + 1));
-+    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "riscv,aclint-mswi");
++
 +    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 +        0x0, addr, 0x0, RISCV_ACLINT_SWI_SIZE);
 +    qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
 +        aclint_mswi_cells, aclint_cells_size);
 +    qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
 +    riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
 +    g_free(name);
 +
 +    addr = memmap[VIRT_CLINT].base + RISCV_ACLINT_SWI_SIZE +
 +        (memmap[VIRT_CLINT].size * socket);
 +    name = g_strdup_printf("/soc/mtimer@%lx", addr);
 +    qemu_fdt_add_subnode(mc->fdt, name);
 +    qemu_fdt_setprop_string(mc->fdt, name, "compatible",
 +        "riscv,aclint-mtimer");
 +    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 +        0x0, addr + RISCV_ACLINT_DEFAULT_MTIME,
 +        0x0, memmap[VIRT_CLINT].size - RISCV_ACLINT_SWI_SIZE -
 +             RISCV_ACLINT_DEFAULT_MTIME,
 +        0x0, addr + RISCV_ACLINT_DEFAULT_MTIMECMP,
 +        0x0, RISCV_ACLINT_DEFAULT_MTIME);
 +    qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
 +        aclint_mtimer_cells, aclint_cells_size);
 +    riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
 +    g_free(name);
 +
 +    addr = memmap[VIRT_ACLINT_SSWI].base +
 +        (memmap[VIRT_ACLINT_SSWI].size * socket);
 +    name = g_strdup_printf("/soc/sswi@%lx", addr);
 +    qemu_fdt_add_subnode(mc->fdt, name);
 +    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "riscv,aclint-sswi");
 +    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 +        0x0, addr, 0x0, memmap[VIRT_ACLINT_SSWI].size);
 +    qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
 +        aclint_sswi_cells, aclint_cells_size);
 +    qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
 +    riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
 +    g_free(name);
 +
 +    g_free(aclint_mswi_cells);
 +    g_free(aclint_mtimer_cells);
 +    g_free(aclint_sswi_cells);
 +}
 +
- static void create_fdt_socket_plic(RISCVVirtState *s,
++static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
-                                    const MemMapEntry *memmap, int socket,
++                                 unsigned long aplic_addr, uint32_t aplic_size,
-                                    uint32_t *phandle, uint32_t *intc_phandles,
++                                 uint32_t msi_phandle,
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
++                                 uint32_t *intc_phandles,
++                                 uint32_t aplic_phandle,
-         create_fdt_socket_memory(s, memmap, socket);
++                                 uint32_t aplic_child_phandle,
++                                 bool m_mode)
 -        create_fdt_socket_clint(s, memmap, socket, intc_phandles);
 +        if (s->have_aclint) {
 +            create_fdt_socket_aclint(s, memmap, socket, intc_phandles);
 +        } else {
 +            create_fdt_socket_clint(s, memmap, socket, intc_phandles);
 +        }
          create_fdt_socket_plic(s, memmap, socket, phandle,
              intc_phandles, xplic_phandles);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
              RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
              RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
 +        /* Per-socket ACLINT SSWI */
 +        if (s->have_aclint) {
 +            riscv_aclint_swi_create(
 +                memmap[VIRT_ACLINT_SSWI].base +
 +                    i * memmap[VIRT_ACLINT_SSWI].size,
 +                base_hartid, hart_count, true);
 +        }
 +
          /* Per-socket PLIC hart topology configuration string */
          plic_hart_config = plic_hart_config_string(hart_count);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_instance_init(Object *obj)
  {
+     int cpu;
+     char *aplic_name;
+     uint32_t *aplic_cells;
+-    unsigned long aplic_addr;
+     MachineState *ms = MACHINE(s);
+-    uint32_t aplic_m_phandle, aplic_s_phandle;
+-    aplic_m_phandle = (*phandle)++;
+-    aplic_s_phandle = (*phandle)++;
+     aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+-    /* M-level APLIC node */
+     for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
++        aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
+     }
+-    aplic_addr = memmap[VIRT_APLIC_M].base +
+-                 (memmap[VIRT_APLIC_M].size * socket);
++
+     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
+     qemu_fdt_add_subnode(ms->fdt, aplic_name);
+     qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
+     qemu_fdt_setprop_cell(ms->fdt, aplic_name,
+-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
++                          "#interrupt-cells", FDT_APLIC_INT_CELLS);
+     qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
++
+     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
+         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
+-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
++                         aplic_cells,
++                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+     } else {
+-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
+-            msi_m_phandle);
++        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
+     }
++
+     qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
+-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
++                           0x0, aplic_addr, 0x0, aplic_size);
+     qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
+-        VIRT_IRQCHIP_NUM_SOURCES);
+-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
+-        aplic_s_phandle);
+-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
+-        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
++                          VIRT_IRQCHIP_NUM_SOURCES);
++
++    if (aplic_child_phandle) {
++        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
++                              aplic_child_phandle);
++        qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
++                               aplic_child_phandle, 0x1,
++                               VIRT_IRQCHIP_NUM_SOURCES);
++    }
++
+     riscv_socket_fdt_write_id(ms, aplic_name, socket);
+-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_m_phandle);
++    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_phandle);
++
+     g_free(aplic_name);
++    g_free(aplic_cells);
++}
+-    /* S-level APLIC node */
+-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+-        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
++static void create_fdt_socket_aplic(RISCVVirtState *s,
++                                    const MemMapEntry *memmap, int socket,
++                                    uint32_t msi_m_phandle,
++                                    uint32_t msi_s_phandle,
++                                    uint32_t *phandle,
++                                    uint32_t *intc_phandles,
++                                    uint32_t *aplic_phandles)
++{
++    char *aplic_name;
++    unsigned long aplic_addr;
++    MachineState *ms = MACHINE(s);
++    uint32_t aplic_m_phandle, aplic_s_phandle;
++
++    aplic_m_phandle = (*phandle)++;
++    aplic_s_phandle = (*phandle)++;
++
++    if (!kvm_enabled()) {
++        /* M-level APLIC node */
++        aplic_addr = memmap[VIRT_APLIC_M].base +
++                     (memmap[VIRT_APLIC_M].size * socket);
++        create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
++                             msi_m_phandle, intc_phandles,
++                             aplic_m_phandle, aplic_s_phandle,
++                             true);
+     }
++
++    /* S-level APLIC node */
+     aplic_addr = memmap[VIRT_APLIC_S].base +
+                  (memmap[VIRT_APLIC_S].size * socket);
++    create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
++                         msi_s_phandle, intc_phandles,
++                         aplic_s_phandle, 0,
++                         false);
++
+     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
+-    qemu_fdt_add_subnode(ms->fdt, aplic_name);
+-    qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
+-    qemu_fdt_setprop_cell(ms->fdt, aplic_name,
+-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
+-    qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
+-    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
+-        qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
+-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+-    } else {
+-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
+-            msi_s_phandle);
+-    }
+-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
+-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
+-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
+-        VIRT_IRQCHIP_NUM_SOURCES);
+-    riscv_socket_fdt_write_id(ms, aplic_name, socket);
+-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_s_phandle);
+     if (!socket) {
+         platform_bus_add_all_fdt_nodes(ms->fdt, aplic_name,
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
+     g_free(aplic_name);
+-    g_free(aplic_cells);
+     aplic_phandles[socket] = aplic_s_phandle;
  }
-+static bool virt_get_aclint(Object *obj, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
-+{
+     int i;
-+    MachineState *ms = MACHINE(obj);
+     hwaddr addr;
-+    RISCVVirtState *s = RISCV_VIRT_MACHINE(ms);
+     uint32_t guest_bits;
-+
+-    DeviceState *aplic_m;
-+    return s->have_aclint;
+-    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
-+}
++    DeviceState *aplic_s = NULL;
-+
++    DeviceState *aplic_m = NULL;
-+static void virt_set_aclint(Object *obj, bool value, Error **errp)
++    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
-+{
-+    MachineState *ms = MACHINE(obj);
+     if (msimode) {
-+    RISCVVirtState *s = RISCV_VIRT_MACHINE(ms);
+-        /* Per-socket M-level IMSICs */
-+
+-        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-+    s->have_aclint = value;
+-        for (i = 0; i < hart_count; i++) {
-+}
+-            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
-+
+-                               base_hartid + i, true, 1,
- static void virt_machine_class_init(ObjectClass *oc, void *data)
+-                               VIRT_IRQCHIP_NUM_MSIS);
- {
++        if (!kvm_enabled()) {
-     MachineClass *mc = MACHINE_CLASS(oc);
++            /* Per-socket M-level IMSICs */
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
++            addr = memmap[VIRT_IMSIC_M].base +
-     mc->numa_mem_supported = true;
++                   socket * VIRT_IMSIC_GROUP_MAX_SIZE;
++            for (i = 0; i < hart_count; i++) {
-     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
++                riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
-+
++                                   base_hartid + i, true, 1,
-+    object_class_property_add_bool(oc, "aclint", virt_get_aclint,
++                                   VIRT_IRQCHIP_NUM_MSIS);
-+                                   virt_set_aclint);
++            }
-+    object_class_property_set_description(oc, "aclint",
+         }
-+                                          "Set on/off to enable/disable "
-+                                          "emulating ACLINT devices");
+         /* Per-socket S-level IMSICs */
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
          }
      }
 -    /* Per-socket M-level APLIC */
 -    aplic_m = riscv_aplic_create(
 -        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
 -        memmap[VIRT_APLIC_M].size,
 -        (msimode) ? 0 : base_hartid,
 -        (msimode) ? 0 : hart_count,
 -        VIRT_IRQCHIP_NUM_SOURCES,
 -        VIRT_IRQCHIP_NUM_PRIO_BITS,
 -        msimode, true, NULL);
 -
 -    if (aplic_m) {
 -        /* Per-socket S-level APLIC */
 -        riscv_aplic_create(
 -            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
 -            memmap[VIRT_APLIC_S].size,
 -            (msimode) ? 0 : base_hartid,
 -            (msimode) ? 0 : hart_count,
 -            VIRT_IRQCHIP_NUM_SOURCES,
 -            VIRT_IRQCHIP_NUM_PRIO_BITS,
 -            msimode, false, aplic_m);
 +    if (!kvm_enabled()) {
 +        /* Per-socket M-level APLIC */
 +        aplic_m = riscv_aplic_create(memmap[VIRT_APLIC_M].base +
 +                                     socket * memmap[VIRT_APLIC_M].size,
 +                                     memmap[VIRT_APLIC_M].size,
 +                                     (msimode) ? 0 : base_hartid,
 +                                     (msimode) ? 0 : hart_count,
 +                                     VIRT_IRQCHIP_NUM_SOURCES,
 +                                     VIRT_IRQCHIP_NUM_PRIO_BITS,
 +                                     msimode, true, NULL);
      }
 -    return aplic_m;
 +    /* Per-socket S-level APLIC */
 +    aplic_s = riscv_aplic_create(memmap[VIRT_APLIC_S].base +
 +                                 socket * memmap[VIRT_APLIC_S].size,
 +                                 memmap[VIRT_APLIC_S].size,
 +                                 (msimode) ? 0 : base_hartid,
 +                                 (msimode) ? 0 : hart_count,
 +                                 VIRT_IRQCHIP_NUM_SOURCES,
 +                                 VIRT_IRQCHIP_NUM_PRIO_BITS,
 +                                 msimode, false, aplic_m);
 +
 +    return kvm_enabled() ? aplic_s : aplic_m;
  }
- static const TypeInfo virt_machine_typeinfo = {
+ static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
 --
-.31.1
+.41.0

-New patch
+[PULL v2 30/45] target/riscv: check the in-kernel irqchip support
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+We check the in-kernel irqchip support when using KVM acceleration.
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20230727102439.22554-3-yongxuan.wang@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/kvm.c | 10 +++++++++-
+file changed, 9 insertions(+), 1 deletion(-)
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm.c
++++ b/target/riscv/kvm.c
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+ int kvm_arch_irqchip_create(KVMState *s)
+ {
+-    return 0;
++    if (kvm_kernel_irqchip_split()) {
++        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
++        exit(1);
++    }
++
++    /*
++     * We can create the VAIA using the newer device control API.
++     */
++    return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
+ }
+ int kvm_arch_process_async_events(CPUState *cs)
+--
+.41.0

-[PULL 09/21] sifive_u: Connect the SiFive PWM device
+[PULL v2 31/45] target/riscv: Create an KVM AIA irqchip
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Connect the SiFive PWM device and expose it via the device tree.
+We create a vAIA chip by using the KVM_DEV_TYPE_RISCV_AIA and then set up
 the chip with the KVM_DEV_RISCV_AIA_GRP_* APIs.
 We also extend KVM accelerator to specify the KVM AIA mode. The "riscv-aia"
 parameter is passed along with --accel in QEMU command-line.
 ) "riscv-aia=emul": IMSIC is emulated by hypervisor
 ) "riscv-aia=hwaccel": use hardware guest IMSIC
 ) "riscv-aia=auto": use the hardware guest IMSICs whenever available
                      otherwise we fallback to software emulation.
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20230727102439.22554-4-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 22f98648b4e012f78529a56f5ca60b0b27852a4d.1631159656.git.alistair.francis@wdc.com
 ---
- docs/system/riscv/sifive_u.rst |  1 +
+ target/riscv/kvm_riscv.h |   4 +
- include/hw/riscv/sifive_u.h    | 14 ++++++++-
+ target/riscv/kvm.c       | 186 +++++++++++++++++++++++++++++++++++++++
- hw/riscv/sifive_u.c            | 55 +++++++++++++++++++++++++++++++++-
+files changed, 190 insertions(+)
  hw/riscv/Kconfig               |  1 +
 files changed, 69 insertions(+), 2 deletions(-)
-diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst
+diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/riscv/sifive_u.rst
+--- a/target/riscv/kvm_riscv.h
-+++ b/docs/system/riscv/sifive_u.rst
++++ b/target/riscv/kvm_riscv.h
-@@ -XXX,XX +XXX,XX @@ The ``sifive_u`` machine supports the following devices:
+@@ -XXX,XX +XXX,XX @@
- * 2 QSPI controllers
+ void kvm_riscv_init_user_properties(Object *cpu_obj);
- * 1 ISSI 25WP256 flash
+ void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
- * 1 SD card in SPI mode
+ void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
-+* PWM0 and PWM1
++void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
++                          uint64_t aia_irq_num, uint64_t aia_msi_num,
- Please note the real world HiFive Unleashed board has a fixed configuration of
++                          uint64_t aplic_base, uint64_t imsic_base,
-E51 core and 4 U54 core combination and the RISC-V core boots in 64-bit mode.
++                          uint64_t guest_num);
-diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
  #endif
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/sifive_u.h
+--- a/target/riscv/kvm.c
-+++ b/include/hw/riscv/sifive_u.h
++++ b/target/riscv/kvm.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/misc/sifive_u_otp.h"
+ #include "exec/address-spaces.h"
- #include "hw/misc/sifive_u_prci.h"
+ #include "hw/boards.h"
- #include "hw/ssi/sifive_spi.h"
+ #include "hw/irq.h"
-+#include "hw/timer/sifive_pwm.h"
++#include "hw/intc/riscv_imsic.h"
+ #include "qemu/log.h"
- #define TYPE_RISCV_U_SOC "riscv.sifive.u.soc"
+ #include "hw/loader.h"
- #define RISCV_U_SOC(obj) \
+ #include "kvm_riscv.h"
@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveUSoCState {
      SiFiveSPIState spi0;
      SiFiveSPIState spi2;
      CadenceGEMState gem;
 +    SiFivePwmState pwm[2];
      uint32_t serial;
      char *cpu_type;
@@ -XXX,XX +XXX,XX @@ enum {
      SIFIVE_U_DEV_FLASH0,
      SIFIVE_U_DEV_DRAM,
      SIFIVE_U_DEV_GEM,
 -    SIFIVE_U_DEV_GEM_MGMT
 +    SIFIVE_U_DEV_GEM_MGMT,
 +    SIFIVE_U_DEV_PWM0,
 +    SIFIVE_U_DEV_PWM1
  };
  enum {
@@ -XXX,XX +XXX,XX @@ enum {
      SIFIVE_U_PDMA_IRQ5 = 28,
      SIFIVE_U_PDMA_IRQ6 = 29,
      SIFIVE_U_PDMA_IRQ7 = 30,
 +    SIFIVE_U_PWM0_IRQ0 = 42,
 +    SIFIVE_U_PWM0_IRQ1 = 43,
 +    SIFIVE_U_PWM0_IRQ2 = 44,
 +    SIFIVE_U_PWM0_IRQ3 = 45,
 +    SIFIVE_U_PWM1_IRQ0 = 46,
 +    SIFIVE_U_PWM1_IRQ1 = 47,
 +    SIFIVE_U_PWM1_IRQ2 = 48,
 +    SIFIVE_U_PWM1_IRQ3 = 49,
      SIFIVE_U_QSPI0_IRQ = 51,
      SIFIVE_U_GEM_IRQ = 53
  };
 diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/sifive_u.c
 +++ b/hw/riscv/sifive_u.c
 @@ -XXX,XX +XXX,XX @@
-  * 7) DMA (Direct Memory Access Controller)
+ #include "chardev/char-fe.h"
-  * 8) SPI0 connected to an SPI flash
+ #include "migration/migration.h"
-  * 9) SPI2 connected to an SD card
+ #include "sysemu/runstate.h"
-+ * 10) PWM0 and PWM1
++#include "hw/riscv/numa.h"
-  *
-  * This board currently generates devicetree dynamically that indicates at least
+ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
-  * two harts and up to five harts.
+                                  uint64_t idx)
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry sifive_u_memmap[] = {
+@@ -XXX,XX +XXX,XX @@ bool kvm_arch_cpu_check_are_resettable(void)
-     [SIFIVE_U_DEV_PRCI] =     { 0x10000000,     0x1000 },
+     return true;
      [SIFIVE_U_DEV_UART0] =    { 0x10010000,     0x1000 },
      [SIFIVE_U_DEV_UART1] =    { 0x10011000,     0x1000 },
 +    [SIFIVE_U_DEV_PWM0] =     { 0x10020000,     0x1000 },
 +    [SIFIVE_U_DEV_PWM1] =     { 0x10021000,     0x1000 },
      [SIFIVE_U_DEV_QSPI0] =    { 0x10040000,     0x1000 },
      [SIFIVE_U_DEV_QSPI2] =    { 0x10050000,     0x1000 },
      [SIFIVE_U_DEV_GPIO] =     { 0x10060000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
      qemu_fdt_setprop_cell(fdt, nodename, "reg", 0x0);
      g_free(nodename);
 +    nodename = g_strdup_printf("/soc/pwm@%lx",
 +        (long)memmap[SIFIVE_U_DEV_PWM0].base);
 +    qemu_fdt_add_subnode(fdt, nodename);
 +    qemu_fdt_setprop_string(fdt, nodename, "compatible", "sifive,pwm0");
 +    qemu_fdt_setprop_cells(fdt, nodename, "reg",
 +        0x0, memmap[SIFIVE_U_DEV_PWM0].base,
 +        0x0, memmap[SIFIVE_U_DEV_PWM0].size);
 +    qemu_fdt_setprop_cell(fdt, nodename, "interrupt-parent", plic_phandle);
 +    qemu_fdt_setprop_cells(fdt, nodename, "interrupts",
 +                           SIFIVE_U_PWM0_IRQ0, SIFIVE_U_PWM0_IRQ1,
 +                           SIFIVE_U_PWM0_IRQ2, SIFIVE_U_PWM0_IRQ3);
 +    qemu_fdt_setprop_cells(fdt, nodename, "clocks",
 +                           prci_phandle, PRCI_CLK_TLCLK);
 +    qemu_fdt_setprop_cell(fdt, nodename, "#pwm-cells", 0);
 +    g_free(nodename);
 +
 +    nodename = g_strdup_printf("/soc/pwm@%lx",
 +        (long)memmap[SIFIVE_U_DEV_PWM1].base);
 +    qemu_fdt_add_subnode(fdt, nodename);
 +    qemu_fdt_setprop_string(fdt, nodename, "compatible", "sifive,pwm0");
 +    qemu_fdt_setprop_cells(fdt, nodename, "reg",
 +        0x0, memmap[SIFIVE_U_DEV_PWM1].base,
 +        0x0, memmap[SIFIVE_U_DEV_PWM1].size);
 +    qemu_fdt_setprop_cell(fdt, nodename, "interrupt-parent", plic_phandle);
 +    qemu_fdt_setprop_cells(fdt, nodename, "interrupts",
 +                           SIFIVE_U_PWM1_IRQ0, SIFIVE_U_PWM1_IRQ1,
 +                           SIFIVE_U_PWM1_IRQ2, SIFIVE_U_PWM1_IRQ3);
 +    qemu_fdt_setprop_cells(fdt, nodename, "clocks",
 +                           prci_phandle, PRCI_CLK_TLCLK);
 +    qemu_fdt_setprop_cell(fdt, nodename, "#pwm-cells", 0);
 +    g_free(nodename);
 +
      nodename = g_strdup_printf("/soc/serial@%lx",
          (long)memmap[SIFIVE_U_DEV_UART1].base);
      qemu_fdt_add_subnode(fdt, nodename);
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_instance_init(Object *obj)
      object_initialize_child(obj, "pdma", &s->dma, TYPE_SIFIVE_PDMA);
      object_initialize_child(obj, "spi0", &s->spi0, TYPE_SIFIVE_SPI);
      object_initialize_child(obj, "spi2", &s->spi2, TYPE_SIFIVE_SPI);
 +    object_initialize_child(obj, "pwm0", &s->pwm[0], TYPE_SIFIVE_PWM);
 +    object_initialize_child(obj, "pwm1", &s->pwm[1], TYPE_SIFIVE_PWM);
  }
- static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
++static int aia_mode;
-@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
++
-     MemoryRegion *l2lim_mem = g_new(MemoryRegion, 1);
++static const char *kvm_aia_mode_str(uint64_t mode)
-     char *plic_hart_config;
++{
-     size_t plic_hart_config_len;
++    switch (mode) {
--    int i;
++    case KVM_DEV_RISCV_AIA_MODE_EMUL:
-+    int i, j;
++        return "emul";
-     NICInfo *nd = &nd_table[0];
++    case KVM_DEV_RISCV_AIA_MODE_HWACCEL:
++        return "hwaccel";
-     qdev_prop_set_uint32(DEVICE(&s->u_cpus), "num-harts", ms->smp.cpus - 1);
++    case KVM_DEV_RISCV_AIA_MODE_AUTO:
-@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
++    default:
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gem), 0,
++        return "auto";
-                        qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_U_GEM_IRQ));
++    };
++}
-+    /* PWM */
++
-+    for (i = 0; i < 2; i++) {
++static char *riscv_get_kvm_aia(Object *obj, Error **errp)
-+        if (!sysbus_realize(SYS_BUS_DEVICE(&s->pwm[i]), errp)) {
++{
-+            return;
++    return g_strdup(kvm_aia_mode_str(aia_mode));
 +}
 +
 +static void riscv_set_kvm_aia(Object *obj, const char *val, Error **errp)
 +{
 +    if (!strcmp(val, "emul")) {
 +        aia_mode = KVM_DEV_RISCV_AIA_MODE_EMUL;
 +    } else if (!strcmp(val, "hwaccel")) {
 +        aia_mode = KVM_DEV_RISCV_AIA_MODE_HWACCEL;
 +    } else if (!strcmp(val, "auto")) {
 +        aia_mode = KVM_DEV_RISCV_AIA_MODE_AUTO;
 +    } else {
 +        error_setg(errp, "Invalid KVM AIA mode");
 +        error_append_hint(errp, "Valid values are emul, hwaccel, and auto.\n");
 +    }
 +}
 +
  void kvm_arch_accel_class_init(ObjectClass *oc)
  {
 +    object_class_property_add_str(oc, "riscv-aia", riscv_get_kvm_aia,
 +                                  riscv_set_kvm_aia);
 +    object_class_property_set_description(oc, "riscv-aia",
 +                                          "Set KVM AIA mode. Valid values are "
 +                                          "emul, hwaccel, and auto. Default "
 +                                          "is auto.");
 +    object_property_set_default_str(object_class_property_find(oc, "riscv-aia"),
 +                                    "auto");
 +}
 +
 +void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
 +                          uint64_t aia_irq_num, uint64_t aia_msi_num,
 +                          uint64_t aplic_base, uint64_t imsic_base,
 +                          uint64_t guest_num)
 +{
 +    int ret, i;
 +    int aia_fd = -1;
 +    uint64_t default_aia_mode;
 +    uint64_t socket_count = riscv_socket_count(machine);
 +    uint64_t max_hart_per_socket = 0;
 +    uint64_t socket, base_hart, hart_count, socket_imsic_base, imsic_addr;
 +    uint64_t socket_bits, hart_bits, guest_bits;
 +
 +    aia_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_RISCV_AIA, false);
 +
 +    if (aia_fd < 0) {
 +        error_report("Unable to create in-kernel irqchip");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_MODE,
 +                            &default_aia_mode, false, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to get current KVM AIA mode");
 +        exit(1);
 +    }
 +    qemu_log("KVM AIA: default mode is %s\n",
 +             kvm_aia_mode_str(default_aia_mode));
 +
 +    if (default_aia_mode != aia_mode) {
 +        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                                KVM_DEV_RISCV_AIA_CONFIG_MODE,
 +                                &aia_mode, true, NULL);
 +        if (ret < 0)
 +            warn_report("KVM AIA: failed to set KVM AIA mode");
 +        else
 +            qemu_log("KVM AIA: set current mode to %s\n",
 +                     kvm_aia_mode_str(aia_mode));
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
 +                            &aia_irq_num, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set number of input irq lines");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_IDS,
 +                            &aia_msi_num, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set number of msi");
 +        exit(1);
 +    }
 +
 +    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
 +                            &socket_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set group_bits");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
 +                            &group_shift, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set group_shift");
 +        exit(1);
 +    }
 +
 +    guest_bits = guest_num == 0 ? 0 :
 +                 find_last_bit(&guest_num, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GUEST_BITS,
 +                            &guest_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set guest_bits");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
 +                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
 +                            &aplic_base, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set the base address of APLIC");
 +        exit(1);
 +    }
 +
 +    for (socket = 0; socket < socket_count; socket++) {
 +        socket_imsic_base = imsic_base + socket * (1U << group_shift);
 +        hart_count = riscv_socket_hart_count(machine, socket);
 +        base_hart = riscv_socket_first_hartid(machine, socket);
 +
 +        if (max_hart_per_socket < hart_count) {
 +            max_hart_per_socket = hart_count;
 +        }
-+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->pwm[i]), 0,
++
-+                                memmap[SIFIVE_U_DEV_PWM0].base + (0x1000 * i));
++        for (i = 0; i < hart_count; i++) {
-+
++            imsic_addr = socket_imsic_base + i * IMSIC_HART_SIZE(guest_bits);
-+        /* Connect PWM interrupts to the PLIC */
++            ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
-+        for (j = 0; j < SIFIVE_PWM_IRQS; j++) {
++                                    KVM_DEV_RISCV_AIA_ADDR_IMSIC(i + base_hart),
-+            sysbus_connect_irq(SYS_BUS_DEVICE(&s->pwm[i]), j,
++                                    &imsic_addr, true, NULL);
-+                               qdev_get_gpio_in(DEVICE(s->plic),
++            if (ret < 0) {
-+                                        SIFIVE_U_PWM0_IRQ0 + (i * 4) + j));
++                error_report("KVM AIA: failed to set the IMSIC address for hart %d", i);
 +                exit(1);
 +            }
 +        }
 +    }
 +
-     create_unimplemented_device("riscv.sifive.u.gem-mgmt",
++    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
-         memmap[SIFIVE_U_DEV_GEM_MGMT].base, memmap[SIFIVE_U_DEV_GEM_MGMT].size);
++    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
++                            KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
++                            &hart_bits, true, NULL);
-index XXXXXXX..XXXXXXX 100644
++    if (ret < 0) {
---- a/hw/riscv/Kconfig
++        error_report("KVM AIA: failed to set hart_bits");
-+++ b/hw/riscv/Kconfig
++        exit(1);
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
++    }
-     select SIFIVE_UART
++
-     select SIFIVE_U_OTP
++    if (kvm_has_gsi_routing()) {
-     select SIFIVE_U_PRCI
++        for (uint64_t idx = 0; idx < aia_irq_num + 1; ++idx) {
-+    select SIFIVE_PWM
++            /* KVM AIA only has one APLIC instance */
-     select SSI_M25P80
++            kvm_irqchip_add_irq_route(kvm_state, idx, 0, idx);
-     select SSI_SD
++        }
-     select UNIMP
++        kvm_gsi_routing_allowed = true;
 +        kvm_irqchip_commit_routes(kvm_state);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CTRL,
 +                            KVM_DEV_RISCV_AIA_CTRL_INIT,
 +                            NULL, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: initialized fail");
 +        exit(1);
 +    }
 +
 +    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
  }
 --
-.31.1
+.41.0

-[PULL 14/21] hw/dma: sifive_pdma: reset Next* registers when Control.claim is set
+[PULL v2 32/45] target/riscv: update APLIC and IMSIC to support KVM AIA
-From: Frank Chang <frank.chang@sifive.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Setting Control.claim clears all of the chanel's Next registers.
+KVM AIA can't emulate APLIC only. When "aia=aplic" parameter is passed,
-This is effective only when Control.claim is set from 0 to 1.
+APLIC devices is emulated by QEMU. For "aia=aplic-imsic", remove the
 mmio operations of APLIC when using KVM AIA and send wired interrupt
 signal via KVM_IRQ_LINE API.
 After KVM AIA enabled, MSI messages are delivered by KVM_SIGNAL_MSI API
 when the IMSICs receive mmio write requests.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Tested-by: Max Hsu <max.hsu@sifive.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Tested-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-id: 20210912130553.179501-2-frank.chang@sifive.com
+Message-ID: <20230727102439.22554-5-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/dma/sifive_pdma.c | 19 +++++++++++++++++++
+ hw/intc/riscv_aplic.c | 56 ++++++++++++++++++++++++++++++-------------
-file changed, 19 insertions(+)
+ hw/intc/riscv_imsic.c | 25 +++++++++++++++----
 files changed, 61 insertions(+), 20 deletions(-)
-diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/sifive_pdma.c
+--- a/hw/intc/riscv_aplic.c
-+++ b/hw/dma/sifive_pdma.c
++++ b/hw/intc/riscv_aplic.c
 @@ -XXX,XX +XXX,XX @@
- #define DMA_EXEC_DST        0x110
+ #include "hw/irq.h"
- #define DMA_EXEC_SRC        0x118
+ #include "target/riscv/cpu.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/kvm.h"
  #include "migration/vmstate.h"
  #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@
  #define APLIC_IDC_CLAIMI               0x1c
 +/*
-+ * FU540/FU740 docs are incorrect with NextConfig.wsize/rsize reset values.
++ * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
-+ * The reset values tested on Unleashed/Unmatched boards are 6 instead of 0.
++ * APLIC Wired.
 + */
-+#define CONFIG_WRSZ_DEFAULT 6
++static bool is_kvm_aia(bool msimode)
-+#define CONFIG_RDSZ_DEFAULT 6
++{
 +    return kvm_irqchip_in_kernel() && msimode;
 +}
 +
- enum dma_chan_state {
+ static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
-     DMA_CHAN_STATE_IDLE,
+                                             uint32_t word)
      DMA_CHAN_STATE_STARTED,
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_write(void *opaque, hwaddr offset,
  {
-     SiFivePDMAState *s = opaque;
+@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
-     int ch = SIFIVE_PDMA_CHAN_NO(offset);
+     return topi;
-+    bool claimed;
+ }
-     if (ch >= SIFIVE_PDMA_CHANS) {
++static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
-         qemu_log_mask(LOG_GUEST_ERROR, "%s: Invalid channel no %d\n",
++{
-@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_write(void *opaque, hwaddr offset,
++    kvm_set_irq(kvm_state, irq, !!level);
-     offset &= 0xfff;
++}
      switch (offset) {
      case DMA_CONTROL:
 +        claimed = !!s->chan[ch].control & CONTROL_CLAIM;
 +
-+        if (!claimed && (value & CONTROL_CLAIM)) {
+ static void riscv_aplic_request(void *opaque, int irq, int level)
-+            /* reset Next* registers */
+ {
-+            s->chan[ch].next_config = (CONFIG_RDSZ_DEFAULT << CONFIG_RDSZ_SHIFT) |
+     bool update = false;
-+                                      (CONFIG_WRSZ_DEFAULT << CONFIG_WRSZ_SHIFT);
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
-+            s->chan[ch].next_bytes = 0;
+     uint32_t i;
-+            s->chan[ch].next_dst = 0;
+     RISCVAPLICState *aplic = RISCV_APLIC(dev);
-+            s->chan[ch].next_src = 0;
 -    aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
 -    aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
 -    aplic->state = g_new0(uint32_t, aplic->num_irqs);
 -    aplic->target = g_new0(uint32_t, aplic->num_irqs);
 -    if (!aplic->msimode) {
 -        for (i = 0; i < aplic->num_irqs; i++) {
 -            aplic->target[i] = 1;
 +    if (!is_kvm_aia(aplic->msimode)) {
 +        aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
 +        aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
 +        aplic->state = g_new0(uint32_t, aplic->num_irqs);
 +        aplic->target = g_new0(uint32_t, aplic->num_irqs);
 +        if (!aplic->msimode) {
 +            for (i = 0; i < aplic->num_irqs; i++) {
 +                aplic->target[i] = 1;
 +            }
          }
 -    }
 -    aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
 -    aplic->iforce = g_new0(uint32_t, aplic->num_harts);
 -    aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 +        aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
 +        aplic->iforce = g_new0(uint32_t, aplic->num_harts);
 +        aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 -    memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops, aplic,
 -                          TYPE_RISCV_APLIC, aplic->aperture_size);
 -    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
 +        memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
 +                              aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
 +        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
 +    }
      /*
       * Only root APLICs have hardware IRQ lines. All non-root APLICs
       * have IRQ lines delegated by their parent APLIC.
       */
      if (!aplic->parent) {
 -        qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 +        if (is_kvm_aia(aplic->msimode)) {
 +            qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
 +        } else {
 +            qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 +        }
+     }
+     /* Create output IRQ lines for non-MSI mode */
+@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
+     qdev_prop_set_bit(dev, "mmode", mmode);
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +
-         s->chan[ch].control = value;
++    if (!is_kvm_aia(msimode)) {
++        sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
-         if (value & CONTROL_RUN) {
++    }
      if (parent) {
          riscv_aplic_add_child(parent, dev);
 diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/riscv_imsic.c
 +++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@
  #include "target/riscv/cpu.h"
  #include "target/riscv/cpu_bits.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/kvm.h"
  #include "migration/vmstate.h"
  #define IMSIC_MMIO_PAGE_LE             0x00
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
          goto err;
      }
 +#if defined(CONFIG_KVM)
 +    if (kvm_irqchip_in_kernel()) {
 +        struct kvm_msi msi;
 +
 +        msi.address_lo = extract64(imsic->mmio.addr + addr, 0, 32);
 +        msi.address_hi = extract64(imsic->mmio.addr + addr, 32, 32);
 +        msi.data = le32_to_cpu(value);
 +
 +        kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
 +
 +        return;
 +    }
 +#endif
 +
      /* Writes only supported for MSI little-endian registers */
      page = addr >> IMSIC_MMIO_PAGE_SHIFT;
      if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
      CPUState *cpu = cpu_by_arch_id(imsic->hartid);
      CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 -    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
 -    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
 -    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
 -    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
 +    if (!kvm_irqchip_in_kernel()) {
 +        imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
 +        imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
 +        imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
 +        imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
 +    }
      memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
                            imsic, TYPE_RISCV_IMSIC,
 --
-.31.1
+.41.0

-[PULL 10/21] hw/intc: Rename sifive_clint sources to riscv_aclint sources
+[PULL v2 33/45] target/riscv: select KVM AIA in riscv virt machine
-From: Anup Patel <anup.patel@wdc.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-We will be upgrading SiFive CLINT implementation into RISC-V ACLINT
+Select KVM AIA when the host kernel has in-kernel AIA chip support.
-implementation so let's first rename the sources.
+Since KVM AIA only has one APLIC instance, we map the QEMU APLIC
 devices to KVM APLIC.
-Signed-off-by: Anup Patel <anup.patel@wdc.com>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-id: 20210831110603.338681-2-anup.patel@wdc.com
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20230727102439.22554-6-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/intc/{sifive_clint.h => riscv_aclint.h} |  0
+ hw/riscv/virt.c | 94 +++++++++++++++++++++++++++++++++----------------
- hw/intc/{sifive_clint.c => riscv_aclint.c}         |  2 +-
+file changed, 63 insertions(+), 31 deletions(-)
  hw/riscv/microchip_pfsoc.c                         |  2 +-
  hw/riscv/shakti_c.c                                |  2 +-
  hw/riscv/sifive_e.c                                |  2 +-
  hw/riscv/sifive_u.c                                |  2 +-
  hw/riscv/spike.c                                   |  2 +-
  hw/riscv/virt.c                                    |  2 +-
  hw/intc/Kconfig                                    |  2 +-
  hw/intc/meson.build                                |  2 +-
  hw/riscv/Kconfig                                   | 12 ++++++------
 files changed, 15 insertions(+), 15 deletions(-)
  rename include/hw/intc/{sifive_clint.h => riscv_aclint.h} (100%)
  rename hw/intc/{sifive_clint.c => riscv_aclint.c} (99%)
-diff --git a/include/hw/intc/sifive_clint.h b/include/hw/intc/riscv_aclint.h
-similarity index 100%
-rename from include/hw/intc/sifive_clint.h
-rename to include/hw/intc/riscv_aclint.h
-diff --git a/hw/intc/sifive_clint.c b/hw/intc/riscv_aclint.c
-similarity index 99%
-rename from hw/intc/sifive_clint.c
-rename to hw/intc/riscv_aclint.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/sifive_clint.c
-+++ b/hw/intc/riscv_aclint.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "target/riscv/cpu.h"
- #include "hw/qdev-properties.h"
--#include "hw/intc/sifive_clint.h"
-+#include "hw/intc/riscv_aclint.h"
- #include "qemu/timer.h"
- #include "hw/irq.h"
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/microchip_pfsoc.c
-+++ b/hw/riscv/microchip_pfsoc.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/riscv/boot.h"
- #include "hw/riscv/riscv_hart.h"
- #include "hw/riscv/microchip_pfsoc.h"
--#include "hw/intc/sifive_clint.h"
-+#include "hw/intc/riscv_aclint.h"
- #include "hw/intc/sifive_plic.h"
- #include "sysemu/device_tree.h"
- #include "sysemu/sysemu.h"
-diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/shakti_c.c
-+++ b/hw/riscv/shakti_c.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/riscv/shakti_c.h"
- #include "qapi/error.h"
- #include "hw/intc/sifive_plic.h"
--#include "hw/intc/sifive_clint.h"
-+#include "hw/intc/riscv_aclint.h"
- #include "sysemu/sysemu.h"
- #include "hw/qdev-properties.h"
- #include "exec/address-spaces.h"
-diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_e.c
-+++ b/hw/riscv/sifive_e.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/riscv/sifive_e.h"
- #include "hw/riscv/boot.h"
- #include "hw/char/sifive_uart.h"
--#include "hw/intc/sifive_clint.h"
-+#include "hw/intc/riscv_aclint.h"
- #include "hw/intc/sifive_plic.h"
- #include "hw/misc/sifive_e_prci.h"
- #include "chardev/char.h"
-diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_u.c
-+++ b/hw/riscv/sifive_u.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/riscv/sifive_u.h"
- #include "hw/riscv/boot.h"
- #include "hw/char/sifive_uart.h"
--#include "hw/intc/sifive_clint.h"
-+#include "hw/intc/riscv_aclint.h"
- #include "hw/intc/sifive_plic.h"
- #include "chardev/char.h"
- #include "net/eth.h"
-diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/spike.c
-+++ b/hw/riscv/spike.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/riscv/boot.h"
- #include "hw/riscv/numa.h"
- #include "hw/char/riscv_htif.h"
--#include "hw/intc/sifive_clint.h"
-+#include "hw/intc/riscv_aclint.h"
- #include "chardev/char.h"
- #include "sysemu/device_tree.h"
- #include "sysemu/sysemu.h"
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
 @@ -XXX,XX +XXX,XX @@
  #include "hw/riscv/virt.h"
  #include "hw/riscv/boot.h"
  #include "hw/riscv/numa.h"
--#include "hw/intc/sifive_clint.h"
++#include "kvm_riscv.h"
-+#include "hw/intc/riscv_aclint.h"
+ #include "hw/intc/riscv_aclint.h"
- #include "hw/intc/sifive_plic.h"
+ #include "hw/intc/riscv_aplic.h"
- #include "hw/misc/sifive_test.h"
+ #include "hw/intc/riscv_imsic.h"
- #include "chardev/char.h"
+@@ -XXX,XX +XXX,XX @@
-diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
+ #error "Can't accommodate all IMSIC groups in address space"
-index XXXXXXX..XXXXXXX 100644
+ #endif
---- a/hw/intc/Kconfig
-+++ b/hw/intc/Kconfig
++/* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
-@@ -XXX,XX +XXX,XX @@ config RX_ICU
++static bool virt_use_kvm_aia(RISCVVirtState *s)
- config LOONGSON_LIOINTC
++{
-     bool
++    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
++}
--config SIFIVE_CLINT
++
-+config RISCV_ACLINT
+ static const MemMapEntry virt_memmap[] = {
-     bool
+     [VIRT_DEBUG] =        {        0x0,         0x100 },
+     [VIRT_MROM] =         {     0x1000,        0xf000 },
- config SIFIVE_PLIC
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
-diff --git a/hw/intc/meson.build b/hw/intc/meson.build
+                                  uint32_t *intc_phandles,
-index XXXXXXX..XXXXXXX 100644
+                                  uint32_t aplic_phandle,
---- a/hw/intc/meson.build
+                                  uint32_t aplic_child_phandle,
-+++ b/hw/intc/meson.build
+-                                 bool m_mode)
-@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: 'CONFIG_RX_ICU', if_true: files('rx_icu.c'))
++                                 bool m_mode, int num_harts)
- specific_ss.add(when: 'CONFIG_S390_FLIC', if_true: files('s390_flic.c'))
+ {
- specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: files('s390_flic_kvm.c'))
+     int cpu;
- specific_ss.add(when: 'CONFIG_SH_INTC', if_true: files('sh_intc.c'))
+     char *aplic_name;
--specific_ss.add(when: 'CONFIG_SIFIVE_CLINT', if_true: files('sifive_clint.c'))
+     uint32_t *aplic_cells;
-+specific_ss.add(when: 'CONFIG_RISCV_ACLINT', if_true: files('riscv_aclint.c'))
+     MachineState *ms = MACHINE(s);
- specific_ss.add(when: 'CONFIG_SIFIVE_PLIC', if_true: files('sifive_plic.c'))
- specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c'))
+-    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
- specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_XICS'],
++    aplic_cells = g_new0(uint32_t, num_harts * 2);
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
-index XXXXXXX..XXXXXXX 100644
+-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
---- a/hw/riscv/Kconfig
++    for (cpu = 0; cpu < num_harts; cpu++) {
-+++ b/hw/riscv/Kconfig
+         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
+         aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
-     select MCHP_PFSOC_MMUART
+     }
-     select MCHP_PFSOC_SYSREG
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
-     select MSI_NONBROKEN
--    select SIFIVE_CLINT
+     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
-+    select RISCV_ACLINT
+         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-     select SIFIVE_PDMA
+-                         aplic_cells,
-     select SIFIVE_PLIC
+-                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
-     select UNIMP
++                         aplic_cells, num_harts * sizeof(uint32_t) * 2);
-@@ -XXX,XX +XXX,XX @@ config SHAKTI_C
+     } else {
-     bool
+         qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
-     select UNIMP
+     }
-     select SHAKTI_UART
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
--    select SIFIVE_CLINT
+                                     uint32_t msi_s_phandle,
-+    select RISCV_ACLINT
+                                     uint32_t *phandle,
-     select SIFIVE_PLIC
+                                     uint32_t *intc_phandles,
+-                                    uint32_t *aplic_phandles)
- config RISCV_VIRT
++                                    uint32_t *aplic_phandles,
-@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
++                                    int num_harts)
-     select PCI_EXPRESS_GENERIC_BRIDGE
+ {
-     select PFLASH_CFI01
+     char *aplic_name;
-     select SERIAL
+     unsigned long aplic_addr;
--    select SIFIVE_CLINT
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
-+    select RISCV_ACLINT
+         create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
-     select SIFIVE_PLIC
+                              msi_m_phandle, intc_phandles,
-     select SIFIVE_TEST
+                              aplic_m_phandle, aplic_s_phandle,
-     select VIRTIO_MMIO
+-                             true);
-@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
++                             true, num_harts);
- config SIFIVE_E
+     }
-     bool
-     select MSI_NONBROKEN
+     /* S-level APLIC node */
--    select SIFIVE_CLINT
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
-+    select RISCV_ACLINT
+     create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
-     select SIFIVE_GPIO
+                          msi_s_phandle, intc_phandles,
-     select SIFIVE_PLIC
+                          aplic_s_phandle, 0,
-     select SIFIVE_UART
+-                         false);
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
++                         false, num_harts);
-     bool
-     select CADENCE
+     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
-     select MSI_NONBROKEN
--    select SIFIVE_CLINT
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-+    select RISCV_ACLINT
+         *msi_pcie_phandle = msi_s_phandle;
-     select SIFIVE_GPIO
+     }
-     select SIFIVE_PDMA
-     select SIFIVE_PLIC
+-    phandle_pos = ms->smp.cpus;
-@@ -XXX,XX +XXX,XX @@ config SPIKE
+-    for (socket = (socket_count - 1); socket >= 0; socket--) {
-     select RISCV_NUMA
+-        phandle_pos -= s->soc[socket].num_harts;
-     select HTIF
+-
-     select MSI_NONBROKEN
+-        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
--    select SIFIVE_CLINT
+-            create_fdt_socket_plic(s, memmap, socket, phandle,
-+    select RISCV_ACLINT
+-                &intc_phandles[phandle_pos], xplic_phandles);
-     select SIFIVE_PLIC
+-        } else {
 -            create_fdt_socket_aplic(s, memmap, socket,
 -                msi_m_phandle, msi_s_phandle, phandle,
 -                &intc_phandles[phandle_pos], xplic_phandles);
 +    /* KVM AIA only has one APLIC instance */
 +    if (virt_use_kvm_aia(s)) {
 +        create_fdt_socket_aplic(s, memmap, 0,
 +                                msi_m_phandle, msi_s_phandle, phandle,
 +                                &intc_phandles[0], xplic_phandles,
 +                                ms->smp.cpus);
 +    } else {
 +        phandle_pos = ms->smp.cpus;
 +        for (socket = (socket_count - 1); socket >= 0; socket--) {
 +            phandle_pos -= s->soc[socket].num_harts;
 +
 +            if (s->aia_type == VIRT_AIA_TYPE_NONE) {
 +                create_fdt_socket_plic(s, memmap, socket, phandle,
 +                                       &intc_phandles[phandle_pos],
 +                                       xplic_phandles);
 +            } else {
 +                create_fdt_socket_aplic(s, memmap, socket,
 +                                        msi_m_phandle, msi_s_phandle, phandle,
 +                                        &intc_phandles[phandle_pos],
 +                                        xplic_phandles,
 +                                        s->soc[socket].num_harts);
 +            }
          }
      }
      g_free(intc_phandles);
 -    for (socket = 0; socket < socket_count; socket++) {
 -        if (socket == 0) {
 -            *irq_mmio_phandle = xplic_phandles[socket];
 -            *irq_virtio_phandle = xplic_phandles[socket];
 -            *irq_pcie_phandle = xplic_phandles[socket];
 -        }
 -        if (socket == 1) {
 -            *irq_virtio_phandle = xplic_phandles[socket];
 -            *irq_pcie_phandle = xplic_phandles[socket];
 -        }
 -        if (socket == 2) {
 -            *irq_pcie_phandle = xplic_phandles[socket];
 +    if (virt_use_kvm_aia(s)) {
 +        *irq_mmio_phandle = xplic_phandles[0];
 +        *irq_virtio_phandle = xplic_phandles[0];
 +        *irq_pcie_phandle = xplic_phandles[0];
 +    } else {
 +        for (socket = 0; socket < socket_count; socket++) {
 +            if (socket == 0) {
 +                *irq_mmio_phandle = xplic_phandles[socket];
 +                *irq_virtio_phandle = xplic_phandles[socket];
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
 +            if (socket == 1) {
 +                *irq_virtio_phandle = xplic_phandles[socket];
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
 +            if (socket == 2) {
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
          }
      }
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
          }
      }
 +    if (virt_use_kvm_aia(s)) {
 +        kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
 +                             VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
 +                             memmap[VIRT_APLIC_S].base,
 +                             memmap[VIRT_IMSIC_S].base,
 +                             s->aia_guests);
 +    }
 +
      if (riscv_is_32bit(&s->soc[0])) {
  #if HOST_LONG_BITS == 64
          /* limit RAM size in a 32-bit system */
 --
-.31.1
+.41.0

-[PULL 06/21] hw/intc: sifive_plic: Convert the PLIC to use RISC-V CPU GPIO lines
+[PULL v2 34/45] hw/riscv: virt: Fix riscv,pmu DT node path
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Conor Dooley <conor.dooley@microchip.com>
-Instead of using riscv_cpu_update_mip() let's instead use the new RISC-V
+On a dtb dumped from the virt machine, dt-validate complains:
-CPU GPIO lines to set the external MIP bits.
+soc: pmu: {'riscv,event-to-mhpmcounters': [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280], [65563, 65563, 524280], [65569, 65569, 524280]], 'compatible': ['riscv,pmu']} should not be valid under {'type': 'object'}
         from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
 That's pretty cryptic, but running the dtb back through dtc produces
 something a lot more reasonable:
 Warning (simple_bus_reg): /soc/pmu: missing or empty reg/ranges property
+Moving the riscv,pmu node out of the soc bus solves the problem.
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20230727-groom-decline-2c57ce42841c@spud>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Tested-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 0364190bfa935058a845c0fa1ecf650328840ad5.1630301632.git.alistair.francis@wdc.com
 ---
- include/hw/intc/sifive_plic.h |  4 ++++
+ hw/riscv/virt.c | 2 +-
- hw/intc/sifive_plic.c         | 30 +++++++++++++++++++++++-------
+file changed, 1 insertion(+), 1 deletion(-)
  hw/riscv/microchip_pfsoc.c    |  2 +-
  hw/riscv/shakti_c.c           |  3 ++-
  hw/riscv/sifive_e.c           |  2 +-
  hw/riscv/sifive_u.c           |  2 +-
  hw/riscv/virt.c               |  2 +-
 files changed, 33 insertions(+), 12 deletions(-)
-diff --git a/include/hw/intc/sifive_plic.h b/include/hw/intc/sifive_plic.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/sifive_plic.h
-+++ b/include/hw/intc/sifive_plic.h
-@@ -XXX,XX +XXX,XX @@ struct SiFivePLICState {
-     uint32_t context_base;
-     uint32_t context_stride;
-     uint32_t aperture_size;
-+
-+    qemu_irq *m_external_irqs;
-+    qemu_irq *s_external_irqs;
- };
- DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
-+    uint32_t num_harts,
-     uint32_t hartid_base, uint32_t num_sources,
-     uint32_t num_priorities, uint32_t priority_base,
-     uint32_t pending_base, uint32_t enable_base,
-diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/sifive_plic.c
-+++ b/hw/intc/sifive_plic.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/intc/sifive_plic.h"
- #include "target/riscv/cpu.h"
- #include "migration/vmstate.h"
-+#include "hw/irq.h"
- #define RISCV_DEBUG_PLIC 0
-@@ -XXX,XX +XXX,XX @@ static void sifive_plic_update(SiFivePLICState *plic)
-     for (addrid = 0; addrid < plic->num_addrs; addrid++) {
-         uint32_t hartid = plic->addr_config[addrid].hartid;
-         PLICMode mode = plic->addr_config[addrid].mode;
--        CPUState *cpu = qemu_get_cpu(hartid);
--        CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
--        if (!env) {
--            continue;
--        }
-         int level = sifive_plic_irqs_pending(plic, addrid);
-+
-         switch (mode) {
-         case PLICMode_M:
--            riscv_cpu_update_mip(RISCV_CPU(cpu), MIP_MEIP, BOOL_TO_MASK(level));
-+            qemu_set_irq(plic->m_external_irqs[hartid - plic->hartid_base], level);
-             break;
-         case PLICMode_S:
--            riscv_cpu_update_mip(RISCV_CPU(cpu), MIP_SEIP, BOOL_TO_MASK(level));
-+            qemu_set_irq(plic->s_external_irqs[hartid - plic->hartid_base], level);
-             break;
-         default:
-             break;
-@@ -XXX,XX +XXX,XX @@ static void sifive_plic_realize(DeviceState *dev, Error **errp)
-     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &plic->mmio);
-     qdev_init_gpio_in(dev, sifive_plic_irq_request, plic->num_sources);
-+    plic->s_external_irqs = g_malloc(sizeof(qemu_irq) * plic->num_harts);
-+    qdev_init_gpio_out(dev, plic->s_external_irqs, plic->num_harts);
-+
-+    plic->m_external_irqs = g_malloc(sizeof(qemu_irq) * plic->num_harts);
-+    qdev_init_gpio_out(dev, plic->m_external_irqs, plic->num_harts);
-+
-     /* We can't allow the supervisor to control SEIP as this would allow the
-      * supervisor to clear a pending external interrupt which will result in
-      * lost a interrupt in the case a PLIC is attached. The SEIP bit must be
-@@ -XXX,XX +XXX,XX @@ type_init(sifive_plic_register_types)
-  * Create PLIC device.
-  */
- DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
-+    uint32_t num_harts,
-     uint32_t hartid_base, uint32_t num_sources,
-     uint32_t num_priorities, uint32_t priority_base,
-     uint32_t pending_base, uint32_t enable_base,
-@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
-     uint32_t context_stride, uint32_t aperture_size)
- {
-     DeviceState *dev = qdev_new(TYPE_SIFIVE_PLIC);
-+    int i;
-+
-     assert(enable_stride == (enable_stride & -enable_stride));
-     assert(context_stride == (context_stride & -context_stride));
-     qdev_prop_set_string(dev, "hart-config", hart_config);
-@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
-     qdev_prop_set_uint32(dev, "aperture-size", aperture_size);
-     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
-+
-+    for (i = 0; i < num_harts; i++) {
-+        CPUState *cpu = qemu_get_cpu(hartid_base + i);
-+
-+        qdev_connect_gpio_out(dev, i,
-+                              qdev_get_gpio_in(DEVICE(cpu), IRQ_S_EXT));
-+        qdev_connect_gpio_out(dev, num_harts + i,
-+                              qdev_get_gpio_in(DEVICE(cpu), IRQ_M_EXT));
-+    }
-+
-     return dev;
- }
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/microchip_pfsoc.c
-+++ b/hw/riscv/microchip_pfsoc.c
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
-     /* PLIC */
-     s->plic = sifive_plic_create(memmap[MICROCHIP_PFSOC_PLIC].base,
--        plic_hart_config, 0,
-+        plic_hart_config, ms->smp.cpus, 0,
-         MICROCHIP_PFSOC_PLIC_NUM_SOURCES,
-         MICROCHIP_PFSOC_PLIC_NUM_PRIORITIES,
-         MICROCHIP_PFSOC_PLIC_PRIORITY_BASE,
-diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/shakti_c.c
-+++ b/hw/riscv/shakti_c.c
-@@ -XXX,XX +XXX,XX @@ type_init(shakti_c_machine_type_info_register)
- static void shakti_c_soc_state_realize(DeviceState *dev, Error **errp)
- {
-+    MachineState *ms = MACHINE(qdev_get_machine());
-     ShaktiCSoCState *sss = RISCV_SHAKTI_SOC(dev);
-     MemoryRegion *system_memory = get_system_memory();
-     sysbus_realize(SYS_BUS_DEVICE(&sss->cpus), &error_abort);
-     sss->plic = sifive_plic_create(shakti_c_memmap[SHAKTI_C_PLIC].base,
--        (char *)SHAKTI_C_PLIC_HART_CONFIG, 0,
-+        (char *)SHAKTI_C_PLIC_HART_CONFIG, ms->smp.cpus, 0,
-         SHAKTI_C_PLIC_NUM_SOURCES,
-         SHAKTI_C_PLIC_NUM_PRIORITIES,
-         SHAKTI_C_PLIC_PRIORITY_BASE,
-diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_e.c
-+++ b/hw/riscv/sifive_e.c
-@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
-     /* MMIO */
-     s->plic = sifive_plic_create(memmap[SIFIVE_E_DEV_PLIC].base,
--        (char *)SIFIVE_E_PLIC_HART_CONFIG, 0,
-+        (char *)SIFIVE_E_PLIC_HART_CONFIG, ms->smp.cpus, 0,
-         SIFIVE_E_PLIC_NUM_SOURCES,
-         SIFIVE_E_PLIC_NUM_PRIORITIES,
-         SIFIVE_E_PLIC_PRIORITY_BASE,
-diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_u.c
-+++ b/hw/riscv/sifive_u.c
-@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
-     /* MMIO */
-     s->plic = sifive_plic_create(memmap[SIFIVE_U_DEV_PLIC].base,
--        plic_hart_config, 0,
-+        plic_hart_config, ms->smp.cpus, 0,
-         SIFIVE_U_PLIC_NUM_SOURCES,
-         SIFIVE_U_PLIC_NUM_PRIORITIES,
-         SIFIVE_U_PLIC_PRIORITY_BASE,
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_pmu(RISCVVirtState *s)
-         /* Per-socket PLIC */
+     MachineState *ms = MACHINE(s);
-         s->plic[i] = sifive_plic_create(
+     RISCVCPU hart = s->soc[0].harts[0];
-             memmap[VIRT_PLIC].base + i * memmap[VIRT_PLIC].size,
--            plic_hart_config, base_hartid,
+-    pmu_name = g_strdup_printf("/soc/pmu");
-+            plic_hart_config, hart_count, base_hartid,
++    pmu_name = g_strdup_printf("/pmu");
-             VIRT_PLIC_NUM_SOURCES,
+     qemu_fdt_add_subnode(ms->fdt, pmu_name);
-             VIRT_PLIC_NUM_PRIORITIES,
+     qemu_fdt_setprop_string(ms->fdt, pmu_name, "compatible", "riscv,pmu");
-             VIRT_PLIC_PRIORITY_BASE,
+     riscv_pmu_generate_fdt_node(ms->fdt, hart.cfg.pmu_num, pmu_name);
 --
-.31.1
+.41.0

-[PULL 20/21] target/riscv: csr: Rename HCOUNTEREN_CY and friends
+[PULL v2 35/45] target/riscv: Update CSR bits name for svadu extension
-From: Bin Meng <bmeng.cn@gmail.com>
+From: Weiwei Li <liweiwei@iscas.ac.cn>
-The macro name HCOUNTEREN_CY suggests it is for CSR HCOUNTEREN, but
+The Svadu specification updated the name of the *envcfg bit from
-in fact it applies to M-mode and S-mode CSR too. Rename these macros
+HADE to ADUE.
 to have the COUNTEREN_ prefix.
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Message-id: 20210915084601.24304-1-bmeng.cn@gmail.com
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20230816141916.66898-1-liweiwei@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_bits.h |  8 ++++----
+ target/riscv/cpu_bits.h   |  8 ++++----
- target/riscv/csr.c      | 24 ++++++++++++------------
+ target/riscv/cpu.c        |  4 ++--
-files changed, 16 insertions(+), 16 deletions(-)
+ target/riscv/cpu_helper.c |  6 +++---
  target/riscv/csr.c        | 12 ++++++------
 files changed, 15 insertions(+), 15 deletions(-)
 diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_bits.h
 +++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
- #define HSTATUS32_WPRI       0xFF8FF87E
+ #define MENVCFG_CBIE                       (3UL << 4)
- #define HSTATUS64_WPRI       0xFFFFFFFFFF8FF87EULL
+ #define MENVCFG_CBCFE                      BIT(6)
+ #define MENVCFG_CBZE                       BIT(7)
--#define HCOUNTEREN_CY        (1 << 0)
+-#define MENVCFG_HADE                       (1ULL << 61)
--#define HCOUNTEREN_TM        (1 << 1)
++#define MENVCFG_ADUE                       (1ULL << 61)
--#define HCOUNTEREN_IR        (1 << 2)
+ #define MENVCFG_PBMTE                      (1ULL << 62)
--#define HCOUNTEREN_HPM3      (1 << 3)
+ #define MENVCFG_STCE                       (1ULL << 63)
-+#define COUNTEREN_CY         (1 << 0)
-+#define COUNTEREN_TM         (1 << 1)
+ /* For RV32 */
-+#define COUNTEREN_IR         (1 << 2)
+-#define MENVCFGH_HADE                      BIT(29)
-+#define COUNTEREN_HPM3       (1 << 3)
++#define MENVCFGH_ADUE                      BIT(29)
+ #define MENVCFGH_PBMTE                     BIT(30)
- /* Privilege modes */
+ #define MENVCFGH_STCE                      BIT(31)
- #define PRV_U 0
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define HENVCFG_CBIE                       MENVCFG_CBIE
  #define HENVCFG_CBCFE                      MENVCFG_CBCFE
  #define HENVCFG_CBZE                       MENVCFG_CBZE
 -#define HENVCFG_HADE                       MENVCFG_HADE
 +#define HENVCFG_ADUE                       MENVCFG_ADUE
  #define HENVCFG_PBMTE                      MENVCFG_PBMTE
  #define HENVCFG_STCE                       MENVCFG_STCE
  /* For RV32 */
 -#define HENVCFGH_HADE                       MENVCFGH_HADE
 +#define HENVCFGH_ADUE                       MENVCFGH_ADUE
  #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
  #define HENVCFGH_STCE                       MENVCFGH_STCE
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
      env->two_stage_lookup = false;
      env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
 -                   (cpu->cfg.ext_svadu ? MENVCFG_HADE : 0);
 +                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
      env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
 -                   (cpu->cfg.ext_svadu ? HENVCFG_HADE : 0);
 +                   (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
      /* Initialized default priorities of local interrupts. */
      for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
      }
      bool pbmte = env->menvcfg & MENVCFG_PBMTE;
 -    bool hade = env->menvcfg & MENVCFG_HADE;
 +    bool adue = env->menvcfg & MENVCFG_ADUE;
      if (first_stage && two_stage && env->virt_enabled) {
          pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
 -        hade = hade && (env->henvcfg & HENVCFG_HADE);
 +        adue = adue && (env->henvcfg & HENVCFG_ADUE);
      }
      int ptshift = (levels - 1) * ptidxbits;
@@ -XXX,XX +XXX,XX @@ restart:
      /* Page table updates need to be atomic with MTTCG enabled */
      if (updated_pte != pte && !is_debug) {
 -        if (!hade) {
 +        if (!adue) {
              return TRANSLATE_FAIL;
          }
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
-     if (riscv_cpu_virt_enabled(env)) {
+     if (riscv_cpu_mxl(env) == MXL_RV64) {
-         switch (csrno) {
+         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
-         case CSR_CYCLE:
+                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
--            if (!get_field(env->hcounteren, HCOUNTEREN_CY) &&
+-                (cfg->ext_svadu ? MENVCFG_HADE : 0);
--                get_field(env->mcounteren, HCOUNTEREN_CY)) {
++                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
-+            if (!get_field(env->hcounteren, COUNTEREN_CY) &&
+     }
-+                get_field(env->mcounteren, COUNTEREN_CY)) {
+     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
-                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-             }
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
-             break;
+     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
-         case CSR_TIME:
+     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
--            if (!get_field(env->hcounteren, HCOUNTEREN_TM) &&
+                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
--                get_field(env->mcounteren, HCOUNTEREN_TM)) {
+-                    (cfg->ext_svadu ? MENVCFG_HADE : 0);
-+            if (!get_field(env->hcounteren, COUNTEREN_TM) &&
++                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
-+                get_field(env->mcounteren, COUNTEREN_TM)) {
+     uint64_t valh = (uint64_t)val << 32;
-                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-             }
+     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
-             break;
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
-         case CSR_INSTRET:
+      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
--            if (!get_field(env->hcounteren, HCOUNTEREN_IR) &&
+      * henvcfg.hade is read_only 0 when menvcfg.hade = 0
--                get_field(env->mcounteren, HCOUNTEREN_IR)) {
+      */
-+            if (!get_field(env->hcounteren, COUNTEREN_IR) &&
+-    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
-+                get_field(env->mcounteren, COUNTEREN_IR)) {
++    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
-                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+                            env->menvcfg);
-             }
+     return RISCV_EXCP_NONE;
-             break;
+ }
-@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
-         if (riscv_cpu_is_32bit(env)) {
+     }
-             switch (csrno) {
-             case CSR_CYCLEH:
+     if (riscv_cpu_mxl(env) == MXL_RV64) {
--                if (!get_field(env->hcounteren, HCOUNTEREN_CY) &&
+-        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE);
--                    get_field(env->mcounteren, HCOUNTEREN_CY)) {
++        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
-+                if (!get_field(env->hcounteren, COUNTEREN_CY) &&
+     }
-+                    get_field(env->mcounteren, COUNTEREN_CY)) {
-                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
-                 }
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
-                 break;
+         return ret;
-             case CSR_TIMEH:
+     }
--                if (!get_field(env->hcounteren, HCOUNTEREN_TM) &&
--                    get_field(env->mcounteren, HCOUNTEREN_TM)) {
+-    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
-+                if (!get_field(env->hcounteren, COUNTEREN_TM) &&
++    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
-+                    get_field(env->mcounteren, COUNTEREN_TM)) {
+                             env->menvcfg)) >> 32;
-                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+     return RISCV_EXCP_NONE;
-                 }
+ }
-                 break;
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
-             case CSR_INSTRETH:
+                                      target_ulong val)
--                if (!get_field(env->hcounteren, HCOUNTEREN_IR) &&
+ {
--                    get_field(env->mcounteren, HCOUNTEREN_IR)) {
+     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
-+                if (!get_field(env->hcounteren, COUNTEREN_IR) &&
+-                                    HENVCFG_HADE);
-+                    get_field(env->mcounteren, COUNTEREN_IR)) {
++                                    HENVCFG_ADUE);
-                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+     uint64_t valh = (uint64_t)val << 32;
-                 }
+     RISCVException ret;
-                 break;
 --
-.31.1
+.41.0

-[PULL 01/21] target/riscv: Update the ePMP CSR address
+[PULL v2 36/45] target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Update the ePMP CSRs to match the 0.9.3 ePMP spec
+In the same emulated RISC-V host, the 'host' KVM CPU takes 4 times
-https://github.com/riscv/riscv-tee/blob/61455747230a26002d741f64879dd78cc9689323/Smepmp/Smepmp.pdf
+longer to boot than the 'rv64' KVM CPU.
+The reason is an unintended behavior of riscv_cpu_satp_mode_finalize()
+when satp_mode.supported = 0, i.e. when cpu_init() does not set
+satp_mode_max_supported(). satp_mode_max_from_map(map) does:
+- __builtin_clz(map)
+This means that, if satp_mode.supported = 0, satp_mode_supported_max
+wil be '31 - 32'. But this is C, so satp_mode_supported_max will gladly
+set it to UINT_MAX (4294967295). After that, if the user didn't set a
+satp_mode, set_satp_mode_default_map(cpu) will make
+cfg.satp_mode.map = cfg.satp_mode.supported
+So satp_mode.map = 0. And then satp_mode_map_max will be set to
+satp_mode_max_from_map(cpu->cfg.satp_mode.map), i.e. also UINT_MAX. The
+guard "satp_mode_map_max > satp_mode_supported_max" doesn't protect us
+here since both are UINT_MAX.
+And finally we have 2 loops:
+        for (int i = satp_mode_map_max - 1; i >= 0; --i) {
+Which are, in fact, 2 loops from UINT_MAX -1 to -1. This is where the
+extra delay when booting the 'host' CPU is coming from.
+Commit 43d1de32f8 already set a precedence for satp_mode.supported = 0
+in a different manner. We're doing the same here. If supported == 0,
+interpret as 'the CPU wants the OS to handle satp mode alone' and skip
+satp_mode_finalize().
+We'll also put a guard in satp_mode_max_from_map() to assert out if map
+is 0 since the function is not ready to deal with it.
+Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
+Fixes: 6f23aaeb9b ("riscv: Allow user to set the satp mode")
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20230817152903.694926-1-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 28c908de60b9b04fa20e63d113885c98586053f3.1630543194.git.alistair.francis@wdc.com
 ---
- target/riscv/cpu_bits.h | 4 ++--
+ target/riscv/cpu.c | 23 ++++++++++++++++++++---
- target/riscv/cpu.c      | 1 +
+file changed, 20 insertions(+), 3 deletions(-)
 files changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_bits.h
-+++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@
- #define CSR_MTVAL2          0x34b
- /* Enhanced Physical Memory Protection (ePMP) */
--#define CSR_MSECCFG         0x390
--#define CSR_MSECCFGH        0x391
-+#define CSR_MSECCFG         0x747
-+#define CSR_MSECCFGH        0x757
- /* Physical Memory Protection */
- #define CSR_PMPCFG0         0x3a0
- #define CSR_PMPCFG1         0x3a1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static uint8_t satp_mode_from_str(const char *satp_mode_str)
-     DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
-     DEFINE_PROP_BOOL("mmu", RISCVCPU, cfg.mmu, true),
+ uint8_t satp_mode_max_from_map(uint32_t map)
-     DEFINE_PROP_BOOL("pmp", RISCVCPU, cfg.pmp, true),
+ {
-+    /* ePMP 0.9.3 */
++    /*
-     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
++     * 'map = 0' will make us return (31 - 32), which C will
++     * happily overflow to UINT_MAX. There's no good result to
-     DEFINE_PROP_UINT64("resetvec", RISCVCPU, cfg.resetvec, DEFAULT_RSTVEC),
++     * return if 'map = 0' (e.g. returning 0 will be ambiguous
 +     * with the result for 'map = 1').
 +     *
 +     * Assert out if map = 0. Callers will have to deal with
 +     * it outside of this function.
 +     */
 +    g_assert(map > 0);
 +
      /* map here has at least one bit set, so no problem with clz */
      return 31 - __builtin_clz(map);
  }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
  static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
  {
      bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
 -    uint8_t satp_mode_map_max;
 -    uint8_t satp_mode_supported_max =
 -                        satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
 +    uint8_t satp_mode_map_max, satp_mode_supported_max;
 +
 +    /* The CPU wants the OS to decide which satp mode to use */
 +    if (cpu->cfg.satp_mode.supported == 0) {
 +        return;
 +    }
 +
 +    satp_mode_supported_max =
 +                    satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
      if (cpu->cfg.satp_mode.map == 0) {
          if (cpu->cfg.satp_mode.init == 0) {
 --
-.31.1
+.41.0

-[PULL 21/21] hw/riscv: opentitan: Correct the USB Dev address
+[PULL v2 37/45] riscv: zicond: make non-experimental
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Vineet Gupta <vineetg@rivosinc.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+zicond is now codegen supported in both llvm and gcc.
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: d6cb4dfe75a2f536f217d7075b750ece3acb1535.1631767043.git.alistair.francis@wdc.com
+This change allows seamless enabling/testing of zicond in downstream
 projects. e.g. currently riscv-gnu-toolchain parses elf attributes
 to create a cmdline for qemu but fails short of enabling it because of
 the "x-" prefix.
 Signed-off-by: Vineet Gupta <vineetg@rivosinc.com>
 Message-ID: <20230808181715.436395-1-vineetg@rivosinc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/opentitan.c | 2 +-
+ target/riscv/cpu.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/opentitan.c
+--- a/target/riscv/cpu.c
-+++ b/hw/riscv/opentitan.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry ibex_memmap[] = {
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     [IBEX_DEV_TIMER] =          {  0x40100000,  0x1000  },
+     DEFINE_PROP_BOOL("zcf", RISCVCPU, cfg.ext_zcf, false),
-     [IBEX_DEV_SENSOR_CTRL] =    {  0x40110000,  0x1000  },
+     DEFINE_PROP_BOOL("zcmp", RISCVCPU, cfg.ext_zcmp, false),
-     [IBEX_DEV_OTP_CTRL] =       {  0x40130000,  0x4000  },
+     DEFINE_PROP_BOOL("zcmt", RISCVCPU, cfg.ext_zcmt, false),
-+    [IBEX_DEV_USBDEV] =         {  0x40150000,  0x1000  },
++    DEFINE_PROP_BOOL("zicond", RISCVCPU, cfg.ext_zicond, false),
-     [IBEX_DEV_PWRMGR] =         {  0x40400000,  0x1000  },
-     [IBEX_DEV_RSTMGR] =         {  0x40410000,  0x1000  },
+     /* Vendor-specific custom extensions */
-     [IBEX_DEV_CLKMGR] =         {  0x40420000,  0x1000  },
+     DEFINE_PROP_BOOL("xtheadba", RISCVCPU, cfg.ext_xtheadba, false),
-     [IBEX_DEV_PINMUX] =         {  0x40460000,  0x1000  },
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     [IBEX_DEV_PADCTRL] =        {  0x40470000,  0x1000  },
+     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
--    [IBEX_DEV_USBDEV] =         {  0x40500000,  0x1000  },
-     [IBEX_DEV_FLASH_CTRL] =     {  0x41000000,  0x1000  },
+     /* These are experimental so mark with 'x-' */
-     [IBEX_DEV_PLIC] =           {  0x41010000,  0x1000  },
+-    DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
-     [IBEX_DEV_AES] =            {  0x41100000,  0x1000  },
      /* ePMP 0.9.3 */
      DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
 --
-.31.1
+.41.0

-[PULL 12/21] hw/riscv: virt: Re-factor FDT generation
+[PULL v2 38/45] hw/riscv/virt.c: fix non-KVM --enable-debug build
-From: Anup Patel <anup.patel@wdc.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We re-factor and break the FDT generation into smaller functions
+A build with --enable-debug and without KVM will fail as follows:
 so that it is easier to modify FDT generation for different
 configurations of virt machine.
-Signed-off-by: Anup Patel <anup.patel@wdc.com>
+/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_riscv_virt.c.o: in function `virt_machine_init':
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+./qemu/build/../hw/riscv/virt.c:1465: undefined reference to `kvm_riscv_aia_create'
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 20210831110603.338681-4-anup.patel@wdc.com
+This happens because the code block with "if virt_use_kvm_aia(s)" isn't
 being ignored by the debug build, resulting in an undefined reference to
 a KVM only function.
 Add a 'kvm_enabled()' conditional together with virt_use_kvm_aia() will
 make the compiler crop the kvm_riscv_aia_create() call entirely from a
 non-KVM build. Note that adding the 'kvm_enabled()' conditional inside
 virt_use_kvm_aia() won't fix the build because this function would need
 to be inlined multiple times to make the compiler zero out the entire
 block.
 While we're at it, use kvm_enabled() in all instances where
 virt_use_kvm_aia() is checked to allow the compiler to elide these other
 kvm-only instances as well.
 Suggested-by: Richard Henderson <richard.henderson@linaro.org>
 Fixes: dbdb99948e ("target/riscv: select KVM AIA in riscv virt machine")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230830133503.711138-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 527 ++++++++++++++++++++++++++++++------------------
+ hw/riscv/virt.c | 6 +++---
-file changed, 327 insertions(+), 200 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_pcie_irq_map(void *fdt, char *nodename,
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 x1800, 0, 0, 0x7);
  }
 -static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
 -                       uint64_t mem_size, const char *cmdline, bool is_32_bit)
 +static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
 +                                   char *clust_name, uint32_t *phandle,
 +                                   bool is_32_bit, uint32_t *intc_phandles)
  {
 -    void *fdt;
 -    int i, cpu, socket;
 +    int cpu;
 +    uint32_t cpu_phandle;
      MachineState *mc = MACHINE(s);
 +    char *name, *cpu_name, *core_name, *intc_name;
 +
 +    for (cpu = s->soc[socket].num_harts - 1; cpu >= 0; cpu--) {
 +        cpu_phandle = (*phandle)++;
 +
 +        cpu_name = g_strdup_printf("/cpus/cpu@%d",
 +            s->soc[socket].hartid_base + cpu);
 +        qemu_fdt_add_subnode(mc->fdt, cpu_name);
 +        qemu_fdt_setprop_string(mc->fdt, cpu_name, "mmu-type",
 +            (is_32_bit) ? "riscv,sv32" : "riscv,sv48");
 +        name = riscv_isa_string(&s->soc[socket].harts[cpu]);
 +        qemu_fdt_setprop_string(mc->fdt, cpu_name, "riscv,isa", name);
 +        g_free(name);
 +        qemu_fdt_setprop_string(mc->fdt, cpu_name, "compatible", "riscv");
 +        qemu_fdt_setprop_string(mc->fdt, cpu_name, "status", "okay");
 +        qemu_fdt_setprop_cell(mc->fdt, cpu_name, "reg",
 +            s->soc[socket].hartid_base + cpu);
 +        qemu_fdt_setprop_string(mc->fdt, cpu_name, "device_type", "cpu");
 +        riscv_socket_fdt_write_id(mc, mc->fdt, cpu_name, socket);
 +        qemu_fdt_setprop_cell(mc->fdt, cpu_name, "phandle", cpu_phandle);
 +
 +        intc_phandles[cpu] = (*phandle)++;
 +
 +        intc_name = g_strdup_printf("%s/interrupt-controller", cpu_name);
 +        qemu_fdt_add_subnode(mc->fdt, intc_name);
 +        qemu_fdt_setprop_cell(mc->fdt, intc_name, "phandle",
 +            intc_phandles[cpu]);
 +        qemu_fdt_setprop_string(mc->fdt, intc_name, "compatible",
 +            "riscv,cpu-intc");
 +        qemu_fdt_setprop(mc->fdt, intc_name, "interrupt-controller", NULL, 0);
 +        qemu_fdt_setprop_cell(mc->fdt, intc_name, "#interrupt-cells", 1);
 +
 +        core_name = g_strdup_printf("%s/core%d", clust_name, cpu);
 +        qemu_fdt_add_subnode(mc->fdt, core_name);
 +        qemu_fdt_setprop_cell(mc->fdt, core_name, "cpu", cpu_phandle);
 +
 +        g_free(core_name);
 +        g_free(intc_name);
 +        g_free(cpu_name);
 +    }
 +}
 +
 +static void create_fdt_socket_memory(RISCVVirtState *s,
 +                                     const MemMapEntry *memmap, int socket)
 +{
 +    char *mem_name;
      uint64_t addr, size;
 -    uint32_t *clint_cells, *plic_cells;
 -    unsigned long clint_addr, plic_addr;
 -    uint32_t plic_phandle[MAX_NODES];
 -    uint32_t cpu_phandle, intc_phandle, test_phandle;
 -    uint32_t phandle = 1, plic_mmio_phandle = 1;
 -    uint32_t plic_pcie_phandle = 1, plic_virtio_phandle = 1;
 -    char *mem_name, *cpu_name, *core_name, *intc_name;
 -    char *name, *clint_name, *plic_name, *clust_name;
 -    hwaddr flashsize = virt_memmap[VIRT_FLASH].size / 2;
 -    hwaddr flashbase = virt_memmap[VIRT_FLASH].base;
 +    MachineState *mc = MACHINE(s);
 +
 +    addr = memmap[VIRT_DRAM].base + riscv_socket_mem_offset(mc, socket);
 +    size = riscv_socket_mem_size(mc, socket);
 +    mem_name = g_strdup_printf("/memory@%lx", (long)addr);
 +    qemu_fdt_add_subnode(mc->fdt, mem_name);
 +    qemu_fdt_setprop_cells(mc->fdt, mem_name, "reg",
 +        addr >> 32, addr, size >> 32, size);
 +    qemu_fdt_setprop_string(mc->fdt, mem_name, "device_type", "memory");
 +    riscv_socket_fdt_write_id(mc, mc->fdt, mem_name, socket);
 +    g_free(mem_name);
 +}
 +
 +static void create_fdt_socket_clint(RISCVVirtState *s,
 +                                    const MemMapEntry *memmap, int socket,
 +                                    uint32_t *intc_phandles)
 +{
 +    int cpu;
 +    char *clint_name;
 +    uint32_t *clint_cells;
 +    unsigned long clint_addr;
 +    MachineState *mc = MACHINE(s);
      static const char * const clint_compat[2] = {
          "sifive,clint0", "riscv,clint0"
      };
 +
 +    clint_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
 +
 +    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 +        clint_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
 +        clint_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_SOFT);
 +        clint_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
 +        clint_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_M_TIMER);
 +    }
 +
 +    clint_addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
 +    clint_name = g_strdup_printf("/soc/clint@%lx", clint_addr);
 +    qemu_fdt_add_subnode(mc->fdt, clint_name);
 +    qemu_fdt_setprop_string_array(mc->fdt, clint_name, "compatible",
 +                                  (char **)&clint_compat,
 +                                  ARRAY_SIZE(clint_compat));
 +    qemu_fdt_setprop_cells(mc->fdt, clint_name, "reg",
 +        0x0, clint_addr, 0x0, memmap[VIRT_CLINT].size);
 +    qemu_fdt_setprop(mc->fdt, clint_name, "interrupts-extended",
 +        clint_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
 +    riscv_socket_fdt_write_id(mc, mc->fdt, clint_name, socket);
 +    g_free(clint_name);
 +
 +    g_free(clint_cells);
 +}
 +
 +static void create_fdt_socket_plic(RISCVVirtState *s,
 +                                   const MemMapEntry *memmap, int socket,
 +                                   uint32_t *phandle, uint32_t *intc_phandles,
 +                                   uint32_t *plic_phandles)
 +{
 +    int cpu;
 +    char *plic_name;
 +    uint32_t *plic_cells;
 +    unsigned long plic_addr;
 +    MachineState *mc = MACHINE(s);
      static const char * const plic_compat[2] = {
          "sifive,plic-1.0.0", "riscv,plic0"
      };
 -    if (mc->dtb) {
 -        fdt = mc->fdt = load_device_tree(mc->dtb, &s->fdt_size);
 -        if (!fdt) {
 -            error_report("load_device_tree() failed");
 -            exit(1);
 -        }
 -        goto update_bootargs;
 -    } else {
 -        fdt = mc->fdt = create_device_tree(&s->fdt_size);
 -        if (!fdt) {
 -            error_report("create_device_tree() failed");
 -            exit(1);
 -        }
 +    plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
 +
 +    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 +        plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
 +        plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
 +        plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
 +        plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
      }
--    qemu_fdt_setprop_string(fdt, "/", "model", "riscv-virtio,qemu");
+     /* KVM AIA only has one APLIC instance */
--    qemu_fdt_setprop_string(fdt, "/", "compatible", "riscv-virtio");
+-    if (virt_use_kvm_aia(s)) {
--    qemu_fdt_setprop_cell(fdt, "/", "#size-cells", 0x2);
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
--    qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 0x2);
+         create_fdt_socket_aplic(s, memmap, 0,
-+    plic_phandles[socket] = (*phandle)++;
+                                 msi_m_phandle, msi_s_phandle, phandle,
-+    plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
+                                 &intc_phandles[0], xplic_phandles,
-+    plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-+    qemu_fdt_add_subnode(mc->fdt, plic_name);
-+    qemu_fdt_setprop_cell(mc->fdt, plic_name,
+     g_free(intc_phandles);
-+        "#address-cells", FDT_PLIC_ADDR_CELLS);
-+    qemu_fdt_setprop_cell(mc->fdt, plic_name,
+-    if (virt_use_kvm_aia(s)) {
-+        "#interrupt-cells", FDT_PLIC_INT_CELLS);
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-+    qemu_fdt_setprop_string_array(mc->fdt, plic_name, "compatible",
+         *irq_mmio_phandle = xplic_phandles[0];
-+                                  (char **)&plic_compat,
+         *irq_virtio_phandle = xplic_phandles[0];
-+                                  ARRAY_SIZE(plic_compat));
+         *irq_pcie_phandle = xplic_phandles[0];
-+    qemu_fdt_setprop(mc->fdt, plic_name, "interrupt-controller", NULL, 0);
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
 +    qemu_fdt_setprop(mc->fdt, plic_name, "interrupts-extended",
 +        plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
 +    qemu_fdt_setprop_cells(mc->fdt, plic_name, "reg",
 +        0x0, plic_addr, 0x0, memmap[VIRT_PLIC].size);
 +    qemu_fdt_setprop_cell(mc->fdt, plic_name, "riscv,ndev", VIRTIO_NDEV);
 +    riscv_socket_fdt_write_id(mc, mc->fdt, plic_name, socket);
 +    qemu_fdt_setprop_cell(mc->fdt, plic_name, "phandle",
 +        plic_phandles[socket]);
 +    g_free(plic_name);
 +
 +    g_free(plic_cells);
 +}
 -    qemu_fdt_add_subnode(fdt, "/soc");
 -    qemu_fdt_setprop(fdt, "/soc", "ranges", NULL, 0);
 -    qemu_fdt_setprop_string(fdt, "/soc", "compatible", "simple-bus");
 -    qemu_fdt_setprop_cell(fdt, "/soc", "#size-cells", 0x2);
 -    qemu_fdt_setprop_cell(fdt, "/soc", "#address-cells", 0x2);
 +static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 +                               bool is_32_bit, uint32_t *phandle,
 +                               uint32_t *irq_mmio_phandle,
 +                               uint32_t *irq_pcie_phandle,
 +                               uint32_t *irq_virtio_phandle)
 +{
 +    int socket;
 +    char *clust_name;
 +    uint32_t *intc_phandles;
 +    MachineState *mc = MACHINE(s);
 +    uint32_t xplic_phandles[MAX_NODES];
 -    qemu_fdt_add_subnode(fdt, "/cpus");
 -    qemu_fdt_setprop_cell(fdt, "/cpus", "timebase-frequency",
 +    qemu_fdt_add_subnode(mc->fdt, "/cpus");
 +    qemu_fdt_setprop_cell(mc->fdt, "/cpus", "timebase-frequency",
                            RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ);
 -    qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0x0);
 -    qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 0x1);
 -    qemu_fdt_add_subnode(fdt, "/cpus/cpu-map");
 +    qemu_fdt_setprop_cell(mc->fdt, "/cpus", "#size-cells", 0x0);
 +    qemu_fdt_setprop_cell(mc->fdt, "/cpus", "#address-cells", 0x1);
 +    qemu_fdt_add_subnode(mc->fdt, "/cpus/cpu-map");
      for (socket = (riscv_socket_count(mc) - 1); socket >= 0; socket--) {
          clust_name = g_strdup_printf("/cpus/cpu-map/cluster%d", socket);
 -        qemu_fdt_add_subnode(fdt, clust_name);
 -
 -        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
 -        clint_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
 -
 -        for (cpu = s->soc[socket].num_harts - 1; cpu >= 0; cpu--) {
 -            cpu_phandle = phandle++;
 -
 -            cpu_name = g_strdup_printf("/cpus/cpu@%d",
 -                s->soc[socket].hartid_base + cpu);
 -            qemu_fdt_add_subnode(fdt, cpu_name);
 -            if (is_32_bit) {
 -                qemu_fdt_setprop_string(fdt, cpu_name, "mmu-type", "riscv,sv32");
 -            } else {
 -                qemu_fdt_setprop_string(fdt, cpu_name, "mmu-type", "riscv,sv48");
 -            }
 -            name = riscv_isa_string(&s->soc[socket].harts[cpu]);
 -            qemu_fdt_setprop_string(fdt, cpu_name, "riscv,isa", name);
 -            g_free(name);
 -            qemu_fdt_setprop_string(fdt, cpu_name, "compatible", "riscv");
 -            qemu_fdt_setprop_string(fdt, cpu_name, "status", "okay");
 -            qemu_fdt_setprop_cell(fdt, cpu_name, "reg",
 -                s->soc[socket].hartid_base + cpu);
 -            qemu_fdt_setprop_string(fdt, cpu_name, "device_type", "cpu");
 -            riscv_socket_fdt_write_id(mc, fdt, cpu_name, socket);
 -            qemu_fdt_setprop_cell(fdt, cpu_name, "phandle", cpu_phandle);
 -
 -            intc_name = g_strdup_printf("%s/interrupt-controller", cpu_name);
 -            qemu_fdt_add_subnode(fdt, intc_name);
 -            intc_phandle = phandle++;
 -            qemu_fdt_setprop_cell(fdt, intc_name, "phandle", intc_phandle);
 -            qemu_fdt_setprop_string(fdt, intc_name, "compatible",
 -                "riscv,cpu-intc");
 -            qemu_fdt_setprop(fdt, intc_name, "interrupt-controller", NULL, 0);
 -            qemu_fdt_setprop_cell(fdt, intc_name, "#interrupt-cells", 1);
 -
 -            clint_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandle);
 -            clint_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_SOFT);
 -            clint_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandle);
 -            clint_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_M_TIMER);
 -
 -            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandle);
 -            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
 -            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandle);
 -            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
 -
 -            core_name = g_strdup_printf("%s/core%d", clust_name, cpu);
 -            qemu_fdt_add_subnode(fdt, core_name);
 -            qemu_fdt_setprop_cell(fdt, core_name, "cpu", cpu_phandle);
 -
 -            g_free(core_name);
 -            g_free(intc_name);
 -            g_free(cpu_name);
 -        }
 +        qemu_fdt_add_subnode(mc->fdt, clust_name);
 +
 +        intc_phandles = g_new0(uint32_t, s->soc[socket].num_harts);
 +
 +        create_fdt_socket_cpus(s, socket, clust_name, phandle,
 +            is_32_bit, intc_phandles);
 -        addr = memmap[VIRT_DRAM].base + riscv_socket_mem_offset(mc, socket);
 -        size = riscv_socket_mem_size(mc, socket);
 -        mem_name = g_strdup_printf("/memory@%lx", (long)addr);
 -        qemu_fdt_add_subnode(fdt, mem_name);
 -        qemu_fdt_setprop_cells(fdt, mem_name, "reg",
 -            addr >> 32, addr, size >> 32, size);
 -        qemu_fdt_setprop_string(fdt, mem_name, "device_type", "memory");
 -        riscv_socket_fdt_write_id(mc, fdt, mem_name, socket);
 -        g_free(mem_name);
 -
 -        clint_addr = memmap[VIRT_CLINT].base +
 -            (memmap[VIRT_CLINT].size * socket);
 -        clint_name = g_strdup_printf("/soc/clint@%lx", clint_addr);
 -        qemu_fdt_add_subnode(fdt, clint_name);
 -        qemu_fdt_setprop_string_array(fdt, clint_name, "compatible",
 -            (char **)&clint_compat, ARRAY_SIZE(clint_compat));
 -        qemu_fdt_setprop_cells(fdt, clint_name, "reg",
 -            0x0, clint_addr, 0x0, memmap[VIRT_CLINT].size);
 -        qemu_fdt_setprop(fdt, clint_name, "interrupts-extended",
 -            clint_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
 -        riscv_socket_fdt_write_id(mc, fdt, clint_name, socket);
 -        g_free(clint_name);
 -
 -        plic_phandle[socket] = phandle++;
 -        plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
 -        plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
 -        qemu_fdt_add_subnode(fdt, plic_name);
 -        qemu_fdt_setprop_cell(fdt, plic_name,
 -            "#address-cells", FDT_PLIC_ADDR_CELLS);
 -        qemu_fdt_setprop_cell(fdt, plic_name,
 -            "#interrupt-cells", FDT_PLIC_INT_CELLS);
 -        qemu_fdt_setprop_string_array(fdt, plic_name, "compatible",
 -            (char **)&plic_compat, ARRAY_SIZE(plic_compat));
 -        qemu_fdt_setprop(fdt, plic_name, "interrupt-controller", NULL, 0);
 -        qemu_fdt_setprop(fdt, plic_name, "interrupts-extended",
 -            plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
 -        qemu_fdt_setprop_cells(fdt, plic_name, "reg",
 -            0x0, plic_addr, 0x0, memmap[VIRT_PLIC].size);
 -        qemu_fdt_setprop_cell(fdt, plic_name, "riscv,ndev", VIRTIO_NDEV);
 -        riscv_socket_fdt_write_id(mc, fdt, plic_name, socket);
 -        qemu_fdt_setprop_cell(fdt, plic_name, "phandle", plic_phandle[socket]);
 -        g_free(plic_name);
 -
 -        g_free(clint_cells);
 -        g_free(plic_cells);
 +        create_fdt_socket_memory(s, memmap, socket);
 +
 +        create_fdt_socket_clint(s, memmap, socket, intc_phandles);
 +
 +        create_fdt_socket_plic(s, memmap, socket, phandle,
 +            intc_phandles, xplic_phandles);
 +
 +        g_free(intc_phandles);
          g_free(clust_name);
      }
      for (socket = 0; socket < riscv_socket_count(mc); socket++) {
          if (socket == 0) {
 -            plic_mmio_phandle = plic_phandle[socket];
 -            plic_virtio_phandle = plic_phandle[socket];
 -            plic_pcie_phandle = plic_phandle[socket];
 +            *irq_mmio_phandle = xplic_phandles[socket];
 +            *irq_virtio_phandle = xplic_phandles[socket];
 +            *irq_pcie_phandle = xplic_phandles[socket];
          }
          if (socket == 1) {
 -            plic_virtio_phandle = plic_phandle[socket];
 -            plic_pcie_phandle = plic_phandle[socket];
 +            *irq_virtio_phandle = xplic_phandles[socket];
 +            *irq_pcie_phandle = xplic_phandles[socket];
          }
          if (socket == 2) {
 -            plic_pcie_phandle = plic_phandle[socket];
 +            *irq_pcie_phandle = xplic_phandles[socket];
          }
      }
--    riscv_socket_fdt_write_distance_matrix(mc, fdt);
+-    if (virt_use_kvm_aia(s)) {
-+    riscv_socket_fdt_write_distance_matrix(mc, mc->fdt);
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-+}
+         kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
-+
+                              VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
-+static void create_fdt_virtio(RISCVVirtState *s, const MemMapEntry *memmap,
+                              memmap[VIRT_APLIC_S].base,
 +                              uint32_t irq_virtio_phandle)
 +{
 +    int i;
 +    char *name;
 +    MachineState *mc = MACHINE(s);
      for (i = 0; i < VIRTIO_COUNT; i++) {
          name = g_strdup_printf("/soc/virtio_mmio@%lx",
              (long)(memmap[VIRT_VIRTIO].base + i * memmap[VIRT_VIRTIO].size));
 -        qemu_fdt_add_subnode(fdt, name);
 -        qemu_fdt_setprop_string(fdt, name, "compatible", "virtio,mmio");
 -        qemu_fdt_setprop_cells(fdt, name, "reg",
 +        qemu_fdt_add_subnode(mc->fdt, name);
 +        qemu_fdt_setprop_string(mc->fdt, name, "compatible", "virtio,mmio");
 +        qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 x0, memmap[VIRT_VIRTIO].base + i * memmap[VIRT_VIRTIO].size,
 x0, memmap[VIRT_VIRTIO].size);
 -        qemu_fdt_setprop_cell(fdt, name, "interrupt-parent",
 -            plic_virtio_phandle);
 -        qemu_fdt_setprop_cell(fdt, name, "interrupts", VIRTIO_IRQ + i);
 +        qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent",
 +            irq_virtio_phandle);
 +        qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", VIRTIO_IRQ + i);
          g_free(name);
      }
 +}
 +
 +static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
 +                            uint32_t irq_pcie_phandle)
 +{
 +    char *name;
 +    MachineState *mc = MACHINE(s);
      name = g_strdup_printf("/soc/pci@%lx",
          (long) memmap[VIRT_PCIE_ECAM].base);
 -    qemu_fdt_add_subnode(fdt, name);
 -    qemu_fdt_setprop_cell(fdt, name, "#address-cells", FDT_PCI_ADDR_CELLS);
 -    qemu_fdt_setprop_cell(fdt, name, "#interrupt-cells", FDT_PCI_INT_CELLS);
 -    qemu_fdt_setprop_cell(fdt, name, "#size-cells", 0x2);
 -    qemu_fdt_setprop_string(fdt, name, "compatible", "pci-host-ecam-generic");
 -    qemu_fdt_setprop_string(fdt, name, "device_type", "pci");
 -    qemu_fdt_setprop_cell(fdt, name, "linux,pci-domain", 0);
 -    qemu_fdt_setprop_cells(fdt, name, "bus-range", 0,
 +    qemu_fdt_add_subnode(mc->fdt, name);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "#address-cells",
 +        FDT_PCI_ADDR_CELLS);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells",
 +        FDT_PCI_INT_CELLS);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "#size-cells", 0x2);
 +    qemu_fdt_setprop_string(mc->fdt, name, "compatible",
 +        "pci-host-ecam-generic");
 +    qemu_fdt_setprop_string(mc->fdt, name, "device_type", "pci");
 +    qemu_fdt_setprop_cell(mc->fdt, name, "linux,pci-domain", 0);
 +    qemu_fdt_setprop_cells(mc->fdt, name, "bus-range", 0,
          memmap[VIRT_PCIE_ECAM].size / PCIE_MMCFG_SIZE_MIN - 1);
 -    qemu_fdt_setprop(fdt, name, "dma-coherent", NULL, 0);
 -    qemu_fdt_setprop_cells(fdt, name, "reg", 0,
 +    qemu_fdt_setprop(mc->fdt, name, "dma-coherent", NULL, 0);
 +    qemu_fdt_setprop_cells(mc->fdt, name, "reg", 0,
          memmap[VIRT_PCIE_ECAM].base, 0, memmap[VIRT_PCIE_ECAM].size);
 -    qemu_fdt_setprop_sized_cells(fdt, name, "ranges",
 +    qemu_fdt_setprop_sized_cells(mc->fdt, name, "ranges",
 , FDT_PCI_RANGE_IOPORT, 2, 0,
 , memmap[VIRT_PCIE_PIO].base, 2, memmap[VIRT_PCIE_PIO].size,
 , FDT_PCI_RANGE_MMIO,
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
 , virt_high_pcie_memmap.base,
 , virt_high_pcie_memmap.base, 2, virt_high_pcie_memmap.size);
 -    create_pcie_irq_map(fdt, name, plic_pcie_phandle);
 +    create_pcie_irq_map(mc->fdt, name, irq_pcie_phandle);
      g_free(name);
 +}
 -    test_phandle = phandle++;
 +static void create_fdt_reset(RISCVVirtState *s, const MemMapEntry *memmap,
 +                             uint32_t *phandle)
 +{
 +    char *name;
 +    uint32_t test_phandle;
 +    MachineState *mc = MACHINE(s);
 +
 +    test_phandle = (*phandle)++;
      name = g_strdup_printf("/soc/test@%lx",
          (long)memmap[VIRT_TEST].base);
 -    qemu_fdt_add_subnode(fdt, name);
 +    qemu_fdt_add_subnode(mc->fdt, name);
      {
          static const char * const compat[3] = {
              "sifive,test1", "sifive,test0", "syscon"
          };
 -        qemu_fdt_setprop_string_array(fdt, name, "compatible", (char **)&compat,
 -                                      ARRAY_SIZE(compat));
 +        qemu_fdt_setprop_string_array(mc->fdt, name, "compatible",
 +                                      (char **)&compat, ARRAY_SIZE(compat));
      }
 -    qemu_fdt_setprop_cells(fdt, name, "reg",
 -        0x0, memmap[VIRT_TEST].base,
 -        0x0, memmap[VIRT_TEST].size);
 -    qemu_fdt_setprop_cell(fdt, name, "phandle", test_phandle);
 -    test_phandle = qemu_fdt_get_phandle(fdt, name);
 +    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 +        0x0, memmap[VIRT_TEST].base, 0x0, memmap[VIRT_TEST].size);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "phandle", test_phandle);
 +    test_phandle = qemu_fdt_get_phandle(mc->fdt, name);
      g_free(name);
      name = g_strdup_printf("/soc/reboot");
 -    qemu_fdt_add_subnode(fdt, name);
 -    qemu_fdt_setprop_string(fdt, name, "compatible", "syscon-reboot");
 -    qemu_fdt_setprop_cell(fdt, name, "regmap", test_phandle);
 -    qemu_fdt_setprop_cell(fdt, name, "offset", 0x0);
 -    qemu_fdt_setprop_cell(fdt, name, "value", FINISHER_RESET);
 +    qemu_fdt_add_subnode(mc->fdt, name);
 +    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "syscon-reboot");
 +    qemu_fdt_setprop_cell(mc->fdt, name, "regmap", test_phandle);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "offset", 0x0);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "value", FINISHER_RESET);
      g_free(name);
      name = g_strdup_printf("/soc/poweroff");
 -    qemu_fdt_add_subnode(fdt, name);
 -    qemu_fdt_setprop_string(fdt, name, "compatible", "syscon-poweroff");
 -    qemu_fdt_setprop_cell(fdt, name, "regmap", test_phandle);
 -    qemu_fdt_setprop_cell(fdt, name, "offset", 0x0);
 -    qemu_fdt_setprop_cell(fdt, name, "value", FINISHER_PASS);
 +    qemu_fdt_add_subnode(mc->fdt, name);
 +    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "syscon-poweroff");
 +    qemu_fdt_setprop_cell(mc->fdt, name, "regmap", test_phandle);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "offset", 0x0);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "value", FINISHER_PASS);
      g_free(name);
 +}
 +
 +static void create_fdt_uart(RISCVVirtState *s, const MemMapEntry *memmap,
 +                            uint32_t irq_mmio_phandle)
 +{
 +    char *name;
 +    MachineState *mc = MACHINE(s);
      name = g_strdup_printf("/soc/uart@%lx", (long)memmap[VIRT_UART0].base);
 -    qemu_fdt_add_subnode(fdt, name);
 -    qemu_fdt_setprop_string(fdt, name, "compatible", "ns16550a");
 -    qemu_fdt_setprop_cells(fdt, name, "reg",
 +    qemu_fdt_add_subnode(mc->fdt, name);
 +    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "ns16550a");
 +    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 x0, memmap[VIRT_UART0].base,
 x0, memmap[VIRT_UART0].size);
 -    qemu_fdt_setprop_cell(fdt, name, "clock-frequency", 3686400);
 -    qemu_fdt_setprop_cell(fdt, name, "interrupt-parent", plic_mmio_phandle);
 -    qemu_fdt_setprop_cell(fdt, name, "interrupts", UART0_IRQ);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "clock-frequency", 3686400);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent", irq_mmio_phandle);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", UART0_IRQ);
 -    qemu_fdt_add_subnode(fdt, "/chosen");
 -    qemu_fdt_setprop_string(fdt, "/chosen", "stdout-path", name);
 +    qemu_fdt_add_subnode(mc->fdt, "/chosen");
 +    qemu_fdt_setprop_string(mc->fdt, "/chosen", "stdout-path", name);
      g_free(name);
 +}
 +
 +static void create_fdt_rtc(RISCVVirtState *s, const MemMapEntry *memmap,
 +                           uint32_t irq_mmio_phandle)
 +{
 +    char *name;
 +    MachineState *mc = MACHINE(s);
      name = g_strdup_printf("/soc/rtc@%lx", (long)memmap[VIRT_RTC].base);
 -    qemu_fdt_add_subnode(fdt, name);
 -    qemu_fdt_setprop_string(fdt, name, "compatible", "google,goldfish-rtc");
 -    qemu_fdt_setprop_cells(fdt, name, "reg",
 -        0x0, memmap[VIRT_RTC].base,
 -        0x0, memmap[VIRT_RTC].size);
 -    qemu_fdt_setprop_cell(fdt, name, "interrupt-parent", plic_mmio_phandle);
 -    qemu_fdt_setprop_cell(fdt, name, "interrupts", RTC_IRQ);
 +    qemu_fdt_add_subnode(mc->fdt, name);
 +    qemu_fdt_setprop_string(mc->fdt, name, "compatible",
 +        "google,goldfish-rtc");
 +    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 +        0x0, memmap[VIRT_RTC].base, 0x0, memmap[VIRT_RTC].size);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent",
 +        irq_mmio_phandle);
 +    qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", RTC_IRQ);
      g_free(name);
 +}
 +
 +static void create_fdt_flash(RISCVVirtState *s, const MemMapEntry *memmap)
 +{
 +    char *name;
 +    MachineState *mc = MACHINE(s);
 +    hwaddr flashsize = virt_memmap[VIRT_FLASH].size / 2;
 +    hwaddr flashbase = virt_memmap[VIRT_FLASH].base;
      name = g_strdup_printf("/flash@%" PRIx64, flashbase);
      qemu_fdt_add_subnode(mc->fdt, name);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
 , flashbase + flashsize, 2, flashsize);
      qemu_fdt_setprop_cell(mc->fdt, name, "bank-width", 4);
      g_free(name);
 +}
 +
 +static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
 +                       uint64_t mem_size, const char *cmdline, bool is_32_bit)
 +{
 +    MachineState *mc = MACHINE(s);
 +    uint32_t phandle = 1, irq_mmio_phandle = 1;
 +    uint32_t irq_pcie_phandle = 1, irq_virtio_phandle = 1;
 +
 +    if (mc->dtb) {
 +        mc->fdt = load_device_tree(mc->dtb, &s->fdt_size);
 +        if (!mc->fdt) {
 +            error_report("load_device_tree() failed");
 +            exit(1);
 +        }
 +        goto update_bootargs;
 +    } else {
 +        mc->fdt = create_device_tree(&s->fdt_size);
 +        if (!mc->fdt) {
 +            error_report("create_device_tree() failed");
 +            exit(1);
 +        }
 +    }
 +
 +    qemu_fdt_setprop_string(mc->fdt, "/", "model", "riscv-virtio,qemu");
 +    qemu_fdt_setprop_string(mc->fdt, "/", "compatible", "riscv-virtio");
 +    qemu_fdt_setprop_cell(mc->fdt, "/", "#size-cells", 0x2);
 +    qemu_fdt_setprop_cell(mc->fdt, "/", "#address-cells", 0x2);
 +
 +    qemu_fdt_add_subnode(mc->fdt, "/soc");
 +    qemu_fdt_setprop(mc->fdt, "/soc", "ranges", NULL, 0);
 +    qemu_fdt_setprop_string(mc->fdt, "/soc", "compatible", "simple-bus");
 +    qemu_fdt_setprop_cell(mc->fdt, "/soc", "#size-cells", 0x2);
 +    qemu_fdt_setprop_cell(mc->fdt, "/soc", "#address-cells", 0x2);
 +
 +    create_fdt_sockets(s, memmap, is_32_bit, &phandle,
 +        &irq_mmio_phandle, &irq_pcie_phandle, &irq_virtio_phandle);
 +
 +    create_fdt_virtio(s, memmap, irq_virtio_phandle);
 +
 +    create_fdt_pcie(s, memmap, irq_pcie_phandle);
 +
 +    create_fdt_reset(s, memmap, &phandle);
 +
 +    create_fdt_uart(s, memmap, irq_mmio_phandle);
 +
 +    create_fdt_rtc(s, memmap, irq_mmio_phandle);
 +
 +    create_fdt_flash(s, memmap);
  update_bootargs:
      if (cmdline) {
 -        qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", cmdline);
 +        qemu_fdt_setprop_string(mc->fdt, "/chosen", "bootargs", cmdline);
      }
  }
 --
-.31.1
+.41.0

-[PULL 07/21] hw/intc: ibex_timer: Convert the timer to use RISC-V CPU GPIO lines
+[PULL v2 39/45] hw/intc/riscv_aplic.c fix non-KVM --enable-debug build
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Instead of using riscv_cpu_update_mip() let's instead use the new RISC-V
+Commit 6df0b37e2ab breaks a --enable-debug build in a non-KVM
-CPU GPIO lines to set the timer MIP bits.
+environment with the following error:
+/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_intc_riscv_aplic.c.o: in function `riscv_kvm_aplic_request':
+./qemu/build/../hw/intc/riscv_aplic.c:486: undefined reference to `kvm_set_irq'
+collect2: error: ld returned 1 exit status
+This happens because the debug build will poke into the
+'if (is_kvm_aia(aplic->msimode))' block and fail to find a reference to
+the KVM only function riscv_kvm_aplic_request().
+There are multiple solutions to fix this. We'll go with the same
+solution from the previous patch, i.e. add a kvm_enabled() conditional
+to filter out the block. But there's a catch: riscv_kvm_aplic_request()
+is a local function that would end up being used if the compiler crops
+the block, and this won't work. Quoting Richard Henderson's explanation
+in [1]:
+"(...) the compiler won't eliminate entire unused functions with -O0"
+We'll solve it by moving riscv_kvm_aplic_request() to kvm.c and add its
+declaration in kvm_riscv.h, where all other KVM specific public
+functions are already declared. Other archs handles KVM specific code in
+this manner and we expect to do the same from now on.
+[1] https://lore.kernel.org/qemu-riscv/d2f1ad02-eb03-138f-9d08-db676deeed05@linaro.org/
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20230830133503.711138-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 84d5b1d5783d2e79eee69a2f7ac480cc0c070db3.1630301632.git.alistair.francis@wdc.com
 ---
- include/hw/timer/ibex_timer.h |  2 ++
+ target/riscv/kvm_riscv.h | 1 +
- hw/riscv/opentitan.c          |  3 +++
+ hw/intc/riscv_aplic.c    | 8 ++------
- hw/timer/ibex_timer.c         | 17 ++++++++++++-----
+ target/riscv/kvm.c       | 5 +++++
-files changed, 17 insertions(+), 5 deletions(-)
+files changed, 8 insertions(+), 6 deletions(-)
-diff --git a/include/hw/timer/ibex_timer.h b/include/hw/timer/ibex_timer.h
+diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/timer/ibex_timer.h
+--- a/target/riscv/kvm_riscv.h
-+++ b/include/hw/timer/ibex_timer.h
++++ b/target/riscv/kvm_riscv.h
-@@ -XXX,XX +XXX,XX @@ struct IbexTimerState {
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
-     uint32_t timebase_freq;
+                           uint64_t aia_irq_num, uint64_t aia_msi_num,
+                           uint64_t aplic_base, uint64_t imsic_base,
-     qemu_irq irq;
+                           uint64_t guest_num);
-+
++void riscv_kvm_aplic_request(void *opaque, int irq, int level);
-+    qemu_irq m_timer_irq;
- };
+ #endif
- #endif /* HW_IBEX_TIMER_H */
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/opentitan.c
+--- a/hw/intc/riscv_aplic.c
-+++ b/hw/riscv/opentitan.c
++++ b/hw/intc/riscv_aplic.c
-@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
+@@ -XXX,XX +XXX,XX @@
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer),
+ #include "target/riscv/cpu.h"
-, qdev_get_gpio_in(DEVICE(&s->plic),
+ #include "sysemu/sysemu.h"
-                        IBEX_TIMER_TIMEREXPIRED0_0));
+ #include "sysemu/kvm.h"
-+    qdev_connect_gpio_out(DEVICE(&s->timer), 0,
++#include "kvm_riscv.h"
-+                          qdev_get_gpio_in(DEVICE(qemu_get_cpu(0)),
+ #include "migration/vmstate.h"
-+                                           IRQ_M_TIMER));
+ #define APLIC_MAX_IDC                  (1UL << 14)
-     create_unimplemented_device("riscv.lowrisc.ibex.gpio",
+@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
-         memmap[IBEX_DEV_GPIO].base, memmap[IBEX_DEV_GPIO].size);
+     return topi;
-diff --git a/hw/timer/ibex_timer.c b/hw/timer/ibex_timer.c
+ }
 -static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 -{
 -    kvm_set_irq(kvm_state, irq, !!level);
 -}
 -
  static void riscv_aplic_request(void *opaque, int irq, int level)
  {
      bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
       * have IRQ lines delegated by their parent APLIC.
       */
      if (!aplic->parent) {
 -        if (is_kvm_aia(aplic->msimode)) {
 +        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
              qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
          } else {
              qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/ibex_timer.c
+--- a/target/riscv/kvm.c
-+++ b/hw/timer/ibex_timer.c
++++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
+@@ -XXX,XX +XXX,XX @@
-         /*
+ #include "sysemu/runstate.h"
-          * If the mtimecmp was in the past raise the interrupt now.
+ #include "hw/riscv/numa.h"
-          */
--        riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(1));
++void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 +        qemu_irq_raise(s->m_timer_irq);
          if (s->timer_intr_enable & R_INTR_ENABLE_IE_0_MASK) {
              s->timer_intr_state |= R_INTR_STATE_IS_0_MASK;
              qemu_set_irq(s->irq, true);
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
      }
      /* Setup a timer to trigger the interrupt in the future */
 -    riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(0));
 +    qemu_irq_lower(s->m_timer_irq);
      qemu_set_irq(s->irq, false);
      diff = cpu->env.timecmp - now;
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
  static void ibex_timer_cb(void *opaque)
  {
      IbexTimerState *s = opaque;
 -    CPUState *cs = qemu_get_cpu(0);
 -    RISCVCPU *cpu = RISCV_CPU(cs);
 -    riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(1));
 +    qemu_irq_raise(s->m_timer_irq);
      if (s->timer_intr_enable & R_INTR_ENABLE_IE_0_MASK) {
          s->timer_intr_state |= R_INTR_STATE_IS_0_MASK;
          qemu_set_irq(s->irq, true);
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_init(Object *obj)
      sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
  }
 +static void ibex_timer_realize(DeviceState *dev, Error **errp)
 +{
-+    IbexTimerState *s = IBEX_TIMER(dev);
++    kvm_set_irq(kvm_state, irq, !!level);
 +
 +    qdev_init_gpio_out(dev, &s->m_timer_irq, 1);
 +}
 +
-+
+ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
- static void ibex_timer_class_init(ObjectClass *klass, void *data)
+                                  uint64_t idx)
  {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-     dc->reset = ibex_timer_reset;
-     dc->vmsd = &vmstate_ibex_timer;
-+    dc->realize = ibex_timer_realize;
-     device_class_set_props(dc, ibex_timer_properties);
- }
 --
-.31.1
+.41.0

-New patch
+[PULL v2 40/45] linux-user/riscv: Add new extensions to hwprobe
+From: Robbin Ehn <rehn@rivosinc.com>
+This patch adds the new extensions in
+linux 6.5 to the hwprobe syscall.
+And fixes RVC check to OR with correct value.
+The previous variable contains 0 therefore it
+did work.
+Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
+Acked-by: Richard Henderson <richard.henderson@linaro.org>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <bc82203b72d7efb30f1b4a8f9eb3d94699799dc8.camel@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ linux-user/syscall.c | 14 +++++++++++++-
+file changed, 13 insertions(+), 1 deletion(-)
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/syscall.c
++++ b/linux-user/syscall.c
+@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
+ #define RISCV_HWPROBE_KEY_IMA_EXT_0     4
+ #define     RISCV_HWPROBE_IMA_FD       (1 << 0)
+ #define     RISCV_HWPROBE_IMA_C        (1 << 1)
++#define     RISCV_HWPROBE_IMA_V        (1 << 2)
++#define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
++#define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
++#define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
+ #define RISCV_HWPROBE_KEY_CPUPERF_0     5
+ #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
+@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
+                     riscv_has_ext(env, RVD) ?
+                     RISCV_HWPROBE_IMA_FD : 0;
+             value |= riscv_has_ext(env, RVC) ?
+-                     RISCV_HWPROBE_IMA_C : pair->value;
++                     RISCV_HWPROBE_IMA_C : 0;
++            value |= riscv_has_ext(env, RVV) ?
++                     RISCV_HWPROBE_IMA_V : 0;
++            value |= cfg->ext_zba ?
++                     RISCV_HWPROBE_EXT_ZBA : 0;
++            value |= cfg->ext_zbb ?
++                     RISCV_HWPROBE_EXT_ZBB : 0;
++            value |= cfg->ext_zbs ?
++                     RISCV_HWPROBE_EXT_ZBS : 0;
+             __put_user(value, &pair->value);
+             break;
+         case RISCV_HWPROBE_KEY_CPUPERF_0:
+--
+.41.0

-[PULL 04/21] hw/intc: sifive_clint: Use RISC-V CPU GPIO lines
+[PULL v2 41/45] target/riscv: Use accelerated helper for AES64KS1I
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Ard Biesheuvel <ardb@kernel.org>
-Instead of using riscv_cpu_update_mip() let's instead use the new RISC-V
+Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
-CPU GPIO lines to set the timer and soft MIP bits.
+implement the first half of the key schedule derivation. This does not
 actually involve shifting rows, so clone the same value into all four
 columns of the AES vector to counter that operation.
+Cc: Richard Henderson <richard.henderson@linaro.org>
+Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Cc: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20230831154118.138727-1-ardb@kernel.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Tested-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Message-id: 946e1ef5e268b24084c7ddad84c146de62a56736.1630301632.git.alistair.francis@wdc.com
 ---
- include/hw/intc/sifive_clint.h |  2 +
+ target/riscv/crypto_helper.c | 17 +++++------------
- hw/intc/sifive_clint.c         | 68 ++++++++++++++++++++++++----------
+file changed, 5 insertions(+), 12 deletions(-)
 files changed, 50 insertions(+), 20 deletions(-)
-diff --git a/include/hw/intc/sifive_clint.h b/include/hw/intc/sifive_clint.h
+diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/sifive_clint.h
+--- a/target/riscv/crypto_helper.c
-+++ b/include/hw/intc/sifive_clint.h
++++ b/target/riscv/crypto_helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveCLINTState {
+@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
-     uint32_t time_base;
-     uint32_t aperture_size;
+     uint8_t enc_rnum = rnum;
-     uint32_t timebase_freq;
+     uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
-+    qemu_irq *timer_irqs;
+-    uint8_t rcon_ = 0;
-+    qemu_irq *soft_irqs;
+-    target_ulong result;
- } SiFiveCLINTState;
++    AESState t, rc = {};
- DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
+     if (enc_rnum != 0xA) {
-diff --git a/hw/intc/sifive_clint.c b/hw/intc/sifive_clint.c
+         temp = ror32(temp, 8); /* Rotate right by 8 */
-index XXXXXXX..XXXXXXX 100644
+-        rcon_ = round_consts[enc_rnum];
---- a/hw/intc/sifive_clint.c
++        rc.w[0] = rc.w[1] = round_consts[enc_rnum];
 +++ b/hw/intc/sifive_clint.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/qdev-properties.h"
  #include "hw/intc/sifive_clint.h"
  #include "qemu/timer.h"
 +#include "hw/irq.h"
 +
 +typedef struct sifive_clint_callback {
 +    SiFiveCLINTState *s;
 +    int num;
 +} sifive_clint_callback;
  static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
  {
@@ -XXX,XX +XXX,XX @@ static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
   * Called when timecmp is written to update the QEMU timer or immediately
   * trigger timer interrupt if mtimecmp <= current timer value.
   */
 -static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
 +static void sifive_clint_write_timecmp(SiFiveCLINTState *s, RISCVCPU *cpu,
 +                                       int hartid,
 +                                       uint64_t value,
                                         uint32_t timebase_freq)
  {
      uint64_t next;
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
      if (cpu->env.timecmp <= rtc_r) {
          /* if we're setting an MTIMECMP value in the "past",
             immediately raise the timer interrupt */
 -        riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(1));
 +        qemu_irq_raise(s->timer_irqs[hartid - s->hartid_base]);
          return;
      }
-     /* otherwise, set up the future timer interrupt */
+-    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
--    riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(0));
+-           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
-+    qemu_irq_lower(s->timer_irqs[hartid - s->hartid_base]);
+-           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
-     diff = cpu->env.timecmp - rtc_r;
+-           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
-     /* back to ns (note args switched in muldiv64) */
++    t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
-     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
++    aesenc_SB_SR_AK(&t, &t, &rc, false);
-@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
-  */
+-    temp ^= rcon_;
- static void sifive_clint_timer_cb(void *opaque)
+-
- {
+-    result = ((uint64_t)temp << 32) | temp;
--    RISCVCPU *cpu = opaque;
+-
--    riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(1));
+-    return result;
-+    sifive_clint_callback *state = opaque;
++    return t.d[0];
 +
 +    qemu_irq_raise(state->s->timer_irqs[state->num]);
  }
- /* CPU wants to read rtc or timecmp register */
+ target_ulong HELPER(aes64im)(target_ulong rs1)
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write(void *opaque, hwaddr addr, uint64_t value,
          if (!env) {
              error_report("clint: invalid timecmp hartid: %zu", hartid);
          } else if ((addr & 0x3) == 0) {
 -            riscv_cpu_update_mip(RISCV_CPU(cpu), MIP_MSIP, BOOL_TO_MASK(value));
 +            qemu_set_irq(clint->soft_irqs[hartid - clint->hartid_base], value);
          } else {
              error_report("clint: invalid sip write: %08x", (uint32_t)addr);
          }
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write(void *opaque, hwaddr addr, uint64_t value,
          } else if ((addr & 0x7) == 0) {
              /* timecmp_lo */
              uint64_t timecmp_hi = env->timecmp >> 32;
 -            sifive_clint_write_timecmp(RISCV_CPU(cpu),
 +            sifive_clint_write_timecmp(clint, RISCV_CPU(cpu), hartid,
                  timecmp_hi << 32 | (value & 0xFFFFFFFF), clint->timebase_freq);
              return;
          } else if ((addr & 0x7) == 4) {
              /* timecmp_hi */
              uint64_t timecmp_lo = env->timecmp;
 -            sifive_clint_write_timecmp(RISCV_CPU(cpu),
 +            sifive_clint_write_timecmp(clint, RISCV_CPU(cpu), hartid,
                  value << 32 | (timecmp_lo & 0xFFFFFFFF), clint->timebase_freq);
          } else {
              error_report("clint: invalid timecmp write: %08x", (uint32_t)addr);
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_realize(DeviceState *dev, Error **errp)
      memory_region_init_io(&s->mmio, OBJECT(dev), &sifive_clint_ops, s,
                            TYPE_SIFIVE_CLINT, s->aperture_size);
      sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
 +
 +    s->timer_irqs = g_malloc(sizeof(qemu_irq) * s->num_harts);
 +    qdev_init_gpio_out(dev, s->timer_irqs, s->num_harts);
 +
 +    s->soft_irqs = g_malloc(sizeof(qemu_irq) * s->num_harts);
 +    qdev_init_gpio_out(dev, s->soft_irqs, s->num_harts);
  }
  static void sifive_clint_class_init(ObjectClass *klass, void *data)
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_register_types(void)
  type_init(sifive_clint_register_types)
 -
  /*
   * Create CLINT device.
   */
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
      bool provide_rdtime)
  {
      int i;
 +
 +    DeviceState *dev = qdev_new(TYPE_SIFIVE_CLINT);
 +    qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
 +    qdev_prop_set_uint32(dev, "num-harts", num_harts);
 +    qdev_prop_set_uint32(dev, "sip-base", sip_base);
 +    qdev_prop_set_uint32(dev, "timecmp-base", timecmp_base);
 +    qdev_prop_set_uint32(dev, "time-base", time_base);
 +    qdev_prop_set_uint32(dev, "aperture-size", size);
 +    qdev_prop_set_uint32(dev, "timebase-freq", timebase_freq);
 +    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +
      for (i = 0; i < num_harts; i++) {
          CPUState *cpu = qemu_get_cpu(hartid_base + i);
 +        RISCVCPU *rvcpu = RISCV_CPU(cpu);
          CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 +        sifive_clint_callback *cb = g_malloc0(sizeof(sifive_clint_callback));
 +
          if (!env) {
 +            g_free(cb);
              continue;
          }
          if (provide_rdtime) {
              riscv_cpu_set_rdtime_fn(env, cpu_riscv_read_rtc, timebase_freq);
          }
 +
 +        cb->s = SIFIVE_CLINT(dev);
 +        cb->num = i;
          env->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 -                                  &sifive_clint_timer_cb, cpu);
 +                                  &sifive_clint_timer_cb, cb);
          env->timecmp = 0;
 +
 +        qdev_connect_gpio_out(dev, i,
 +                              qdev_get_gpio_in(DEVICE(rvcpu), IRQ_M_TIMER));
 +        qdev_connect_gpio_out(dev, num_harts + i,
 +                              qdev_get_gpio_in(DEVICE(rvcpu), IRQ_M_SOFT));
      }
 -    DeviceState *dev = qdev_new(TYPE_SIFIVE_CLINT);
 -    qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
 -    qdev_prop_set_uint32(dev, "num-harts", num_harts);
 -    qdev_prop_set_uint32(dev, "sip-base", sip_base);
 -    qdev_prop_set_uint32(dev, "timecmp-base", timecmp_base);
 -    qdev_prop_set_uint32(dev, "time-base", time_base);
 -    qdev_prop_set_uint32(dev, "aperture-size", size);
 -    qdev_prop_set_uint32(dev, "timebase-freq", timebase_freq);
 -    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
      return dev;
  }
 --
-.31.1
+.41.0

-[PULL 03/21] target/riscv: Expose interrupt pending bits as GPIO lines
+[PULL v2 42/45] target/riscv: Allocate itrigger timers only once
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
-Expose the 12 interrupt pending bits in MIP as GPIO lines.
+riscv_trigger_init() had been called on reset events that can happen
 several times for a CPU and it allocated timers for itrigger. If old
 timers were present, they were simply overwritten by the new timers,
 resulting in a memory leak.
+Divide riscv_trigger_init() into two functions, namely
+riscv_trigger_realize() and riscv_trigger_reset() and call them in
+appropriate timing. The timer allocation will happen only once for a
+CPU in riscv_trigger_realize().
+Fixes: 5a4ae64cac ("target/riscv: Add itrigger support when icount is enabled")
+Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230818034059.9146-1-akihiko.odaki@daynix.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Tested-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 069d6162f0bc2f4a4f5a44e73f6442b11c703c53.1630301632.git.alistair.francis@wdc.com
 ---
- target/riscv/cpu.c | 30 ++++++++++++++++++++++++++++++
+ target/riscv/debug.h |  3 ++-
-file changed, 30 insertions(+)
+ target/riscv/cpu.c   |  8 +++++++-
  target/riscv/debug.c | 15 ++++++++++++---
 files changed, 21 insertions(+), 5 deletions(-)
+diff --git a/target/riscv/debug.h b/target/riscv/debug.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/debug.h
++++ b/target/riscv/debug.h
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs);
+ bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
+ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
+-void riscv_trigger_init(CPURISCVState *env);
++void riscv_trigger_realize(CPURISCVState *env);
++void riscv_trigger_reset_hold(CPURISCVState *env);
+ bool riscv_itrigger_enabled(CPURISCVState *env);
+ void riscv_itrigger_update_priv(CPURISCVState *env);
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
+ #ifndef CONFIG_USER_ONLY
+     if (cpu->cfg.debug) {
+-        riscv_trigger_init(env);
++        riscv_trigger_reset_hold(env);
+     }
+     if (kvm_enabled()) {
 @@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-     mcc->parent_realize(dev, errp);
      riscv_cpu_register_gdb_regs_for_features(cs);
 +#ifndef CONFIG_USER_ONLY
 +    if (cpu->cfg.debug) {
 +        riscv_trigger_realize(&cpu->env);
 +    }
 +#endif
 +
      qemu_init_vcpu(cs);
      cpu_reset(cs);
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
      return false;
  }
-+#ifndef CONFIG_USER_ONLY
+-void riscv_trigger_init(CPURISCVState *env)
-+static void riscv_cpu_set_irq(void *opaque, int irq, int level)
++void riscv_trigger_realize(CPURISCVState *env)
 +{
-+    RISCVCPU *cpu = RISCV_CPU(opaque);
++    int i;
 +
-+    switch (irq) {
++    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
-+    case IRQ_U_SOFT:
++        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-+    case IRQ_S_SOFT:
++                                              riscv_itrigger_timer_cb, env);
 +    case IRQ_VS_SOFT:
 +    case IRQ_M_SOFT:
 +    case IRQ_U_TIMER:
 +    case IRQ_S_TIMER:
 +    case IRQ_VS_TIMER:
 +    case IRQ_M_TIMER:
 +    case IRQ_U_EXT:
 +    case IRQ_S_EXT:
 +    case IRQ_VS_EXT:
 +    case IRQ_M_EXT:
 +        riscv_cpu_update_mip(cpu, 1 << irq, BOOL_TO_MASK(level));
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
-+#endif /* CONFIG_USER_ONLY */
 +
- static void riscv_cpu_init(Object *obj)
++void riscv_trigger_reset_hold(CPURISCVState *env)
  {
-     RISCVCPU *cpu = RISCV_CPU(obj);
+     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
+     int i;
-     cpu_set_cpustate_pointers(cpu);
+@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
-+
+         env->tdata3[i] = 0;
-+#ifndef CONFIG_USER_ONLY
+         env->cpu_breakpoint[i] = NULL;
-+    qdev_init_gpio_in(DEVICE(cpu), riscv_cpu_set_irq, 12);
+         env->cpu_watchpoint[i] = NULL;
-+#endif /* CONFIG_USER_ONLY */
+-        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 -                                              riscv_itrigger_timer_cb, env);
 +        timer_del(env->itrigger_timer[i]);
      }
  }
- static Property riscv_cpu_properties[] = {
 --
-.31.1
+.41.0

-New patch
+[PULL v2 43/45] target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes
+From: Leon Schuermann <leons@opentitan.org>
+When the rule-lock bypass (RLB) bit is set in the mseccfg CSR, the PMP
+configuration lock bits must not apply. While this behavior is
+implemented for the pmpcfgX CSRs, this bit is not respected for
+changes to the pmpaddrX CSRs. This patch ensures that pmpaddrX CSR
+writes work even on locked regions when the global rule-lock bypass is
+enabled.
+Signed-off-by: Leon Schuermann <leons@opentitan.org>
+Reviewed-by: Mayuresh Chitale <mchitale@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230829215046.1430463-1-leon@is.currently.online>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/pmp.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/pmp.c
++++ b/target/riscv/pmp.c
+@@ -XXX,XX +XXX,XX @@ static inline uint8_t pmp_get_a_field(uint8_t cfg)
+  */
+ static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
+ {
++    /* mseccfg.RLB is set */
++    if (MSECCFG_RLB_ISSET(env)) {
++        return 0;
++    }
+     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
+         return 1;
+--
+.41.0

-[PULL 02/21] target/riscv: Fix satp write
+[PULL v2 44/45] target/riscv: Align the AIA model to v1.0 ratified spec
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Tommy Wu <tommy.wu@sifive.com>
-These variables should be target_ulong. If truncated to int,
+According to the new spec, when vsiselect has a reserved value, attempts
-the bool conditions they indicate will be wrong.
+from M-mode or HS-mode to access vsireg, or from VS-mode to access
 sireg, should preferably raise an illegal instruction exception.
-As satp is very important for Linux, this bug almost fails every boot.
+Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+Message-ID: <20230816061647.600672-1-tommy.wu@sifive.com>
 Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20210901124539.222868-1-zhiwei_liu@c-sky.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 2 +-
+ target/riscv/csr.c | 7 +++++--
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_satp(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
- static RISCVException write_satp(CPURISCVState *env, int csrno,
+ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
-                                  target_ulong val)
+                      target_ulong new_val, target_ulong wr_mask)
  {
--    int vm, mask, asid;
+-    bool virt;
-+    target_ulong vm, mask, asid;
++    bool virt, isel_reserved;
+     uint8_t *iprio;
-     if (!riscv_feature(env, RISCV_FEATURE_MMU)) {
+     int ret = -EINVAL;
-         return RISCV_EXCP_NONE;
+     target_ulong priv, isel, vgein;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
      /* Decode register details from CSR number */
      virt = false;
 +    isel_reserved = false;
      switch (csrno) {
      case CSR_MIREG:
          iprio = env->miprio;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                                                    riscv_cpu_mxl_bits(env)),
                                      val, new_val, wr_mask);
          }
 +    } else {
 +        isel_reserved = true;
      }
  done:
      if (ret) {
 -        return (env->virt_enabled && virt) ?
 +        return (env->virt_enabled && virt && !isel_reserved) ?
                 RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
      }
      return RISCV_EXCP_NONE;
 --
-.31.1
+.41.0

-[PULL 17/21] hw/dma: sifive_pdma: don't set Control.error if 0 bytes to transfer
+[PULL v2 45/45] target/riscv: don't read CSR in riscv_csrrw_do64
-From: Frank Chang <frank.chang@sifive.com>
+From: Nikita Shubin <n.shubin@yadro.com>
-Real PDMA doesn't set Control.error if there are 0 bytes to be
+As per ISA:
 transferred. The DMA transfer is still success.
-The following result is PDMA tested in U-Boot on Unmatched board:
+"For CSRRWI, if rd=x0, then the instruction shall not read the CSR and
 shall not cause any of the side effects that might occur on a CSR read."
-=> mw.l 0x3000000 0x0                      <= Disclaim channel 0
+trans_csrrwi() and trans_csrrw() call do_csrw() if rd=x0, do_csrw() calls
-=> mw.l 0x3000000 0x1                      <= Claim channel 0
+riscv_csrrw_do64(), via helper_csrw() passing NULL as *ret_value.
 => mw.l 0x3000004 0x55000000               <= wsize = rsize = 5 (2^5 = 32 bytes)
 => mw.q 0x3000008 0x0                      <= NextBytes = 0
 => mw.q 0x3000010 0x84000000               <= NextDestination = 0x84000000
 => mw.q 0x3000018 0x84001000               <= NextSource = 0x84001000
 => mw.l 0x84000000 0x87654321              <= Fill test data to dst
 => mw.l 0x84001000 0x12345678              <= Fill test data to src
 => md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
 84000000: 87654321                               !Ce.
 84001000: 12345678                               xV4.
 => md.l 0x3000000 8                        <= Dump PDMA status
 03000000: 00000001 55000000 00000000 00000000    .......U........
 03000010: 84000000 00000000 84001000 00000000    ................
 => mw.l 0x3000000 0x3                      <= Set channel 0 run and claim bits
 => md.l 0x3000000 8                        <= Dump PDMA status
 03000000: 40000001 55000000 00000000 00000000    ...@...U........
 03000010: 84000000 00000000 84001000 00000000    ................
 => md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
 84000000: 87654321                               !Ce.
 84001000: 12345678                               xV4.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
-Tested-by: Max Hsu <max.hsu@sifive.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Message-ID: <20230808090914.17634-1-nikita.shubin@maquefel.me>
 Tested-by: Bin Meng <bmeng.cn@gmail.com>
 Message-id: 20210912130553.179501-5-frank.chang@sifive.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/dma/sifive_pdma.c | 12 ++++++------
+ target/riscv/csr.c | 24 +++++++++++++++---------
-file changed, 6 insertions(+), 6 deletions(-)
+file changed, 15 insertions(+), 9 deletions(-)
-diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/sifive_pdma.c
+--- a/target/riscv/csr.c
-+++ b/hw/dma/sifive_pdma.c
++++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
+@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
+                                        target_ulong write_mask)
-     /* do nothing if bytes to transfer is zero */
+ {
-     if (!bytes) {
+     RISCVException ret;
--        goto error;
+-    target_ulong old_value;
-+        goto done;
++    target_ulong old_value = 0;
      /* execute combined read/write operation if it exists */
      if (csr_ops[csrno].op) {
          return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
      }
-     /*
+-    /* if no accessor exists then return failure */
-@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
+-    if (!csr_ops[csrno].read) {
-         s->chan[ch].exec_bytes -= remainder;
+-        return RISCV_EXCP_ILLEGAL_INST;
 -    }
 -    /* read old value */
 -    ret = csr_ops[csrno].read(env, csrno, &old_value);
 -    if (ret != RISCV_EXCP_NONE) {
 -        return ret;
 +    /*
 +     * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
 +     * and we can't throw side effects caused by CSR reads.
 +     */
 +    if (ret_value) {
 +        /* if no accessor exists then return failure */
 +        if (!csr_ops[csrno].read) {
 +            return RISCV_EXCP_ILLEGAL_INST;
 +        }
 +        /* read old value */
 +        ret = csr_ops[csrno].read(env, csrno, &old_value);
 +        if (ret != RISCV_EXCP_NONE) {
 +            return ret;
 +        }
      }
--    /* indicate a DMA transfer is done */
+     /* write value if writable and write mask set, otherwise drop writes */
 -    s->chan[ch].state = DMA_CHAN_STATE_DONE;
 -    s->chan[ch].control &= ~CONTROL_RUN;
 -    s->chan[ch].control |= CONTROL_DONE;
 -
      /* reload exec_ registers if repeat is required */
      if (s->chan[ch].next_config & CONFIG_REPEAT) {
          s->chan[ch].exec_bytes = bytes;
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
          s->chan[ch].exec_src = src;
      }
 +done:
 +    /* indicate a DMA transfer is done */
 +    s->chan[ch].state = DMA_CHAN_STATE_DONE;
 +    s->chan[ch].control &= ~CONTROL_RUN;
 +    s->chan[ch].control |= CONTROL_DONE;
      return;
  error:
 --
-.31.1
+.41.0

From: Alistair Francis <alistair.francis@wdc.com>

The following changes since commit d1fe59377bbbf91dfded1f08ffe3c636e9db8dc0:

Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-for-6.2-pull-request' into staging (2021-09-16 16:02:31 +0100)

are available in the Git repository at:

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20210917

for you to fetch changes up to c14620db9b66de88bb4fef1d0cfc283bb3d53f85:

hw/riscv: opentitan: Correct the USB Dev address (2021-09-17 07:43:55 +1000)

----------------------------------------------------------------
Second RISC-V PR for QEMU 6.2

- ePMP CSR address updates
 - Convert internal interrupts to use QEMU GPIO lines
 - SiFive PWM support
 - Support for RISC-V ACLINT
 - SiFive PDMA fixes
 - Update to u-boot instructions for sifive_u
 - mstatus.SD bug fix for hypervisor extensions
 - OpenTitan fix for USB dev address

----------------------------------------------------------------
Alistair Francis (9):
      target/riscv: Update the ePMP CSR address
      target/riscv: Expose interrupt pending bits as GPIO lines
      hw/intc: sifive_clint: Use RISC-V CPU GPIO lines
      hw/intc: ibex_plic: Convert the PLIC to use RISC-V CPU GPIO lines
      hw/intc: sifive_plic: Convert the PLIC to use RISC-V CPU GPIO lines
      hw/intc: ibex_timer: Convert the timer to use RISC-V CPU GPIO lines
      hw/timer: Add SiFive PWM support
      sifive_u: Connect the SiFive PWM device
      hw/riscv: opentitan: Correct the USB Dev address

Anup Patel (4):
      hw/intc: Rename sifive_clint sources to riscv_aclint sources
      hw/intc: Upgrade the SiFive CLINT implementation to RISC-V ACLINT
      hw/riscv: virt: Re-factor FDT generation
      hw/riscv: virt: Add optional ACLINT support to virt machine

Bin Meng (2):
      docs/system/riscv: sifive_u: Update U-Boot instructions
      target/riscv: csr: Rename HCOUNTEREN_CY and friends

Frank Chang (4):
      hw/dma: sifive_pdma: reset Next* registers when Control.claim is set
      hw/dma: sifive_pdma: claim bit must be set before DMA transactions
      hw/dma: sifive_pdma: don't set Control.error if 0 bytes to transfer
      target/riscv: Backup/restore mstatus.SD bit when virtual register swapped

Green Wan (1):
      hw/dma: sifive_pdma: allow non-multiple transaction size transactions

LIU Zhiwei (1):
      target/riscv: Fix satp write

From: Alistair Francis <alistair.francis@wdc.com>

Update the ePMP CSRs to match the 0.9.3 ePMP spec
https://github.com/riscv/riscv-tee/blob/61455747230a26002d741f64879dd78cc9689323/Smepmp/Smepmp.pdf

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 28c908de60b9b04fa20e63d113885c98586053f3.1630543194.git.alistair.francis@wdc.com
---
 target/riscv/cpu_bits.h | 4 ++--
 target/riscv/cpu.c      | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define CSR_MTVAL2          0x34b
 
 /* Enhanced Physical Memory Protection (ePMP) */
-#define CSR_MSECCFG         0x390
-#define CSR_MSECCFGH        0x391
+#define CSR_MSECCFG         0x747
+#define CSR_MSECCFGH        0x757
 /* Physical Memory Protection */
 #define CSR_PMPCFG0         0x3a0
 #define CSR_PMPCFG1         0x3a1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
     DEFINE_PROP_BOOL("mmu", RISCVCPU, cfg.mmu, true),
     DEFINE_PROP_BOOL("pmp", RISCVCPU, cfg.pmp, true),
+    /* ePMP 0.9.3 */
     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
 
     DEFINE_PROP_UINT64("resetvec", RISCVCPU, cfg.resetvec, DEFAULT_RSTVEC),
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

These variables should be target_ulong. If truncated to int,
the bool conditions they indicate will be wrong.

As satp is very important for Linux, this bug almost fails every boot.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124539.222868-1-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException read_satp(CPURISCVState *env, int csrno,
 static RISCVException write_satp(CPURISCVState *env, int csrno,
                                  target_ulong val)
 {
-    int vm, mask, asid;
+    target_ulong vm, mask, asid;
 
     if (!riscv_feature(env, RISCV_FEATURE_MMU)) {
         return RISCV_EXCP_NONE;
-- 
2.31.1

From: Alistair Francis <alistair.francis@wdc.com>

Expose the 12 interrupt pending bits in MIP as GPIO lines.

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
     mcc->parent_realize(dev, errp);
 }
 
+#ifndef CONFIG_USER_ONLY
+static void riscv_cpu_set_irq(void *opaque, int irq, int level)
+{
+    RISCVCPU *cpu = RISCV_CPU(opaque);
+
+    switch (irq) {
+    case IRQ_U_SOFT:
+    case IRQ_S_SOFT:
+    case IRQ_VS_SOFT:
+    case IRQ_M_SOFT:
+    case IRQ_U_TIMER:
+    case IRQ_S_TIMER:
+    case IRQ_VS_TIMER:
+    case IRQ_M_TIMER:
+    case IRQ_U_EXT:
+    case IRQ_S_EXT:
+    case IRQ_VS_EXT:
+    case IRQ_M_EXT:
+        riscv_cpu_update_mip(cpu, 1 << irq, BOOL_TO_MASK(level));
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+#endif /* CONFIG_USER_ONLY */
+
 static void riscv_cpu_init(Object *obj)
 {
     RISCVCPU *cpu = RISCV_CPU(obj);
 
     cpu_set_cpustate_pointers(cpu);
+
+#ifndef CONFIG_USER_ONLY
+    qdev_init_gpio_in(DEVICE(cpu), riscv_cpu_set_irq, 12);
+#endif /* CONFIG_USER_ONLY */
 }
 
 static Property riscv_cpu_properties[] = {
-- 
2.31.1

From: Alistair Francis <alistair.francis@wdc.com>

Instead of using riscv_cpu_update_mip() let's instead use the new RISC-V
CPU GPIO lines to set the timer and soft MIP bits.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Tested-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Message-id: 946e1ef5e268b24084c7ddad84c146de62a56736.1630301632.git.alistair.francis@wdc.com
---
 include/hw/intc/sifive_clint.h |  2 +
 hw/intc/sifive_clint.c         | 68 ++++++++++++++++++++++++----------
 2 files changed, 50 insertions(+), 20 deletions(-)

diff --git a/include/hw/intc/sifive_clint.h b/include/hw/intc/sifive_clint.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/sifive_clint.h
+++ b/include/hw/intc/sifive_clint.h
@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveCLINTState {
     uint32_t time_base;
     uint32_t aperture_size;
     uint32_t timebase_freq;
+    qemu_irq *timer_irqs;
+    qemu_irq *soft_irqs;
 } SiFiveCLINTState;
 
 DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
diff --git a/hw/intc/sifive_clint.c b/hw/intc/sifive_clint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/sifive_clint.c
+++ b/hw/intc/sifive_clint.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "hw/intc/sifive_clint.h"
 #include "qemu/timer.h"
+#include "hw/irq.h"
+
+typedef struct sifive_clint_callback {
+    SiFiveCLINTState *s;
+    int num;
+} sifive_clint_callback;
 
 static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
 {
@@ -XXX,XX +XXX,XX @@ static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
  * Called when timecmp is written to update the QEMU timer or immediately
  * trigger timer interrupt if mtimecmp <= current timer value.
  */
-static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
+static void sifive_clint_write_timecmp(SiFiveCLINTState *s, RISCVCPU *cpu,
+                                       int hartid,
+                                       uint64_t value,
                                        uint32_t timebase_freq)
 {
     uint64_t next;
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
     if (cpu->env.timecmp <= rtc_r) {
         /* if we're setting an MTIMECMP value in the "past",
            immediately raise the timer interrupt */
-        riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(1));
+        qemu_irq_raise(s->timer_irqs[hartid - s->hartid_base]);
         return;
     }
 
     /* otherwise, set up the future timer interrupt */
-    riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(0));
+    qemu_irq_lower(s->timer_irqs[hartid - s->hartid_base]);
     diff = cpu->env.timecmp - rtc_r;
     /* back to ns (note args switched in muldiv64) */
     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write_timecmp(RISCVCPU *cpu, uint64_t value,
  */
 static void sifive_clint_timer_cb(void *opaque)
 {
-    RISCVCPU *cpu = opaque;
-    riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(1));
+    sifive_clint_callback *state = opaque;
+
+    qemu_irq_raise(state->s->timer_irqs[state->num]);
 }
 
 /* CPU wants to read rtc or timecmp register */
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write(void *opaque, hwaddr addr, uint64_t value,
         if (!env) {
             error_report("clint: invalid timecmp hartid: %zu", hartid);
         } else if ((addr & 0x3) == 0) {
-            riscv_cpu_update_mip(RISCV_CPU(cpu), MIP_MSIP, BOOL_TO_MASK(value));
+            qemu_set_irq(clint->soft_irqs[hartid - clint->hartid_base], value);
         } else {
             error_report("clint: invalid sip write: %08x", (uint32_t)addr);
         }
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write(void *opaque, hwaddr addr, uint64_t value,
         } else if ((addr & 0x7) == 0) {
             /* timecmp_lo */
             uint64_t timecmp_hi = env->timecmp >> 32;
-            sifive_clint_write_timecmp(RISCV_CPU(cpu),
+            sifive_clint_write_timecmp(clint, RISCV_CPU(cpu), hartid,
                 timecmp_hi << 32 | (value & 0xFFFFFFFF), clint->timebase_freq);
             return;
         } else if ((addr & 0x7) == 4) {
             /* timecmp_hi */
             uint64_t timecmp_lo = env->timecmp;
-            sifive_clint_write_timecmp(RISCV_CPU(cpu),
+            sifive_clint_write_timecmp(clint, RISCV_CPU(cpu), hartid,
                 value << 32 | (timecmp_lo & 0xFFFFFFFF), clint->timebase_freq);
         } else {
             error_report("clint: invalid timecmp write: %08x", (uint32_t)addr);
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->mmio, OBJECT(dev), &sifive_clint_ops, s,
                           TYPE_SIFIVE_CLINT, s->aperture_size);
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
+
+    s->timer_irqs = g_malloc(sizeof(qemu_irq) * s->num_harts);
+    qdev_init_gpio_out(dev, s->timer_irqs, s->num_harts);
+
+    s->soft_irqs = g_malloc(sizeof(qemu_irq) * s->num_harts);
+    qdev_init_gpio_out(dev, s->soft_irqs, s->num_harts);
 }
 
 static void sifive_clint_class_init(ObjectClass *klass, void *data)
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_register_types(void)
 
 type_init(sifive_clint_register_types)
 
-
 /*
  * Create CLINT device.
  */
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
     bool provide_rdtime)
 {
     int i;
+
+    DeviceState *dev = qdev_new(TYPE_SIFIVE_CLINT);
+    qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
+    qdev_prop_set_uint32(dev, "num-harts", num_harts);
+    qdev_prop_set_uint32(dev, "sip-base", sip_base);
+    qdev_prop_set_uint32(dev, "timecmp-base", timecmp_base);
+    qdev_prop_set_uint32(dev, "time-base", time_base);
+    qdev_prop_set_uint32(dev, "aperture-size", size);
+    qdev_prop_set_uint32(dev, "timebase-freq", timebase_freq);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+
     for (i = 0; i < num_harts; i++) {
         CPUState *cpu = qemu_get_cpu(hartid_base + i);
+        RISCVCPU *rvcpu = RISCV_CPU(cpu);
         CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
+        sifive_clint_callback *cb = g_malloc0(sizeof(sifive_clint_callback));
+
         if (!env) {
+            g_free(cb);
             continue;
         }
         if (provide_rdtime) {
             riscv_cpu_set_rdtime_fn(env, cpu_riscv_read_rtc, timebase_freq);
         }
+
+        cb->s = SIFIVE_CLINT(dev);
+        cb->num = i;
         env->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                  &sifive_clint_timer_cb, cpu);
+                                  &sifive_clint_timer_cb, cb);
         env->timecmp = 0;
+
+        qdev_connect_gpio_out(dev, i,
+                              qdev_get_gpio_in(DEVICE(rvcpu), IRQ_M_TIMER));
+        qdev_connect_gpio_out(dev, num_harts + i,
+                              qdev_get_gpio_in(DEVICE(rvcpu), IRQ_M_SOFT));
     }
 
-    DeviceState *dev = qdev_new(TYPE_SIFIVE_CLINT);
-    qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
-    qdev_prop_set_uint32(dev, "num-harts", num_harts);
-    qdev_prop_set_uint32(dev, "sip-base", sip_base);
-    qdev_prop_set_uint32(dev, "timecmp-base", timecmp_base);
-    qdev_prop_set_uint32(dev, "time-base", time_base);
-    qdev_prop_set_uint32(dev, "aperture-size", size);
-    qdev_prop_set_uint32(dev, "timebase-freq", timebase_freq);
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
     return dev;
 }
-- 
2.31.1

From: Alistair Francis <alistair.francis@wdc.com>

Instead of using riscv_cpu_update_mip() let's instead use the new RISC-V
CPU GPIO lines to set the external MIP bits.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 0a76946981852f5bd15f0c37ab35b253371027a8.1630301632.git.alistair.francis@wdc.com
---
 include/hw/intc/ibex_plic.h |  2 ++
 hw/intc/ibex_plic.c         | 17 ++++++-----------
 hw/riscv/opentitan.c        |  8 ++++++++
 3 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/include/hw/intc/ibex_plic.h b/include/hw/intc/ibex_plic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/ibex_plic.h
+++ b/include/hw/intc/ibex_plic.h
@@ -XXX,XX +XXX,XX @@ struct IbexPlicState {
     uint32_t threshold_base;
 
     uint32_t claim_base;
+
+    qemu_irq *external_irqs;
 };
 
 #endif /* HW_IBEX_PLIC_H */
diff --git a/hw/intc/ibex_plic.c b/hw/intc/ibex_plic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/ibex_plic.c
+++ b/hw/intc/ibex_plic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu_bits.h"
 #include "target/riscv/cpu.h"
 #include "hw/intc/ibex_plic.h"
+#include "hw/irq.h"
 
 static bool addr_between(uint32_t addr, uint32_t base, uint32_t num)
 {
@@ -XXX,XX +XXX,XX @@ static bool ibex_plic_irqs_pending(IbexPlicState *s, uint32_t context)
 
 static void ibex_plic_update(IbexPlicState *s)
 {
-    CPUState *cpu;
-    int level, i;
+    int i;
 
     for (i = 0; i < s->num_cpus; i++) {
-        cpu = qemu_get_cpu(i);
-
-        if (!cpu) {
-            continue;
-        }
-
-        level = ibex_plic_irqs_pending(s, 0);
-
-        riscv_cpu_update_mip(RISCV_CPU(cpu), MIP_MEIP, BOOL_TO_MASK(level));
+        qemu_set_irq(s->external_irqs[i], ibex_plic_irqs_pending(s, 0));
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void ibex_plic_realize(DeviceState *dev, Error **errp)
 
     qdev_init_gpio_in(dev, ibex_plic_irq_request, s->num_sources);
 
+    s->external_irqs = g_malloc(sizeof(qemu_irq) * s->num_cpus);
+    qdev_init_gpio_out(dev, s->external_irqs, s->num_cpus);
+
     /*
      * We can't allow the supervisor to control SEIP as this would allow the
      * supervisor to clear a pending external interrupt which will result in
diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
     MachineState *ms = MACHINE(qdev_get_machine());
     LowRISCIbexSoCState *s = RISCV_IBEX_SOC(dev_soc);
     MemoryRegion *sys_mem = get_system_memory();
+    int i;
 
     object_property_set_str(OBJECT(&s->cpus), "cpu-type", ms->cpu_type,
                             &error_abort);
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->plic), 0, memmap[IBEX_DEV_PLIC].base);
 
+    for (i = 0; i < ms->smp.cpus; i++) {
+        CPUState *cpu = qemu_get_cpu(i);
+
+        qdev_connect_gpio_out(DEVICE(&s->plic), i,
+                              qdev_get_gpio_in(DEVICE(cpu), IRQ_M_EXT));
+    }
+
     /* UART */
     qdev_prop_set_chr(DEVICE(&(s->uart)), "chardev", serial_hd(0));
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->uart), errp)) {
-- 
2.31.1

From: Alistair Francis <alistair.francis@wdc.com>

Instead of using riscv_cpu_update_mip() let's instead use the new RISC-V
CPU GPIO lines to set the external MIP bits.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Tested-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 0364190bfa935058a845c0fa1ecf650328840ad5.1630301632.git.alistair.francis@wdc.com
---
 include/hw/intc/sifive_plic.h |  4 ++++
 hw/intc/sifive_plic.c         | 30 +++++++++++++++++++++++-------
 hw/riscv/microchip_pfsoc.c    |  2 +-
 hw/riscv/shakti_c.c           |  3 ++-
 hw/riscv/sifive_e.c           |  2 +-
 hw/riscv/sifive_u.c           |  2 +-
 hw/riscv/virt.c               |  2 +-
 7 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/include/hw/intc/sifive_plic.h b/include/hw/intc/sifive_plic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/sifive_plic.h
+++ b/include/hw/intc/sifive_plic.h
@@ -XXX,XX +XXX,XX @@ struct SiFivePLICState {
     uint32_t context_base;
     uint32_t context_stride;
     uint32_t aperture_size;
+
+    qemu_irq *m_external_irqs;
+    qemu_irq *s_external_irqs;
 };
 
 DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
+    uint32_t num_harts,
     uint32_t hartid_base, uint32_t num_sources,
     uint32_t num_priorities, uint32_t priority_base,
     uint32_t pending_base, uint32_t enable_base,
diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/sifive_plic.c
+++ b/hw/intc/sifive_plic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/sifive_plic.h"
 #include "target/riscv/cpu.h"
 #include "migration/vmstate.h"
+#include "hw/irq.h"
 
 #define RISCV_DEBUG_PLIC 0
 
@@ -XXX,XX +XXX,XX @@ static void sifive_plic_update(SiFivePLICState *plic)
     for (addrid = 0; addrid < plic->num_addrs; addrid++) {
         uint32_t hartid = plic->addr_config[addrid].hartid;
         PLICMode mode = plic->addr_config[addrid].mode;
-        CPUState *cpu = qemu_get_cpu(hartid);
-        CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
-        if (!env) {
-            continue;
-        }
         int level = sifive_plic_irqs_pending(plic, addrid);
+
         switch (mode) {
         case PLICMode_M:
-            riscv_cpu_update_mip(RISCV_CPU(cpu), MIP_MEIP, BOOL_TO_MASK(level));
+            qemu_set_irq(plic->m_external_irqs[hartid - plic->hartid_base], level);
             break;
         case PLICMode_S:
-            riscv_cpu_update_mip(RISCV_CPU(cpu), MIP_SEIP, BOOL_TO_MASK(level));
+            qemu_set_irq(plic->s_external_irqs[hartid - plic->hartid_base], level);
             break;
         default:
             break;
@@ -XXX,XX +XXX,XX @@ static void sifive_plic_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &plic->mmio);
     qdev_init_gpio_in(dev, sifive_plic_irq_request, plic->num_sources);
 
+    plic->s_external_irqs = g_malloc(sizeof(qemu_irq) * plic->num_harts);
+    qdev_init_gpio_out(dev, plic->s_external_irqs, plic->num_harts);
+
+    plic->m_external_irqs = g_malloc(sizeof(qemu_irq) * plic->num_harts);
+    qdev_init_gpio_out(dev, plic->m_external_irqs, plic->num_harts);
+
     /* We can't allow the supervisor to control SEIP as this would allow the
      * supervisor to clear a pending external interrupt which will result in
      * lost a interrupt in the case a PLIC is attached. The SEIP bit must be
@@ -XXX,XX +XXX,XX @@ type_init(sifive_plic_register_types)
  * Create PLIC device.
  */
 DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
+    uint32_t num_harts,
     uint32_t hartid_base, uint32_t num_sources,
     uint32_t num_priorities, uint32_t priority_base,
     uint32_t pending_base, uint32_t enable_base,
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
     uint32_t context_stride, uint32_t aperture_size)
 {
     DeviceState *dev = qdev_new(TYPE_SIFIVE_PLIC);
+    int i;
+
     assert(enable_stride == (enable_stride & -enable_stride));
     assert(context_stride == (context_stride & -context_stride));
     qdev_prop_set_string(dev, "hart-config", hart_config);
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
     qdev_prop_set_uint32(dev, "aperture-size", aperture_size);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+
+    for (i = 0; i < num_harts; i++) {
+        CPUState *cpu = qemu_get_cpu(hartid_base + i);
+
+        qdev_connect_gpio_out(dev, i,
+                              qdev_get_gpio_in(DEVICE(cpu), IRQ_S_EXT));
+        qdev_connect_gpio_out(dev, num_harts + i,
+                              qdev_get_gpio_in(DEVICE(cpu), IRQ_M_EXT));
+    }
+
     return dev;
 }
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
 
     /* PLIC */
     s->plic = sifive_plic_create(memmap[MICROCHIP_PFSOC_PLIC].base,
-        plic_hart_config, 0,
+        plic_hart_config, ms->smp.cpus, 0,
         MICROCHIP_PFSOC_PLIC_NUM_SOURCES,
         MICROCHIP_PFSOC_PLIC_NUM_PRIORITIES,
         MICROCHIP_PFSOC_PLIC_PRIORITY_BASE,
diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/shakti_c.c
+++ b/hw/riscv/shakti_c.c
@@ -XXX,XX +XXX,XX @@ type_init(shakti_c_machine_type_info_register)
 
 static void shakti_c_soc_state_realize(DeviceState *dev, Error **errp)
 {
+    MachineState *ms = MACHINE(qdev_get_machine());
     ShaktiCSoCState *sss = RISCV_SHAKTI_SOC(dev);
     MemoryRegion *system_memory = get_system_memory();
 
     sysbus_realize(SYS_BUS_DEVICE(&sss->cpus), &error_abort);
 
     sss->plic = sifive_plic_create(shakti_c_memmap[SHAKTI_C_PLIC].base,
-        (char *)SHAKTI_C_PLIC_HART_CONFIG, 0,
+        (char *)SHAKTI_C_PLIC_HART_CONFIG, ms->smp.cpus, 0,
         SHAKTI_C_PLIC_NUM_SOURCES,
         SHAKTI_C_PLIC_NUM_PRIORITIES,
         SHAKTI_C_PLIC_PRIORITY_BASE,
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
 
     /* MMIO */
     s->plic = sifive_plic_create(memmap[SIFIVE_E_DEV_PLIC].base,
-        (char *)SIFIVE_E_PLIC_HART_CONFIG, 0,
+        (char *)SIFIVE_E_PLIC_HART_CONFIG, ms->smp.cpus, 0,
         SIFIVE_E_PLIC_NUM_SOURCES,
         SIFIVE_E_PLIC_NUM_PRIORITIES,
         SIFIVE_E_PLIC_PRIORITY_BASE,
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
 
     /* MMIO */
     s->plic = sifive_plic_create(memmap[SIFIVE_U_DEV_PLIC].base,
-        plic_hart_config, 0,
+        plic_hart_config, ms->smp.cpus, 0,
         SIFIVE_U_PLIC_NUM_SOURCES,
         SIFIVE_U_PLIC_NUM_PRIORITIES,
         SIFIVE_U_PLIC_PRIORITY_BASE,
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         /* Per-socket PLIC */
         s->plic[i] = sifive_plic_create(
             memmap[VIRT_PLIC].base + i * memmap[VIRT_PLIC].size,
-            plic_hart_config, base_hartid,
+            plic_hart_config, hart_count, base_hartid,
             VIRT_PLIC_NUM_SOURCES,
             VIRT_PLIC_NUM_PRIORITIES,
             VIRT_PLIC_PRIORITY_BASE,
-- 
2.31.1

From: Alistair Francis <alistair.francis@wdc.com>

Instead of using riscv_cpu_update_mip() let's instead use the new RISC-V
CPU GPIO lines to set the timer MIP bits.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 84d5b1d5783d2e79eee69a2f7ac480cc0c070db3.1630301632.git.alistair.francis@wdc.com
---
 include/hw/timer/ibex_timer.h |  2 ++
 hw/riscv/opentitan.c          |  3 +++
 hw/timer/ibex_timer.c         | 17 ++++++++++++-----
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/include/hw/timer/ibex_timer.h b/include/hw/timer/ibex_timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/ibex_timer.h
+++ b/include/hw/timer/ibex_timer.h
@@ -XXX,XX +XXX,XX @@ struct IbexTimerState {
     uint32_t timebase_freq;
 
     qemu_irq irq;
+
+    qemu_irq m_timer_irq;
 };
 #endif /* HW_IBEX_TIMER_H */
diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer),
                        0, qdev_get_gpio_in(DEVICE(&s->plic),
                        IBEX_TIMER_TIMEREXPIRED0_0));
+    qdev_connect_gpio_out(DEVICE(&s->timer), 0,
+                          qdev_get_gpio_in(DEVICE(qemu_get_cpu(0)),
+                                           IRQ_M_TIMER));
 
     create_unimplemented_device("riscv.lowrisc.ibex.gpio",
         memmap[IBEX_DEV_GPIO].base, memmap[IBEX_DEV_GPIO].size);
diff --git a/hw/timer/ibex_timer.c b/hw/timer/ibex_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/ibex_timer.c
+++ b/hw/timer/ibex_timer.c
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
         /*
          * If the mtimecmp was in the past raise the interrupt now.
          */
-        riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(1));
+        qemu_irq_raise(s->m_timer_irq);
         if (s->timer_intr_enable & R_INTR_ENABLE_IE_0_MASK) {
             s->timer_intr_state |= R_INTR_STATE_IS_0_MASK;
             qemu_set_irq(s->irq, true);
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
     }
 
     /* Setup a timer to trigger the interrupt in the future */
-    riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(0));
+    qemu_irq_lower(s->m_timer_irq);
     qemu_set_irq(s->irq, false);
 
     diff = cpu->env.timecmp - now;
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
 static void ibex_timer_cb(void *opaque)
 {
     IbexTimerState *s = opaque;
-    CPUState *cs = qemu_get_cpu(0);
-    RISCVCPU *cpu = RISCV_CPU(cs);
 
-    riscv_cpu_update_mip(cpu, MIP_MTIP, BOOL_TO_MASK(1));
+    qemu_irq_raise(s->m_timer_irq);
     if (s->timer_intr_enable & R_INTR_ENABLE_IE_0_MASK) {
         s->timer_intr_state |= R_INTR_STATE_IS_0_MASK;
         qemu_set_irq(s->irq, true);
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_init(Object *obj)
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 }
 
+static void ibex_timer_realize(DeviceState *dev, Error **errp)
+{
+    IbexTimerState *s = IBEX_TIMER(dev);
+
+    qdev_init_gpio_out(dev, &s->m_timer_irq, 1);
+}
+
+
 static void ibex_timer_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->reset = ibex_timer_reset;
     dc->vmsd = &vmstate_ibex_timer;
+    dc->realize = ibex_timer_realize;
     device_class_set_props(dc, ibex_timer_properties);
 }
 
-- 
2.31.1

From: Alistair Francis <alistair.francis@wdc.com>

This is the initial commit of the SiFive PWM timer. This is used by
guest software as a timer and is included in the SiFive FU540 SoC.

Signed-off-by: Justin Restivo <jrestivo@draper.com>
Signed-off-by: Alexandra Clifford <aclifford@draper.com>
Signed-off-by: Amanda Strnad <astrnad@draper.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 9f70a210acbfaf0e1ea6ad311ab892ac69134d8b.1631159656.git.alistair.francis@wdc.com
---
 include/hw/timer/sifive_pwm.h |  62 +++++
 hw/timer/sifive_pwm.c         | 468 ++++++++++++++++++++++++++++++++++
 hw/timer/Kconfig              |   3 +
 hw/timer/meson.build          |   1 +
 hw/timer/trace-events         |   6 +
 5 files changed, 540 insertions(+)
 create mode 100644 include/hw/timer/sifive_pwm.h
 create mode 100644 hw/timer/sifive_pwm.c

diff --git a/include/hw/timer/sifive_pwm.h b/include/hw/timer/sifive_pwm.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/timer/sifive_pwm.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * SiFive PWM
+ *
+ * Copyright (c) 2020 Western Digital
+ *
+ * Author:  Alistair Francis <alistair.francis@wdc.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_SIFIVE_PWM_H
+#define HW_SIFIVE_PWM_H
+
+#include "hw/sysbus.h"
+#include "qemu/timer.h"
+#include "qom/object.h"
+
+#define TYPE_SIFIVE_PWM "sifive-pwm"
+
+#define SIFIVE_PWM(obj) \
+    OBJECT_CHECK(SiFivePwmState, (obj), TYPE_SIFIVE_PWM)
+
+#define SIFIVE_PWM_CHANS          4
+#define SIFIVE_PWM_IRQS           SIFIVE_PWM_CHANS
+
+typedef struct SiFivePwmState {
+    /* <private> */
+    SysBusDevice parent_obj;
+
+    /* <public> */
+    MemoryRegion mmio;
+    QEMUTimer timer[SIFIVE_PWM_CHANS];
+    /*
+     * if en bit(s) set, is the number of ticks when pwmcount was 0
+     * if en bit(s) not set, is the number of ticks in pwmcount
+     */
+    uint64_t tick_offset;
+    uint64_t freq_hz;
+
+    uint32_t pwmcfg;
+    uint32_t pwmcmp[SIFIVE_PWM_CHANS];
+
+    qemu_irq irqs[SIFIVE_PWM_IRQS];
+} SiFivePwmState;
+
+#endif /* HW_SIFIVE_PWM_H */
diff --git a/hw/timer/sifive_pwm.c b/hw/timer/sifive_pwm.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/timer/sifive_pwm.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * SiFive PWM
+ *
+ * Copyright (c) 2020 Western Digital
+ *
+ * Author:  Alistair Francis <alistair.francis@wdc.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "trace.h"
+#include "hw/irq.h"
+#include "hw/timer/sifive_pwm.h"
+#include "hw/qdev-properties.h"
+#include "hw/registerfields.h"
+#include "migration/vmstate.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+
+#define HAS_PWM_EN_BITS(cfg) ((cfg & R_CONFIG_ENONESHOT_MASK) || \
+                              (cfg & R_CONFIG_ENALWAYS_MASK))
+
+#define PWMCMP_MASK 0xFFFF
+#define PWMCOUNT_MASK 0x7FFFFFFF
+
+REG32(CONFIG,                   0x00)
+    FIELD(CONFIG, SCALE,            0, 4)
+    FIELD(CONFIG, STICKY,           8, 1)
+    FIELD(CONFIG, ZEROCMP,          9, 1)
+    FIELD(CONFIG, DEGLITCH,         10, 1)
+    FIELD(CONFIG, ENALWAYS,         12, 1)
+    FIELD(CONFIG, ENONESHOT,        13, 1)
+    FIELD(CONFIG, CMP0CENTER,       16, 1)
+    FIELD(CONFIG, CMP1CENTER,       17, 1)
+    FIELD(CONFIG, CMP2CENTER,       18, 1)
+    FIELD(CONFIG, CMP3CENTER,       19, 1)
+    FIELD(CONFIG, CMP0GANG,         24, 1)
+    FIELD(CONFIG, CMP1GANG,         25, 1)
+    FIELD(CONFIG, CMP2GANG,         26, 1)
+    FIELD(CONFIG, CMP3GANG,         27, 1)
+    FIELD(CONFIG, CMP0IP,           28, 1)
+    FIELD(CONFIG, CMP1IP,           29, 1)
+    FIELD(CONFIG, CMP2IP,           30, 1)
+    FIELD(CONFIG, CMP3IP,           31, 1)
+REG32(COUNT,                    0x08)
+REG32(PWMS,                     0x10)
+REG32(PWMCMP0,                  0x20)
+REG32(PWMCMP1,                  0x24)
+REG32(PWMCMP2,                  0x28)
+REG32(PWMCMP3,                  0x2C)
+
+static inline uint64_t sifive_pwm_ns_to_ticks(SiFivePwmState *s,
+                                                uint64_t time)
+{
+    return muldiv64(time, s->freq_hz, NANOSECONDS_PER_SECOND);
+}
+
+static inline uint64_t sifive_pwm_ticks_to_ns(SiFivePwmState *s,
+                                                uint64_t ticks)
+{
+    return muldiv64(ticks, NANOSECONDS_PER_SECOND, s->freq_hz);
+}
+
+static inline uint64_t sifive_pwm_compute_scale(SiFivePwmState *s)
+{
+    return s->pwmcfg & R_CONFIG_SCALE_MASK;
+}
+
+static void sifive_pwm_set_alarms(SiFivePwmState *s)
+{
+    uint64_t now_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+
+    if (HAS_PWM_EN_BITS(s->pwmcfg)) {
+        /*
+         * Subtract ticks from number of ticks when the timer was zero
+         * and mask to the register width.
+         */
+        uint64_t pwmcount = (sifive_pwm_ns_to_ticks(s, now_ns) -
+                             s->tick_offset) & PWMCOUNT_MASK;
+        uint64_t scale = sifive_pwm_compute_scale(s);
+        /* PWMs only contains PWMCMP_MASK bits starting at scale */
+        uint64_t pwms = (pwmcount & (PWMCMP_MASK << scale)) >> scale;
+
+        for (int i = 0; i < SIFIVE_PWM_CHANS; i++) {
+            uint64_t pwmcmp = s->pwmcmp[i] & PWMCMP_MASK;
+            uint64_t pwmcmp_ticks = pwmcmp << scale;
+
+            /*
+             * Per circuit diagram and spec, both cases raises corresponding
+             * IP bit one clock cycle after time expires.
+             */
+            if (pwmcmp > pwms) {
+                uint64_t offset = pwmcmp_ticks - pwmcount + 1;
+                uint64_t when_to_fire = now_ns +
+                                          sifive_pwm_ticks_to_ns(s, offset);
+
+                trace_sifive_pwm_set_alarm(when_to_fire, now_ns);
+                timer_mod(&s->timer[i], when_to_fire);
+            } else {
+                /* Schedule interrupt for next cycle */
+                trace_sifive_pwm_set_alarm(now_ns + 1, now_ns);
+                timer_mod(&s->timer[i], now_ns + 1);
+            }
+
+        }
+    } else {
+        /*
+         * If timer incrementing disabled, just do pwms > pwmcmp check since
+         * a write may have happened to PWMs.
+         */
+        uint64_t pwmcount = (s->tick_offset) & PWMCOUNT_MASK;
+        uint64_t scale = sifive_pwm_compute_scale(s);
+        uint64_t pwms = (pwmcount & (PWMCMP_MASK << scale)) >> scale;
+
+        for (int i = 0; i < SIFIVE_PWM_CHANS; i++) {
+            uint64_t pwmcmp = s->pwmcmp[i] & PWMCMP_MASK;
+
+            if (pwms >= pwmcmp) {
+                trace_sifive_pwm_set_alarm(now_ns + 1, now_ns);
+                timer_mod(&s->timer[i], now_ns + 1);
+            } else {
+                /* Effectively disable timer by scheduling far in future. */
+                trace_sifive_pwm_set_alarm(0xFFFFFFFFFFFFFF, now_ns);
+                timer_mod(&s->timer[i], 0xFFFFFFFFFFFFFF);
+            }
+        }
+    }
+}
+
+static void sifive_pwm_interrupt(SiFivePwmState *s, int num)
+{
+    uint64_t now = sifive_pwm_ns_to_ticks(s,
+                                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
+    bool was_incrementing = HAS_PWM_EN_BITS(s->pwmcfg);
+
+    trace_sifive_pwm_interrupt(num);
+
+    s->pwmcfg |= R_CONFIG_CMP0IP_MASK << num;
+    qemu_irq_raise(s->irqs[num]);
+
+    /*
+     * If the zerocmp is set and pwmcmp0 raised the interrupt
+     * reset the zero ticks.
+     */
+    if ((s->pwmcfg & R_CONFIG_ZEROCMP_MASK) && (num == 0)) {
+        /* If reset signal conditions, disable ENONESHOT. */
+        s->pwmcfg &= ~R_CONFIG_ENONESHOT_MASK;
+
+        if (was_incrementing) {
+            /* If incrementing, time in ticks is when pwmcount is zero */
+            s->tick_offset = now;
+        } else {
+            /* If not incrementing, pwmcount = 0 */
+            s->tick_offset = 0;
+        }
+    }
+
+    /*
+     * If carryout bit set, which we discern via looking for overflow,
+     * also reset ENONESHOT.
+     */
+    if (was_incrementing &&
+        ((now & PWMCOUNT_MASK) < (s->tick_offset & PWMCOUNT_MASK))) {
+        s->pwmcfg &= ~R_CONFIG_ENONESHOT_MASK;
+    }
+
+    /* Schedule or disable interrupts */
+    sifive_pwm_set_alarms(s);
+
+    /* If was enabled, and now not enabled, switch tick rep */
+    if (was_incrementing && !HAS_PWM_EN_BITS(s->pwmcfg)) {
+        s->tick_offset = (now - s->tick_offset) & PWMCOUNT_MASK;
+    }
+}
+
+static void sifive_pwm_interrupt_0(void *opaque)
+{
+    SiFivePwmState *s = opaque;
+
+    sifive_pwm_interrupt(s, 0);
+}
+
+static void sifive_pwm_interrupt_1(void *opaque)
+{
+    SiFivePwmState *s = opaque;
+
+    sifive_pwm_interrupt(s, 1);
+}
+
+static void sifive_pwm_interrupt_2(void *opaque)
+{
+    SiFivePwmState *s = opaque;
+
+    sifive_pwm_interrupt(s, 2);
+}
+
+static void sifive_pwm_interrupt_3(void *opaque)
+{
+    SiFivePwmState *s = opaque;
+
+    sifive_pwm_interrupt(s, 3);
+}
+
+static uint64_t sifive_pwm_read(void *opaque, hwaddr addr,
+                                  unsigned int size)
+{
+    SiFivePwmState *s = opaque;
+    uint64_t cur_time, scale;
+    uint64_t now = sifive_pwm_ns_to_ticks(s,
+                                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
+
+    trace_sifive_pwm_read(addr);
+
+    switch (addr) {
+    case A_CONFIG:
+        return s->pwmcfg;
+    case A_COUNT:
+        cur_time = s->tick_offset;
+
+        if (HAS_PWM_EN_BITS(s->pwmcfg)) {
+            cur_time = now - cur_time;
+        }
+
+        /*
+         * Return the value in the counter with bit 31 always 0
+         * This is allowed to wrap around so we don't need to check that.
+         */
+        return cur_time & PWMCOUNT_MASK;
+    case A_PWMS:
+        cur_time = s->tick_offset;
+        scale = sifive_pwm_compute_scale(s);
+
+        if (HAS_PWM_EN_BITS(s->pwmcfg)) {
+            cur_time = now - cur_time;
+        }
+
+        return ((cur_time & PWMCOUNT_MASK) >> scale) & PWMCMP_MASK;
+    case A_PWMCMP0:
+        return s->pwmcmp[0] & PWMCMP_MASK;
+    case A_PWMCMP1:
+        return s->pwmcmp[1] & PWMCMP_MASK;
+    case A_PWMCMP2:
+        return s->pwmcmp[2] & PWMCMP_MASK;
+    case A_PWMCMP3:
+        return s->pwmcmp[3] & PWMCMP_MASK;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
+        return 0;
+    }
+
+    return 0;
+}
+
+static void sifive_pwm_write(void *opaque, hwaddr addr,
+                               uint64_t val64, unsigned int size)
+{
+    SiFivePwmState *s = opaque;
+    uint32_t value = val64;
+    uint64_t new_offset, scale;
+    uint64_t now = sifive_pwm_ns_to_ticks(s,
+                                        qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
+
+    trace_sifive_pwm_write(value, addr);
+
+    switch (addr) {
+    case A_CONFIG:
+        if (value & (R_CONFIG_CMP0CENTER_MASK | R_CONFIG_CMP1CENTER_MASK |
+                     R_CONFIG_CMP2CENTER_MASK | R_CONFIG_CMP3CENTER_MASK)) {
+            qemu_log_mask(LOG_UNIMP, "%s: CMPxCENTER is not supported\n",
+                          __func__);
+        }
+
+        if (value & (R_CONFIG_CMP0GANG_MASK | R_CONFIG_CMP1GANG_MASK |
+                     R_CONFIG_CMP2GANG_MASK | R_CONFIG_CMP3GANG_MASK)) {
+            qemu_log_mask(LOG_UNIMP, "%s: CMPxGANG is not supported\n",
+                          __func__);
+        }
+
+        if (value & (R_CONFIG_CMP0IP_MASK | R_CONFIG_CMP1IP_MASK |
+                     R_CONFIG_CMP2IP_MASK | R_CONFIG_CMP3IP_MASK)) {
+            qemu_log_mask(LOG_UNIMP, "%s: CMPxIP is not supported\n",
+                          __func__);
+        }
+
+        if (!(value & R_CONFIG_CMP0IP_MASK)) {
+            qemu_irq_lower(s->irqs[0]);
+        }
+
+        if (!(value & R_CONFIG_CMP1IP_MASK)) {
+            qemu_irq_lower(s->irqs[1]);
+        }
+
+        if (!(value & R_CONFIG_CMP2IP_MASK)) {
+            qemu_irq_lower(s->irqs[2]);
+        }
+
+        if (!(value & R_CONFIG_CMP3IP_MASK)) {
+            qemu_irq_lower(s->irqs[3]);
+        }
+
+        /*
+         * If this write enables the timer increment
+         * set the time when pwmcount was zero to be cur_time - pwmcount.
+         * If this write disables the timer increment
+         * convert back from pwmcount to the time in ticks
+         * when pwmcount was zero.
+         */
+        if ((!HAS_PWM_EN_BITS(s->pwmcfg) && HAS_PWM_EN_BITS(value)) ||
+            (HAS_PWM_EN_BITS(s->pwmcfg) && !HAS_PWM_EN_BITS(value))) {
+            s->tick_offset = (now - s->tick_offset) & PWMCOUNT_MASK;
+        }
+
+        s->pwmcfg = value;
+        break;
+    case A_COUNT:
+        /* The guest changed the counter, updated the offset value. */
+        new_offset = value;
+
+        if (HAS_PWM_EN_BITS(s->pwmcfg)) {
+            new_offset = now - new_offset;
+        }
+
+        s->tick_offset = new_offset;
+        break;
+    case A_PWMS:
+        scale = sifive_pwm_compute_scale(s);
+        new_offset = (((value & PWMCMP_MASK) << scale) & PWMCOUNT_MASK);
+
+        if (HAS_PWM_EN_BITS(s->pwmcfg)) {
+            new_offset = now - new_offset;
+        }
+
+        s->tick_offset = new_offset;
+        break;
+    case A_PWMCMP0:
+        s->pwmcmp[0] = value & PWMCMP_MASK;
+        break;
+    case A_PWMCMP1:
+        s->pwmcmp[1] = value & PWMCMP_MASK;
+        break;
+    case A_PWMCMP2:
+        s->pwmcmp[2] = value & PWMCMP_MASK;
+        break;
+    case A_PWMCMP3:
+        s->pwmcmp[3] = value & PWMCMP_MASK;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
+    }
+
+    /* Update the alarms to reflect possible updated values */
+    sifive_pwm_set_alarms(s);
+}
+
+static void sifive_pwm_reset(DeviceState *dev)
+{
+    SiFivePwmState *s = SIFIVE_PWM(dev);
+    uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+
+    s->pwmcfg = 0x00000000;
+    s->pwmcmp[0] = 0x00000000;
+    s->pwmcmp[1] = 0x00000000;
+    s->pwmcmp[2] = 0x00000000;
+    s->pwmcmp[3] = 0x00000000;
+
+    s->tick_offset = sifive_pwm_ns_to_ticks(s, now);
+}
+
+static const MemoryRegionOps sifive_pwm_ops = {
+    .read = sifive_pwm_read,
+    .write = sifive_pwm_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static const VMStateDescription vmstate_sifive_pwm = {
+    .name = TYPE_SIFIVE_PWM,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_TIMER_ARRAY(timer, SiFivePwmState, 4),
+        VMSTATE_UINT64(tick_offset, SiFivePwmState),
+        VMSTATE_UINT32(pwmcfg, SiFivePwmState),
+        VMSTATE_UINT32_ARRAY(pwmcmp, SiFivePwmState, 4),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property sifive_pwm_properties[] = {
+    /* 0.5Ghz per spec after FSBL */
+    DEFINE_PROP_UINT64("clock-frequency", struct SiFivePwmState,
+                       freq_hz, 500000000ULL),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void sifive_pwm_init(Object *obj)
+{
+    SiFivePwmState *s = SIFIVE_PWM(obj);
+    int i;
+
+    for (i = 0; i < SIFIVE_PWM_IRQS; i++) {
+        sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irqs[i]);
+    }
+
+    memory_region_init_io(&s->mmio, obj, &sifive_pwm_ops, s,
+                          TYPE_SIFIVE_PWM, 0x100);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+}
+
+static void sifive_pwm_realize(DeviceState *dev, Error **errp)
+{
+    SiFivePwmState *s = SIFIVE_PWM(dev);
+
+    timer_init_ns(&s->timer[0], QEMU_CLOCK_VIRTUAL,
+                  sifive_pwm_interrupt_0, s);
+
+    timer_init_ns(&s->timer[1], QEMU_CLOCK_VIRTUAL,
+                  sifive_pwm_interrupt_1, s);
+
+    timer_init_ns(&s->timer[2], QEMU_CLOCK_VIRTUAL,
+                  sifive_pwm_interrupt_2, s);
+
+    timer_init_ns(&s->timer[3], QEMU_CLOCK_VIRTUAL,
+                  sifive_pwm_interrupt_3, s);
+}
+
+static void sifive_pwm_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = sifive_pwm_reset;
+    device_class_set_props(dc, sifive_pwm_properties);
+    dc->vmsd = &vmstate_sifive_pwm;
+    dc->realize = sifive_pwm_realize;
+}
+
+static const TypeInfo sifive_pwm_info = {
+    .name          = TYPE_SIFIVE_PWM,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(SiFivePwmState),
+    .instance_init = sifive_pwm_init,
+    .class_init    = sifive_pwm_class_init,
+};
+
+static void sifive_pwm_register_types(void)
+{
+    type_register_static(&sifive_pwm_info);
+}
+
+type_init(sifive_pwm_register_types)
diff --git a/hw/timer/Kconfig b/hw/timer/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/Kconfig
+++ b/hw/timer/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10_PIT
     bool
     select PTIMER
 
+config SIFIVE_PWM
+    bool
+
 config STM32F2XX_TIMER
     bool
 
diff --git a/hw/timer/meson.build b/hw/timer/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/meson.build
+++ b/hw/timer/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_STELLARIS_GPTM', if_true: files('stellaris-gptm.c')
 softmmu_ss.add(when: 'CONFIG_STM32F2XX_TIMER', if_true: files('stm32f2xx_timer.c'))
 softmmu_ss.add(when: 'CONFIG_XILINX', if_true: files('xilinx_timer.c'))
 specific_ss.add(when: 'CONFIG_IBEX', if_true: files('ibex_timer.c'))
+softmmu_ss.add(when: 'CONFIG_SIFIVE_PWM', if_true: files('sifive_pwm.c'))
 
 specific_ss.add(when: 'CONFIG_AVR_TIMER16', if_true: files('avr_timer16.c'))
diff --git a/hw/timer/trace-events b/hw/timer/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/trace-events
+++ b/hw/timer/trace-events
@@ -XXX,XX +XXX,XX @@ sse_counter_reset(void) "SSE system counter: reset"
 sse_timer_read(uint64_t offset, uint64_t data, unsigned size) "SSE system timer read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 sse_timer_write(uint64_t offset, uint64_t data, unsigned size) "SSE system timer write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 sse_timer_reset(void) "SSE system timer: reset"
+
+# sifive_pwm.c
+sifive_pwm_set_alarm(uint64_t alarm, uint64_t now) "Setting alarm to: 0x%" PRIx64 ", now: 0x%" PRIx64
+sifive_pwm_interrupt(int num) "Interrupt %d"
+sifive_pwm_read(uint64_t offset) "Read at address: 0x%" PRIx64
+sifive_pwm_write(uint64_t data, uint64_t offset) "Write 0x%" PRIx64 " at address: 0x%" PRIx64
-- 
2.31.1

From: Alistair Francis <alistair.francis@wdc.com>

Connect the SiFive PWM device and expose it via the device tree.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 22f98648b4e012f78529a56f5ca60b0b27852a4d.1631159656.git.alistair.francis@wdc.com
---
 docs/system/riscv/sifive_u.rst |  1 +
 include/hw/riscv/sifive_u.h    | 14 ++++++++-
 hw/riscv/sifive_u.c            | 55 +++++++++++++++++++++++++++++++++-
 hw/riscv/Kconfig               |  1 +
 4 files changed, 69 insertions(+), 2 deletions(-)

diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/sifive_u.rst
+++ b/docs/system/riscv/sifive_u.rst
@@ -XXX,XX +XXX,XX @@ The ``sifive_u`` machine supports the following devices:
 * 2 QSPI controllers
 * 1 ISSI 25WP256 flash
 * 1 SD card in SPI mode
+* PWM0 and PWM1
 
 Please note the real world HiFive Unleashed board has a fixed configuration of
 1 E51 core and 4 U54 core combination and the RISC-V core boots in 64-bit mode.
diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_u.h
+++ b/include/hw/riscv/sifive_u.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/sifive_u_otp.h"
 #include "hw/misc/sifive_u_prci.h"
 #include "hw/ssi/sifive_spi.h"
+#include "hw/timer/sifive_pwm.h"
 
 #define TYPE_RISCV_U_SOC "riscv.sifive.u.soc"
 #define RISCV_U_SOC(obj) \
@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveUSoCState {
     SiFiveSPIState spi0;
     SiFiveSPIState spi2;
     CadenceGEMState gem;
+    SiFivePwmState pwm[2];
 
     uint32_t serial;
     char *cpu_type;
@@ -XXX,XX +XXX,XX @@ enum {
     SIFIVE_U_DEV_FLASH0,
     SIFIVE_U_DEV_DRAM,
     SIFIVE_U_DEV_GEM,
-    SIFIVE_U_DEV_GEM_MGMT
+    SIFIVE_U_DEV_GEM_MGMT,
+    SIFIVE_U_DEV_PWM0,
+    SIFIVE_U_DEV_PWM1
 };
 
 enum {
@@ -XXX,XX +XXX,XX @@ enum {
     SIFIVE_U_PDMA_IRQ5 = 28,
     SIFIVE_U_PDMA_IRQ6 = 29,
     SIFIVE_U_PDMA_IRQ7 = 30,
+    SIFIVE_U_PWM0_IRQ0 = 42,
+    SIFIVE_U_PWM0_IRQ1 = 43,
+    SIFIVE_U_PWM0_IRQ2 = 44,
+    SIFIVE_U_PWM0_IRQ3 = 45,
+    SIFIVE_U_PWM1_IRQ0 = 46,
+    SIFIVE_U_PWM1_IRQ1 = 47,
+    SIFIVE_U_PWM1_IRQ2 = 48,
+    SIFIVE_U_PWM1_IRQ3 = 49,
     SIFIVE_U_QSPI0_IRQ = 51,
     SIFIVE_U_GEM_IRQ = 53
 };
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@
  * 7) DMA (Direct Memory Access Controller)
  * 8) SPI0 connected to an SPI flash
  * 9) SPI2 connected to an SD card
+ * 10) PWM0 and PWM1
  *
  * This board currently generates devicetree dynamically that indicates at least
  * two harts and up to five harts.
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry sifive_u_memmap[] = {
     [SIFIVE_U_DEV_PRCI] =     { 0x10000000,     0x1000 },
     [SIFIVE_U_DEV_UART0] =    { 0x10010000,     0x1000 },
     [SIFIVE_U_DEV_UART1] =    { 0x10011000,     0x1000 },
+    [SIFIVE_U_DEV_PWM0] =     { 0x10020000,     0x1000 },
+    [SIFIVE_U_DEV_PWM1] =     { 0x10021000,     0x1000 },
     [SIFIVE_U_DEV_QSPI0] =    { 0x10040000,     0x1000 },
     [SIFIVE_U_DEV_QSPI2] =    { 0x10050000,     0x1000 },
     [SIFIVE_U_DEV_GPIO] =     { 0x10060000,     0x1000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
     qemu_fdt_setprop_cell(fdt, nodename, "reg", 0x0);
     g_free(nodename);
 
+    nodename = g_strdup_printf("/soc/pwm@%lx",
+        (long)memmap[SIFIVE_U_DEV_PWM0].base);
+    qemu_fdt_add_subnode(fdt, nodename);
+    qemu_fdt_setprop_string(fdt, nodename, "compatible", "sifive,pwm0");
+    qemu_fdt_setprop_cells(fdt, nodename, "reg",
+        0x0, memmap[SIFIVE_U_DEV_PWM0].base,
+        0x0, memmap[SIFIVE_U_DEV_PWM0].size);
+    qemu_fdt_setprop_cell(fdt, nodename, "interrupt-parent", plic_phandle);
+    qemu_fdt_setprop_cells(fdt, nodename, "interrupts",
+                           SIFIVE_U_PWM0_IRQ0, SIFIVE_U_PWM0_IRQ1,
+                           SIFIVE_U_PWM0_IRQ2, SIFIVE_U_PWM0_IRQ3);
+    qemu_fdt_setprop_cells(fdt, nodename, "clocks",
+                           prci_phandle, PRCI_CLK_TLCLK);
+    qemu_fdt_setprop_cell(fdt, nodename, "#pwm-cells", 0);
+    g_free(nodename);
+
+    nodename = g_strdup_printf("/soc/pwm@%lx",
+        (long)memmap[SIFIVE_U_DEV_PWM1].base);
+    qemu_fdt_add_subnode(fdt, nodename);
+    qemu_fdt_setprop_string(fdt, nodename, "compatible", "sifive,pwm0");
+    qemu_fdt_setprop_cells(fdt, nodename, "reg",
+        0x0, memmap[SIFIVE_U_DEV_PWM1].base,
+        0x0, memmap[SIFIVE_U_DEV_PWM1].size);
+    qemu_fdt_setprop_cell(fdt, nodename, "interrupt-parent", plic_phandle);
+    qemu_fdt_setprop_cells(fdt, nodename, "interrupts",
+                           SIFIVE_U_PWM1_IRQ0, SIFIVE_U_PWM1_IRQ1,
+                           SIFIVE_U_PWM1_IRQ2, SIFIVE_U_PWM1_IRQ3);
+    qemu_fdt_setprop_cells(fdt, nodename, "clocks",
+                           prci_phandle, PRCI_CLK_TLCLK);
+    qemu_fdt_setprop_cell(fdt, nodename, "#pwm-cells", 0);
+    g_free(nodename);
+
     nodename = g_strdup_printf("/soc/serial@%lx",
         (long)memmap[SIFIVE_U_DEV_UART1].base);
     qemu_fdt_add_subnode(fdt, nodename);
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_instance_init(Object *obj)
     object_initialize_child(obj, "pdma", &s->dma, TYPE_SIFIVE_PDMA);
     object_initialize_child(obj, "spi0", &s->spi0, TYPE_SIFIVE_SPI);
     object_initialize_child(obj, "spi2", &s->spi2, TYPE_SIFIVE_SPI);
+    object_initialize_child(obj, "pwm0", &s->pwm[0], TYPE_SIFIVE_PWM);
+    object_initialize_child(obj, "pwm1", &s->pwm[1], TYPE_SIFIVE_PWM);
 }
 
 static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
     MemoryRegion *l2lim_mem = g_new(MemoryRegion, 1);
     char *plic_hart_config;
     size_t plic_hart_config_len;
-    int i;
+    int i, j;
     NICInfo *nd = &nd_table[0];
 
     qdev_prop_set_uint32(DEVICE(&s->u_cpus), "num-harts", ms->smp.cpus - 1);
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gem), 0,
                        qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_U_GEM_IRQ));
 
+    /* PWM */
+    for (i = 0; i < 2; i++) {
+        if (!sysbus_realize(SYS_BUS_DEVICE(&s->pwm[i]), errp)) {
+            return;
+        }
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->pwm[i]), 0,
+                                memmap[SIFIVE_U_DEV_PWM0].base + (0x1000 * i));
+
+        /* Connect PWM interrupts to the PLIC */
+        for (j = 0; j < SIFIVE_PWM_IRQS; j++) {
+            sysbus_connect_irq(SYS_BUS_DEVICE(&s->pwm[i]), j,
+                               qdev_get_gpio_in(DEVICE(s->plic),
+                                        SIFIVE_U_PWM0_IRQ0 + (i * 4) + j));
+        }
+    }
+
     create_unimplemented_device("riscv.sifive.u.gem-mgmt",
         memmap[SIFIVE_U_DEV_GEM_MGMT].base, memmap[SIFIVE_U_DEV_GEM_MGMT].size);
 
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
     select SIFIVE_UART
     select SIFIVE_U_OTP
     select SIFIVE_U_PRCI
+    select SIFIVE_PWM
     select SSI_M25P80
     select SSI_SD
     select UNIMP
-- 
2.31.1

From: Anup Patel <anup.patel@wdc.com>

We will be upgrading SiFive CLINT implementation into RISC-V ACLINT
implementation so let's first rename the sources.

Signed-off-by: Anup Patel <anup.patel@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 20210831110603.338681-2-anup.patel@wdc.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/intc/{sifive_clint.h => riscv_aclint.h} |  0
 hw/intc/{sifive_clint.c => riscv_aclint.c}         |  2 +-
 hw/riscv/microchip_pfsoc.c                         |  2 +-
 hw/riscv/shakti_c.c                                |  2 +-
 hw/riscv/sifive_e.c                                |  2 +-
 hw/riscv/sifive_u.c                                |  2 +-
 hw/riscv/spike.c                                   |  2 +-
 hw/riscv/virt.c                                    |  2 +-
 hw/intc/Kconfig                                    |  2 +-
 hw/intc/meson.build                                |  2 +-
 hw/riscv/Kconfig                                   | 12 ++++++------
 11 files changed, 15 insertions(+), 15 deletions(-)
 rename include/hw/intc/{sifive_clint.h => riscv_aclint.h} (100%)
 rename hw/intc/{sifive_clint.c => riscv_aclint.c} (99%)

diff --git a/include/hw/intc/sifive_clint.h b/include/hw/intc/riscv_aclint.h
similarity index 100%
rename from include/hw/intc/sifive_clint.h
rename to include/hw/intc/riscv_aclint.h
diff --git a/hw/intc/sifive_clint.c b/hw/intc/riscv_aclint.c
similarity index 99%
rename from hw/intc/sifive_clint.c
rename to hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/sifive_clint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "target/riscv/cpu.h"
 #include "hw/qdev-properties.h"
-#include "hw/intc/sifive_clint.h"
+#include "hw/intc/riscv_aclint.h"
 #include "qemu/timer.h"
 #include "hw/irq.h"
 
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/boot.h"
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/microchip_pfsoc.h"
-#include "hw/intc/sifive_clint.h"
+#include "hw/intc/riscv_aclint.h"
 #include "hw/intc/sifive_plic.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/shakti_c.c
+++ b/hw/riscv/shakti_c.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/shakti_c.h"
 #include "qapi/error.h"
 #include "hw/intc/sifive_plic.h"
-#include "hw/intc/sifive_clint.h"
+#include "hw/intc/riscv_aclint.h"
 #include "sysemu/sysemu.h"
 #include "hw/qdev-properties.h"
 #include "exec/address-spaces.h"
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/sifive_e.h"
 #include "hw/riscv/boot.h"
 #include "hw/char/sifive_uart.h"
-#include "hw/intc/sifive_clint.h"
+#include "hw/intc/riscv_aclint.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_e_prci.h"
 #include "chardev/char.h"
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/sifive_u.h"
 #include "hw/riscv/boot.h"
 #include "hw/char/sifive_uart.h"
-#include "hw/intc/sifive_clint.h"
+#include "hw/intc/riscv_aclint.h"
 #include "hw/intc/sifive_plic.h"
 #include "chardev/char.h"
 #include "net/eth.h"
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
 #include "hw/char/riscv_htif.h"
-#include "hw/intc/sifive_clint.h"
+#include "hw/intc/riscv_aclint.h"
 #include "chardev/char.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
-#include "hw/intc/sifive_clint.h"
+#include "hw/intc/riscv_aclint.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_test.h"
 #include "chardev/char.h"
diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -XXX,XX +XXX,XX @@ config RX_ICU
 config LOONGSON_LIOINTC
     bool
 
-config SIFIVE_CLINT
+config RISCV_ACLINT
     bool
 
 config SIFIVE_PLIC
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: 'CONFIG_RX_ICU', if_true: files('rx_icu.c'))
 specific_ss.add(when: 'CONFIG_S390_FLIC', if_true: files('s390_flic.c'))
 specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: files('s390_flic_kvm.c'))
 specific_ss.add(when: 'CONFIG_SH_INTC', if_true: files('sh_intc.c'))
-specific_ss.add(when: 'CONFIG_SIFIVE_CLINT', if_true: files('sifive_clint.c'))
+specific_ss.add(when: 'CONFIG_RISCV_ACLINT', if_true: files('riscv_aclint.c'))
 specific_ss.add(when: 'CONFIG_SIFIVE_PLIC', if_true: files('sifive_plic.c'))
 specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c'))
 specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_XICS'],
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
     select MCHP_PFSOC_MMUART
     select MCHP_PFSOC_SYSREG
     select MSI_NONBROKEN
-    select SIFIVE_CLINT
+    select RISCV_ACLINT
     select SIFIVE_PDMA
     select SIFIVE_PLIC
     select UNIMP
@@ -XXX,XX +XXX,XX @@ config SHAKTI_C
     bool
     select UNIMP
     select SHAKTI_UART
-    select SIFIVE_CLINT
+    select RISCV_ACLINT
     select SIFIVE_PLIC
 
 config RISCV_VIRT
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select PCI_EXPRESS_GENERIC_BRIDGE
     select PFLASH_CFI01
     select SERIAL
-    select SIFIVE_CLINT
+    select RISCV_ACLINT
     select SIFIVE_PLIC
     select SIFIVE_TEST
     select VIRTIO_MMIO
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
 config SIFIVE_E
     bool
     select MSI_NONBROKEN
-    select SIFIVE_CLINT
+    select RISCV_ACLINT
     select SIFIVE_GPIO
     select SIFIVE_PLIC
     select SIFIVE_UART
@@ -XXX,XX +XXX,XX @@ config SIFIVE_U
     bool
     select CADENCE
     select MSI_NONBROKEN
-    select SIFIVE_CLINT
+    select RISCV_ACLINT
     select SIFIVE_GPIO
     select SIFIVE_PDMA
     select SIFIVE_PLIC
@@ -XXX,XX +XXX,XX @@ config SPIKE
     select RISCV_NUMA
     select HTIF
     select MSI_NONBROKEN
-    select SIFIVE_CLINT
+    select RISCV_ACLINT
     select SIFIVE_PLIC
-- 
2.31.1

From: Anup Patel <anup.patel@wdc.com>

The RISC-V ACLINT is more modular and backward compatible with
original SiFive CLINT so instead of duplicating the original
SiFive CLINT implementation we upgrade the current SiFive CLINT
implementation to RISC-V ACLINT implementation.

diff --git a/include/hw/intc/riscv_aclint.h b/include/hw/intc/riscv_aclint.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/riscv_aclint.h
+++ b/include/hw/intc/riscv_aclint.h
@@ -XXX,XX +XXX,XX @@
 /*
- * SiFive CLINT (Core Local Interruptor) interface
+ * RISC-V ACLINT (Advanced Core Local Interruptor) interface
  *
  * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
  * Copyright (c) 2017 SiFive, Inc.
+ * Copyright (c) 2021 Western Digital Corporation or its affiliates.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -XXX,XX +XXX,XX @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifndef HW_SIFIVE_CLINT_H
-#define HW_SIFIVE_CLINT_H
+#ifndef HW_RISCV_ACLINT_H
+#define HW_RISCV_ACLINT_H
 
 #include "hw/sysbus.h"
 
-#define TYPE_SIFIVE_CLINT "riscv.sifive.clint"
+#define TYPE_RISCV_ACLINT_MTIMER "riscv.aclint.mtimer"
 
-#define SIFIVE_CLINT(obj) \
-    OBJECT_CHECK(SiFiveCLINTState, (obj), TYPE_SIFIVE_CLINT)
+#define RISCV_ACLINT_MTIMER(obj) \
+    OBJECT_CHECK(RISCVAclintMTimerState, (obj), TYPE_RISCV_ACLINT_MTIMER)
 
-typedef struct SiFiveCLINTState {
+typedef struct RISCVAclintMTimerState {
     /*< private >*/
     SysBusDevice parent_obj;
 
@@ -XXX,XX +XXX,XX @@ typedef struct SiFiveCLINTState {
     MemoryRegion mmio;
     uint32_t hartid_base;
     uint32_t num_harts;
-    uint32_t sip_base;
     uint32_t timecmp_base;
     uint32_t time_base;
     uint32_t aperture_size;
     uint32_t timebase_freq;
     qemu_irq *timer_irqs;
-    qemu_irq *soft_irqs;
-} SiFiveCLINTState;
+} RISCVAclintMTimerState;
 
-DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
-    uint32_t hartid_base, uint32_t num_harts, uint32_t sip_base,
+DeviceState *riscv_aclint_mtimer_create(hwaddr addr, hwaddr size,
+    uint32_t hartid_base, uint32_t num_harts,
     uint32_t timecmp_base, uint32_t time_base, uint32_t timebase_freq,
     bool provide_rdtime);
 
-enum {
-    SIFIVE_SIP_BASE     = 0x0,
-    SIFIVE_TIMECMP_BASE = 0x4000,
-    SIFIVE_TIME_BASE    = 0xBFF8
-};
+#define TYPE_RISCV_ACLINT_SWI "riscv.aclint.swi"
+
+#define RISCV_ACLINT_SWI(obj) \
+    OBJECT_CHECK(RISCVAclintSwiState, (obj), TYPE_RISCV_ACLINT_SWI)
+
+typedef struct RISCVAclintSwiState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion mmio;
+    uint32_t hartid_base;
+    uint32_t num_harts;
+    uint32_t sswi;
+    qemu_irq *soft_irqs;
+} RISCVAclintSwiState;
+
+DeviceState *riscv_aclint_swi_create(hwaddr addr, uint32_t hartid_base,
+    uint32_t num_harts, bool sswi);
 
 enum {
-    SIFIVE_CLINT_TIMEBASE_FREQ = 10000000
+    RISCV_ACLINT_DEFAULT_MTIMECMP      = 0x0,
+    RISCV_ACLINT_DEFAULT_MTIME         = 0x7ff8,
+    RISCV_ACLINT_DEFAULT_MTIMER_SIZE   = 0x8000,
+    RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ = 10000000,
+    RISCV_ACLINT_MAX_HARTS             = 4095,
+    RISCV_ACLINT_SWI_SIZE              = 0x4000
 };
 
 #endif
diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@
 /*
- * SiFive CLINT (Core Local Interruptor)
+ * RISC-V ACLINT (Advanced Core Local Interruptor)
+ * URL: https://github.com/riscv/riscv-aclint
  *
  * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
  * Copyright (c) 2017 SiFive, Inc.
+ * Copyright (c) 2021 Western Digital Corporation or its affiliates.
  *
  * This provides real-time clock, timer and interprocessor interrupts.
  *
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
+#include "qemu/log.h"
 #include "qemu/module.h"
 #include "hw/sysbus.h"
 #include "target/riscv/cpu.h"
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "hw/irq.h"
 
-typedef struct sifive_clint_callback {
-    SiFiveCLINTState *s;
+typedef struct riscv_aclint_mtimer_callback {
+    RISCVAclintMTimerState *s;
     int num;
-} sifive_clint_callback;
+} riscv_aclint_mtimer_callback;
 
 static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
 {
@@ -XXX,XX +XXX,XX @@ static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
  * Called when timecmp is written to update the QEMU timer or immediately
  * trigger timer interrupt if mtimecmp <= current timer value.
  */
-static void sifive_clint_write_timecmp(SiFiveCLINTState *s, RISCVCPU *cpu,
-                                       int hartid,
-                                       uint64_t value,
-                                       uint32_t timebase_freq)
+static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
+                                              RISCVCPU *cpu,
+                                              int hartid,
+                                              uint64_t value,
+                                              uint32_t timebase_freq)
 {
     uint64_t next;
     uint64_t diff;
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write_timecmp(SiFiveCLINTState *s, RISCVCPU *cpu,
 
     cpu->env.timecmp = value;
     if (cpu->env.timecmp <= rtc_r) {
-        /* if we're setting an MTIMECMP value in the "past",
-           immediately raise the timer interrupt */
-        qemu_irq_raise(s->timer_irqs[hartid - s->hartid_base]);
+        /*
+         * If we're setting an MTIMECMP value in the "past",
+         * immediately raise the timer interrupt
+         */
+        qemu_irq_raise(mtimer->timer_irqs[hartid - mtimer->hartid_base]);
         return;
     }
 
     /* otherwise, set up the future timer interrupt */
-    qemu_irq_lower(s->timer_irqs[hartid - s->hartid_base]);
+    qemu_irq_lower(mtimer->timer_irqs[hartid - mtimer->hartid_base]);
     diff = cpu->env.timecmp - rtc_r;
     /* back to ns (note args switched in muldiv64) */
     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
@@ -XXX,XX +XXX,XX @@ static void sifive_clint_write_timecmp(SiFiveCLINTState *s, RISCVCPU *cpu,
  * Callback used when the timer set using timer_mod expires.
  * Should raise the timer interrupt line
  */
-static void sifive_clint_timer_cb(void *opaque)
+static void riscv_aclint_mtimer_cb(void *opaque)
 {
-    sifive_clint_callback *state = opaque;
+    riscv_aclint_mtimer_callback *state = opaque;
 
     qemu_irq_raise(state->s->timer_irqs[state->num]);
 }
 
-/* CPU wants to read rtc or timecmp register */
-static uint64_t sifive_clint_read(void *opaque, hwaddr addr, unsigned size)
+/* CPU read MTIMER register */
+static uint64_t riscv_aclint_mtimer_read(void *opaque, hwaddr addr,
+    unsigned size)
 {
-    SiFiveCLINTState *clint = opaque;
-    if (addr >= clint->sip_base &&
-        addr < clint->sip_base + (clint->num_harts << 2)) {
-        size_t hartid = clint->hartid_base + ((addr - clint->sip_base) >> 2);
-        CPUState *cpu = qemu_get_cpu(hartid);
-        CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
-        if (!env) {
-            error_report("clint: invalid timecmp hartid: %zu", hartid);
-        } else if ((addr & 0x3) == 0) {
-            return (env->mip & MIP_MSIP) > 0;
-        } else {
-            error_report("clint: invalid read: %08x", (uint32_t)addr);
-            return 0;
-        }
-    } else if (addr >= clint->timecmp_base &&
-        addr < clint->timecmp_base + (clint->num_harts << 3)) {
-        size_t hartid = clint->hartid_base +
-            ((addr - clint->timecmp_base) >> 3);
+    RISCVAclintMTimerState *mtimer = opaque;
+
+    if (addr >= mtimer->timecmp_base &&
+        addr < (mtimer->timecmp_base + (mtimer->num_harts << 3))) {
+        size_t hartid = mtimer->hartid_base +
+                        ((addr - mtimer->timecmp_base) >> 3);
         CPUState *cpu = qemu_get_cpu(hartid);
         CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
         if (!env) {
-            error_report("clint: invalid timecmp hartid: %zu", hartid);
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "aclint-mtimer: invalid hartid: %zu", hartid);
         } else if ((addr & 0x7) == 0) {
             /* timecmp_lo */
             uint64_t timecmp = env->timecmp;
@@ -XXX,XX +XXX,XX @@ static uint64_t sifive_clint_read(void *opaque, hwaddr addr, unsigned size)
             uint64_t timecmp = env->timecmp;
             return (timecmp >> 32) & 0xFFFFFFFF;
         } else {
-            error_report("clint: invalid read: %08x", (uint32_t)addr);
+            qemu_log_mask(LOG_UNIMP,
+                          "aclint-mtimer: invalid read: %08x", (uint32_t)addr);
             return 0;
         }
-    } else if (addr == clint->time_base) {
+    } else if (addr == mtimer->time_base) {
         /* time_lo */
-        return cpu_riscv_read_rtc(clint->timebase_freq) & 0xFFFFFFFF;
-    } else if (addr == clint->time_base + 4) {
+        return cpu_riscv_read_rtc(mtimer->timebase_freq) & 0xFFFFFFFF;
+    } else if (addr == mtimer->time_base + 4) {
         /* time_hi */
-        return (cpu_riscv_read_rtc(clint->timebase_freq) >> 32) & 0xFFFFFFFF;
+        return (cpu_riscv_read_rtc(mtimer->timebase_freq) >> 32) & 0xFFFFFFFF;
     }
 
-    error_report("clint: invalid read: %08x", (uint32_t)addr);
+    qemu_log_mask(LOG_UNIMP,
+                  "aclint-mtimer: invalid read: %08x", (uint32_t)addr);
     return 0;
 }
 
-/* CPU wrote to rtc or timecmp register */
-static void sifive_clint_write(void *opaque, hwaddr addr, uint64_t value,
-        unsigned size)
+/* CPU write MTIMER register */
+static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
+    uint64_t value, unsigned size)
 {
-    SiFiveCLINTState *clint = opaque;
+    RISCVAclintMTimerState *mtimer = opaque;
 
-    if (addr >= clint->sip_base &&
-        addr < clint->sip_base + (clint->num_harts << 2)) {
-        size_t hartid = clint->hartid_base + ((addr - clint->sip_base) >> 2);
-        CPUState *cpu = qemu_get_cpu(hartid);
-        CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
-        if (!env) {
-            error_report("clint: invalid timecmp hartid: %zu", hartid);
-        } else if ((addr & 0x3) == 0) {
-            qemu_set_irq(clint->soft_irqs[hartid - clint->hartid_base], value);
-        } else {
-            error_report("clint: invalid sip write: %08x", (uint32_t)addr);
-        }
-        return;
-    } else if (addr >= clint->timecmp_base &&
-        addr < clint->timecmp_base + (clint->num_harts << 3)) {
-        size_t hartid = clint->hartid_base +
-            ((addr - clint->timecmp_base) >> 3);
+    if (addr >= mtimer->timecmp_base &&
+        addr < (mtimer->timecmp_base + (mtimer->num_harts << 3))) {
+        size_t hartid = mtimer->hartid_base +
+                        ((addr - mtimer->timecmp_base) >> 3);
         CPUState *cpu = qemu_get_cpu(hartid);
         CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
         if (!env) {
-            error_report("clint: invalid timecmp hartid: %zu", hartid);
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "aclint-mtimer: invalid hartid: %zu", hartid);
         } else if ((addr & 0x7) == 0) {
             /* timecmp_lo */
             uint64_t timecmp_hi = env->timecmp >> 32;
-            sifive_clint_write_timecmp(clint, RISCV_CPU(cpu), hartid,
-                timecmp_hi << 32 | (value & 0xFFFFFFFF), clint->timebase_freq);
+            riscv_aclint_mtimer_write_timecmp(mtimer, RISCV_CPU(cpu), hartid,
+                timecmp_hi << 32 | (value & 0xFFFFFFFF),
+                mtimer->timebase_freq);
             return;
         } else if ((addr & 0x7) == 4) {
             /* timecmp_hi */
             uint64_t timecmp_lo = env->timecmp;
-            sifive_clint_write_timecmp(clint, RISCV_CPU(cpu), hartid,
-                value << 32 | (timecmp_lo & 0xFFFFFFFF), clint->timebase_freq);
+            riscv_aclint_mtimer_write_timecmp(mtimer, RISCV_CPU(cpu), hartid,
+                value << 32 | (timecmp_lo & 0xFFFFFFFF),
+                mtimer->timebase_freq);
         } else {
-            error_report("clint: invalid timecmp write: %08x", (uint32_t)addr);
+            qemu_log_mask(LOG_UNIMP,
+                          "aclint-mtimer: invalid timecmp write: %08x",
+                          (uint32_t)addr);
         }
         return;
-    } else if (addr == clint->time_base) {
+    } else if (addr == mtimer->time_base) {
         /* time_lo */
-        error_report("clint: time_lo write not implemented");
+        qemu_log_mask(LOG_UNIMP,
+                      "aclint-mtimer: time_lo write not implemented");
         return;
-    } else if (addr == clint->time_base + 4) {
+    } else if (addr == mtimer->time_base + 4) {
         /* time_hi */
-        error_report("clint: time_hi write not implemented");
+        qemu_log_mask(LOG_UNIMP,
+                      "aclint-mtimer: time_hi write not implemented");
         return;
     }
 
-    error_report("clint: invalid write: %08x", (uint32_t)addr);
+    qemu_log_mask(LOG_UNIMP,
+                  "aclint-mtimer: invalid write: %08x", (uint32_t)addr);
 }
 
-static const MemoryRegionOps sifive_clint_ops = {
-    .read = sifive_clint_read,
-    .write = sifive_clint_write,
+static const MemoryRegionOps riscv_aclint_mtimer_ops = {
+    .read = riscv_aclint_mtimer_read,
+    .write = riscv_aclint_mtimer_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
     .valid = {
         .min_access_size = 4,
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps sifive_clint_ops = {
     }
 };
 
-static Property sifive_clint_properties[] = {
-    DEFINE_PROP_UINT32("hartid-base", SiFiveCLINTState, hartid_base, 0),
-    DEFINE_PROP_UINT32("num-harts", SiFiveCLINTState, num_harts, 0),
-    DEFINE_PROP_UINT32("sip-base", SiFiveCLINTState, sip_base, 0),
-    DEFINE_PROP_UINT32("timecmp-base", SiFiveCLINTState, timecmp_base, 0),
-    DEFINE_PROP_UINT32("time-base", SiFiveCLINTState, time_base, 0),
-    DEFINE_PROP_UINT32("aperture-size", SiFiveCLINTState, aperture_size, 0),
-    DEFINE_PROP_UINT32("timebase-freq", SiFiveCLINTState, timebase_freq, 0),
+static Property riscv_aclint_mtimer_properties[] = {
+    DEFINE_PROP_UINT32("hartid-base", RISCVAclintMTimerState,
+        hartid_base, 0),
+    DEFINE_PROP_UINT32("num-harts", RISCVAclintMTimerState, num_harts, 1),
+    DEFINE_PROP_UINT32("timecmp-base", RISCVAclintMTimerState,
+        timecmp_base, RISCV_ACLINT_DEFAULT_MTIMECMP),
+    DEFINE_PROP_UINT32("time-base", RISCVAclintMTimerState,
+        time_base, RISCV_ACLINT_DEFAULT_MTIME),
+    DEFINE_PROP_UINT32("aperture-size", RISCVAclintMTimerState,
+        aperture_size, RISCV_ACLINT_DEFAULT_MTIMER_SIZE),
+    DEFINE_PROP_UINT32("timebase-freq", RISCVAclintMTimerState,
+        timebase_freq, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-static void sifive_clint_realize(DeviceState *dev, Error **errp)
+static void riscv_aclint_mtimer_realize(DeviceState *dev, Error **errp)
 {
-    SiFiveCLINTState *s = SIFIVE_CLINT(dev);
-    memory_region_init_io(&s->mmio, OBJECT(dev), &sifive_clint_ops, s,
-                          TYPE_SIFIVE_CLINT, s->aperture_size);
+    RISCVAclintMTimerState *s = RISCV_ACLINT_MTIMER(dev);
+    int i;
+
+    memory_region_init_io(&s->mmio, OBJECT(dev), &riscv_aclint_mtimer_ops,
+                          s, TYPE_RISCV_ACLINT_MTIMER, s->aperture_size);
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
 
     s->timer_irqs = g_malloc(sizeof(qemu_irq) * s->num_harts);
     qdev_init_gpio_out(dev, s->timer_irqs, s->num_harts);
 
-    s->soft_irqs = g_malloc(sizeof(qemu_irq) * s->num_harts);
-    qdev_init_gpio_out(dev, s->soft_irqs, s->num_harts);
+    /* Claim timer interrupt bits */
+    for (i = 0; i < s->num_harts; i++) {
+        RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(s->hartid_base + i));
+        if (riscv_cpu_claim_interrupts(cpu, MIP_MTIP) < 0) {
+            error_report("MTIP already claimed");
+            exit(1);
+        }
+    }
 }
 
-static void sifive_clint_class_init(ObjectClass *klass, void *data)
+static void riscv_aclint_mtimer_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    dc->realize = sifive_clint_realize;
-    device_class_set_props(dc, sifive_clint_properties);
+    dc->realize = riscv_aclint_mtimer_realize;
+    device_class_set_props(dc, riscv_aclint_mtimer_properties);
 }
 
-static const TypeInfo sifive_clint_info = {
-    .name          = TYPE_SIFIVE_CLINT,
+static const TypeInfo riscv_aclint_mtimer_info = {
+    .name          = TYPE_RISCV_ACLINT_MTIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(SiFiveCLINTState),
-    .class_init    = sifive_clint_class_init,
+    .instance_size = sizeof(RISCVAclintMTimerState),
+    .class_init    = riscv_aclint_mtimer_class_init,
 };
 
-static void sifive_clint_register_types(void)
-{
-    type_register_static(&sifive_clint_info);
-}
-
-type_init(sifive_clint_register_types)
-
 /*
- * Create CLINT device.
+ * Create ACLINT MTIMER device.
  */
-DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
-    uint32_t hartid_base, uint32_t num_harts, uint32_t sip_base,
+DeviceState *riscv_aclint_mtimer_create(hwaddr addr, hwaddr size,
+    uint32_t hartid_base, uint32_t num_harts,
     uint32_t timecmp_base, uint32_t time_base, uint32_t timebase_freq,
     bool provide_rdtime)
 {
     int i;
+    DeviceState *dev = qdev_new(TYPE_RISCV_ACLINT_MTIMER);
+
+    assert(num_harts <= RISCV_ACLINT_MAX_HARTS);
+    assert(!(addr & 0x7));
+    assert(!(timecmp_base & 0x7));
+    assert(!(time_base & 0x7));
 
-    DeviceState *dev = qdev_new(TYPE_SIFIVE_CLINT);
     qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
     qdev_prop_set_uint32(dev, "num-harts", num_harts);
-    qdev_prop_set_uint32(dev, "sip-base", sip_base);
     qdev_prop_set_uint32(dev, "timecmp-base", timecmp_base);
     qdev_prop_set_uint32(dev, "time-base", time_base);
     qdev_prop_set_uint32(dev, "aperture-size", size);
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
         CPUState *cpu = qemu_get_cpu(hartid_base + i);
         RISCVCPU *rvcpu = RISCV_CPU(cpu);
         CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
-        sifive_clint_callback *cb = g_malloc0(sizeof(sifive_clint_callback));
+        riscv_aclint_mtimer_callback *cb =
+            g_malloc0(sizeof(riscv_aclint_mtimer_callback));
 
         if (!env) {
             g_free(cb);
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_clint_create(hwaddr addr, hwaddr size,
             riscv_cpu_set_rdtime_fn(env, cpu_riscv_read_rtc, timebase_freq);
         }
 
-        cb->s = SIFIVE_CLINT(dev);
+        cb->s = RISCV_ACLINT_MTIMER(dev);
         cb->num = i;
         env->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                  &sifive_clint_timer_cb, cb);
+                                  &riscv_aclint_mtimer_cb, cb);
         env->timecmp = 0;
 
         qdev_connect_gpio_out(dev, i,
                               qdev_get_gpio_in(DEVICE(rvcpu), IRQ_M_TIMER));
-        qdev_connect_gpio_out(dev, num_harts + i,
-                              qdev_get_gpio_in(DEVICE(rvcpu), IRQ_M_SOFT));
     }
 
     return dev;
 }
+
+/* CPU read [M|S]SWI register */
+static uint64_t riscv_aclint_swi_read(void *opaque, hwaddr addr,
+    unsigned size)
+{
+    RISCVAclintSwiState *swi = opaque;
+
+    if (addr < (swi->num_harts << 2)) {
+        size_t hartid = swi->hartid_base + (addr >> 2);
+        CPUState *cpu = qemu_get_cpu(hartid);
+        CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
+        if (!env) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "aclint-swi: invalid hartid: %zu", hartid);
+        } else if ((addr & 0x3) == 0) {
+            return (swi->sswi) ? 0 : ((env->mip & MIP_MSIP) > 0);
+        }
+    }
+
+    qemu_log_mask(LOG_UNIMP,
+                  "aclint-swi: invalid read: %08x", (uint32_t)addr);
+    return 0;
+}
+
+/* CPU write [M|S]SWI register */
+static void riscv_aclint_swi_write(void *opaque, hwaddr addr, uint64_t value,
+        unsigned size)
+{
+    RISCVAclintSwiState *swi = opaque;
+
+    if (addr < (swi->num_harts << 2)) {
+        size_t hartid = swi->hartid_base + (addr >> 2);
+        CPUState *cpu = qemu_get_cpu(hartid);
+        CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
+        if (!env) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "aclint-swi: invalid hartid: %zu", hartid);
+        } else if ((addr & 0x3) == 0) {
+            if (value & 0x1) {
+                qemu_irq_raise(swi->soft_irqs[hartid - swi->hartid_base]);
+            } else {
+                if (!swi->sswi) {
+                    qemu_irq_lower(swi->soft_irqs[hartid - swi->hartid_base]);
+                }
+            }
+            return;
+        }
+    }
+
+    qemu_log_mask(LOG_UNIMP,
+                  "aclint-swi: invalid write: %08x", (uint32_t)addr);
+}
+
+static const MemoryRegionOps riscv_aclint_swi_ops = {
+    .read = riscv_aclint_swi_read,
+    .write = riscv_aclint_swi_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4
+    }
+};
+
+static Property riscv_aclint_swi_properties[] = {
+    DEFINE_PROP_UINT32("hartid-base", RISCVAclintSwiState, hartid_base, 0),
+    DEFINE_PROP_UINT32("num-harts", RISCVAclintSwiState, num_harts, 1),
+    DEFINE_PROP_UINT32("sswi", RISCVAclintSwiState, sswi, false),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void riscv_aclint_swi_realize(DeviceState *dev, Error **errp)
+{
+    RISCVAclintSwiState *swi = RISCV_ACLINT_SWI(dev);
+    int i;
+
+    memory_region_init_io(&swi->mmio, OBJECT(dev), &riscv_aclint_swi_ops, swi,
+                          TYPE_RISCV_ACLINT_SWI, RISCV_ACLINT_SWI_SIZE);
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &swi->mmio);
+
+    swi->soft_irqs = g_malloc(sizeof(qemu_irq) * swi->num_harts);
+    qdev_init_gpio_out(dev, swi->soft_irqs, swi->num_harts);
+
+    /* Claim software interrupt bits */
+    for (i = 0; i < swi->num_harts; i++) {
+        RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(swi->hartid_base + i));
+        /* We don't claim mip.SSIP because it is writeable by software */
+        if (riscv_cpu_claim_interrupts(cpu, swi->sswi ? 0 : MIP_MSIP) < 0) {
+            error_report("MSIP already claimed");
+            exit(1);
+        }
+    }
+}
+
+static void riscv_aclint_swi_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    dc->realize = riscv_aclint_swi_realize;
+    device_class_set_props(dc, riscv_aclint_swi_properties);
+}
+
+static const TypeInfo riscv_aclint_swi_info = {
+    .name          = TYPE_RISCV_ACLINT_SWI,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(RISCVAclintSwiState),
+    .class_init    = riscv_aclint_swi_class_init,
+};
+
+/*
+ * Create ACLINT [M|S]SWI device.
+ */
+DeviceState *riscv_aclint_swi_create(hwaddr addr, uint32_t hartid_base,
+    uint32_t num_harts, bool sswi)
+{
+    int i;
+    DeviceState *dev = qdev_new(TYPE_RISCV_ACLINT_SWI);
+
+    assert(num_harts <= RISCV_ACLINT_MAX_HARTS);
+    assert(!(addr & 0x3));
+
+    qdev_prop_set_uint32(dev, "hartid-base", hartid_base);
+    qdev_prop_set_uint32(dev, "num-harts", num_harts);
+    qdev_prop_set_uint32(dev, "sswi", sswi ? true : false);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+
+    for (i = 0; i < num_harts; i++) {
+        CPUState *cpu = qemu_get_cpu(hartid_base + i);
+        RISCVCPU *rvcpu = RISCV_CPU(cpu);
+
+        qdev_connect_gpio_out(dev, i,
+                              qdev_get_gpio_in(DEVICE(rvcpu),
+                                  (sswi) ? IRQ_S_SOFT : IRQ_M_SOFT));
+    }
+
+    return dev;
+}
+
+static void riscv_aclint_register_types(void)
+{
+    type_register_static(&riscv_aclint_mtimer_info);
+    type_register_static(&riscv_aclint_swi_info);
+}
+
+type_init(riscv_aclint_register_types)
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
         memmap[MICROCHIP_PFSOC_BUSERR_UNIT4].size);
 
     /* CLINT */
-    sifive_clint_create(memmap[MICROCHIP_PFSOC_CLINT].base,
-        memmap[MICROCHIP_PFSOC_CLINT].size, 0, ms->smp.cpus,
-        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
+    riscv_aclint_swi_create(memmap[MICROCHIP_PFSOC_CLINT].base,
+        0, ms->smp.cpus, false);
+    riscv_aclint_mtimer_create(
+        memmap[MICROCHIP_PFSOC_CLINT].base + RISCV_ACLINT_SWI_SIZE,
+        RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
+        RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
         CLINT_TIMEBASE_FREQ, false);
 
     /* L2 cache controller */
diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/shakti_c.c
+++ b/hw/riscv/shakti_c.c
@@ -XXX,XX +XXX,XX @@ static void shakti_c_soc_state_realize(DeviceState *dev, Error **errp)
         SHAKTI_C_PLIC_CONTEXT_STRIDE,
         shakti_c_memmap[SHAKTI_C_PLIC].size);
 
-    sifive_clint_create(shakti_c_memmap[SHAKTI_C_CLINT].base,
-        shakti_c_memmap[SHAKTI_C_CLINT].size, 0, 1,
-        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
-        SIFIVE_CLINT_TIMEBASE_FREQ, false);
+    riscv_aclint_swi_create(shakti_c_memmap[SHAKTI_C_CLINT].base,
+        0, 1, false);
+    riscv_aclint_mtimer_create(shakti_c_memmap[SHAKTI_C_CLINT].base +
+            RISCV_ACLINT_SWI_SIZE,
+        RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, 1,
+        RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
+        RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
 
     qdev_prop_set_chr(DEVICE(&(sss->uart)), "chardev", serial_hd(0));
     if (!sysbus_realize(SYS_BUS_DEVICE(&sss->uart), errp)) {
diff --git a/hw/riscv/sifive_e.c b/hw/riscv/sifive_e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_e.c
+++ b/hw/riscv/sifive_e.c
@@ -XXX,XX +XXX,XX @@ static void sifive_e_soc_realize(DeviceState *dev, Error **errp)
         SIFIVE_E_PLIC_CONTEXT_BASE,
         SIFIVE_E_PLIC_CONTEXT_STRIDE,
         memmap[SIFIVE_E_DEV_PLIC].size);
-    sifive_clint_create(memmap[SIFIVE_E_DEV_CLINT].base,
-        memmap[SIFIVE_E_DEV_CLINT].size, 0, ms->smp.cpus,
-        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
-        SIFIVE_CLINT_TIMEBASE_FREQ, false);
+    riscv_aclint_swi_create(memmap[SIFIVE_E_DEV_CLINT].base,
+        0, ms->smp.cpus, false);
+    riscv_aclint_mtimer_create(memmap[SIFIVE_E_DEV_CLINT].base +
+            RISCV_ACLINT_SWI_SIZE,
+        RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
+        RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
+        RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
     create_unimplemented_device("riscv.sifive.e.aon",
         memmap[SIFIVE_E_DEV_AON].base, memmap[SIFIVE_E_DEV_AON].size);
     sifive_e_prci_create(memmap[SIFIVE_E_DEV_PRCI].base);
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void sifive_u_soc_realize(DeviceState *dev, Error **errp)
         serial_hd(0), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_U_UART0_IRQ));
     sifive_uart_create(system_memory, memmap[SIFIVE_U_DEV_UART1].base,
         serial_hd(1), qdev_get_gpio_in(DEVICE(s->plic), SIFIVE_U_UART1_IRQ));
-    sifive_clint_create(memmap[SIFIVE_U_DEV_CLINT].base,
-        memmap[SIFIVE_U_DEV_CLINT].size, 0, ms->smp.cpus,
-        SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
+    riscv_aclint_swi_create(memmap[SIFIVE_U_DEV_CLINT].base, 0,
+        ms->smp.cpus, false);
+    riscv_aclint_mtimer_create(memmap[SIFIVE_U_DEV_CLINT].base +
+            RISCV_ACLINT_SWI_SIZE,
+        RISCV_ACLINT_DEFAULT_MTIMER_SIZE, 0, ms->smp.cpus,
+        RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
         CLINT_TIMEBASE_FREQ, false);
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->prci), errp)) {
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
 
     qemu_fdt_add_subnode(fdt, "/cpus");
     qemu_fdt_setprop_cell(fdt, "/cpus", "timebase-frequency",
-        SIFIVE_CLINT_TIMEBASE_FREQ);
+        RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ);
     qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0x0);
     qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 0x1);
     qemu_fdt_add_subnode(fdt, "/cpus/cpu-map");
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_abort);
 
         /* Core Local Interruptor (timer and IPI) for each socket */
-        sifive_clint_create(
+        riscv_aclint_swi_create(
             memmap[SPIKE_CLINT].base + i * memmap[SPIKE_CLINT].size,
-            memmap[SPIKE_CLINT].size, base_hartid, hart_count,
-            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
-            SIFIVE_CLINT_TIMEBASE_FREQ, false);
+            base_hartid, hart_count, false);
+        riscv_aclint_mtimer_create(
+            memmap[SPIKE_CLINT].base + i * memmap[SPIKE_CLINT].size +
+                RISCV_ACLINT_SWI_SIZE,
+            RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
+            RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
+            RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, false);
     }
 
     /* register system main memory (actual RAM) */
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
 
     qemu_fdt_add_subnode(fdt, "/cpus");
     qemu_fdt_setprop_cell(fdt, "/cpus", "timebase-frequency",
-                          SIFIVE_CLINT_TIMEBASE_FREQ);
+                          RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ);
     qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0x0);
     qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 0x1);
     qemu_fdt_add_subnode(fdt, "/cpus/cpu-map");
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_abort);
 
         /* Per-socket CLINT */
-        sifive_clint_create(
+        riscv_aclint_swi_create(
             memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
-            memmap[VIRT_CLINT].size, base_hartid, hart_count,
-            SIFIVE_SIP_BASE, SIFIVE_TIMECMP_BASE, SIFIVE_TIME_BASE,
-            SIFIVE_CLINT_TIMEBASE_FREQ, true);
+            base_hartid, hart_count, false);
+        riscv_aclint_mtimer_create(
+            memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size +
+                RISCV_ACLINT_SWI_SIZE,
+            RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
+            RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
+            RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
 
         /* Per-socket PLIC hart topology configuration string */
         plic_hart_config = plic_hart_config_string(hart_count);
-- 
2.31.1

From: Anup Patel <anup.patel@wdc.com>

We re-factor and break the FDT generation into smaller functions
so that it is easier to modify FDT generation for different
configurations of virt machine.

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_pcie_irq_map(void *fdt, char *nodename,
                            0x1800, 0, 0, 0x7);
 }
 
-static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
-                       uint64_t mem_size, const char *cmdline, bool is_32_bit)
+static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
+                                   char *clust_name, uint32_t *phandle,
+                                   bool is_32_bit, uint32_t *intc_phandles)
 {
-    void *fdt;
-    int i, cpu, socket;
+    int cpu;
+    uint32_t cpu_phandle;
     MachineState *mc = MACHINE(s);
+    char *name, *cpu_name, *core_name, *intc_name;
+
+    for (cpu = s->soc[socket].num_harts - 1; cpu >= 0; cpu--) {
+        cpu_phandle = (*phandle)++;
+
+        cpu_name = g_strdup_printf("/cpus/cpu@%d",
+            s->soc[socket].hartid_base + cpu);
+        qemu_fdt_add_subnode(mc->fdt, cpu_name);
+        qemu_fdt_setprop_string(mc->fdt, cpu_name, "mmu-type",
+            (is_32_bit) ? "riscv,sv32" : "riscv,sv48");
+        name = riscv_isa_string(&s->soc[socket].harts[cpu]);
+        qemu_fdt_setprop_string(mc->fdt, cpu_name, "riscv,isa", name);
+        g_free(name);
+        qemu_fdt_setprop_string(mc->fdt, cpu_name, "compatible", "riscv");
+        qemu_fdt_setprop_string(mc->fdt, cpu_name, "status", "okay");
+        qemu_fdt_setprop_cell(mc->fdt, cpu_name, "reg",
+            s->soc[socket].hartid_base + cpu);
+        qemu_fdt_setprop_string(mc->fdt, cpu_name, "device_type", "cpu");
+        riscv_socket_fdt_write_id(mc, mc->fdt, cpu_name, socket);
+        qemu_fdt_setprop_cell(mc->fdt, cpu_name, "phandle", cpu_phandle);
+
+        intc_phandles[cpu] = (*phandle)++;
+
+        intc_name = g_strdup_printf("%s/interrupt-controller", cpu_name);
+        qemu_fdt_add_subnode(mc->fdt, intc_name);
+        qemu_fdt_setprop_cell(mc->fdt, intc_name, "phandle",
+            intc_phandles[cpu]);
+        qemu_fdt_setprop_string(mc->fdt, intc_name, "compatible",
+            "riscv,cpu-intc");
+        qemu_fdt_setprop(mc->fdt, intc_name, "interrupt-controller", NULL, 0);
+        qemu_fdt_setprop_cell(mc->fdt, intc_name, "#interrupt-cells", 1);
+
+        core_name = g_strdup_printf("%s/core%d", clust_name, cpu);
+        qemu_fdt_add_subnode(mc->fdt, core_name);
+        qemu_fdt_setprop_cell(mc->fdt, core_name, "cpu", cpu_phandle);
+
+        g_free(core_name);
+        g_free(intc_name);
+        g_free(cpu_name);
+    }
+}
+
+static void create_fdt_socket_memory(RISCVVirtState *s,
+                                     const MemMapEntry *memmap, int socket)
+{
+    char *mem_name;
     uint64_t addr, size;
-    uint32_t *clint_cells, *plic_cells;
-    unsigned long clint_addr, plic_addr;
-    uint32_t plic_phandle[MAX_NODES];
-    uint32_t cpu_phandle, intc_phandle, test_phandle;
-    uint32_t phandle = 1, plic_mmio_phandle = 1;
-    uint32_t plic_pcie_phandle = 1, plic_virtio_phandle = 1;
-    char *mem_name, *cpu_name, *core_name, *intc_name;
-    char *name, *clint_name, *plic_name, *clust_name;
-    hwaddr flashsize = virt_memmap[VIRT_FLASH].size / 2;
-    hwaddr flashbase = virt_memmap[VIRT_FLASH].base;
+    MachineState *mc = MACHINE(s);
+
+    addr = memmap[VIRT_DRAM].base + riscv_socket_mem_offset(mc, socket);
+    size = riscv_socket_mem_size(mc, socket);
+    mem_name = g_strdup_printf("/memory@%lx", (long)addr);
+    qemu_fdt_add_subnode(mc->fdt, mem_name);
+    qemu_fdt_setprop_cells(mc->fdt, mem_name, "reg",
+        addr >> 32, addr, size >> 32, size);
+    qemu_fdt_setprop_string(mc->fdt, mem_name, "device_type", "memory");
+    riscv_socket_fdt_write_id(mc, mc->fdt, mem_name, socket);
+    g_free(mem_name);
+}
+
+static void create_fdt_socket_clint(RISCVVirtState *s,
+                                    const MemMapEntry *memmap, int socket,
+                                    uint32_t *intc_phandles)
+{
+    int cpu;
+    char *clint_name;
+    uint32_t *clint_cells;
+    unsigned long clint_addr;
+    MachineState *mc = MACHINE(s);
     static const char * const clint_compat[2] = {
         "sifive,clint0", "riscv,clint0"
     };
+
+    clint_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
+
+    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+        clint_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
+        clint_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_SOFT);
+        clint_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
+        clint_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_M_TIMER);
+    }
+
+    clint_addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
+    clint_name = g_strdup_printf("/soc/clint@%lx", clint_addr);
+    qemu_fdt_add_subnode(mc->fdt, clint_name);
+    qemu_fdt_setprop_string_array(mc->fdt, clint_name, "compatible",
+                                  (char **)&clint_compat,
+                                  ARRAY_SIZE(clint_compat));
+    qemu_fdt_setprop_cells(mc->fdt, clint_name, "reg",
+        0x0, clint_addr, 0x0, memmap[VIRT_CLINT].size);
+    qemu_fdt_setprop(mc->fdt, clint_name, "interrupts-extended",
+        clint_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
+    riscv_socket_fdt_write_id(mc, mc->fdt, clint_name, socket);
+    g_free(clint_name);
+
+    g_free(clint_cells);
+}
+
+static void create_fdt_socket_plic(RISCVVirtState *s,
+                                   const MemMapEntry *memmap, int socket,
+                                   uint32_t *phandle, uint32_t *intc_phandles,
+                                   uint32_t *plic_phandles)
+{
+    int cpu;
+    char *plic_name;
+    uint32_t *plic_cells;
+    unsigned long plic_addr;
+    MachineState *mc = MACHINE(s);
     static const char * const plic_compat[2] = {
         "sifive,plic-1.0.0", "riscv,plic0"
     };
 
-    if (mc->dtb) {
-        fdt = mc->fdt = load_device_tree(mc->dtb, &s->fdt_size);
-        if (!fdt) {
-            error_report("load_device_tree() failed");
-            exit(1);
-        }
-        goto update_bootargs;
-    } else {
-        fdt = mc->fdt = create_device_tree(&s->fdt_size);
-        if (!fdt) {
-            error_report("create_device_tree() failed");
-            exit(1);
-        }
+    plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
+
+    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+        plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
+        plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
+        plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
+        plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
     }
 
-    qemu_fdt_setprop_string(fdt, "/", "model", "riscv-virtio,qemu");
-    qemu_fdt_setprop_string(fdt, "/", "compatible", "riscv-virtio");
-    qemu_fdt_setprop_cell(fdt, "/", "#size-cells", 0x2);
-    qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 0x2);
+    plic_phandles[socket] = (*phandle)++;
+    plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
+    plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
+    qemu_fdt_add_subnode(mc->fdt, plic_name);
+    qemu_fdt_setprop_cell(mc->fdt, plic_name,
+        "#address-cells", FDT_PLIC_ADDR_CELLS);
+    qemu_fdt_setprop_cell(mc->fdt, plic_name,
+        "#interrupt-cells", FDT_PLIC_INT_CELLS);
+    qemu_fdt_setprop_string_array(mc->fdt, plic_name, "compatible",
+                                  (char **)&plic_compat,
+                                  ARRAY_SIZE(plic_compat));
+    qemu_fdt_setprop(mc->fdt, plic_name, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop(mc->fdt, plic_name, "interrupts-extended",
+        plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
+    qemu_fdt_setprop_cells(mc->fdt, plic_name, "reg",
+        0x0, plic_addr, 0x0, memmap[VIRT_PLIC].size);
+    qemu_fdt_setprop_cell(mc->fdt, plic_name, "riscv,ndev", VIRTIO_NDEV);
+    riscv_socket_fdt_write_id(mc, mc->fdt, plic_name, socket);
+    qemu_fdt_setprop_cell(mc->fdt, plic_name, "phandle",
+        plic_phandles[socket]);
+    g_free(plic_name);
+
+    g_free(plic_cells);
+}
 
-    qemu_fdt_add_subnode(fdt, "/soc");
-    qemu_fdt_setprop(fdt, "/soc", "ranges", NULL, 0);
-    qemu_fdt_setprop_string(fdt, "/soc", "compatible", "simple-bus");
-    qemu_fdt_setprop_cell(fdt, "/soc", "#size-cells", 0x2);
-    qemu_fdt_setprop_cell(fdt, "/soc", "#address-cells", 0x2);
+static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
+                               bool is_32_bit, uint32_t *phandle,
+                               uint32_t *irq_mmio_phandle,
+                               uint32_t *irq_pcie_phandle,
+                               uint32_t *irq_virtio_phandle)
+{
+    int socket;
+    char *clust_name;
+    uint32_t *intc_phandles;
+    MachineState *mc = MACHINE(s);
+    uint32_t xplic_phandles[MAX_NODES];
 
-    qemu_fdt_add_subnode(fdt, "/cpus");
-    qemu_fdt_setprop_cell(fdt, "/cpus", "timebase-frequency",
+    qemu_fdt_add_subnode(mc->fdt, "/cpus");
+    qemu_fdt_setprop_cell(mc->fdt, "/cpus", "timebase-frequency",
                           RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ);
-    qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0x0);
-    qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 0x1);
-    qemu_fdt_add_subnode(fdt, "/cpus/cpu-map");
+    qemu_fdt_setprop_cell(mc->fdt, "/cpus", "#size-cells", 0x0);
+    qemu_fdt_setprop_cell(mc->fdt, "/cpus", "#address-cells", 0x1);
+    qemu_fdt_add_subnode(mc->fdt, "/cpus/cpu-map");
 
     for (socket = (riscv_socket_count(mc) - 1); socket >= 0; socket--) {
         clust_name = g_strdup_printf("/cpus/cpu-map/cluster%d", socket);
-        qemu_fdt_add_subnode(fdt, clust_name);
-
-        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
-        clint_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
-
-        for (cpu = s->soc[socket].num_harts - 1; cpu >= 0; cpu--) {
-            cpu_phandle = phandle++;
-
-            cpu_name = g_strdup_printf("/cpus/cpu@%d",
-                s->soc[socket].hartid_base + cpu);
-            qemu_fdt_add_subnode(fdt, cpu_name);
-            if (is_32_bit) {
-                qemu_fdt_setprop_string(fdt, cpu_name, "mmu-type", "riscv,sv32");
-            } else {
-                qemu_fdt_setprop_string(fdt, cpu_name, "mmu-type", "riscv,sv48");
-            }
-            name = riscv_isa_string(&s->soc[socket].harts[cpu]);
-            qemu_fdt_setprop_string(fdt, cpu_name, "riscv,isa", name);
-            g_free(name);
-            qemu_fdt_setprop_string(fdt, cpu_name, "compatible", "riscv");
-            qemu_fdt_setprop_string(fdt, cpu_name, "status", "okay");
-            qemu_fdt_setprop_cell(fdt, cpu_name, "reg",
-                s->soc[socket].hartid_base + cpu);
-            qemu_fdt_setprop_string(fdt, cpu_name, "device_type", "cpu");
-            riscv_socket_fdt_write_id(mc, fdt, cpu_name, socket);
-            qemu_fdt_setprop_cell(fdt, cpu_name, "phandle", cpu_phandle);
-
-            intc_name = g_strdup_printf("%s/interrupt-controller", cpu_name);
-            qemu_fdt_add_subnode(fdt, intc_name);
-            intc_phandle = phandle++;
-            qemu_fdt_setprop_cell(fdt, intc_name, "phandle", intc_phandle);
-            qemu_fdt_setprop_string(fdt, intc_name, "compatible",
-                "riscv,cpu-intc");
-            qemu_fdt_setprop(fdt, intc_name, "interrupt-controller", NULL, 0);
-            qemu_fdt_setprop_cell(fdt, intc_name, "#interrupt-cells", 1);
-
-            clint_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandle);
-            clint_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_SOFT);
-            clint_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandle);
-            clint_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_M_TIMER);
-
-            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandle);
-            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
-            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandle);
-            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
-
-            core_name = g_strdup_printf("%s/core%d", clust_name, cpu);
-            qemu_fdt_add_subnode(fdt, core_name);
-            qemu_fdt_setprop_cell(fdt, core_name, "cpu", cpu_phandle);
-
-            g_free(core_name);
-            g_free(intc_name);
-            g_free(cpu_name);
-        }
+        qemu_fdt_add_subnode(mc->fdt, clust_name);
+
+        intc_phandles = g_new0(uint32_t, s->soc[socket].num_harts);
+
+        create_fdt_socket_cpus(s, socket, clust_name, phandle,
+            is_32_bit, intc_phandles);
 
-        addr = memmap[VIRT_DRAM].base + riscv_socket_mem_offset(mc, socket);
-        size = riscv_socket_mem_size(mc, socket);
-        mem_name = g_strdup_printf("/memory@%lx", (long)addr);
-        qemu_fdt_add_subnode(fdt, mem_name);
-        qemu_fdt_setprop_cells(fdt, mem_name, "reg",
-            addr >> 32, addr, size >> 32, size);
-        qemu_fdt_setprop_string(fdt, mem_name, "device_type", "memory");
-        riscv_socket_fdt_write_id(mc, fdt, mem_name, socket);
-        g_free(mem_name);
-
-        clint_addr = memmap[VIRT_CLINT].base +
-            (memmap[VIRT_CLINT].size * socket);
-        clint_name = g_strdup_printf("/soc/clint@%lx", clint_addr);
-        qemu_fdt_add_subnode(fdt, clint_name);
-        qemu_fdt_setprop_string_array(fdt, clint_name, "compatible",
-            (char **)&clint_compat, ARRAY_SIZE(clint_compat));
-        qemu_fdt_setprop_cells(fdt, clint_name, "reg",
-            0x0, clint_addr, 0x0, memmap[VIRT_CLINT].size);
-        qemu_fdt_setprop(fdt, clint_name, "interrupts-extended",
-            clint_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
-        riscv_socket_fdt_write_id(mc, fdt, clint_name, socket);
-        g_free(clint_name);
-
-        plic_phandle[socket] = phandle++;
-        plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
-        plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
-        qemu_fdt_add_subnode(fdt, plic_name);
-        qemu_fdt_setprop_cell(fdt, plic_name,
-            "#address-cells", FDT_PLIC_ADDR_CELLS);
-        qemu_fdt_setprop_cell(fdt, plic_name,
-            "#interrupt-cells", FDT_PLIC_INT_CELLS);
-        qemu_fdt_setprop_string_array(fdt, plic_name, "compatible",
-            (char **)&plic_compat, ARRAY_SIZE(plic_compat));
-        qemu_fdt_setprop(fdt, plic_name, "interrupt-controller", NULL, 0);
-        qemu_fdt_setprop(fdt, plic_name, "interrupts-extended",
-            plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
-        qemu_fdt_setprop_cells(fdt, plic_name, "reg",
-            0x0, plic_addr, 0x0, memmap[VIRT_PLIC].size);
-        qemu_fdt_setprop_cell(fdt, plic_name, "riscv,ndev", VIRTIO_NDEV);
-        riscv_socket_fdt_write_id(mc, fdt, plic_name, socket);
-        qemu_fdt_setprop_cell(fdt, plic_name, "phandle", plic_phandle[socket]);
-        g_free(plic_name);
-
-        g_free(clint_cells);
-        g_free(plic_cells);
+        create_fdt_socket_memory(s, memmap, socket);
+
+        create_fdt_socket_clint(s, memmap, socket, intc_phandles);
+
+        create_fdt_socket_plic(s, memmap, socket, phandle,
+            intc_phandles, xplic_phandles);
+
+        g_free(intc_phandles);
         g_free(clust_name);
     }
 
     for (socket = 0; socket < riscv_socket_count(mc); socket++) {
         if (socket == 0) {
-            plic_mmio_phandle = plic_phandle[socket];
-            plic_virtio_phandle = plic_phandle[socket];
-            plic_pcie_phandle = plic_phandle[socket];
+            *irq_mmio_phandle = xplic_phandles[socket];
+            *irq_virtio_phandle = xplic_phandles[socket];
+            *irq_pcie_phandle = xplic_phandles[socket];
         }
         if (socket == 1) {
-            plic_virtio_phandle = plic_phandle[socket];
-            plic_pcie_phandle = plic_phandle[socket];
+            *irq_virtio_phandle = xplic_phandles[socket];
+            *irq_pcie_phandle = xplic_phandles[socket];
         }
         if (socket == 2) {
-            plic_pcie_phandle = plic_phandle[socket];
+            *irq_pcie_phandle = xplic_phandles[socket];
         }
     }
 
-    riscv_socket_fdt_write_distance_matrix(mc, fdt);
+    riscv_socket_fdt_write_distance_matrix(mc, mc->fdt);
+}
+
+static void create_fdt_virtio(RISCVVirtState *s, const MemMapEntry *memmap,
+                              uint32_t irq_virtio_phandle)
+{
+    int i;
+    char *name;
+    MachineState *mc = MACHINE(s);
 
     for (i = 0; i < VIRTIO_COUNT; i++) {
         name = g_strdup_printf("/soc/virtio_mmio@%lx",
             (long)(memmap[VIRT_VIRTIO].base + i * memmap[VIRT_VIRTIO].size));
-        qemu_fdt_add_subnode(fdt, name);
-        qemu_fdt_setprop_string(fdt, name, "compatible", "virtio,mmio");
-        qemu_fdt_setprop_cells(fdt, name, "reg",
+        qemu_fdt_add_subnode(mc->fdt, name);
+        qemu_fdt_setprop_string(mc->fdt, name, "compatible", "virtio,mmio");
+        qemu_fdt_setprop_cells(mc->fdt, name, "reg",
             0x0, memmap[VIRT_VIRTIO].base + i * memmap[VIRT_VIRTIO].size,
             0x0, memmap[VIRT_VIRTIO].size);
-        qemu_fdt_setprop_cell(fdt, name, "interrupt-parent",
-            plic_virtio_phandle);
-        qemu_fdt_setprop_cell(fdt, name, "interrupts", VIRTIO_IRQ + i);
+        qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent",
+            irq_virtio_phandle);
+        qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", VIRTIO_IRQ + i);
         g_free(name);
     }
+}
+
+static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
+                            uint32_t irq_pcie_phandle)
+{
+    char *name;
+    MachineState *mc = MACHINE(s);
 
     name = g_strdup_printf("/soc/pci@%lx",
         (long) memmap[VIRT_PCIE_ECAM].base);
-    qemu_fdt_add_subnode(fdt, name);
-    qemu_fdt_setprop_cell(fdt, name, "#address-cells", FDT_PCI_ADDR_CELLS);
-    qemu_fdt_setprop_cell(fdt, name, "#interrupt-cells", FDT_PCI_INT_CELLS);
-    qemu_fdt_setprop_cell(fdt, name, "#size-cells", 0x2);
-    qemu_fdt_setprop_string(fdt, name, "compatible", "pci-host-ecam-generic");
-    qemu_fdt_setprop_string(fdt, name, "device_type", "pci");
-    qemu_fdt_setprop_cell(fdt, name, "linux,pci-domain", 0);
-    qemu_fdt_setprop_cells(fdt, name, "bus-range", 0,
+    qemu_fdt_add_subnode(mc->fdt, name);
+    qemu_fdt_setprop_cell(mc->fdt, name, "#address-cells",
+        FDT_PCI_ADDR_CELLS);
+    qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells",
+        FDT_PCI_INT_CELLS);
+    qemu_fdt_setprop_cell(mc->fdt, name, "#size-cells", 0x2);
+    qemu_fdt_setprop_string(mc->fdt, name, "compatible",
+        "pci-host-ecam-generic");
+    qemu_fdt_setprop_string(mc->fdt, name, "device_type", "pci");
+    qemu_fdt_setprop_cell(mc->fdt, name, "linux,pci-domain", 0);
+    qemu_fdt_setprop_cells(mc->fdt, name, "bus-range", 0,
         memmap[VIRT_PCIE_ECAM].size / PCIE_MMCFG_SIZE_MIN - 1);
-    qemu_fdt_setprop(fdt, name, "dma-coherent", NULL, 0);
-    qemu_fdt_setprop_cells(fdt, name, "reg", 0,
+    qemu_fdt_setprop(mc->fdt, name, "dma-coherent", NULL, 0);
+    qemu_fdt_setprop_cells(mc->fdt, name, "reg", 0,
         memmap[VIRT_PCIE_ECAM].base, 0, memmap[VIRT_PCIE_ECAM].size);
-    qemu_fdt_setprop_sized_cells(fdt, name, "ranges",
+    qemu_fdt_setprop_sized_cells(mc->fdt, name, "ranges",
         1, FDT_PCI_RANGE_IOPORT, 2, 0,
         2, memmap[VIRT_PCIE_PIO].base, 2, memmap[VIRT_PCIE_PIO].size,
         1, FDT_PCI_RANGE_MMIO,
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
         2, virt_high_pcie_memmap.base,
         2, virt_high_pcie_memmap.base, 2, virt_high_pcie_memmap.size);
 
-    create_pcie_irq_map(fdt, name, plic_pcie_phandle);
+    create_pcie_irq_map(mc->fdt, name, irq_pcie_phandle);
     g_free(name);
+}
 
-    test_phandle = phandle++;
+static void create_fdt_reset(RISCVVirtState *s, const MemMapEntry *memmap,
+                             uint32_t *phandle)
+{
+    char *name;
+    uint32_t test_phandle;
+    MachineState *mc = MACHINE(s);
+
+    test_phandle = (*phandle)++;
     name = g_strdup_printf("/soc/test@%lx",
         (long)memmap[VIRT_TEST].base);
-    qemu_fdt_add_subnode(fdt, name);
+    qemu_fdt_add_subnode(mc->fdt, name);
     {
         static const char * const compat[3] = {
             "sifive,test1", "sifive,test0", "syscon"
         };
-        qemu_fdt_setprop_string_array(fdt, name, "compatible", (char **)&compat,
-                                      ARRAY_SIZE(compat));
+        qemu_fdt_setprop_string_array(mc->fdt, name, "compatible",
+                                      (char **)&compat, ARRAY_SIZE(compat));
     }
-    qemu_fdt_setprop_cells(fdt, name, "reg",
-        0x0, memmap[VIRT_TEST].base,
-        0x0, memmap[VIRT_TEST].size);
-    qemu_fdt_setprop_cell(fdt, name, "phandle", test_phandle);
-    test_phandle = qemu_fdt_get_phandle(fdt, name);
+    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
+        0x0, memmap[VIRT_TEST].base, 0x0, memmap[VIRT_TEST].size);
+    qemu_fdt_setprop_cell(mc->fdt, name, "phandle", test_phandle);
+    test_phandle = qemu_fdt_get_phandle(mc->fdt, name);
     g_free(name);
 
     name = g_strdup_printf("/soc/reboot");
-    qemu_fdt_add_subnode(fdt, name);
-    qemu_fdt_setprop_string(fdt, name, "compatible", "syscon-reboot");
-    qemu_fdt_setprop_cell(fdt, name, "regmap", test_phandle);
-    qemu_fdt_setprop_cell(fdt, name, "offset", 0x0);
-    qemu_fdt_setprop_cell(fdt, name, "value", FINISHER_RESET);
+    qemu_fdt_add_subnode(mc->fdt, name);
+    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "syscon-reboot");
+    qemu_fdt_setprop_cell(mc->fdt, name, "regmap", test_phandle);
+    qemu_fdt_setprop_cell(mc->fdt, name, "offset", 0x0);
+    qemu_fdt_setprop_cell(mc->fdt, name, "value", FINISHER_RESET);
     g_free(name);
 
     name = g_strdup_printf("/soc/poweroff");
-    qemu_fdt_add_subnode(fdt, name);
-    qemu_fdt_setprop_string(fdt, name, "compatible", "syscon-poweroff");
-    qemu_fdt_setprop_cell(fdt, name, "regmap", test_phandle);
-    qemu_fdt_setprop_cell(fdt, name, "offset", 0x0);
-    qemu_fdt_setprop_cell(fdt, name, "value", FINISHER_PASS);
+    qemu_fdt_add_subnode(mc->fdt, name);
+    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "syscon-poweroff");
+    qemu_fdt_setprop_cell(mc->fdt, name, "regmap", test_phandle);
+    qemu_fdt_setprop_cell(mc->fdt, name, "offset", 0x0);
+    qemu_fdt_setprop_cell(mc->fdt, name, "value", FINISHER_PASS);
     g_free(name);
+}
+
+static void create_fdt_uart(RISCVVirtState *s, const MemMapEntry *memmap,
+                            uint32_t irq_mmio_phandle)
+{
+    char *name;
+    MachineState *mc = MACHINE(s);
 
     name = g_strdup_printf("/soc/uart@%lx", (long)memmap[VIRT_UART0].base);
-    qemu_fdt_add_subnode(fdt, name);
-    qemu_fdt_setprop_string(fdt, name, "compatible", "ns16550a");
-    qemu_fdt_setprop_cells(fdt, name, "reg",
+    qemu_fdt_add_subnode(mc->fdt, name);
+    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "ns16550a");
+    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
         0x0, memmap[VIRT_UART0].base,
         0x0, memmap[VIRT_UART0].size);
-    qemu_fdt_setprop_cell(fdt, name, "clock-frequency", 3686400);
-    qemu_fdt_setprop_cell(fdt, name, "interrupt-parent", plic_mmio_phandle);
-    qemu_fdt_setprop_cell(fdt, name, "interrupts", UART0_IRQ);
+    qemu_fdt_setprop_cell(mc->fdt, name, "clock-frequency", 3686400);
+    qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent", irq_mmio_phandle);
+    qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", UART0_IRQ);
 
-    qemu_fdt_add_subnode(fdt, "/chosen");
-    qemu_fdt_setprop_string(fdt, "/chosen", "stdout-path", name);
+    qemu_fdt_add_subnode(mc->fdt, "/chosen");
+    qemu_fdt_setprop_string(mc->fdt, "/chosen", "stdout-path", name);
     g_free(name);
+}
+
+static void create_fdt_rtc(RISCVVirtState *s, const MemMapEntry *memmap,
+                           uint32_t irq_mmio_phandle)
+{
+    char *name;
+    MachineState *mc = MACHINE(s);
 
     name = g_strdup_printf("/soc/rtc@%lx", (long)memmap[VIRT_RTC].base);
-    qemu_fdt_add_subnode(fdt, name);
-    qemu_fdt_setprop_string(fdt, name, "compatible", "google,goldfish-rtc");
-    qemu_fdt_setprop_cells(fdt, name, "reg",
-        0x0, memmap[VIRT_RTC].base,
-        0x0, memmap[VIRT_RTC].size);
-    qemu_fdt_setprop_cell(fdt, name, "interrupt-parent", plic_mmio_phandle);
-    qemu_fdt_setprop_cell(fdt, name, "interrupts", RTC_IRQ);
+    qemu_fdt_add_subnode(mc->fdt, name);
+    qemu_fdt_setprop_string(mc->fdt, name, "compatible",
+        "google,goldfish-rtc");
+    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
+        0x0, memmap[VIRT_RTC].base, 0x0, memmap[VIRT_RTC].size);
+    qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent",
+        irq_mmio_phandle);
+    qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", RTC_IRQ);
     g_free(name);
+}
+
+static void create_fdt_flash(RISCVVirtState *s, const MemMapEntry *memmap)
+{
+    char *name;
+    MachineState *mc = MACHINE(s);
+    hwaddr flashsize = virt_memmap[VIRT_FLASH].size / 2;
+    hwaddr flashbase = virt_memmap[VIRT_FLASH].base;
 
     name = g_strdup_printf("/flash@%" PRIx64, flashbase);
     qemu_fdt_add_subnode(mc->fdt, name);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
                                  2, flashbase + flashsize, 2, flashsize);
     qemu_fdt_setprop_cell(mc->fdt, name, "bank-width", 4);
     g_free(name);
+}
+
+static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
+                       uint64_t mem_size, const char *cmdline, bool is_32_bit)
+{
+    MachineState *mc = MACHINE(s);
+    uint32_t phandle = 1, irq_mmio_phandle = 1;
+    uint32_t irq_pcie_phandle = 1, irq_virtio_phandle = 1;
+
+    if (mc->dtb) {
+        mc->fdt = load_device_tree(mc->dtb, &s->fdt_size);
+        if (!mc->fdt) {
+            error_report("load_device_tree() failed");
+            exit(1);
+        }
+        goto update_bootargs;
+    } else {
+        mc->fdt = create_device_tree(&s->fdt_size);
+        if (!mc->fdt) {
+            error_report("create_device_tree() failed");
+            exit(1);
+        }
+    }
+
+    qemu_fdt_setprop_string(mc->fdt, "/", "model", "riscv-virtio,qemu");
+    qemu_fdt_setprop_string(mc->fdt, "/", "compatible", "riscv-virtio");
+    qemu_fdt_setprop_cell(mc->fdt, "/", "#size-cells", 0x2);
+    qemu_fdt_setprop_cell(mc->fdt, "/", "#address-cells", 0x2);
+
+    qemu_fdt_add_subnode(mc->fdt, "/soc");
+    qemu_fdt_setprop(mc->fdt, "/soc", "ranges", NULL, 0);
+    qemu_fdt_setprop_string(mc->fdt, "/soc", "compatible", "simple-bus");
+    qemu_fdt_setprop_cell(mc->fdt, "/soc", "#size-cells", 0x2);
+    qemu_fdt_setprop_cell(mc->fdt, "/soc", "#address-cells", 0x2);
+
+    create_fdt_sockets(s, memmap, is_32_bit, &phandle,
+        &irq_mmio_phandle, &irq_pcie_phandle, &irq_virtio_phandle);
+
+    create_fdt_virtio(s, memmap, irq_virtio_phandle);
+
+    create_fdt_pcie(s, memmap, irq_pcie_phandle);
+
+    create_fdt_reset(s, memmap, &phandle);
+
+    create_fdt_uart(s, memmap, irq_mmio_phandle);
+
+    create_fdt_rtc(s, memmap, irq_mmio_phandle);
+
+    create_fdt_flash(s, memmap);
 
 update_bootargs:
     if (cmdline) {
-        qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", cmdline);
+        qemu_fdt_setprop_string(mc->fdt, "/chosen", "bootargs", cmdline);
     }
 }
 
-- 
2.31.1

From: Anup Patel <anup.patel@wdc.com>

We extend virt machine to emulate ACLINT devices only when "aclint=on"
parameter is passed along with machine name in QEMU command-line.

diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ with the default OpenSBI firmware image as the -bios. It also supports
 the recommended RISC-V bootflow: U-Boot SPL (M-mode) loads OpenSBI fw_dynamic
 firmware and U-Boot proper (S-mode), using the standard -bios functionality.
 
+Machine-specific options
+------------------------
+
+The following machine-specific options are supported:
+
+- aclint=[on|off]
+
+  When this option is "on", ACLINT devices will be emulated instead of
+  SiFive CLINT. When not specified, this option is assumed to be "off".
+
 Running Linux kernel
 --------------------
 
diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
     FWCfgState *fw_cfg;
 
     int fdt_size;
+    bool have_aclint;
 };
 
 enum {
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_TEST,
     VIRT_RTC,
     VIRT_CLINT,
+    VIRT_ACLINT_SSWI,
     VIRT_PLIC,
     VIRT_UART0,
     VIRT_VIRTIO,
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
     [VIRT_TEST] =        {   0x100000,        0x1000 },
     [VIRT_RTC] =         {   0x101000,        0x1000 },
     [VIRT_CLINT] =       {  0x2000000,       0x10000 },
+    [VIRT_ACLINT_SSWI] = {  0x2F00000,        0x4000 },
     [VIRT_PCIE_PIO] =    {  0x3000000,       0x10000 },
     [VIRT_PLIC] =        {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
     [VIRT_UART0] =       { 0x10000000,         0x100 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_clint(RISCVVirtState *s,
     g_free(clint_cells);
 }
 
+static void create_fdt_socket_aclint(RISCVVirtState *s,
+                                     const MemMapEntry *memmap, int socket,
+                                     uint32_t *intc_phandles)
+{
+    int cpu;
+    char *name;
+    unsigned long addr;
+    uint32_t aclint_cells_size;
+    uint32_t *aclint_mswi_cells;
+    uint32_t *aclint_sswi_cells;
+    uint32_t *aclint_mtimer_cells;
+    MachineState *mc = MACHINE(s);
+
+    aclint_mswi_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+    aclint_mtimer_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+    aclint_sswi_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+
+    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+        aclint_mswi_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+        aclint_mswi_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_SOFT);
+        aclint_mtimer_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+        aclint_mtimer_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_TIMER);
+        aclint_sswi_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+        aclint_sswi_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_SOFT);
+    }
+    aclint_cells_size = s->soc[socket].num_harts * sizeof(uint32_t) * 2;
+
+    addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
+    name = g_strdup_printf("/soc/mswi@%lx", addr);
+    qemu_fdt_add_subnode(mc->fdt, name);
+    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "riscv,aclint-mswi");
+    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
+        0x0, addr, 0x0, RISCV_ACLINT_SWI_SIZE);
+    qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
+        aclint_mswi_cells, aclint_cells_size);
+    qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
+    riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
+    g_free(name);
+
+    addr = memmap[VIRT_CLINT].base + RISCV_ACLINT_SWI_SIZE +
+        (memmap[VIRT_CLINT].size * socket);
+    name = g_strdup_printf("/soc/mtimer@%lx", addr);
+    qemu_fdt_add_subnode(mc->fdt, name);
+    qemu_fdt_setprop_string(mc->fdt, name, "compatible",
+        "riscv,aclint-mtimer");
+    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
+        0x0, addr + RISCV_ACLINT_DEFAULT_MTIME,
+        0x0, memmap[VIRT_CLINT].size - RISCV_ACLINT_SWI_SIZE -
+             RISCV_ACLINT_DEFAULT_MTIME,
+        0x0, addr + RISCV_ACLINT_DEFAULT_MTIMECMP,
+        0x0, RISCV_ACLINT_DEFAULT_MTIME);
+    qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
+        aclint_mtimer_cells, aclint_cells_size);
+    riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
+    g_free(name);
+
+    addr = memmap[VIRT_ACLINT_SSWI].base +
+        (memmap[VIRT_ACLINT_SSWI].size * socket);
+    name = g_strdup_printf("/soc/sswi@%lx", addr);
+    qemu_fdt_add_subnode(mc->fdt, name);
+    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "riscv,aclint-sswi");
+    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
+        0x0, addr, 0x0, memmap[VIRT_ACLINT_SSWI].size);
+    qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
+        aclint_sswi_cells, aclint_cells_size);
+    qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
+    riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
+    g_free(name);
+
+    g_free(aclint_mswi_cells);
+    g_free(aclint_mtimer_cells);
+    g_free(aclint_sswi_cells);
+}
+
 static void create_fdt_socket_plic(RISCVVirtState *s,
                                    const MemMapEntry *memmap, int socket,
                                    uint32_t *phandle, uint32_t *intc_phandles,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
         create_fdt_socket_memory(s, memmap, socket);
 
-        create_fdt_socket_clint(s, memmap, socket, intc_phandles);
+        if (s->have_aclint) {
+            create_fdt_socket_aclint(s, memmap, socket, intc_phandles);
+        } else {
+            create_fdt_socket_clint(s, memmap, socket, intc_phandles);
+        }
 
         create_fdt_socket_plic(s, memmap, socket, phandle,
             intc_phandles, xplic_phandles);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
             RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
             RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
 
+        /* Per-socket ACLINT SSWI */
+        if (s->have_aclint) {
+            riscv_aclint_swi_create(
+                memmap[VIRT_ACLINT_SSWI].base +
+                    i * memmap[VIRT_ACLINT_SSWI].size,
+                base_hartid, hart_count, true);
+        }
+
         /* Per-socket PLIC hart topology configuration string */
         plic_hart_config = plic_hart_config_string(hart_count);
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_instance_init(Object *obj)
 {
 }
 
+static bool virt_get_aclint(Object *obj, Error **errp)
+{
+    MachineState *ms = MACHINE(obj);
+    RISCVVirtState *s = RISCV_VIRT_MACHINE(ms);
+
+    return s->have_aclint;
+}
+
+static void virt_set_aclint(Object *obj, bool value, Error **errp)
+{
+    MachineState *ms = MACHINE(obj);
+    RISCVVirtState *s = RISCV_VIRT_MACHINE(ms);
+
+    s->have_aclint = value;
+}
+
 static void virt_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     mc->numa_mem_supported = true;
 
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
+
+    object_class_property_add_bool(oc, "aclint", virt_get_aclint,
+                                   virt_set_aclint);
+    object_class_property_set_description(oc, "aclint",
+                                          "Set on/off to enable/disable "
+                                          "emulating ACLINT devices");
 }
 
 static const TypeInfo virt_machine_typeinfo = {
-- 
2.31.1

From: Frank Chang <frank.chang@sifive.com>

Setting Control.claim clears all of the chanel's Next registers.
This is effective only when Control.claim is set from 0 to 1.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Tested-by: Max Hsu <max.hsu@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Tested-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 20210912130553.179501-2-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/dma/sifive_pdma.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/sifive_pdma.c
+++ b/hw/dma/sifive_pdma.c
@@ -XXX,XX +XXX,XX @@
 #define DMA_EXEC_DST        0x110
 #define DMA_EXEC_SRC        0x118
 
+/*
+ * FU540/FU740 docs are incorrect with NextConfig.wsize/rsize reset values.
+ * The reset values tested on Unleashed/Unmatched boards are 6 instead of 0.
+ */
+#define CONFIG_WRSZ_DEFAULT 6
+#define CONFIG_RDSZ_DEFAULT 6
+
 enum dma_chan_state {
     DMA_CHAN_STATE_IDLE,
     DMA_CHAN_STATE_STARTED,
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_write(void *opaque, hwaddr offset,
 {
     SiFivePDMAState *s = opaque;
     int ch = SIFIVE_PDMA_CHAN_NO(offset);
+    bool claimed;
 
     if (ch >= SIFIVE_PDMA_CHANS) {
         qemu_log_mask(LOG_GUEST_ERROR, "%s: Invalid channel no %d\n",
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_write(void *opaque, hwaddr offset,
     offset &= 0xfff;
     switch (offset) {
     case DMA_CONTROL:
+        claimed = !!s->chan[ch].control & CONTROL_CLAIM;
+
+        if (!claimed && (value & CONTROL_CLAIM)) {
+            /* reset Next* registers */
+            s->chan[ch].next_config = (CONFIG_RDSZ_DEFAULT << CONFIG_RDSZ_SHIFT) |
+                                      (CONFIG_WRSZ_DEFAULT << CONFIG_WRSZ_SHIFT);
+            s->chan[ch].next_bytes = 0;
+            s->chan[ch].next_dst = 0;
+            s->chan[ch].next_src = 0;
+        }
+
         s->chan[ch].control = value;
 
         if (value & CONTROL_RUN) {
-- 
2.31.1

From: Frank Chang <frank.chang@sifive.com>

Real PDMA must have Control.claim bit to be set before
Control.run bit is set to start any DMA transactions.
Otherwise nothing will be transferred.

The following result is PDMA tested in U-Boot on Unmatched board:

=> mw.l 0x3000000 0x0                      <= Disclaim channel 0
                                              (Channel 0 is not claimed)
=> mw.l 0x3000004 0x55000000               <= wsize = rsize = 5 (2^5 = 32 bytes)
=> mw.q 0x3000008 0x2                      <= NextBytes = 2
=> mw.q 0x3000010 0x84000000               <= NextDestination = 0x84000000
=> mw.q 0x3000018 0x84001000               <= NextSource = 0x84001000
=> mw.l 0x84000000 0x87654321              <= Fill test data to dst
=> mw.l 0x84001000 0x12345678              <= Fill test data to src
=> md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
84000000: 87654321                               !Ce.
84001000: 12345678                               xV4.
=> md.l 0x3000000 8                        <= Dump PDMA status
03000000: 00000000 55000000 00000002 00000000    .......U........
03000010: 84000000 00000000 84001000 00000000    ................
=> mw.l 0x3000000 0x3                      <= Set channel 0 run and claim bits
=> md.l 0x3000000 8                        <= Dump PDMA status
03000000: 00000001 66000000 00000000 00000000    .......f........
03000010: 00000000 00000000 00000000 00000000    ................
=> md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
84000000: 87654321                               !Ce.
84001000: 12345678                               xV4.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Tested-by: Max Hsu <max.hsu@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Tested-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 20210912130553.179501-3-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/dma/sifive_pdma.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/sifive_pdma.c
+++ b/hw/dma/sifive_pdma.c
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_write(void *opaque, hwaddr offset,
 
         s->chan[ch].control = value;
 
+        /*
+         * If channel was not claimed before run bit is set,
+         * DMA won't run.
+         */
+        if (!claimed) {
+            s->chan[ch].control &= ~CONTROL_RUN;
+            return;
+        }
+
         if (value & CONTROL_RUN) {
             sifive_pdma_run(s, ch);
         }
-- 
2.31.1

From: Green Wan <green.wan@sifive.com>

Real PDMA is able to deal with non-multiple transaction size transactions.

The following result is PDMA tested in U-Boot on Unmatched board:

=> mw.l 0x3000000 0x0                      <= Disclaim channel 0
=> mw.l 0x3000000 0x1                      <= Claim channel 0
=> mw.l 0x3000004 0x11000000               <= wsize = rsize = 1 (2^1 = 2 bytes)
=> mw.q 0x3000008 0x3                      <= NextBytes = 3
=> mw.q 0x3000010 0x84000000               <= NextDestination = 0x84000000
=> mw.q 0x3000018 0x84001000               <= NextSource = 0x84001000
=> mw.l 0x84000000 0x87654321              <= Fill test data to dst
=> mw.l 0x84001000 0x12345678              <= Fill test data to src
=> md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
84000000: 87654321                               !Ce.
84001000: 12345678                               xV4.
=> md.l 0x3000000 8                        <= Dump PDMA status
03000000: 00000001 11000000 00000003 00000000    ................
03000010: 84000000 00000000 84001000 00000000    ................
=> mw.l 0x3000000 0x3                      <= Set channel 0 run and claim bits
=> md.l 0x3000000 8                        <= Dump PDMA status
03000000: 40000001 11000000 00000003 00000000    ...@............
03000010: 84000000 00000000 84001000 00000000    ................
=> md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
84000000: 87345678                               xV4.
84001000: 12345678                               xV4.

Signed-off-by: Green Wan <green.wan@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Tested-by: Max Hsu <max.hsu@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Tested-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Message-id: 20210912130553.179501-4-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/dma/sifive_pdma.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/sifive_pdma.c
+++ b/hw/dma/sifive_pdma.c
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
     uint64_t dst = s->chan[ch].next_dst;
     uint64_t src = s->chan[ch].next_src;
     uint32_t config = s->chan[ch].next_config;
-    int wsize, rsize, size;
+    int wsize, rsize, size, remainder;
     uint8_t buf[64];
     int n;
 
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
         size = 6;
     }
     size = 1 << size;
-
-    /* the bytes to transfer should be multiple of transaction size */
-    if (bytes % size) {
-        goto error;
-    }
+    remainder = bytes % size;
 
     /* indicate a DMA transfer is started */
     s->chan[ch].state = DMA_CHAN_STATE_STARTED;
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
         s->chan[ch].exec_bytes -= size;
     }
 
+    if (remainder) {
+        cpu_physical_memory_read(s->chan[ch].exec_src, buf, remainder);
+        cpu_physical_memory_write(s->chan[ch].exec_dst, buf, remainder);
+        s->chan[ch].exec_src += remainder;
+        s->chan[ch].exec_dst += remainder;
+        s->chan[ch].exec_bytes -= remainder;
+    }
+
     /* indicate a DMA transfer is done */
     s->chan[ch].state = DMA_CHAN_STATE_DONE;
     s->chan[ch].control &= ~CONTROL_RUN;
-- 
2.31.1

From: Frank Chang <frank.chang@sifive.com>

Real PDMA doesn't set Control.error if there are 0 bytes to be
transferred. The DMA transfer is still success.

The following result is PDMA tested in U-Boot on Unmatched board:

=> mw.l 0x3000000 0x0                      <= Disclaim channel 0
=> mw.l 0x3000000 0x1                      <= Claim channel 0
=> mw.l 0x3000004 0x55000000               <= wsize = rsize = 5 (2^5 = 32 bytes)
=> mw.q 0x3000008 0x0                      <= NextBytes = 0
=> mw.q 0x3000010 0x84000000               <= NextDestination = 0x84000000
=> mw.q 0x3000018 0x84001000               <= NextSource = 0x84001000
=> mw.l 0x84000000 0x87654321              <= Fill test data to dst
=> mw.l 0x84001000 0x12345678              <= Fill test data to src
=> md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
84000000: 87654321                               !Ce.
84001000: 12345678                               xV4.
=> md.l 0x3000000 8                        <= Dump PDMA status
03000000: 00000001 55000000 00000000 00000000    .......U........
03000010: 84000000 00000000 84001000 00000000    ................
=> mw.l 0x3000000 0x3                      <= Set channel 0 run and claim bits
=> md.l 0x3000000 8                        <= Dump PDMA status
03000000: 40000001 55000000 00000000 00000000    ...@...U........
03000010: 84000000 00000000 84001000 00000000    ................
=> md.l 0x84000000 1; md.l 0x84001000 1    <= Dump src/dst memory contents
84000000: 87654321                               !Ce.
84001000: 12345678                               xV4.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Tested-by: Max Hsu <max.hsu@sifive.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Tested-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 20210912130553.179501-5-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/dma/sifive_pdma.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/dma/sifive_pdma.c b/hw/dma/sifive_pdma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/sifive_pdma.c
+++ b/hw/dma/sifive_pdma.c
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
 
     /* do nothing if bytes to transfer is zero */
     if (!bytes) {
-        goto error;
+        goto done;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
         s->chan[ch].exec_bytes -= remainder;
     }
 
-    /* indicate a DMA transfer is done */
-    s->chan[ch].state = DMA_CHAN_STATE_DONE;
-    s->chan[ch].control &= ~CONTROL_RUN;
-    s->chan[ch].control |= CONTROL_DONE;
-
     /* reload exec_ registers if repeat is required */
     if (s->chan[ch].next_config & CONFIG_REPEAT) {
         s->chan[ch].exec_bytes = bytes;
@@ -XXX,XX +XXX,XX @@ static void sifive_pdma_run(SiFivePDMAState *s, int ch)
         s->chan[ch].exec_src = src;
     }
 
+done:
+    /* indicate a DMA transfer is done */
+    s->chan[ch].state = DMA_CHAN_STATE_DONE;
+    s->chan[ch].control &= ~CONTROL_RUN;
+    s->chan[ch].control |= CONTROL_DONE;
     return;
 
 error:
-- 
2.31.1

From: Bin Meng <bmeng.cn@gmail.com>

In U-Boot v2021.07 release, there were 2 major changes for the
SiFive Unleashed board support:

- Board config name was changed from sifive_fu540_defconfig to
  sifive_unleashed_defconfig
- The generic binman tool was used to generate the FIT image
  (combination of U-Boot proper, DTB and OpenSBI firmware)

which make the existing U-Boot instructions out of date.

Update the doc with latest instructions.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210911153431.10362-1-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/sifive_u.rst | 49 ++++++++++++++++++----------------
 1 file changed, 26 insertions(+), 23 deletions(-)

diff --git a/docs/system/riscv/sifive_u.rst b/docs/system/riscv/sifive_u.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/sifive_u.rst
+++ b/docs/system/riscv/sifive_u.rst
@@ -XXX,XX +XXX,XX @@ command line options with ``qemu-system-riscv32``.
 Running U-Boot
 --------------
 
-U-Boot mainline v2021.01 release is tested at the time of writing. To build a
+U-Boot mainline v2021.07 release is tested at the time of writing. To build a
 U-Boot mainline bootloader that can be booted by the ``sifive_u`` machine, use
-the sifive_fu540_defconfig with similar commands as described above for Linux:
+the sifive_unleashed_defconfig with similar commands as described above for
+Linux:
 
 .. code-block:: bash
 
   $ export CROSS_COMPILE=riscv64-linux-
   $ export OPENSBI=/path/to/opensbi-riscv64-generic-fw_dynamic.bin
-  $ make sifive_fu540_defconfig
+  $ make sifive_unleashed_defconfig
 
 You will get spl/u-boot-spl.bin and u-boot.itb file in the build tree.
 
@@ -XXX,XX +XXX,XX @@ board on QEMU ``sifive_u`` machine out of the box. This allows users to
 develop and test the recommended RISC-V boot flow with a real world use
 case: ZSBL (in QEMU) loads U-Boot SPL from SD card or SPI flash to L2LIM,
 then U-Boot SPL loads the combined payload image of OpenSBI fw_dynamic
-firmware and U-Boot proper. However sometimes we want to have a quick test
-of booting U-Boot on QEMU without the needs of preparing the SPI flash or
-SD card images, an alternate way can be used, which is to create a U-Boot
-S-mode image by modifying the configuration of U-Boot:
+firmware and U-Boot proper.
+
+However sometimes we want to have a quick test of booting U-Boot on QEMU
+without the needs of preparing the SPI flash or SD card images, an alternate
+way can be used, which is to create a U-Boot S-mode image by modifying the
+configuration of U-Boot:
 
 .. code-block:: bash
 
+  $ export CROSS_COMPILE=riscv64-linux-
+  $ make sifive_unleashed_defconfig
   $ make menuconfig
 
-then manually select the following configuration in U-Boot:
-
-  Device Tree Control > Provider of DTB for DT Control > Prior Stage bootloader DTB
+then manually select the following configuration:
 
-This lets U-Boot to use the QEMU generated device tree blob. During the build,
-a build error will be seen below:
+  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
 
-.. code-block:: none
+and unselect the following configuration:
 
-  MKIMAGE u-boot.img
-  ./tools/mkimage: Can't open arch/riscv/dts/hifive-unleashed-a00.dtb: No such file or directory
-  ./tools/mkimage: failed to build FIT
-  make: *** [Makefile:1440: u-boot.img] Error 1
+  * Library routines ---> Allow access to binman information in the device tree
 
-The above errors can be safely ignored as we don't run U-Boot SPL under QEMU
-in this alternate configuration.
+This changes U-Boot to use the QEMU generated device tree blob, and bypass
+running the U-Boot SPL stage.
 
 Boot the 64-bit U-Boot S-mode image directly:
 
@@ -XXX,XX +XXX,XX @@ It's possible to create a 32-bit U-Boot S-mode image as well.
 .. code-block:: bash
 
   $ export CROSS_COMPILE=riscv64-linux-
-  $ make sifive_fu540_defconfig
+  $ make sifive_unleashed_defconfig
   $ make menuconfig
 
 then manually update the following configuration in U-Boot:
 
-  Device Tree Control > Provider of DTB for DT Control > Prior Stage bootloader DTB
-  RISC-V architecture > Base ISA > RV32I
-  Boot images > Text Base > 0x80400000
+  * Device Tree Control ---> Provider of DTB for DT Control ---> Prior Stage bootloader DTB
+  * RISC-V architecture ---> Base ISA ---> RV32I
+  * Boot options ---> Boot images ---> Text Base ---> 0x80400000
+
+and unselect the following configuration:
+
+  * Library routines ---> Allow access to binman information in the device tree
 
 Use the same command line options to boot the 32-bit U-Boot S-mode image:
 
-- 
2.31.1

From: Frank Chang <frank.chang@sifive.com>

When virtual registers are swapped, mstatus.SD bit should also be
backed up/restored. Otherwise, mstatus.SD bit will be incorrectly kept
across the world switches.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Vincent Chen <vincent.chen@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210914013717.881430-1-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_fp_enabled(CPURISCVState *env)
 
 void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
 {
+    target_ulong sd = riscv_cpu_is_32bit(env) ? MSTATUS32_SD : MSTATUS64_SD;
     uint64_t mstatus_mask = MSTATUS_MXR | MSTATUS_SUM | MSTATUS_FS |
                             MSTATUS_SPP | MSTATUS_SPIE | MSTATUS_SIE |
-                            MSTATUS64_UXL;
+                            MSTATUS64_UXL | sd;
     bool current_virt = riscv_cpu_virt_enabled(env);
 
     g_assert(riscv_has_ext(env, RVH));
-- 
2.31.1

From: Bin Meng <bmeng.cn@gmail.com>

The macro name HCOUNTEREN_CY suggests it is for CSR HCOUNTEREN, but
in fact it applies to M-mode and S-mode CSR too. Rename these macros
to have the COUNTEREN_ prefix.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210915084601.24304-1-bmeng.cn@gmail.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h |  8 ++++----
 target/riscv/csr.c      | 24 ++++++++++++------------
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define HSTATUS32_WPRI       0xFF8FF87E
 #define HSTATUS64_WPRI       0xFFFFFFFFFF8FF87EULL
 
-#define HCOUNTEREN_CY        (1 << 0)
-#define HCOUNTEREN_TM        (1 << 1)
-#define HCOUNTEREN_IR        (1 << 2)
-#define HCOUNTEREN_HPM3      (1 << 3)
+#define COUNTEREN_CY         (1 << 0)
+#define COUNTEREN_TM         (1 << 1)
+#define COUNTEREN_IR         (1 << 2)
+#define COUNTEREN_HPM3       (1 << 3)
 
 /* Privilege modes */
 #define PRV_U 0
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
     if (riscv_cpu_virt_enabled(env)) {
         switch (csrno) {
         case CSR_CYCLE:
-            if (!get_field(env->hcounteren, HCOUNTEREN_CY) &&
-                get_field(env->mcounteren, HCOUNTEREN_CY)) {
+            if (!get_field(env->hcounteren, COUNTEREN_CY) &&
+                get_field(env->mcounteren, COUNTEREN_CY)) {
                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
             }
             break;
         case CSR_TIME:
-            if (!get_field(env->hcounteren, HCOUNTEREN_TM) &&
-                get_field(env->mcounteren, HCOUNTEREN_TM)) {
+            if (!get_field(env->hcounteren, COUNTEREN_TM) &&
+                get_field(env->mcounteren, COUNTEREN_TM)) {
                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
             }
             break;
         case CSR_INSTRET:
-            if (!get_field(env->hcounteren, HCOUNTEREN_IR) &&
-                get_field(env->mcounteren, HCOUNTEREN_IR)) {
+            if (!get_field(env->hcounteren, COUNTEREN_IR) &&
+                get_field(env->mcounteren, COUNTEREN_IR)) {
                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
             }
             break;
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
         if (riscv_cpu_is_32bit(env)) {
             switch (csrno) {
             case CSR_CYCLEH:
-                if (!get_field(env->hcounteren, HCOUNTEREN_CY) &&
-                    get_field(env->mcounteren, HCOUNTEREN_CY)) {
+                if (!get_field(env->hcounteren, COUNTEREN_CY) &&
+                    get_field(env->mcounteren, COUNTEREN_CY)) {
                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
                 }
                 break;
             case CSR_TIMEH:
-                if (!get_field(env->hcounteren, HCOUNTEREN_TM) &&
-                    get_field(env->mcounteren, HCOUNTEREN_TM)) {
+                if (!get_field(env->hcounteren, COUNTEREN_TM) &&
+                    get_field(env->mcounteren, COUNTEREN_TM)) {
                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
                 }
                 break;
             case CSR_INSTRETH:
-                if (!get_field(env->hcounteren, HCOUNTEREN_IR) &&
-                    get_field(env->mcounteren, HCOUNTEREN_IR)) {
+                if (!get_field(env->hcounteren, COUNTEREN_IR) &&
+                    get_field(env->mcounteren, COUNTEREN_IR)) {
                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
                 }
                 break;
-- 
2.31.1

From: Alistair Francis <alistair.francis@wdc.com>

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: d6cb4dfe75a2f536f217d7075b750ece3acb1535.1631767043.git.alistair.francis@wdc.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/opentitan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry ibex_memmap[] = {
     [IBEX_DEV_TIMER] =          {  0x40100000,  0x1000  },
     [IBEX_DEV_SENSOR_CTRL] =    {  0x40110000,  0x1000  },
     [IBEX_DEV_OTP_CTRL] =       {  0x40130000,  0x4000  },
+    [IBEX_DEV_USBDEV] =         {  0x40150000,  0x1000  },
     [IBEX_DEV_PWRMGR] =         {  0x40400000,  0x1000  },
     [IBEX_DEV_RSTMGR] =         {  0x40410000,  0x1000  },
     [IBEX_DEV_CLKMGR] =         {  0x40420000,  0x1000  },
     [IBEX_DEV_PINMUX] =         {  0x40460000,  0x1000  },
     [IBEX_DEV_PADCTRL] =        {  0x40470000,  0x1000  },
-    [IBEX_DEV_USBDEV] =         {  0x40500000,  0x1000  },
     [IBEX_DEV_FLASH_CTRL] =     {  0x41000000,  0x1000  },
     [IBEX_DEV_PLIC] =           {  0x41010000,  0x1000  },
     [IBEX_DEV_AES] =            {  0x41100000,  0x1000  },
-- 
2.31.1

The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:

Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230911

for you to fetch changes up to e7a03409f29e2da59297d55afbaec98c96e43e3a:

target/riscv: don't read CSR in riscv_csrrw_do64 (2023-09-11 11:45:55 +1000)

----------------------------------------------------------------
First RISC-V PR for 8.2

* Remove 'host' CPU from TCG
 * riscv_htif Fixup printing on big endian hosts
 * Add zmmul isa string
 * Add smepmp isa string
 * Fix page_check_range use in fault-only-first
 * Use existing lookup tables for MixColumns
 * Add RISC-V vector cryptographic instruction set support
 * Implement WARL behaviour for mcountinhibit/mcounteren
 * Add Zihintntl extension ISA string to DTS
 * Fix zfa fleq.d and fltq.d
 * Fix upper/lower mtime write calculation
 * Make rtc variable names consistent
 * Use abi type for linux-user target_ucontext
 * Add RISC-V KVM AIA Support
 * Fix riscv,pmu DT node path in the virt machine
 * Update CSR bits name for svadu extension
 * Mark zicond non-experimental
 * Fix satp_mode_finalize() when satp_mode.supported = 0
 * Fix non-KVM --enable-debug build
 * Add new extensions to hwprobe
 * Use accelerated helper for AES64KS1I
 * Allocate itrigger timers only once
 * Respect mseccfg.RLB for pmpaddrX changes
 * Align the AIA model to v1.0 ratified spec
 * Don't read the CSR in riscv_csrrw_do64

----------------------------------------------------------------
Akihiko Odaki (1):
      target/riscv: Allocate itrigger timers only once

Ard Biesheuvel (2):
      target/riscv: Use existing lookup tables for MixColumns
      target/riscv: Use accelerated helper for AES64KS1I

Conor Dooley (1):
      hw/riscv: virt: Fix riscv,pmu DT node path

Daniel Henrique Barboza (6):
      target/riscv/cpu.c: do not run 'host' CPU with TCG
      target/riscv/cpu.c: add zmmul isa string
      target/riscv/cpu.c: add smepmp isa string
      target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
      hw/riscv/virt.c: fix non-KVM --enable-debug build
      hw/intc/riscv_aplic.c fix non-KVM --enable-debug build

Dickon Hood (2):
      target/riscv: Refactor translation of vector-widening instruction
      target/riscv: Add Zvbb ISA extension support

Jason Chien (3):
      target/riscv: Add Zihintntl extension ISA string to DTS
      hw/intc: Fix upper/lower mtime write calculation
      hw/intc: Make rtc variable names consistent

Kiran Ostrolenk (4):
      target/riscv: Refactor some of the generic vector functionality
      target/riscv: Refactor vector-vector translation macro
      target/riscv: Refactor some of the generic vector functionality
      target/riscv: Add Zvknh ISA extension support

LIU Zhiwei (3):
      target/riscv: Fix page_check_range use in fault-only-first
      target/riscv: Fix zfa fleq.d and fltq.d
      linux-user/riscv: Use abi type for target_ucontext

Lawrence Hunter (2):
      target/riscv: Add Zvbc ISA extension support
      target/riscv: Add Zvksh ISA extension support

Leon Schuermann (1):
      target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes

Max Chou (3):
      crypto: Create sm4_subword
      crypto: Add SM4 constant parameter CK
      target/riscv: Add Zvksed ISA extension support

Nazar Kazakov (4):
      target/riscv: Remove redundant "cpu_vl == 0" checks
      target/riscv: Move vector translation checks
      target/riscv: Add Zvkned ISA extension support
      target/riscv: Add Zvkg ISA extension support

Nikita Shubin (1):
      target/riscv: don't read CSR in riscv_csrrw_do64

Rob Bradford (1):
      target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren

Robbin Ehn (1):
      linux-user/riscv: Add new extensions to hwprobe

Thomas Huth (2):
      hw/char/riscv_htif: Fix printing of console characters on big endian hosts
      hw/char/riscv_htif: Fix the console syscall on big endian hosts

Tommy Wu (1):
      target/riscv: Align the AIA model to v1.0 ratified spec

Vineet Gupta (1):
      riscv: zicond: make non-experimental

Weiwei Li (1):
      target/riscv: Update CSR bits name for svadu extension

Yong-Xuan Wang (5):
      target/riscv: support the AIA device emulation with KVM enabled
      target/riscv: check the in-kernel irqchip support
      target/riscv: Create an KVM AIA irqchip
      target/riscv: update APLIC and IMSIC to support KVM AIA
      target/riscv: select KVM AIA in riscv virt machine

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The 'host' CPU is available in a CONFIG_KVM build and it's currently
available for all accels, but is a KVM only CPU. This means that in a
RISC-V KVM capable host we can do things like this:

$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
qemu-system-riscv64: H extension requires priv spec 1.12.0

This CPU does not have a priv spec because we don't filter its extensions
via priv spec. We shouldn't be reaching riscv_cpu_realize_tcg() at all
with the 'host' CPU.

We don't have a way to filter the 'host' CPU out of the available CPU
options (-cpu help) if the build includes both KVM and TCG. What we can
do is to error out during riscv_cpu_realize_tcg() if the user chooses
the 'host' CPU with accel=tcg:

$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
qemu-system-riscv64: 'host' CPU is not compatible with TCG acceleration

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230721133411.474105-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
     CPURISCVState *env = &cpu->env;
     Error *local_err = NULL;
 
+    if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_CPU_HOST)) {
+        error_setg(errp, "'host' CPU is not compatible with TCG acceleration");
+        return;
+    }
+
     riscv_cpu_validate_misa_mxl(cpu, &local_err);
     if (local_err != NULL) {
         error_propagate(errp, local_err);
-- 
2.41.0

From: Thomas Huth <thuth@redhat.com>

The character that should be printed is stored in the 64 bit "payload"
variable. The code currently tries to print it by taking the address
of the variable and passing this pointer to qemu_chr_fe_write(). However,
this only works on little endian hosts where the least significant bits
are stored on the lowest address. To do this in a portable way, we have
to store the value in an uint8_t variable instead.

Fixes: 5033606780 ("RISC-V HTIF Console")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230721094720.902454-2-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             s->tohost = 0; /* clear to indicate we read */
             return;
         } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
-            qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1);
+            uint8_t ch = (uint8_t)payload;
+            qemu_chr_fe_write(&s->chr, &ch, 1);
             resp = 0x100 | (uint8_t)payload;
         } else {
             qemu_log("HTIF device %d: unknown command\n", device);
-- 
2.41.0

From: Thomas Huth <thuth@redhat.com>

Values that have been read via cpu_physical_memory_read() from the
guest's memory have to be swapped in case the host endianess differs
from the guest.

Fixes: a6e13e31d5 ("riscv_htif: Support console output via proxy syscall")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230721094720.902454-3-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
 #include "exec/address-spaces.h"
+#include "exec/tswap.h"
 #include "sysemu/dma.h"
 
 #define RISCV_DEBUG_HTIF 0
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             } else {
                 uint64_t syscall[8];
                 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
-                if (syscall[0] == PK_SYS_WRITE &&
-                    syscall[1] == HTIF_DEV_CONSOLE &&
-                    syscall[3] == HTIF_CONSOLE_CMD_PUTC) {
+                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
+                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
+                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
                     uint8_t ch;
-                    cpu_physical_memory_read(syscall[2], &ch, 1);
+                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
                     qemu_chr_fe_write(&s->chr, &ch, 1);
                     resp = 0x100 | (uint8_t)payload;
                 } else {
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

zmmul was promoted from experimental to ratified in commit 6d00ffad4e95.
Add a riscv,isa string for it.

Fixes: 6d00ffad4e95 ("target/riscv: move zmmul out of the experimental properties")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230720132424.371132-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
+    ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The cpu->cfg.epmp extension is still experimental, but it already has a
'smepmp' riscv,isa string. Add it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230720132424.371132-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
+    ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, epmp),
     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
-- 
2.41.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Commit bef6f008b98(accel/tcg: Return bool from page_check_range) converts
integer return value to bool type. However, it wrongly converted the use
of the API in riscv fault-only-first, where page_check_range < = 0, should
be converted to !page_check_range.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230729031618.821-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
                                          cpu_mmu_index(env, false));
                 if (host) {
 #ifdef CONFIG_USER_ONLY
-                    if (page_check_range(addr, offset, PAGE_READ)) {
+                    if (!page_check_range(addr, offset, PAGE_READ)) {
                         vl = i;
                         goto ProbeSuccess;
                     }
-- 
2.41.0

From: Ard Biesheuvel <ardb@kernel.org>

The AES MixColumns and InvMixColumns operations are relatively
expensive 4x4 matrix multiplications in GF(2^8), which is why C
implementations usually rely on precomputed lookup tables rather than
performing the calculations on demand.

Given that we already carry those tables in QEMU, we can just grab the
right value in the implementation of the RISC-V AES32 instructions. Note
that the tables in question are permuted according to the respective
Sbox, so we can omit the Sbox lookup as well in this case.

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Zewen Ye <lustrew@foxmail.com>
Cc: Weiwei Li <liweiwei@iscas.ac.cn>
Cc: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230731084043.1791984-1-ardb@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/aes.h         |  7 +++++++
 crypto/aes.c                 |  4 ++--
 target/riscv/crypto_helper.c | 34 ++++------------------------------
 3 files changed, 13 insertions(+), 32 deletions(-)

diff --git a/include/crypto/aes.h b/include/crypto/aes.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/aes.h
+++ b/include/crypto/aes.h
@@ -XXX,XX +XXX,XX @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
 extern const uint8_t AES_sbox[256];
 extern const uint8_t AES_isbox[256];
 
+/*
+AES_Te0[x] = S [x].[02, 01, 01, 03];
+AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
+*/
+
+extern const uint32_t AES_Te0[256], AES_Td0[256];
+
 #endif
diff --git a/crypto/aes.c b/crypto/aes.c
index XXXXXXX..XXXXXXX 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -XXX,XX +XXX,XX @@ AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
 AES_Td4[x] = Si[x].[01, 01, 01, 01];
 */
 
-static const uint32_t AES_Te0[256] = {
+const uint32_t AES_Te0[256] = {
     0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
     0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
     0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
@@ -XXX,XX +XXX,XX @@ static const uint32_t AES_Te4[256] = {
     0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
 };
 
-static const uint32_t AES_Td0[256] = {
+const uint32_t AES_Td0[256] = {
     0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
     0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
     0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "crypto/aes-round.h"
 #include "crypto/sm4.h"
 
-#define AES_XTIME(a) \
-    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
-
-#define AES_GFMUL(a, b) (( \
-    (((b) & 0x1) ? (a) : 0) ^ \
-    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
-    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
-    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
-
-static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
-{
-    uint32_t u;
-
-    if (fwd) {
-        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
-            (AES_GFMUL(x, 2) << 0);
-    } else {
-        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
-            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
-    }
-    return u;
-}
-
 #define sext32_xlen(x) (target_ulong)(int32_t)(x)
 
 static inline target_ulong aes32_operation(target_ulong shamt,
@@ -XXX,XX +XXX,XX @@ static inline target_ulong aes32_operation(target_ulong shamt,
                                            bool enc, bool mix)
 {
     uint8_t si = rs2 >> shamt;
-    uint8_t so;
     uint32_t mixed;
     target_ulong res;
 
     if (enc) {
-        so = AES_sbox[si];
         if (mix) {
-            mixed = aes_mixcolumn_byte(so, true);
+            mixed = be32_to_cpu(AES_Te0[si]);
         } else {
-            mixed = so;
+            mixed = AES_sbox[si];
         }
     } else {
-        so = AES_isbox[si];
         if (mix) {
-            mixed = aes_mixcolumn_byte(so, false);
+            mixed = be32_to_cpu(AES_Td0[si]);
         } else {
-            mixed = so;
+            mixed = AES_isbox[si];
         }
     }
     mixed = rol32(mixed, shamt);
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Take some functions/macros out of `vector_helper` and put them in a new
module called `vector_internals`. This ensures they can be used by both
vector and vector-crypto helpers (latter implemented in proceeding
commits).

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230711165917.2629866-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 182 +++++++++++++++++++++++++++++
 target/riscv/vector_helper.c    | 201 +-------------------------------
 target/riscv/vector_internals.c |  81 +++++++++++++
 target/riscv/meson.build        |   1 +
 4 files changed, 265 insertions(+), 200 deletions(-)
 create mode 100644 target/riscv/vector_internals.h
 create mode 100644 target/riscv/vector_internals.c

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Vector Extension Internals
+ *
+ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef TARGET_RISCV_VECTOR_INTERNALS_H
+#define TARGET_RISCV_VECTOR_INTERNALS_H
+
+#include "qemu/osdep.h"
+#include "qemu/bitops.h"
+#include "cpu.h"
+#include "tcg/tcg-gvec-desc.h"
+#include "internals.h"
+
+static inline uint32_t vext_nf(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, NF);
+}
+
+/*
+ * Note that vector data is stored in host-endian 64-bit chunks,
+ * so addressing units smaller than that needs a host-endian fixup.
+ */
+#if HOST_BIG_ENDIAN
+#define H1(x)   ((x) ^ 7)
+#define H1_2(x) ((x) ^ 6)
+#define H1_4(x) ((x) ^ 4)
+#define H2(x)   ((x) ^ 3)
+#define H4(x)   ((x) ^ 1)
+#define H8(x)   ((x))
+#else
+#define H1(x)   (x)
+#define H1_2(x) (x)
+#define H1_4(x) (x)
+#define H2(x)   (x)
+#define H4(x)   (x)
+#define H8(x)   (x)
+#endif
+
+/*
+ * Encode LMUL to lmul as following:
+ *     LMUL    vlmul    lmul
+ *      1       000       0
+ *      2       001       1
+ *      4       010       2
+ *      8       011       3
+ *      -       100       -
+ *     1/8      101      -3
+ *     1/4      110      -2
+ *     1/2      111      -1
+ */
+static inline int32_t vext_lmul(uint32_t desc)
+{
+    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
+}
+
+static inline uint32_t vext_vm(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VM);
+}
+
+static inline uint32_t vext_vma(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VMA);
+}
+
+static inline uint32_t vext_vta(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VTA);
+}
+
+static inline uint32_t vext_vta_all_1s(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
+}
+
+/*
+ * Earlier designs (pre-0.9) had a varying number of bits
+ * per mask value (MLEN). In the 0.9 design, MLEN=1.
+ * (Section 4.5)
+ */
+static inline int vext_elem_mask(void *v0, int index)
+{
+    int idx = index / 64;
+    int pos = index  % 64;
+    return (((uint64_t *)v0)[idx] >> pos) & 1;
+}
+
+/*
+ * Get number of total elements, including prestart, body and tail elements.
+ * Note that when LMUL < 1, the tail includes the elements past VLMAX that
+ * are held in the same vector register.
+ */
+static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
+                                            uint32_t esz)
+{
+    uint32_t vlenb = simd_maxsz(desc);
+    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
+    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
+                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
+    return (vlenb << emul) / esz;
+}
+
+/* set agnostic elements to 1s */
+void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+                       uint32_t tot);
+
+/* expand macro args before macro */
+#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
+
+/* (TD, T1, T2, TX1, TX2) */
+#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
+#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
+#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
+#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
+
+/* operation of two vector elements */
+typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
+
+#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
+static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
+{                                                               \
+    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
+    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
+}
+
+void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivv2_fn *fn, uint32_t esz);
+
+/* generate the helpers for OPIVV */
+#define GEN_VEXT_VV(NAME, ESZ)                            \
+void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
+{                                                         \
+    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
+               do_##NAME, ESZ);                           \
+}
+
+typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
+
+/*
+ * (T1)s1 gives the real operator type.
+ * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
+ */
+#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
+static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
+{                                                                   \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
+    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
+}
+
+void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivx2_fn fn, uint32_t esz);
+
+/* generate the helpers for OPIVX */
+#define GEN_VEXT_VX(NAME, ESZ)                            \
+void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
+{                                                         \
+    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
+               do_##NAME, ESZ);                           \
+}
+
+#endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "fpu/softfloat.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "internals.h"
+#include "vector_internals.h"
 #include <math.h>
 
 target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
     return vl;
 }
 
-/*
- * Note that vector data is stored in host-endian 64-bit chunks,
- * so addressing units smaller than that needs a host-endian fixup.
- */
-#if HOST_BIG_ENDIAN
-#define H1(x)   ((x) ^ 7)
-#define H1_2(x) ((x) ^ 6)
-#define H1_4(x) ((x) ^ 4)
-#define H2(x)   ((x) ^ 3)
-#define H4(x)   ((x) ^ 1)
-#define H8(x)   ((x))
-#else
-#define H1(x)   (x)
-#define H1_2(x) (x)
-#define H1_4(x) (x)
-#define H2(x)   (x)
-#define H4(x)   (x)
-#define H8(x)   (x)
-#endif
-
-static inline uint32_t vext_nf(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, NF);
-}
-
-static inline uint32_t vext_vm(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VM);
-}
-
-/*
- * Encode LMUL to lmul as following:
- *     LMUL    vlmul    lmul
- *      1       000       0
- *      2       001       1
- *      4       010       2
- *      8       011       3
- *      -       100       -
- *     1/8      101      -3
- *     1/4      110      -2
- *     1/2      111      -1
- */
-static inline int32_t vext_lmul(uint32_t desc)
-{
-    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
-}
-
-static inline uint32_t vext_vta(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VTA);
-}
-
-static inline uint32_t vext_vma(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VMA);
-}
-
-static inline uint32_t vext_vta_all_1s(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
-}
-
 /*
  * Get the maximum number of elements can be operated.
  *
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
     return scale < 0 ? vlenb >> -scale : vlenb << scale;
 }
 
-/*
- * Get number of total elements, including prestart, body and tail elements.
- * Note that when LMUL < 1, the tail includes the elements past VLMAX that
- * are held in the same vector register.
- */
-static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
-                                            uint32_t esz)
-{
-    uint32_t vlenb = simd_maxsz(desc);
-    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
-    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
-                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
-    return (vlenb << emul) / esz;
-}
-
 static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
 {
     return (addr & ~env->cur_pmmask) | env->cur_pmbase;
@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
     }
 }
 
-/* set agnostic elements to 1s */
-static void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
-                              uint32_t tot)
-{
-    if (is_agnostic == 0) {
-        /* policy undisturbed */
-        return;
-    }
-    if (tot - cnt == 0) {
-        return;
-    }
-    memset(base + cnt, -1, tot - cnt);
-}
-
 static inline void vext_set_elem_mask(void *v0, int index,
                                       uint8_t value)
 {
@@ -XXX,XX +XXX,XX @@ static inline void vext_set_elem_mask(void *v0, int index,
     ((uint64_t *)v0)[idx] = deposit64(old, pos, 1, value);
 }
 
-/*
- * Earlier designs (pre-0.9) had a varying number of bits
- * per mask value (MLEN). In the 0.9 design, MLEN=1.
- * (Section 4.5)
- */
-static inline int vext_elem_mask(void *v0, int index)
-{
-    int idx = index / 64;
-    int pos = index  % 64;
-    return (((uint64_t *)v0)[idx] >> pos) & 1;
-}
-
 /* elements operations for load and store */
 typedef void vext_ldst_elem_fn(CPURISCVState *env, abi_ptr addr,
                                uint32_t idx, void *vd, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
  * Vector Integer Arithmetic Instructions
  */
 
-/* expand macro args before macro */
-#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
-
 /* (TD, T1, T2, TX1, TX2) */
 #define OP_SSS_B int8_t, int8_t, int8_t, int8_t, int8_t
 #define OP_SSS_H int16_t, int16_t, int16_t, int16_t, int16_t
 #define OP_SSS_W int32_t, int32_t, int32_t, int32_t, int32_t
 #define OP_SSS_D int64_t, int64_t, int64_t, int64_t, int64_t
-#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
-#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
-#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
-#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 #define OP_SUS_B int8_t, uint8_t, int8_t, uint8_t, int8_t
 #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
 #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
 #define NOP_UUU_H uint16_t, uint16_t, uint32_t, uint16_t, uint32_t
 #define NOP_UUU_W uint32_t, uint32_t, uint64_t, uint32_t, uint64_t
 
-/* operation of two vector elements */
-typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
-
-#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
-static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
-{                                                               \
-    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
-    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
-}
 #define DO_SUB(N, M) (N - M)
 #define DO_RSUB(N, M) (M - N)
 
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vsub_vv_h, OP_SSS_H, H2, H2, H2, DO_SUB)
 RVVCALL(OPIVV2, vsub_vv_w, OP_SSS_W, H4, H4, H4, DO_SUB)
 RVVCALL(OPIVV2, vsub_vv_d, OP_SSS_D, H8, H8, H8, DO_SUB)
 
-static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
-                       CPURISCVState *env, uint32_t desc,
-                       opivv2_fn *fn, uint32_t esz)
-{
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-    uint32_t vta = vext_vta(desc);
-    uint32_t vma = vext_vma(desc);
-    uint32_t i;
-
-    for (i = env->vstart; i < vl; i++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            /* set masked-off elements to 1s */
-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-            continue;
-        }
-        fn(vd, vs1, vs2, i);
-    }
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-}
-
-/* generate the helpers for OPIVV */
-#define GEN_VEXT_VV(NAME, ESZ)                            \
-void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
-                  void *vs2, CPURISCVState *env,          \
-                  uint32_t desc)                          \
-{                                                         \
-    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
-               do_##NAME, ESZ);                           \
-}
-
 GEN_VEXT_VV(vadd_vv_b, 1)
 GEN_VEXT_VV(vadd_vv_h, 2)
 GEN_VEXT_VV(vadd_vv_w, 4)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV(vsub_vv_h, 2)
 GEN_VEXT_VV(vsub_vv_w, 4)
 GEN_VEXT_VV(vsub_vv_d, 8)
 
-typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
-
-/*
- * (T1)s1 gives the real operator type.
- * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
- */
-#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
-static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
-{                                                                   \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
-    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
-}
 
 RVVCALL(OPIVX2, vadd_vx_b, OP_SSS_B, H1, H1, DO_ADD)
 RVVCALL(OPIVX2, vadd_vx_h, OP_SSS_H, H2, H2, DO_ADD)
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vrsub_vx_h, OP_SSS_H, H2, H2, DO_RSUB)
 RVVCALL(OPIVX2, vrsub_vx_w, OP_SSS_W, H4, H4, DO_RSUB)
 RVVCALL(OPIVX2, vrsub_vx_d, OP_SSS_D, H8, H8, DO_RSUB)
 
-static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
-                       CPURISCVState *env, uint32_t desc,
-                       opivx2_fn fn, uint32_t esz)
-{
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-    uint32_t vta = vext_vta(desc);
-    uint32_t vma = vext_vma(desc);
-    uint32_t i;
-
-    for (i = env->vstart; i < vl; i++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            /* set masked-off elements to 1s */
-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-            continue;
-        }
-        fn(vd, s1, vs2, i);
-    }
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-}
-
-/* generate the helpers for OPIVX */
-#define GEN_VEXT_VX(NAME, ESZ)                            \
-void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
-                  void *vs2, CPURISCVState *env,          \
-                  uint32_t desc)                          \
-{                                                         \
-    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
-               do_##NAME, ESZ);                           \
-}
-
 GEN_VEXT_VX(vadd_vx_b, 1)
 GEN_VEXT_VX(vadd_vx_h, 2)
 GEN_VEXT_VX(vadd_vx_w, 4)
diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Vector Extension Internals
+ *
+ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "vector_internals.h"
+
+/* set agnostic elements to 1s */
+void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+                       uint32_t tot)
+{
+    if (is_agnostic == 0) {
+        /* policy undisturbed */
+        return;
+    }
+    if (tot - cnt == 0) {
+        return ;
+    }
+    memset(base + cnt, -1, tot - cnt);
+}
+
+void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivv2_fn *fn, uint32_t esz)
+{
+    uint32_t vm = vext_vm(desc);
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+    uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
+    uint32_t i;
+
+    for (i = env->vstart; i < vl; i++) {
+        if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+            continue;
+        }
+        fn(vd, vs1, vs2, i);
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+}
+
+void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivx2_fn fn, uint32_t esz)
+{
+    uint32_t vm = vext_vm(desc);
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+    uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
+    uint32_t i;
+
+    for (i = env->vstart; i < vl; i++) {
+        if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+            continue;
+        }
+        fn(vd, s1, vs2, i);
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
   'gdbstub.c',
   'op_helper.c',
   'vector_helper.c',
+  'vector_internals.c',
   'bitmanip_helper.c',
   'translate.c',
   'm128_helper.c',
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Refactor the non SEW-specific stuff out of `GEN_OPIVV_TRANS` into
function `opivv_trans` (similar to `opivi_trans`). `opivv_trans` will be
used in proceeding vector-crypto commits.

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 62 +++++++++++++------------
 1 file changed, 32 insertions(+), 30 deletions(-)

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

Remove the redundant "vl == 0" check which is already included within the  vstart >= vl check, when vl == 0.

Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230711165917.2629866-4-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 31 +------------------------
 1 file changed, 1 insertion(+), 30 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
         return false;
     }
 
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
     uint32_t data = 0;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
     uint32_t data = 0;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
     if (checkfn(s, a)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
     if (opiwv_widen_check(s, a)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
 {
     uint32_t data = 0;
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     data = FIELD_DP32(data, VDATA, VM, vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
             gen_helper_##NAME##_w,                                 \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
                 gen_helper_vmv_v_v_w, gen_helper_vmv_v_v_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
         vext_check_ss(s, a->rd, 0, 1)) {
         TCGv s1;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         s1 = get_gpr(s, a->rs1, EXT_SIGN);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
                 gen_helper_vmv_v_x_w, gen_helper_vmv_v_x_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             s1 = tcg_constant_i64(simm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     TCGv_i64 t1;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
         };                                                       \
         TCGLabel *over = gen_new_label();                        \
         gen_set_rm(s, RISCV_FRM_DYN);                            \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);        \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);\
                                                                  \
         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
         gen_set_rm_chkfrm(s, rm);
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
                 gen_helper_vmv_v_x_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
         uint32_t data = 0;                                         \
         gen_helper_gvec_4_ptr *fn = gen_helper_##NAME;             \
         TCGLabel *over = gen_new_label();                          \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
         require_vm(a->vm, a->rd)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_s_x(DisasContext *s, arg_vmv_s_x *a)
         TCGv s1;
         TCGLabel *over = gen_new_label();
 
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
         TCGv_i64 t1;
         TCGLabel *over = gen_new_label();
 
-        /* if vl == 0 or vstart >= vl, skip vector register write back */
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        /* if vstart >= vl, skip vector register write back */
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         /* NaN-box f[rs1] */
@@ -XXX,XX +XXX,XX @@ static bool int_ext_op(DisasContext *s, arg_rmr *a, uint8_t seq)
     uint32_t data = 0;
     gen_helper_gvec_3_ptr *fn;
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     static gen_helper_gvec_3_ptr * const fns[6][4] = {
-- 
2.41.0

From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>

This commit adds support for the Zvbc vector-crypto extension, which
consists of the following instructions:

* vclmulh.[vx,vv]
* vclmul.[vx,vv]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: Max Chou <max.chou@sifive.com>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
[max.chou@sifive.com: Exposed x-zvbc property]
Message-ID: <20230711165917.2629866-5-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |  1 +
 target/riscv/helper.h                    |  6 +++
 target/riscv/insn32.decode               |  6 +++
 target/riscv/cpu.c                       |  9 ++++
 target/riscv/translate.c                 |  1 +
 target/riscv/vcrypto_helper.c            | 59 ++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 62 ++++++++++++++++++++++++
 target/riscv/meson.build                 |  3 +-
 8 files changed, 146 insertions(+), 1 deletion(-)
 create mode 100644 target/riscv/vcrypto_helper.c
 create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

Move the checks out of `do_opiv{v,x,i}_gvec{,_shift}` functions
and into the corresponding macros. This enables the functions to be
reused in proceeding commits without check duplication.

Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-6-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 28 +++++++++++--------------
 1 file changed, 12 insertions(+), 16 deletions(-)

From: Dickon Hood <dickon.hood@codethink.co.uk>

Zvbb (implemented in later commit) has a widening instruction, which
requires an extra check on the enabled extensions.  Refactor
GEN_OPIVX_WIDEN_TRANS() to take a check function to avoid reimplementing
it.

Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-7-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 52 +++++++++++--------------
 1 file changed, 23 insertions(+), 29 deletions(-)

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Move some macros out of `vector_helper` and into `vector_internals`.
This ensures they can be used by both vector and vector-crypto helpers
(latter implemented in proceeding commits).

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-8-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 46 +++++++++++++++++++++++++++++++++
 target/riscv/vector_helper.c    | 42 ------------------------------
 2 files changed, 46 insertions(+), 42 deletions(-)

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_internals.h
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 /* expand macro args before macro */
 #define RVVCALL(macro, ...)  macro(__VA_ARGS__)
 
+/* (TD, T2, TX2) */
+#define OP_UU_B uint8_t, uint8_t, uint8_t
+#define OP_UU_H uint16_t, uint16_t, uint16_t
+#define OP_UU_W uint32_t, uint32_t, uint32_t
+#define OP_UU_D uint64_t, uint64_t, uint64_t
+
 /* (TD, T1, T2, TX1, TX2) */
 #define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
 #define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
 #define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
 #define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 
+#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
+static void do_##NAME(void *vd, void *vs2, int i)      \
+{                                                      \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
+    *((TD *)vd + HD(i)) = OP(s2);                      \
+}
+
+#define GEN_VEXT_V(NAME, ESZ)                          \
+void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
+                  CPURISCVState *env, uint32_t desc)   \
+{                                                      \
+    uint32_t vm = vext_vm(desc);                       \
+    uint32_t vl = env->vl;                             \
+    uint32_t total_elems =                             \
+        vext_get_total_elems(env, desc, ESZ);          \
+    uint32_t vta = vext_vta(desc);                     \
+    uint32_t vma = vext_vma(desc);                     \
+    uint32_t i;                                        \
+                                                       \
+    for (i = env->vstart; i < vl; i++) {               \
+        if (!vm && !vext_elem_mask(v0, i)) {           \
+            /* set masked-off elements to 1s */        \
+            vext_set_elems_1s(vd, vma, i * ESZ,        \
+                              (i + 1) * ESZ);          \
+            continue;                                  \
+        }                                              \
+        do_##NAME(vd, vs2, i);                         \
+    }                                                  \
+    env->vstart = 0;                                   \
+    /* set tail elements to 1s */                      \
+    vext_set_elems_1s(vd, vta, vl * ESZ,               \
+                      total_elems * ESZ);              \
+}
+
 /* operation of two vector elements */
 typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
 
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
                do_##NAME, ESZ);                           \
 }
 
+/* Three of the widening shortening macros: */
+/* (TD, T1, T2, TX1, TX2) */
+#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
+#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
+#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
+
 #endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
 #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
 #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
 #define OP_SUS_D int64_t, uint64_t, int64_t, uint64_t, int64_t
-#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
-#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
-#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
 #define WOP_SSS_B int16_t, int8_t, int8_t, int16_t, int16_t
 #define WOP_SSS_H int32_t, int16_t, int16_t, int32_t, int32_t
 #define WOP_SSS_W int64_t, int32_t, int32_t, int64_t, int64_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_h, 4)
 GEN_VEXT_VF(vfwnmsac_vf_w, 8)
 
 /* Vector Floating-Point Square-Root Instruction */
-/* (TD, T2, TX2) */
-#define OP_UU_H uint16_t, uint16_t, uint16_t
-#define OP_UU_W uint32_t, uint32_t, uint32_t
-#define OP_UU_D uint64_t, uint64_t, uint64_t
-
 #define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 static void do_##NAME(void *vd, void *vs2, int i,      \
                       CPURISCVState *env)              \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
 GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
 
 /* Vector Floating-Point Classify Instruction */
-#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
-static void do_##NAME(void *vd, void *vs2, int i)      \
-{                                                      \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
-    *((TD *)vd + HD(i)) = OP(s2);                      \
-}
-
-#define GEN_VEXT_V(NAME, ESZ)                          \
-void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-                  CPURISCVState *env, uint32_t desc)   \
-{                                                      \
-    uint32_t vm = vext_vm(desc);                       \
-    uint32_t vl = env->vl;                             \
-    uint32_t total_elems =                             \
-        vext_get_total_elems(env, desc, ESZ);          \
-    uint32_t vta = vext_vta(desc);                     \
-    uint32_t vma = vext_vma(desc);                     \
-    uint32_t i;                                        \
-                                                       \
-    for (i = env->vstart; i < vl; i++) {               \
-        if (!vm && !vext_elem_mask(v0, i)) {           \
-            /* set masked-off elements to 1s */        \
-            vext_set_elems_1s(vd, vma, i * ESZ,        \
-                              (i + 1) * ESZ);          \
-            continue;                                  \
-        }                                              \
-        do_##NAME(vd, vs2, i);                         \
-    }                                                  \
-    env->vstart = 0;                                   \
-    /* set tail elements to 1s */                      \
-    vext_set_elems_1s(vd, vta, vl * ESZ,               \
-                      total_elems * ESZ);              \
-}
-
 target_ulong fclass_h(uint64_t frs1)
 {
     float16 f = frs1;
-- 
2.41.0

From: Dickon Hood <dickon.hood@codethink.co.uk>

This commit adds support for the Zvbb vector-crypto extension, which
consists of the following instructions:

* vrol.[vv,vx]
* vror.[vv,vx,vi]
* vbrev8.v
* vrev8.v
* vandn.[vv,vx]
* vbrev.v
* vclz.v
* vctz.v
* vcpop.v
* vwsll.[vv,vx,vi]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
[max.chou@sifive.com: Fix imm mode of vror.vi]
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvbb property]
Message-ID: <20230711165917.2629866-9-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |  62 +++++++++
 target/riscv/insn32.decode               |  20 +++
 target/riscv/cpu.c                       |  12 ++
 target/riscv/vcrypto_helper.c            | 138 +++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 164 +++++++++++++++++++++++
 6 files changed, 397 insertions(+)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve32f;
     bool ext_zve64f;
     bool ext_zve64d;
+    bool ext_zvbb;
     bool ext_zvbc;
     bool ext_zmmul;
     bool ext_zvfbfmin;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vror_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vror_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vrol_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vrol_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_5(vrev8_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_d, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_5(vclz_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_d, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vwsll_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vandn_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 %imm_u    12:s20                 !function=ex_shift_12
 %imm_bs   30:2                   !function=ex_shift_3
 %imm_rnum 20:4
+%imm_z6   26:1 15:5
 
 # Argument sets:
 &empty
@@ -XXX,XX +XXX,XX @@
 @r_vm    ...... vm:1 ..... ..... ... ..... ....... &rmrr %rs2 %rs1 %rd
 @r_vm_1  ...... . ..... ..... ... ..... .......    &rmrr vm=1 %rs2 %rs1 %rd
 @r_vm_0  ...... . ..... ..... ... ..... .......    &rmrr vm=0 %rs2 %rs1 %rd
+@r2_zimm6  ..... . vm:1 ..... ..... ... ..... .......  &rmrr %rs2 rs1=%imm_z6 %rd
 @r2_zimm11 . zimm:11  ..... ... ..... ....... %rs1 %rd
 @r2_zimm10 .. zimm:10  ..... ... ..... ....... %rs1 %rd
 @r2_s    .......   ..... ..... ... ..... ....... %rs2 %rs1
@@ -XXX,XX +XXX,XX @@ vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
 vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
 vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
 vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
+
+# *** Zvbb vector crypto extension ***
+vrol_vv     010101 . ..... ..... 000 ..... 1010111 @r_vm
+vrol_vx     010101 . ..... ..... 100 ..... 1010111 @r_vm
+vror_vv     010100 . ..... ..... 000 ..... 1010111 @r_vm
+vror_vx     010100 . ..... ..... 100 ..... 1010111 @r_vm
+vror_vi     01010. . ..... ..... 011 ..... 1010111 @r2_zimm6
+vbrev8_v    010010 . ..... 01000 010 ..... 1010111 @r2_vm
+vrev8_v     010010 . ..... 01001 010 ..... 1010111 @r2_vm
+vandn_vv    000001 . ..... ..... 000 ..... 1010111 @r_vm
+vandn_vx    000001 . ..... ..... 100 ..... 1010111 @r_vm
+vbrev_v     010010 . ..... 01010 010 ..... 1010111 @r2_vm
+vclz_v      010010 . ..... 01100 010 ..... 1010111 @r2_vm
+vctz_v      010010 . ..... 01101 010 ..... 1010111 @r2_vm
+vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
+vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
+vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
+vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
     ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
     ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
+    ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    /*
+     * In principle Zve*x would also suffice here, were they supported
+     * in qemu
+     */
+    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
+        error_setg(errp,
+                   "Vector crypto extensions require V or Zve* extensions");
+        return;
+    }
+
     if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
         error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
         return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
 
     /* Vector cryptography extensions */
+    DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 
     DEFINE_PROP_END_OF_LIST(),
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
 #include "qemu/bitops.h"
+#include "qemu/bswap.h"
 #include "cpu.h"
 #include "exec/memop.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
 GEN_VEXT_VV(vclmulh_vv, 8)
 RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
 GEN_VEXT_VX(vclmulh_vx, 8)
+
+RVVCALL(OPIVV2, vror_vv_b, OP_UUU_B, H1, H1, H1, ror8)
+RVVCALL(OPIVV2, vror_vv_h, OP_UUU_H, H2, H2, H2, ror16)
+RVVCALL(OPIVV2, vror_vv_w, OP_UUU_W, H4, H4, H4, ror32)
+RVVCALL(OPIVV2, vror_vv_d, OP_UUU_D, H8, H8, H8, ror64)
+GEN_VEXT_VV(vror_vv_b, 1)
+GEN_VEXT_VV(vror_vv_h, 2)
+GEN_VEXT_VV(vror_vv_w, 4)
+GEN_VEXT_VV(vror_vv_d, 8)
+
+RVVCALL(OPIVX2, vror_vx_b, OP_UUU_B, H1, H1, ror8)
+RVVCALL(OPIVX2, vror_vx_h, OP_UUU_H, H2, H2, ror16)
+RVVCALL(OPIVX2, vror_vx_w, OP_UUU_W, H4, H4, ror32)
+RVVCALL(OPIVX2, vror_vx_d, OP_UUU_D, H8, H8, ror64)
+GEN_VEXT_VX(vror_vx_b, 1)
+GEN_VEXT_VX(vror_vx_h, 2)
+GEN_VEXT_VX(vror_vx_w, 4)
+GEN_VEXT_VX(vror_vx_d, 8)
+
+RVVCALL(OPIVV2, vrol_vv_b, OP_UUU_B, H1, H1, H1, rol8)
+RVVCALL(OPIVV2, vrol_vv_h, OP_UUU_H, H2, H2, H2, rol16)
+RVVCALL(OPIVV2, vrol_vv_w, OP_UUU_W, H4, H4, H4, rol32)
+RVVCALL(OPIVV2, vrol_vv_d, OP_UUU_D, H8, H8, H8, rol64)
+GEN_VEXT_VV(vrol_vv_b, 1)
+GEN_VEXT_VV(vrol_vv_h, 2)
+GEN_VEXT_VV(vrol_vv_w, 4)
+GEN_VEXT_VV(vrol_vv_d, 8)
+
+RVVCALL(OPIVX2, vrol_vx_b, OP_UUU_B, H1, H1, rol8)
+RVVCALL(OPIVX2, vrol_vx_h, OP_UUU_H, H2, H2, rol16)
+RVVCALL(OPIVX2, vrol_vx_w, OP_UUU_W, H4, H4, rol32)
+RVVCALL(OPIVX2, vrol_vx_d, OP_UUU_D, H8, H8, rol64)
+GEN_VEXT_VX(vrol_vx_b, 1)
+GEN_VEXT_VX(vrol_vx_h, 2)
+GEN_VEXT_VX(vrol_vx_w, 4)
+GEN_VEXT_VX(vrol_vx_d, 8)
+
+static uint64_t brev8(uint64_t val)
+{
+    val = ((val & 0x5555555555555555ull) << 1) |
+          ((val & 0xAAAAAAAAAAAAAAAAull) >> 1);
+    val = ((val & 0x3333333333333333ull) << 2) |
+          ((val & 0xCCCCCCCCCCCCCCCCull) >> 2);
+    val = ((val & 0x0F0F0F0F0F0F0F0Full) << 4) |
+          ((val & 0xF0F0F0F0F0F0F0F0ull) >> 4);
+
+    return val;
+}
+
+RVVCALL(OPIVV1, vbrev8_v_b, OP_UU_B, H1, H1, brev8)
+RVVCALL(OPIVV1, vbrev8_v_h, OP_UU_H, H2, H2, brev8)
+RVVCALL(OPIVV1, vbrev8_v_w, OP_UU_W, H4, H4, brev8)
+RVVCALL(OPIVV1, vbrev8_v_d, OP_UU_D, H8, H8, brev8)
+GEN_VEXT_V(vbrev8_v_b, 1)
+GEN_VEXT_V(vbrev8_v_h, 2)
+GEN_VEXT_V(vbrev8_v_w, 4)
+GEN_VEXT_V(vbrev8_v_d, 8)
+
+#define DO_IDENTITY(a) (a)
+RVVCALL(OPIVV1, vrev8_v_b, OP_UU_B, H1, H1, DO_IDENTITY)
+RVVCALL(OPIVV1, vrev8_v_h, OP_UU_H, H2, H2, bswap16)
+RVVCALL(OPIVV1, vrev8_v_w, OP_UU_W, H4, H4, bswap32)
+RVVCALL(OPIVV1, vrev8_v_d, OP_UU_D, H8, H8, bswap64)
+GEN_VEXT_V(vrev8_v_b, 1)
+GEN_VEXT_V(vrev8_v_h, 2)
+GEN_VEXT_V(vrev8_v_w, 4)
+GEN_VEXT_V(vrev8_v_d, 8)
+
+#define DO_ANDN(a, b) ((a) & ~(b))
+RVVCALL(OPIVV2, vandn_vv_b, OP_UUU_B, H1, H1, H1, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_h, OP_UUU_H, H2, H2, H2, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_w, OP_UUU_W, H4, H4, H4, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_d, OP_UUU_D, H8, H8, H8, DO_ANDN)
+GEN_VEXT_VV(vandn_vv_b, 1)
+GEN_VEXT_VV(vandn_vv_h, 2)
+GEN_VEXT_VV(vandn_vv_w, 4)
+GEN_VEXT_VV(vandn_vv_d, 8)
+
+RVVCALL(OPIVX2, vandn_vx_b, OP_UUU_B, H1, H1, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_h, OP_UUU_H, H2, H2, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_w, OP_UUU_W, H4, H4, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_d, OP_UUU_D, H8, H8, DO_ANDN)
+GEN_VEXT_VX(vandn_vx_b, 1)
+GEN_VEXT_VX(vandn_vx_h, 2)
+GEN_VEXT_VX(vandn_vx_w, 4)
+GEN_VEXT_VX(vandn_vx_d, 8)
+
+RVVCALL(OPIVV1, vbrev_v_b, OP_UU_B, H1, H1, revbit8)
+RVVCALL(OPIVV1, vbrev_v_h, OP_UU_H, H2, H2, revbit16)
+RVVCALL(OPIVV1, vbrev_v_w, OP_UU_W, H4, H4, revbit32)
+RVVCALL(OPIVV1, vbrev_v_d, OP_UU_D, H8, H8, revbit64)
+GEN_VEXT_V(vbrev_v_b, 1)
+GEN_VEXT_V(vbrev_v_h, 2)
+GEN_VEXT_V(vbrev_v_w, 4)
+GEN_VEXT_V(vbrev_v_d, 8)
+
+RVVCALL(OPIVV1, vclz_v_b, OP_UU_B, H1, H1, clz8)
+RVVCALL(OPIVV1, vclz_v_h, OP_UU_H, H2, H2, clz16)
+RVVCALL(OPIVV1, vclz_v_w, OP_UU_W, H4, H4, clz32)
+RVVCALL(OPIVV1, vclz_v_d, OP_UU_D, H8, H8, clz64)
+GEN_VEXT_V(vclz_v_b, 1)
+GEN_VEXT_V(vclz_v_h, 2)
+GEN_VEXT_V(vclz_v_w, 4)
+GEN_VEXT_V(vclz_v_d, 8)
+
+RVVCALL(OPIVV1, vctz_v_b, OP_UU_B, H1, H1, ctz8)
+RVVCALL(OPIVV1, vctz_v_h, OP_UU_H, H2, H2, ctz16)
+RVVCALL(OPIVV1, vctz_v_w, OP_UU_W, H4, H4, ctz32)
+RVVCALL(OPIVV1, vctz_v_d, OP_UU_D, H8, H8, ctz64)
+GEN_VEXT_V(vctz_v_b, 1)
+GEN_VEXT_V(vctz_v_h, 2)
+GEN_VEXT_V(vctz_v_w, 4)
+GEN_VEXT_V(vctz_v_d, 8)
+
+RVVCALL(OPIVV1, vcpop_v_b, OP_UU_B, H1, H1, ctpop8)
+RVVCALL(OPIVV1, vcpop_v_h, OP_UU_H, H2, H2, ctpop16)
+RVVCALL(OPIVV1, vcpop_v_w, OP_UU_W, H4, H4, ctpop32)
+RVVCALL(OPIVV1, vcpop_v_d, OP_UU_D, H8, H8, ctpop64)
+GEN_VEXT_V(vcpop_v_b, 1)
+GEN_VEXT_V(vcpop_v_h, 2)
+GEN_VEXT_V(vcpop_v_w, 4)
+GEN_VEXT_V(vcpop_v_d, 8)
+
+#define DO_SLL(N, M) (N << (M & (sizeof(N) * 8 - 1)))
+RVVCALL(OPIVV2, vwsll_vv_b, WOP_UUU_B, H2, H1, H1, DO_SLL)
+RVVCALL(OPIVV2, vwsll_vv_h, WOP_UUU_H, H4, H2, H2, DO_SLL)
+RVVCALL(OPIVV2, vwsll_vv_w, WOP_UUU_W, H8, H4, H4, DO_SLL)
+GEN_VEXT_VV(vwsll_vv_b, 2)
+GEN_VEXT_VV(vwsll_vv_h, 4)
+GEN_VEXT_VV(vwsll_vv_w, 8)
+
+RVVCALL(OPIVX2, vwsll_vx_b, WOP_UUU_B, H2, H1, DO_SLL)
+RVVCALL(OPIVX2, vwsll_vx_h, WOP_UUU_H, H4, H2, DO_SLL)
+RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
+GEN_VEXT_VX(vwsll_vx_b, 2)
+GEN_VEXT_VX(vwsll_vx_h, 4)
+GEN_VEXT_VX(vwsll_vx_w, 8)
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
 
 GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
 GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
+
+/*
+ * Zvbb
+ */
+
+#define GEN_OPIVI_GVEC_TRANS_CHECK(NAME, IMM_MODE, OPIVX, SUF, CHECK)   \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)              \
+    {                                                                   \
+        if (CHECK(s, a)) {                                              \
+            static gen_helper_opivx *const fns[4] = {                   \
+                gen_helper_##OPIVX##_b,                                 \
+                gen_helper_##OPIVX##_h,                                 \
+                gen_helper_##OPIVX##_w,                                 \
+                gen_helper_##OPIVX##_d,                                 \
+            };                                                          \
+            return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew], \
+                                 IMM_MODE);                             \
+        }                                                               \
+        return false;                                                   \
+    }
+
+#define GEN_OPIVV_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
+    {                                                                    \
+        if (CHECK(s, a)) {                                               \
+            static gen_helper_gvec_4_ptr *const fns[4] = {               \
+                gen_helper_##NAME##_b,                                   \
+                gen_helper_##NAME##_h,                                   \
+                gen_helper_##NAME##_w,                                   \
+                gen_helper_##NAME##_d,                                   \
+            };                                                           \
+            return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
+        }                                                                \
+        return false;                                                    \
+    }
+
+#define GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(NAME, SUF, CHECK)       \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
+    {                                                            \
+        if (CHECK(s, a)) {                                       \
+            static gen_helper_opivx *const fns[4] = {            \
+                gen_helper_##NAME##_b,                           \
+                gen_helper_##NAME##_h,                           \
+                gen_helper_##NAME##_w,                           \
+                gen_helper_##NAME##_d,                           \
+            };                                                   \
+            return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, \
+                                       fns[s->sew]);             \
+        }                                                        \
+        return false;                                            \
+    }
+
+static bool zvbb_vv_check(DisasContext *s, arg_rmrr *a)
+{
+    return opivv_check(s, a) && s->cfg_ptr->ext_zvbb == true;
+}
+
+static bool zvbb_vx_check(DisasContext *s, arg_rmrr *a)
+{
+    return opivx_check(s, a) && s->cfg_ptr->ext_zvbb == true;
+}
+
+/* vrol.v[vx] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vrol_vv, rotlv, zvbb_vv_check)
+GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vrol_vx, rotls, zvbb_vx_check)
+
+/* vror.v[vxi] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vror_vv, rotrv, zvbb_vv_check)
+GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vror_vx, rotrs, zvbb_vx_check)
+GEN_OPIVI_GVEC_TRANS_CHECK(vror_vi, IMM_TRUNC_SEW, vror_vx, rotri, zvbb_vx_check)
+
+#define GEN_OPIVX_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
+    {                                                                    \
+        if (CHECK(s, a)) {                                               \
+            static gen_helper_opivx *const fns[4] = {                    \
+                gen_helper_##NAME##_b,                                   \
+                gen_helper_##NAME##_h,                                   \
+                gen_helper_##NAME##_w,                                   \
+                gen_helper_##NAME##_d,                                   \
+            };                                                           \
+            return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
+        }                                                                \
+        return false;                                                    \
+    }
+
+/* vandn.v[vx] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vandn_vv, andc, zvbb_vv_check)
+GEN_OPIVX_GVEC_TRANS_CHECK(vandn_vx, andcs, zvbb_vx_check)
+
+#define GEN_OPIV_TRANS(NAME, CHECK)                                        \
+    static bool trans_##NAME(DisasContext *s, arg_rmr *a)                  \
+    {                                                                      \
+        if (CHECK(s, a)) {                                                 \
+            uint32_t data = 0;                                             \
+            static gen_helper_gvec_3_ptr *const fns[4] = {                 \
+                gen_helper_##NAME##_b,                                     \
+                gen_helper_##NAME##_h,                                     \
+                gen_helper_##NAME##_w,                                     \
+                gen_helper_##NAME##_d,                                     \
+            };                                                             \
+            TCGLabel *over = gen_new_label();                              \
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);     \
+                                                                           \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                     \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                 \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                   \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s); \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                   \
+            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),         \
+                               vreg_ofs(s, a->rs2), cpu_env,               \
+                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, \
+                               data, fns[s->sew]);                         \
+            mark_vs_dirty(s);                                              \
+            gen_set_label(over);                                           \
+            return true;                                                   \
+        }                                                                  \
+        return false;                                                      \
+    }
+
+static bool zvbb_opiv_check(DisasContext *s, arg_rmr *a)
+{
+    return s->cfg_ptr->ext_zvbb == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           vext_check_ss(s, a->rd, a->rs2, a->vm);
+}
+
+GEN_OPIV_TRANS(vbrev8_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vrev8_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vbrev_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vclz_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vctz_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vcpop_v, zvbb_opiv_check)
+
+static bool vwsll_vv_check(DisasContext *s, arg_rmrr *a)
+{
+    return s->cfg_ptr->ext_zvbb && opivv_widen_check(s, a);
+}
+
+static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
+{
+    return s->cfg_ptr->ext_zvbb && opivx_widen_check(s, a);
+}
+
+/* OPIVI without GVEC IR */
+#define GEN_OPIVI_WIDEN_TRANS(NAME, IMM_MODE, OPIVX, CHECK)                  \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
+    {                                                                        \
+        if (CHECK(s, a)) {                                                   \
+            static gen_helper_opivx *const fns[3] = {                        \
+                gen_helper_##OPIVX##_b,                                      \
+                gen_helper_##OPIVX##_h,                                      \
+                gen_helper_##OPIVX##_w,                                      \
+            };                                                               \
+            return opivi_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s, \
+                               IMM_MODE);                                    \
+        }                                                                    \
+        return false;                                                        \
+    }
+
+GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
+GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
+GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
-- 
2.41.0

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

This commit adds support for the Zvkned vector-crypto extension, which
consists of the following instructions:

* vaesef.[vv,vs]
* vaesdf.[vv,vs]
* vaesdm.[vv,vs]
* vaesz.vs
* vaesem.[vv,vs]
* vaeskf1.vi
* vaeskf2.vi

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Imported aes-round.h and exposed x-zvkned
property]
[max.chou@sifive.com: Fixed endian issues and replaced the vstart & vl
egs checking by helper function]
[max.chou@sifive.com: Replaced bswap32 calls in aes key expanding]
Message-ID: <20230711165917.2629866-10-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |  14 ++
 target/riscv/insn32.decode               |  14 ++
 target/riscv/cpu.c                       |   4 +-
 target/riscv/vcrypto_helper.c            | 202 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 147 +++++++++++++++++
 6 files changed, 381 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve64d;
     bool ext_zvbb;
     bool ext_zvbc;
+    bool ext_zvkned;
     bool ext_zmmul;
     bool ext_zvfbfmin;
     bool ext_zvfbfwma;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_2(egs_check, void, i32, env)
+
+DEF_HELPER_4(vaesef_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesef_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdf_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdf_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesem_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesem_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdm_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
+DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
 @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
 @r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
+@r2_vm_1 ...... . ..... ..... ... ..... ....... &rmr vm=1 %rs2 %rd
 @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
 @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
 @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
@@ -XXX,XX +XXX,XX @@ vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
 vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
 vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
 vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
+
+# *** Zvkned vector crypto extension ***
+vaesef_vv   101000 1 ..... 00011 010 ..... 1110111 @r2_vm_1
+vaesef_vs   101001 1 ..... 00011 010 ..... 1110111 @r2_vm_1
+vaesdf_vv   101000 1 ..... 00001 010 ..... 1110111 @r2_vm_1
+vaesdf_vs   101001 1 ..... 00001 010 ..... 1110111 @r2_vm_1
+vaesem_vv   101000 1 ..... 00010 010 ..... 1110111 @r2_vm_1
+vaesem_vs   101001 1 ..... 00010 010 ..... 1110111 @r2_vm_1
+vaesdm_vv   101000 1 ..... 00000 010 ..... 1110111 @r2_vm_1
+vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
+vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
+vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
+    ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      * In principle Zve*x would also suffice here, were they supported
      * in qemu
      */
-    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
+    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     /* Vector cryptography extensions */
     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
+    DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
 
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "qemu/bswap.h"
 #include "cpu.h"
+#include "crypto/aes.h"
+#include "crypto/aes-round.h"
 #include "exec/memop.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
 GEN_VEXT_VX(vwsll_vx_b, 2)
 GEN_VEXT_VX(vwsll_vx_h, 4)
 GEN_VEXT_VX(vwsll_vx_w, 8)
+
+void HELPER(egs_check)(uint32_t egs, CPURISCVState *env)
+{
+    uint32_t vl = env->vl;
+    uint32_t vstart = env->vstart;
+
+    if (vl % egs != 0 || vstart % egs != 0) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+    }
+}
+
+static inline void xor_round_key(AESState *round_state, AESState *round_key)
+{
+    round_state->v = round_state->v ^ round_key->v;
+}
+
+#define GEN_ZVKNED_HELPER_VV(NAME, ...)                                   \
+    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
+                      uint32_t desc)                                      \
+    {                                                                     \
+        uint32_t vl = env->vl;                                            \
+        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
+        uint32_t vta = vext_vta(desc);                                    \
+                                                                          \
+        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
+            AESState round_key;                                           \
+            round_key.d[0] = *((uint64_t *)vs2 + H8(i * 2 + 0));          \
+            round_key.d[1] = *((uint64_t *)vs2 + H8(i * 2 + 1));          \
+            AESState round_state;                                         \
+            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
+            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
+            __VA_ARGS__;                                                  \
+            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
+            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
+        }                                                                 \
+        env->vstart = 0;                                                  \
+        /* set tail elements to 1s */                                     \
+        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
+    }
+
+#define GEN_ZVKNED_HELPER_VS(NAME, ...)                                   \
+    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
+                      uint32_t desc)                                      \
+    {                                                                     \
+        uint32_t vl = env->vl;                                            \
+        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
+        uint32_t vta = vext_vta(desc);                                    \
+                                                                          \
+        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
+            AESState round_key;                                           \
+            round_key.d[0] = *((uint64_t *)vs2 + H8(0));                  \
+            round_key.d[1] = *((uint64_t *)vs2 + H8(1));                  \
+            AESState round_state;                                         \
+            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
+            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
+            __VA_ARGS__;                                                  \
+            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
+            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
+        }                                                                 \
+        env->vstart = 0;                                                  \
+        /* set tail elements to 1s */                                     \
+        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
+    }
+
+GEN_ZVKNED_HELPER_VV(vaesef_vv, aesenc_SB_SR_AK(&round_state,
+                                                &round_state,
+                                                &round_key,
+                                                false);)
+GEN_ZVKNED_HELPER_VS(vaesef_vs, aesenc_SB_SR_AK(&round_state,
+                                                &round_state,
+                                                &round_key,
+                                                false);)
+GEN_ZVKNED_HELPER_VV(vaesdf_vv, aesdec_ISB_ISR_AK(&round_state,
+                                                  &round_state,
+                                                  &round_key,
+                                                  false);)
+GEN_ZVKNED_HELPER_VS(vaesdf_vs, aesdec_ISB_ISR_AK(&round_state,
+                                                  &round_state,
+                                                  &round_key,
+                                                  false);)
+GEN_ZVKNED_HELPER_VV(vaesem_vv, aesenc_SB_SR_MC_AK(&round_state,
+                                                   &round_state,
+                                                   &round_key,
+                                                   false);)
+GEN_ZVKNED_HELPER_VS(vaesem_vs, aesenc_SB_SR_MC_AK(&round_state,
+                                                   &round_state,
+                                                   &round_key,
+                                                   false);)
+GEN_ZVKNED_HELPER_VV(vaesdm_vv, aesdec_ISB_ISR_AK_IMC(&round_state,
+                                                      &round_state,
+                                                      &round_key,
+                                                      false);)
+GEN_ZVKNED_HELPER_VS(vaesdm_vs, aesdec_ISB_ISR_AK_IMC(&round_state,
+                                                      &round_state,
+                                                      &round_key,
+                                                      false);)
+GEN_ZVKNED_HELPER_VS(vaesz_vs, xor_round_key(&round_state, &round_key);)
+
+void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
+                        CPURISCVState *env, uint32_t desc)
+{
+    uint32_t *vd = vd_vptr;
+    uint32_t *vs2 = vs2_vptr;
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
+    uint32_t vta = vext_vta(desc);
+
+    uimm &= 0b1111;
+    if (uimm > 10 || uimm == 0) {
+        uimm ^= 0b1000;
+    }
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        uint32_t rk[8], tmp;
+        static const uint32_t rcon[] = {
+            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
+            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
+        };
+
+        rk[0] = vs2[i * 4 + H4(0)];
+        rk[1] = vs2[i * 4 + H4(1)];
+        rk[2] = vs2[i * 4 + H4(2)];
+        rk[3] = vs2[i * 4 + H4(3)];
+        tmp = ror32(rk[3], 8);
+
+        rk[4] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
+                         ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
+                         ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
+                         ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
+                      ^ rcon[uimm - 1];
+        rk[5] = rk[1] ^ rk[4];
+        rk[6] = rk[2] ^ rk[5];
+        rk[7] = rk[3] ^ rk[6];
+
+        vd[i * 4 + H4(0)] = rk[4];
+        vd[i * 4 + H4(1)] = rk[5];
+        vd[i * 4 + H4(2)] = rk[6];
+        vd[i * 4 + H4(3)] = rk[7];
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
+}
+
+void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
+                        CPURISCVState *env, uint32_t desc)
+{
+    uint32_t *vd = vd_vptr;
+    uint32_t *vs2 = vs2_vptr;
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
+    uint32_t vta = vext_vta(desc);
+
+    uimm &= 0b1111;
+    if (uimm > 14 || uimm < 2) {
+        uimm ^= 0b1000;
+    }
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        uint32_t rk[12], tmp;
+        static const uint32_t rcon[] = {
+            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
+            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
+        };
+
+        rk[0] = vd[i * 4 + H4(0)];
+        rk[1] = vd[i * 4 + H4(1)];
+        rk[2] = vd[i * 4 + H4(2)];
+        rk[3] = vd[i * 4 + H4(3)];
+        rk[4] = vs2[i * 4 + H4(0)];
+        rk[5] = vs2[i * 4 + H4(1)];
+        rk[6] = vs2[i * 4 + H4(2)];
+        rk[7] = vs2[i * 4 + H4(3)];
+
+        if (uimm % 2 == 0) {
+            tmp = ror32(rk[7], 8);
+            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
+                             ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
+                             ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
+                             ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
+                          ^ rcon[(uimm - 1) / 2];
+        } else {
+            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(rk[7] >> 24) & 0xff] << 24) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 16) & 0xff] << 16) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 8) & 0xff] << 8) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 0) & 0xff] << 0));
+        }
+        rk[9] = rk[1] ^ rk[8];
+        rk[10] = rk[2] ^ rk[9];
+        rk[11] = rk[3] ^ rk[10];
+
+        vd[i * 4 + H4(0)] = rk[8];
+        vd[i * 4 + H4(1)] = rk[9];
+        vd[i * 4 + H4(2)] = rk[10];
+        vd[i * 4 + H4(3)] = rk[11];
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
+}
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
 GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
 GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
 GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
+
+/*
+ * Zvkned
+ */
+
+#define ZVKNED_EGS 4
+
+#define GEN_V_UNMASKED_TRANS(NAME, CHECK, EGS)                                \
+    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            TCGv_ptr rd_v, rs2_v;                                             \
+            TCGv_i32 desc, egs;                                               \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+            rd_v = tcg_temp_new_ptr();                                        \
+            rs2_v = tcg_temp_new_ptr();                                       \
+            desc = tcg_constant_i32(                                          \
+                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
+            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
+            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
+            gen_helper_##NAME(rd_v, rs2_v, cpu_env, desc);                    \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vaes_check_vv(DisasContext *s, arg_rmr *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul) &&
+           s->sew == MO_32;
+}
+
+static bool vaes_check_overlap(DisasContext *s, int vd, int vs2)
+{
+    int8_t op_size = s->lmul <= 0 ? 1 : 1 << s->lmul;
+    return !is_overlapped(vd, op_size, vs2, 1);
+}
+
+static bool vaes_check_vs(DisasContext *s, arg_rmr *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return vaes_check_overlap(s, a->rd, a->rs2) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           require_align(a->rd, s->lmul) &&
+           s->sew == MO_32;
+}
+
+GEN_V_UNMASKED_TRANS(vaesef_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesef_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdf_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdf_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdm_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdm_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesz_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesem_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesem_vs, vaes_check_vs, ZVKNED_EGS)
+
+#define GEN_VI_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
+    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            TCGv_ptr rd_v, rs2_v;                                             \
+            TCGv_i32 uimm_v, desc, egs;                                       \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+                                                                              \
+            rd_v = tcg_temp_new_ptr();                                        \
+            rs2_v = tcg_temp_new_ptr();                                       \
+            uimm_v = tcg_constant_i32(a->rs1);                                \
+            desc = tcg_constant_i32(                                          \
+                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
+            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
+            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
+            gen_helper_##NAME(rd_v, rs2_v, uimm_v, cpu_env, desc);            \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vaeskf1_check(DisasContext *s, arg_vaeskf1_vi *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->sew == MO_32 &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul);
+}
+
+static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->sew == MO_32 &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul);
+}
+
+GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
+GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

This commit adds support for the Zvknh vector-crypto extension, which
consists of the following instructions:

* vsha2ms.vv
* vsha2c[hl].vv

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvknha & x-zvknhb properties]
[max.chou@sifive.com: Replaced SEW selection to happened during
translation]
Message-ID: <20230711165917.2629866-11-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   2 +
 target/riscv/helper.h                    |   6 +
 target/riscv/insn32.decode               |   5 +
 target/riscv/cpu.c                       |  13 +-
 target/riscv/vcrypto_helper.c            | 238 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 129 ++++++++++++
 6 files changed, 390 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zvbb;
     bool ext_zvbc;
     bool ext_zvkned;
+    bool ext_zvknha;
+    bool ext_zvknhb;
     bool ext_zmmul;
     bool ext_zvfbfmin;
     bool ext_zvfbfwma;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
 DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
 DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
 DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
+
+DEF_HELPER_5(vsha2ms_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
 vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
 vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+
+# *** Zvknh vector crypto extension ***
+vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
+    ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
+    ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      * In principle Zve*x would also suffice here, were they supported
      * in qemu
      */
-    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
+    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
+        !cpu->cfg.ext_zve32f) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
     }
 
-    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
-        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
+    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
+        error_setg(
+            errp,
+            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
     DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
+    DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
+    DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
     /* set tail elements to 1s */
     vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 }
+
+static inline uint32_t sig0_sha256(uint32_t x)
+{
+    return ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3);
+}
+
+static inline uint32_t sig1_sha256(uint32_t x)
+{
+    return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
+}
+
+static inline uint64_t sig0_sha512(uint64_t x)
+{
+    return ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7);
+}
+
+static inline uint64_t sig1_sha512(uint64_t x)
+{
+    return ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6);
+}
+
+static inline void vsha2ms_e32(uint32_t *vd, uint32_t *vs1, uint32_t *vs2)
+{
+    uint32_t res[4];
+    res[0] = sig1_sha256(vs1[H4(2)]) + vs2[H4(1)] + sig0_sha256(vd[H4(1)]) +
+             vd[H4(0)];
+    res[1] = sig1_sha256(vs1[H4(3)]) + vs2[H4(2)] + sig0_sha256(vd[H4(2)]) +
+             vd[H4(1)];
+    res[2] =
+        sig1_sha256(res[0]) + vs2[H4(3)] + sig0_sha256(vd[H4(3)]) + vd[H4(2)];
+    res[3] =
+        sig1_sha256(res[1]) + vs1[H4(0)] + sig0_sha256(vs2[H4(0)]) + vd[H4(3)];
+    vd[H4(3)] = res[3];
+    vd[H4(2)] = res[2];
+    vd[H4(1)] = res[1];
+    vd[H4(0)] = res[0];
+}
+
+static inline void vsha2ms_e64(uint64_t *vd, uint64_t *vs1, uint64_t *vs2)
+{
+    uint64_t res[4];
+    res[0] = sig1_sha512(vs1[2]) + vs2[1] + sig0_sha512(vd[1]) + vd[0];
+    res[1] = sig1_sha512(vs1[3]) + vs2[2] + sig0_sha512(vd[2]) + vd[1];
+    res[2] = sig1_sha512(res[0]) + vs2[3] + sig0_sha512(vd[3]) + vd[2];
+    res[3] = sig1_sha512(res[1]) + vs1[0] + sig0_sha512(vs2[0]) + vd[3];
+    vd[3] = res[3];
+    vd[2] = res[2];
+    vd[1] = res[1];
+    vd[0] = res[0];
+}
+
+void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                        uint32_t desc)
+{
+    uint32_t sew = FIELD_EX64(env->vtype, VTYPE, VSEW);
+    uint32_t esz = sew == MO_32 ? 4 : 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        if (sew == MO_32) {
+            vsha2ms_e32(((uint32_t *)vd) + i * 4, ((uint32_t *)vs1) + i * 4,
+                        ((uint32_t *)vs2) + i * 4);
+        } else {
+            /* If not 32 then SEW should be 64 */
+            vsha2ms_e64(((uint64_t *)vd) + i * 4, ((uint64_t *)vs1) + i * 4,
+                        ((uint64_t *)vs2) + i * 4);
+        }
+    }
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+static inline uint64_t sum0_64(uint64_t x)
+{
+    return ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39);
+}
+
+static inline uint32_t sum0_32(uint32_t x)
+{
+    return ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22);
+}
+
+static inline uint64_t sum1_64(uint64_t x)
+{
+    return ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41);
+}
+
+static inline uint32_t sum1_32(uint32_t x)
+{
+    return ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25);
+}
+
+#define ch(x, y, z) ((x & y) ^ ((~x) & z))
+
+#define maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
+
+static void vsha2c_64(uint64_t *vs2, uint64_t *vd, uint64_t *vs1)
+{
+    uint64_t a = vs2[3], b = vs2[2], e = vs2[1], f = vs2[0];
+    uint64_t c = vd[3], d = vd[2], g = vd[1], h = vd[0];
+    uint64_t W0 = vs1[0], W1 = vs1[1];
+    uint64_t T1 = h + sum1_64(e) + ch(e, f, g) + W0;
+    uint64_t T2 = sum0_64(a) + maj(a, b, c);
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    T1 = h + sum1_64(e) + ch(e, f, g) + W1;
+    T2 = sum0_64(a) + maj(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    vd[0] = f;
+    vd[1] = e;
+    vd[2] = b;
+    vd[3] = a;
+}
+
+static void vsha2c_32(uint32_t *vs2, uint32_t *vd, uint32_t *vs1)
+{
+    uint32_t a = vs2[H4(3)], b = vs2[H4(2)], e = vs2[H4(1)], f = vs2[H4(0)];
+    uint32_t c = vd[H4(3)], d = vd[H4(2)], g = vd[H4(1)], h = vd[H4(0)];
+    uint32_t W0 = vs1[H4(0)], W1 = vs1[H4(1)];
+    uint32_t T1 = h + sum1_32(e) + ch(e, f, g) + W0;
+    uint32_t T2 = sum0_32(a) + maj(a, b, c);
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    T1 = h + sum1_32(e) + ch(e, f, g) + W1;
+    T2 = sum0_32(a) + maj(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    vd[H4(0)] = f;
+    vd[H4(1)] = e;
+    vd[H4(2)] = b;
+    vd[H4(3)] = a;
+}
+
+void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 4;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
+                  ((uint32_t *)vs1) + 4 * i + 2);
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
+                  ((uint64_t *)vs1) + 4 * i + 2);
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 4;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
+                  (((uint32_t *)vs1) + 4 * i));
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    uint32_t esz = 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
+                  (((uint64_t *)vs1) + 4 * i));
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
 
 GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
 GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
+
+/*
+ * Zvknh
+ */
+
+#define ZVKNH_EGS 4
+
+#define GEN_VV_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+            TCGv_i32 egs;                                                     \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+                                                                              \
+            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),       \
+                               vreg_ofs(s, a->rs2), cpu_env,                  \
+                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8,    \
+                               data, gen_helper_##NAME);                      \
+                                                                              \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vsha_check_sew(DisasContext *s)
+{
+    return (s->cfg_ptr->ext_zvknha == true && s->sew == MO_32) ||
+           (s->cfg_ptr->ext_zvknhb == true &&
+            (s->sew == MO_32 || s->sew == MO_64));
+}
+
+static bool vsha_check(DisasContext *s, arg_rmrr *a)
+{
+    int egw_bytes = ZVKNH_EGS << s->sew;
+    int mult = 1 << MAX(s->lmul, 0);
+    return opivv_check(s, a) &&
+           vsha_check_sew(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           !is_overlapped(a->rd, mult, a->rs1, mult) &&
+           !is_overlapped(a->rd, mult, a->rs2, mult) &&
+           s->lmul >= 0;
+}
+
+GEN_VV_UNMASKED_TRANS(vsha2ms_vv, vsha_check, ZVKNH_EGS)
+
+static bool trans_vsha2cl_vv(DisasContext *s, arg_rmrr *a)
+{
+    if (vsha_check(s, a)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+        TCGv_i32 egs;
+
+        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
+            /* save opcode for unwinding in case we throw an exception */
+            decode_save_opc(s);
+            egs = tcg_constant_i32(ZVKNH_EGS);
+            gen_helper_egs_check(egs, cpu_env);
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+        }
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
+
+        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
+            s->cfg_ptr->vlen / 8, data,
+            s->sew == MO_32 ?
+                gen_helper_vsha2cl32_vv : gen_helper_vsha2cl64_vv);
+
+        mark_vs_dirty(s);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
+{
+    if (vsha_check(s, a)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+        TCGv_i32 egs;
+
+        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
+            /* save opcode for unwinding in case we throw an exception */
+            decode_save_opc(s);
+            egs = tcg_constant_i32(ZVKNH_EGS);
+            gen_helper_egs_check(egs, cpu_env);
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+        }
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
+
+        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
+            s->cfg_ptr->vlen / 8, data,
+            s->sew == MO_32 ?
+                gen_helper_vsha2ch32_vv : gen_helper_vsha2ch64_vv);
+
+        mark_vs_dirty(s);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
-- 
2.41.0

From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>

This commit adds support for the Zvksh vector-crypto extension, which
consists of the following instructions:

* vsm3me.vv
* vsm3c.vi

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvksh property]
Message-ID: <20230711165917.2629866-12-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |   3 +
 target/riscv/insn32.decode               |   4 +
 target/riscv/cpu.c                       |   6 +-
 target/riscv/vcrypto_helper.c            | 134 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc |  31 ++++++
 6 files changed, 177 insertions(+), 2 deletions(-)

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

This commit adds support for the Zvkg vector-crypto extension, which
consists of the following instructions:

* vgmul.vv
* vghsh.vv

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvkg property]
[max.chou@sifive.com: Replaced uint by int for cross win32 build]
Message-ID: <20230711165917.2629866-13-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |  1 +
 target/riscv/helper.h                    |  3 +
 target/riscv/insn32.decode               |  4 ++
 target/riscv/cpu.c                       |  6 +-
 target/riscv/vcrypto_helper.c            | 72 ++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 30 ++++++++++
 6 files changed, 114 insertions(+), 2 deletions(-)

From: Max Chou <max.chou@sifive.com>

Allows sharing of sm4_subword between different targets.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-14-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/sm4.h           |  8 ++++++++
 target/arm/tcg/crypto_helper.c | 10 ++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/sm4.h
+++ b/include/crypto/sm4.h
@@ -XXX,XX +XXX,XX @@
 
 extern const uint8_t sm4_sbox[256];
 
+static inline uint32_t sm4_subword(uint32_t word)
+{
+    return sm4_sbox[word & 0xff] |
+           sm4_sbox[(word >> 8) & 0xff] << 8 |
+           sm4_sbox[(word >> 16) & 0xff] << 16 |
+           sm4_sbox[(word >> 24) & 0xff] << 24;
+}
+
 #endif
diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
             CR_ST_WORD(d, (i + 3) % 4) ^
             CR_ST_WORD(n, i);
 
-        t = sm4_sbox[t & 0xff] |
-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-            sm4_sbox[(t >> 24) & 0xff] << 24;
+        t = sm4_subword(t);
 
         CR_ST_WORD(d, i) ^= t ^ rol32(t, 2) ^ rol32(t, 10) ^ rol32(t, 18) ^
                             rol32(t, 24);
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4ekey(uint64_t *rd, uint64_t *rn, uint64_t *rm)
             CR_ST_WORD(d, (i + 3) % 4) ^
             CR_ST_WORD(m, i);
 
-        t = sm4_sbox[t & 0xff] |
-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-            sm4_sbox[(t >> 24) & 0xff] << 24;
+        t = sm4_subword(t);
 
         CR_ST_WORD(d, i) ^= t ^ rol32(t, 13) ^ rol32(t, 23);
     }
-- 
2.41.0

From: Max Chou <max.chou@sifive.com>

Adds sm4_ck constant for use in sm4 cryptography across different targets.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-15-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/sm4.h |  1 +
 crypto/sm4.c         | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/sm4.h
+++ b/include/crypto/sm4.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_SM4_H
 
 extern const uint8_t sm4_sbox[256];
+extern const uint32_t sm4_ck[32];
 
 static inline uint32_t sm4_subword(uint32_t word)
 {
diff --git a/crypto/sm4.c b/crypto/sm4.c
index XXXXXXX..XXXXXXX 100644
--- a/crypto/sm4.c
+++ b/crypto/sm4.c
@@ -XXX,XX +XXX,XX @@ uint8_t const sm4_sbox[] = {
     0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
 };
 
+uint32_t const sm4_ck[] = {
+    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
+    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
+    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
+    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
+    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
+    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
+    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
+    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
+};
-- 
2.41.0

From: Max Chou <max.chou@sifive.com>

This commit adds support for the Zvksed vector-crypto extension, which
consists of the following instructions:

* vsm4k.vi
* vsm4r.[vv,vs]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
[lawrence.hunter@codethink.co.uk: Moved SM4 functions from
crypto_helper.c to vcrypto_helper.c]
[nazar.kazakov@codethink.co.uk: Added alignment checks, refactored code to
use macros, and minor style changes]
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-16-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |   4 +
 target/riscv/insn32.decode               |   5 +
 target/riscv/cpu.c                       |   5 +-
 target/riscv/vcrypto_helper.c            | 127 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc |  43 ++++++++
 6 files changed, 184 insertions(+), 1 deletion(-)

From: Rob Bradford <rbradford@rivosinc.com>

These are WARL fields - zero out the bits for unavailable counters and
special case the TM bit in mcountinhibit which is hardwired to zero.
This patch achieves this by modifying the value written so that any use
of the field will see the correctly masked bits.

Tested by modifying OpenSBI to write max value to these CSRs and upon
subsequent read the appropriate number of bits for number of PMUs is
enabled and the TM bit is zero in mcountinhibit.

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20230802124906.24197-1-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
 {
     int cidx;
     PMUCTRState *counter;
+    RISCVCPU *cpu = env_archcpu(env);
 
-    env->mcountinhibit = val;
+    /* WARL register - disable unavailable counters; TM bit is always 0 */
+    env->mcountinhibit =
+        val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR);
 
     /* Check if any other counter is also monitoring cycles/instructions */
     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
                                        target_ulong val)
 {
-    env->mcounteren = val;
+    RISCVCPU *cpu = env_archcpu(env);
+
+    /* WARL register - disable unavailable counters */
+    env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
+                             COUNTEREN_IR);
     return RISCV_EXCP_NONE;
 }
 
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

RVA23 Profiles states:
The RVA23 profiles are intended to be used for 64-bit application
processors that will run rich OS stacks from standard binary OS
distributions and with a substantial number of third-party binary user
applications that will be supported over a considerable length of time
in the field.

The chapter 4 of the unprivileged spec introduces the Zihintntl extension
and Zihintntl is a mandatory extension presented in RVA23 Profiles, whose
purpose is to enable application and operating system portability across
different implementations. Thus the DTS should contain the Zihintntl ISA
string in order to pass to software.

The unprivileged spec states:
Like any HINTs, these instructions may be freely ignored. Hence, although
they are described in terms of cache-based memory hierarchies, they do not
mandate the provision of caches.

These instructions are encoded with non-used opcode, e.g. ADD x0, x0, x2,
which QEMU already supports, and QEMU does not emulate cache. Therefore
these instructions can be considered as a no-op, and we only need to add
a new property for the Zihintntl extension.

Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Jason Chien <jason.chien@sifive.com>
Message-ID: <20230726074049.19505-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h | 1 +
 target/riscv/cpu.c     | 2 ++
 2 files changed, 3 insertions(+)

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Commit a47842d ("riscv: Add support for the Zfa extension") implemented the zfa extension.
However, it has some typos for fleq.d and fltq.d. Both of them misused the fltq.s
helper function.

Fixes: a47842d ("riscv: Add support for the Zfa extension")
Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-ID: <20230728003906.768-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzfa.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzfa.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
@@ -XXX,XX +XXX,XX @@ bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_helper_fleq_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_helper_fltq_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

When writing the upper mtime, we should keep the original lower mtime
whose value is given by cpu_riscv_read_rtc() instead of
cpu_riscv_read_rtc_raw(). The same logic applies to writes to lower mtime.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230728082502.26439-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         return;
     } else if (addr == mtimer->time_base || addr == mtimer->time_base + 4) {
         uint64_t rtc_r = cpu_riscv_read_rtc_raw(mtimer->timebase_freq);
+        uint64_t rtc = cpu_riscv_read_rtc(mtimer);
 
         if (addr == mtimer->time_base) {
             if (size == 4) {
                 /* time_lo for RV32/RV64 */
-                mtimer->time_delta = ((rtc_r & ~0xFFFFFFFFULL) | value) - rtc_r;
+                mtimer->time_delta = ((rtc & ~0xFFFFFFFFULL) | value) - rtc_r;
             } else {
                 /* time for RV64 */
                 mtimer->time_delta = value - rtc_r;
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         } else {
             if (size == 4) {
                 /* time_hi for RV32/RV64 */
-                mtimer->time_delta = (value << 32 | (rtc_r & 0xFFFFFFFF)) - rtc_r;
+                mtimer->time_delta = (value << 32 | (rtc & 0xFFFFFFFF)) - rtc_r;
             } else {
                 qemu_log_mask(LOG_GUEST_ERROR,
                               "aclint-mtimer: invalid time_hi write: %08x",
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

The variables whose values are given by cpu_riscv_read_rtc() should be named
"rtc". The variables whose value are given by cpu_riscv_read_rtc_raw()
should be named "rtc_r".

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230728082502.26439-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
     uint64_t next;
     uint64_t diff;
 
-    uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
+    uint64_t rtc = cpu_riscv_read_rtc(mtimer);
 
     /* Compute the relative hartid w.r.t the socket */
     hartid = hartid - mtimer->hartid_base;
 
     mtimer->timecmp[hartid] = value;
-    if (mtimer->timecmp[hartid] <= rtc_r) {
+    if (mtimer->timecmp[hartid] <= rtc) {
         /*
          * If we're setting an MTIMECMP value in the "past",
          * immediately raise the timer interrupt
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
 
     /* otherwise, set up the future timer interrupt */
     qemu_irq_lower(mtimer->timer_irqs[hartid]);
-    diff = mtimer->timecmp[hartid] - rtc_r;
+    diff = mtimer->timecmp[hartid] - rtc;
     /* back to ns (note args switched in muldiv64) */
     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
 
-- 
2.41.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

We should not use types dependend on host arch for target_ucontext.
This bug is found when run rv32 applications.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230811055438.1945-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/riscv/signal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/riscv/signal.c
+++ b/linux-user/riscv/signal.c
@@ -XXX,XX +XXX,XX @@ struct target_sigcontext {
 }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
 
 struct target_ucontext {
-    unsigned long uc_flags;
-    struct target_ucontext *uc_link;
+    abi_ulong uc_flags;
+    abi_ptr uc_link;
     target_stack_t uc_stack;
     target_sigset_t uc_sigmask;
     uint8_t   __unused[1024 / 8 - sizeof(target_sigset_t)];
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

In this patch, we create the APLIC and IMSIC FDT helper functions and
remove M mode AIA devices when using KVM acceleration.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-2-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 290 +++++++++++++++++++++++-------------------------
 1 file changed, 137 insertions(+), 153 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static uint32_t imsic_num_bits(uint32_t count)
     return ret;
 }
 
-static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
-                             uint32_t *phandle, uint32_t *intc_phandles,
-                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
+static void create_fdt_one_imsic(RISCVVirtState *s, hwaddr base_addr,
+                                 uint32_t *intc_phandles, uint32_t msi_phandle,
+                                 bool m_mode, uint32_t imsic_guest_bits)
 {
     int cpu, socket;
     char *imsic_name;
     MachineState *ms = MACHINE(s);
     int socket_count = riscv_socket_count(ms);
-    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
+    uint32_t imsic_max_hart_per_socket;
     uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
 
-    *msi_m_phandle = (*phandle)++;
-    *msi_s_phandle = (*phandle)++;
     imsic_cells = g_new0(uint32_t, ms->smp.cpus * 2);
     imsic_regs = g_new0(uint32_t, socket_count * 4);
 
-    /* M-level IMSIC node */
     for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
         imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+        imsic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
-    imsic_max_hart_per_socket = 0;
-    for (socket = 0; socket < socket_count; socket++) {
-        imsic_addr = memmap[VIRT_IMSIC_M].base +
-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
-        imsic_regs[socket * 4 + 0] = 0;
-        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
-        imsic_regs[socket * 4 + 2] = 0;
-        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
-        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
-            imsic_max_hart_per_socket = s->soc[socket].num_harts;
-        }
-    }
-    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-        (unsigned long)memmap[VIRT_IMSIC_M].base);
-    qemu_fdt_add_subnode(ms->fdt, imsic_name);
-    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
-        "riscv,imsics");
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
-        FDT_IMSIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
-        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
-        socket_count * sizeof(uint32_t) * 4);
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
-        VIRT_IRQCHIP_NUM_MSIS);
-    if (socket_count > 1) {
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
-            imsic_num_bits(imsic_max_hart_per_socket));
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
-            imsic_num_bits(socket_count));
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
-            IMSIC_MMIO_GROUP_MIN_SHIFT);
-    }
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_m_phandle);
-
-    g_free(imsic_name);
 
-    /* S-level IMSIC node */
-    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
-        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
-    }
-    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
     imsic_max_hart_per_socket = 0;
     for (socket = 0; socket < socket_count; socket++) {
-        imsic_addr = memmap[VIRT_IMSIC_S].base +
-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+        imsic_addr = base_addr + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
         imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
                      s->soc[socket].num_harts;
         imsic_regs[socket * 4 + 0] = 0;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
             imsic_max_hart_per_socket = s->soc[socket].num_harts;
         }
     }
-    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-        (unsigned long)memmap[VIRT_IMSIC_S].base);
+
+    imsic_name = g_strdup_printf("/soc/imsics@%lx", (unsigned long)base_addr);
     qemu_fdt_add_subnode(ms->fdt, imsic_name);
-    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
-        "riscv,imsics");
+    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible", "riscv,imsics");
     qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
-        FDT_IMSIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
-        NULL, 0);
+                          FDT_IMSIC_INT_CELLS);
+    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller", NULL, 0);
     qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
-        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
+                     imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
     qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
-        socket_count * sizeof(uint32_t) * 4);
+                     socket_count * sizeof(uint32_t) * 4);
     qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
-        VIRT_IRQCHIP_NUM_MSIS);
+                     VIRT_IRQCHIP_NUM_MSIS);
+
     if (imsic_guest_bits) {
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,guest-index-bits",
-            imsic_guest_bits);
+                              imsic_guest_bits);
     }
+
     if (socket_count > 1) {
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
-            imsic_num_bits(imsic_max_hart_per_socket));
+                              imsic_num_bits(imsic_max_hart_per_socket));
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
-            imsic_num_bits(socket_count));
+                              imsic_num_bits(socket_count));
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
-            IMSIC_MMIO_GROUP_MIN_SHIFT);
+                              IMSIC_MMIO_GROUP_MIN_SHIFT);
     }
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_s_phandle);
-    g_free(imsic_name);
+    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", msi_phandle);
 
+    g_free(imsic_name);
     g_free(imsic_regs);
     g_free(imsic_cells);
 }
 
-static void create_fdt_socket_aplic(RISCVVirtState *s,
-                                    const MemMapEntry *memmap, int socket,
-                                    uint32_t msi_m_phandle,
-                                    uint32_t msi_s_phandle,
-                                    uint32_t *phandle,
-                                    uint32_t *intc_phandles,
-                                    uint32_t *aplic_phandles)
+static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
+                             uint32_t *phandle, uint32_t *intc_phandles,
+                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
+{
+    *msi_m_phandle = (*phandle)++;
+    *msi_s_phandle = (*phandle)++;
+
+    if (!kvm_enabled()) {
+        /* M-level IMSIC node */
+        create_fdt_one_imsic(s, memmap[VIRT_IMSIC_M].base, intc_phandles,
+                             *msi_m_phandle, true, 0);
+    }
+
+    /* S-level IMSIC node */
+    create_fdt_one_imsic(s, memmap[VIRT_IMSIC_S].base, intc_phandles,
+                         *msi_s_phandle, false,
+                         imsic_num_bits(s->aia_guests + 1));
+
+}
+
+static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
+                                 unsigned long aplic_addr, uint32_t aplic_size,
+                                 uint32_t msi_phandle,
+                                 uint32_t *intc_phandles,
+                                 uint32_t aplic_phandle,
+                                 uint32_t aplic_child_phandle,
+                                 bool m_mode)
 {
     int cpu;
     char *aplic_name;
     uint32_t *aplic_cells;
-    unsigned long aplic_addr;
     MachineState *ms = MACHINE(s);
-    uint32_t aplic_m_phandle, aplic_s_phandle;
 
-    aplic_m_phandle = (*phandle)++;
-    aplic_s_phandle = (*phandle)++;
     aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 
-    /* M-level APLIC node */
     for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+        aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
-    aplic_addr = memmap[VIRT_APLIC_M].base +
-                 (memmap[VIRT_APLIC_M].size * socket);
+
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
     qemu_fdt_add_subnode(ms->fdt, aplic_name);
     qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
     qemu_fdt_setprop_cell(ms->fdt, aplic_name,
-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
+                          "#interrupt-cells", FDT_APLIC_INT_CELLS);
     qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
+
     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+                         aplic_cells,
+                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
     } else {
-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
-            msi_m_phandle);
+        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
     }
+
     qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
+                           0x0, aplic_addr, 0x0, aplic_size);
     qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
-        VIRT_IRQCHIP_NUM_SOURCES);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
-        aplic_s_phandle);
-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
-        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
+                          VIRT_IRQCHIP_NUM_SOURCES);
+
+    if (aplic_child_phandle) {
+        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
+                              aplic_child_phandle);
+        qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
+                               aplic_child_phandle, 0x1,
+                               VIRT_IRQCHIP_NUM_SOURCES);
+    }
+
     riscv_socket_fdt_write_id(ms, aplic_name, socket);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_m_phandle);
+    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_phandle);
+
     g_free(aplic_name);
+    g_free(aplic_cells);
+}
 
-    /* S-level APLIC node */
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
-        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
+static void create_fdt_socket_aplic(RISCVVirtState *s,
+                                    const MemMapEntry *memmap, int socket,
+                                    uint32_t msi_m_phandle,
+                                    uint32_t msi_s_phandle,
+                                    uint32_t *phandle,
+                                    uint32_t *intc_phandles,
+                                    uint32_t *aplic_phandles)
+{
+    char *aplic_name;
+    unsigned long aplic_addr;
+    MachineState *ms = MACHINE(s);
+    uint32_t aplic_m_phandle, aplic_s_phandle;
+
+    aplic_m_phandle = (*phandle)++;
+    aplic_s_phandle = (*phandle)++;
+
+    if (!kvm_enabled()) {
+        /* M-level APLIC node */
+        aplic_addr = memmap[VIRT_APLIC_M].base +
+                     (memmap[VIRT_APLIC_M].size * socket);
+        create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
+                             msi_m_phandle, intc_phandles,
+                             aplic_m_phandle, aplic_s_phandle,
+                             true);
     }
+
+    /* S-level APLIC node */
     aplic_addr = memmap[VIRT_APLIC_S].base +
                  (memmap[VIRT_APLIC_S].size * socket);
+    create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
+                         msi_s_phandle, intc_phandles,
+                         aplic_s_phandle, 0,
+                         false);
+
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
-    qemu_fdt_add_subnode(ms->fdt, aplic_name);
-    qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name,
-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
-    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
-        qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
-    } else {
-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
-            msi_s_phandle);
-    }
-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
-        VIRT_IRQCHIP_NUM_SOURCES);
-    riscv_socket_fdt_write_id(ms, aplic_name, socket);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_s_phandle);
 
     if (!socket) {
         platform_bus_add_all_fdt_nodes(ms->fdt, aplic_name,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
 
     g_free(aplic_name);
 
-    g_free(aplic_cells);
     aplic_phandles[socket] = aplic_s_phandle;
 }
 
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
     int i;
     hwaddr addr;
     uint32_t guest_bits;
-    DeviceState *aplic_m;
-    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
+    DeviceState *aplic_s = NULL;
+    DeviceState *aplic_m = NULL;
+    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 
     if (msimode) {
-        /* Per-socket M-level IMSICs */
-        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-        for (i = 0; i < hart_count; i++) {
-            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
-                               base_hartid + i, true, 1,
-                               VIRT_IRQCHIP_NUM_MSIS);
+        if (!kvm_enabled()) {
+            /* Per-socket M-level IMSICs */
+            addr = memmap[VIRT_IMSIC_M].base +
+                   socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+            for (i = 0; i < hart_count; i++) {
+                riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
+                                   base_hartid + i, true, 1,
+                                   VIRT_IRQCHIP_NUM_MSIS);
+            }
         }
 
         /* Per-socket S-level IMSICs */
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
         }
     }
 
-    /* Per-socket M-level APLIC */
-    aplic_m = riscv_aplic_create(
-        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
-        memmap[VIRT_APLIC_M].size,
-        (msimode) ? 0 : base_hartid,
-        (msimode) ? 0 : hart_count,
-        VIRT_IRQCHIP_NUM_SOURCES,
-        VIRT_IRQCHIP_NUM_PRIO_BITS,
-        msimode, true, NULL);
-
-    if (aplic_m) {
-        /* Per-socket S-level APLIC */
-        riscv_aplic_create(
-            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
-            memmap[VIRT_APLIC_S].size,
-            (msimode) ? 0 : base_hartid,
-            (msimode) ? 0 : hart_count,
-            VIRT_IRQCHIP_NUM_SOURCES,
-            VIRT_IRQCHIP_NUM_PRIO_BITS,
-            msimode, false, aplic_m);
+    if (!kvm_enabled()) {
+        /* Per-socket M-level APLIC */
+        aplic_m = riscv_aplic_create(memmap[VIRT_APLIC_M].base +
+                                     socket * memmap[VIRT_APLIC_M].size,
+                                     memmap[VIRT_APLIC_M].size,
+                                     (msimode) ? 0 : base_hartid,
+                                     (msimode) ? 0 : hart_count,
+                                     VIRT_IRQCHIP_NUM_SOURCES,
+                                     VIRT_IRQCHIP_NUM_PRIO_BITS,
+                                     msimode, true, NULL);
     }
 
-    return aplic_m;
+    /* Per-socket S-level APLIC */
+    aplic_s = riscv_aplic_create(memmap[VIRT_APLIC_S].base +
+                                 socket * memmap[VIRT_APLIC_S].size,
+                                 memmap[VIRT_APLIC_S].size,
+                                 (msimode) ? 0 : base_hartid,
+                                 (msimode) ? 0 : hart_count,
+                                 VIRT_IRQCHIP_NUM_SOURCES,
+                                 VIRT_IRQCHIP_NUM_PRIO_BITS,
+                                 msimode, false, aplic_m);
+
+    return kvm_enabled() ? aplic_s : aplic_m;
 }
 
 static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

We check the in-kernel irqchip support when using KVM acceleration.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-3-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
 
 int kvm_arch_irqchip_create(KVMState *s)
 {
-    return 0;
+    if (kvm_kernel_irqchip_split()) {
+        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
+        exit(1);
+    }
+
+    /*
+     * We can create the VAIA using the newer device control API.
+     */
+    return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
 }
 
 int kvm_arch_process_async_events(CPUState *cs)
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

We create a vAIA chip by using the KVM_DEV_TYPE_RISCV_AIA and then set up
the chip with the KVM_DEV_RISCV_AIA_GRP_* APIs.
We also extend KVM accelerator to specify the KVM AIA mode. The "riscv-aia"
parameter is passed along with --accel in QEMU command-line.
1) "riscv-aia=emul": IMSIC is emulated by hypervisor
2) "riscv-aia=hwaccel": use hardware guest IMSIC
3) "riscv-aia=auto": use the hardware guest IMSICs whenever available
                     otherwise we fallback to software emulation.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-4-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h |   4 +
 target/riscv/kvm.c       | 186 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 190 insertions(+)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@
 void kvm_riscv_init_user_properties(Object *cpu_obj);
 void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
 void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
+void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                          uint64_t aia_irq_num, uint64_t aia_msi_num,
+                          uint64_t aplic_base, uint64_t imsic_base,
+                          uint64_t guest_num);
 
 #endif
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/irq.h"
+#include "hw/intc/riscv_imsic.h"
 #include "qemu/log.h"
 #include "hw/loader.h"
 #include "kvm_riscv.h"
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "migration/migration.h"
 #include "sysemu/runstate.h"
+#include "hw/riscv/numa.h"
 
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_cpu_check_are_resettable(void)
     return true;
 }
 
+static int aia_mode;
+
+static const char *kvm_aia_mode_str(uint64_t mode)
+{
+    switch (mode) {
+    case KVM_DEV_RISCV_AIA_MODE_EMUL:
+        return "emul";
+    case KVM_DEV_RISCV_AIA_MODE_HWACCEL:
+        return "hwaccel";
+    case KVM_DEV_RISCV_AIA_MODE_AUTO:
+    default:
+        return "auto";
+    };
+}
+
+static char *riscv_get_kvm_aia(Object *obj, Error **errp)
+{
+    return g_strdup(kvm_aia_mode_str(aia_mode));
+}
+
+static void riscv_set_kvm_aia(Object *obj, const char *val, Error **errp)
+{
+    if (!strcmp(val, "emul")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_EMUL;
+    } else if (!strcmp(val, "hwaccel")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_HWACCEL;
+    } else if (!strcmp(val, "auto")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_AUTO;
+    } else {
+        error_setg(errp, "Invalid KVM AIA mode");
+        error_append_hint(errp, "Valid values are emul, hwaccel, and auto.\n");
+    }
+}
+
 void kvm_arch_accel_class_init(ObjectClass *oc)
 {
+    object_class_property_add_str(oc, "riscv-aia", riscv_get_kvm_aia,
+                                  riscv_set_kvm_aia);
+    object_class_property_set_description(oc, "riscv-aia",
+                                          "Set KVM AIA mode. Valid values are "
+                                          "emul, hwaccel, and auto. Default "
+                                          "is auto.");
+    object_property_set_default_str(object_class_property_find(oc, "riscv-aia"),
+                                    "auto");
+}
+
+void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                          uint64_t aia_irq_num, uint64_t aia_msi_num,
+                          uint64_t aplic_base, uint64_t imsic_base,
+                          uint64_t guest_num)
+{
+    int ret, i;
+    int aia_fd = -1;
+    uint64_t default_aia_mode;
+    uint64_t socket_count = riscv_socket_count(machine);
+    uint64_t max_hart_per_socket = 0;
+    uint64_t socket, base_hart, hart_count, socket_imsic_base, imsic_addr;
+    uint64_t socket_bits, hart_bits, guest_bits;
+
+    aia_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_RISCV_AIA, false);
+
+    if (aia_fd < 0) {
+        error_report("Unable to create in-kernel irqchip");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_MODE,
+                            &default_aia_mode, false, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to get current KVM AIA mode");
+        exit(1);
+    }
+    qemu_log("KVM AIA: default mode is %s\n",
+             kvm_aia_mode_str(default_aia_mode));
+
+    if (default_aia_mode != aia_mode) {
+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                                KVM_DEV_RISCV_AIA_CONFIG_MODE,
+                                &aia_mode, true, NULL);
+        if (ret < 0)
+            warn_report("KVM AIA: failed to set KVM AIA mode");
+        else
+            qemu_log("KVM AIA: set current mode to %s\n",
+                     kvm_aia_mode_str(aia_mode));
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
+                            &aia_irq_num, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set number of input irq lines");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_IDS,
+                            &aia_msi_num, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set number of msi");
+        exit(1);
+    }
+
+    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
+                            &socket_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set group_bits");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
+                            &group_shift, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set group_shift");
+        exit(1);
+    }
+
+    guest_bits = guest_num == 0 ? 0 :
+                 find_last_bit(&guest_num, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GUEST_BITS,
+                            &guest_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set guest_bits");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
+                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
+                            &aplic_base, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set the base address of APLIC");
+        exit(1);
+    }
+
+    for (socket = 0; socket < socket_count; socket++) {
+        socket_imsic_base = imsic_base + socket * (1U << group_shift);
+        hart_count = riscv_socket_hart_count(machine, socket);
+        base_hart = riscv_socket_first_hartid(machine, socket);
+
+        if (max_hart_per_socket < hart_count) {
+            max_hart_per_socket = hart_count;
+        }
+
+        for (i = 0; i < hart_count; i++) {
+            imsic_addr = socket_imsic_base + i * IMSIC_HART_SIZE(guest_bits);
+            ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
+                                    KVM_DEV_RISCV_AIA_ADDR_IMSIC(i + base_hart),
+                                    &imsic_addr, true, NULL);
+            if (ret < 0) {
+                error_report("KVM AIA: failed to set the IMSIC address for hart %d", i);
+                exit(1);
+            }
+        }
+    }
+
+    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
+                            &hart_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set hart_bits");
+        exit(1);
+    }
+
+    if (kvm_has_gsi_routing()) {
+        for (uint64_t idx = 0; idx < aia_irq_num + 1; ++idx) {
+            /* KVM AIA only has one APLIC instance */
+            kvm_irqchip_add_irq_route(kvm_state, idx, 0, idx);
+        }
+        kvm_gsi_routing_allowed = true;
+        kvm_irqchip_commit_routes(kvm_state);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CTRL,
+                            KVM_DEV_RISCV_AIA_CTRL_INIT,
+                            NULL, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: initialized fail");
+        exit(1);
+    }
+
+    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
 }
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

KVM AIA can't emulate APLIC only. When "aia=aplic" parameter is passed,
APLIC devices is emulated by QEMU. For "aia=aplic-imsic", remove the
mmio operations of APLIC when using KVM AIA and send wired interrupt
signal via KVM_IRQ_LINE API.
After KVM AIA enabled, MSI messages are delivered by KVM_SIGNAL_MSI API
when the IMSICs receive mmio write requests.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-5-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 56 ++++++++++++++++++++++++++++++-------------
 hw/intc/riscv_imsic.c | 25 +++++++++++++++----
 2 files changed, 61 insertions(+), 20 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "migration/vmstate.h"
 
 #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@
 
 #define APLIC_IDC_CLAIMI               0x1c
 
+/*
+ * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
+ * APLIC Wired.
+ */
+static bool is_kvm_aia(bool msimode)
+{
+    return kvm_irqchip_in_kernel() && msimode;
+}
+
 static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
                                             uint32_t word)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
     return topi;
 }
 
+static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
+{
+    kvm_set_irq(kvm_state, irq, !!level);
+}
+
 static void riscv_aplic_request(void *opaque, int irq, int level)
 {
     bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
     uint32_t i;
     RISCVAPLICState *aplic = RISCV_APLIC(dev);
 
-    aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
-    aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
-    aplic->state = g_new0(uint32_t, aplic->num_irqs);
-    aplic->target = g_new0(uint32_t, aplic->num_irqs);
-    if (!aplic->msimode) {
-        for (i = 0; i < aplic->num_irqs; i++) {
-            aplic->target[i] = 1;
+    if (!is_kvm_aia(aplic->msimode)) {
+        aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
+        aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
+        aplic->state = g_new0(uint32_t, aplic->num_irqs);
+        aplic->target = g_new0(uint32_t, aplic->num_irqs);
+        if (!aplic->msimode) {
+            for (i = 0; i < aplic->num_irqs; i++) {
+                aplic->target[i] = 1;
+            }
         }
-    }
-    aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
-    aplic->iforce = g_new0(uint32_t, aplic->num_harts);
-    aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
+        aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
+        aplic->iforce = g_new0(uint32_t, aplic->num_harts);
+        aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 
-    memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops, aplic,
-                          TYPE_RISCV_APLIC, aplic->aperture_size);
-    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
+        memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
+                              aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
+        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
+    }
 
     /*
      * Only root APLICs have hardware IRQ lines. All non-root APLICs
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
+        if (is_kvm_aia(aplic->msimode)) {
+            qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
+        } else {
+            qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
+        }
     }
 
     /* Create output IRQ lines for non-MSI mode */
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
     qdev_prop_set_bit(dev, "mmode", mmode);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+
+    if (!is_kvm_aia(msimode)) {
+        sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+    }
 
     if (parent) {
         riscv_aplic_add_child(parent, dev);
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "target/riscv/cpu_bits.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "migration/vmstate.h"
 
 #define IMSIC_MMIO_PAGE_LE             0x00
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
         goto err;
     }
 
+#if defined(CONFIG_KVM)
+    if (kvm_irqchip_in_kernel()) {
+        struct kvm_msi msi;
+
+        msi.address_lo = extract64(imsic->mmio.addr + addr, 0, 32);
+        msi.address_hi = extract64(imsic->mmio.addr + addr, 32, 32);
+        msi.data = le32_to_cpu(value);
+
+        kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
+
+        return;
+    }
+#endif
+
     /* Writes only supported for MSI little-endian registers */
     page = addr >> IMSIC_MMIO_PAGE_SHIFT;
     if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
     CPUState *cpu = cpu_by_arch_id(imsic->hartid);
     CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 
-    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
-    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
-    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
-    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
+    if (!kvm_irqchip_in_kernel()) {
+        imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
+        imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
+        imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
+        imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
+    }
 
     memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
                           imsic, TYPE_RISCV_IMSIC,
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

Select KVM AIA when the host kernel has in-kernel AIA chip support.
Since KVM AIA only has one APLIC instance, we map the QEMU APLIC
devices to KVM APLIC.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-6-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 94 +++++++++++++++++++++++++++++++++----------------
 1 file changed, 63 insertions(+), 31 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
+#include "kvm_riscv.h"
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/riscv_aplic.h"
 #include "hw/intc/riscv_imsic.h"
@@ -XXX,XX +XXX,XX @@
 #error "Can't accommodate all IMSIC groups in address space"
 #endif
 
+/* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
+static bool virt_use_kvm_aia(RISCVVirtState *s)
+{
+    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
+}
+
 static const MemMapEntry virt_memmap[] = {
     [VIRT_DEBUG] =        {        0x0,         0x100 },
     [VIRT_MROM] =         {     0x1000,        0xf000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
                                  uint32_t *intc_phandles,
                                  uint32_t aplic_phandle,
                                  uint32_t aplic_child_phandle,
-                                 bool m_mode)
+                                 bool m_mode, int num_harts)
 {
     int cpu;
     char *aplic_name;
     uint32_t *aplic_cells;
     MachineState *ms = MACHINE(s);
 
-    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+    aplic_cells = g_new0(uint32_t, num_harts * 2);
 
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+    for (cpu = 0; cpu < num_harts; cpu++) {
         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
         aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
 
     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-                         aplic_cells,
-                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+                         aplic_cells, num_harts * sizeof(uint32_t) * 2);
     } else {
         qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
     }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
                                     uint32_t msi_s_phandle,
                                     uint32_t *phandle,
                                     uint32_t *intc_phandles,
-                                    uint32_t *aplic_phandles)
+                                    uint32_t *aplic_phandles,
+                                    int num_harts)
 {
     char *aplic_name;
     unsigned long aplic_addr;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
         create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
                              msi_m_phandle, intc_phandles,
                              aplic_m_phandle, aplic_s_phandle,
-                             true);
+                             true, num_harts);
     }
 
     /* S-level APLIC node */
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
     create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
                          msi_s_phandle, intc_phandles,
                          aplic_s_phandle, 0,
-                         false);
+                         false, num_harts);
 
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
         *msi_pcie_phandle = msi_s_phandle;
     }
 
-    phandle_pos = ms->smp.cpus;
-    for (socket = (socket_count - 1); socket >= 0; socket--) {
-        phandle_pos -= s->soc[socket].num_harts;
-
-        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
-            create_fdt_socket_plic(s, memmap, socket, phandle,
-                &intc_phandles[phandle_pos], xplic_phandles);
-        } else {
-            create_fdt_socket_aplic(s, memmap, socket,
-                msi_m_phandle, msi_s_phandle, phandle,
-                &intc_phandles[phandle_pos], xplic_phandles);
+    /* KVM AIA only has one APLIC instance */
+    if (virt_use_kvm_aia(s)) {
+        create_fdt_socket_aplic(s, memmap, 0,
+                                msi_m_phandle, msi_s_phandle, phandle,
+                                &intc_phandles[0], xplic_phandles,
+                                ms->smp.cpus);
+    } else {
+        phandle_pos = ms->smp.cpus;
+        for (socket = (socket_count - 1); socket >= 0; socket--) {
+            phandle_pos -= s->soc[socket].num_harts;
+
+            if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+                create_fdt_socket_plic(s, memmap, socket, phandle,
+                                       &intc_phandles[phandle_pos],
+                                       xplic_phandles);
+            } else {
+                create_fdt_socket_aplic(s, memmap, socket,
+                                        msi_m_phandle, msi_s_phandle, phandle,
+                                        &intc_phandles[phandle_pos],
+                                        xplic_phandles,
+                                        s->soc[socket].num_harts);
+            }
         }
     }
 
     g_free(intc_phandles);
 
-    for (socket = 0; socket < socket_count; socket++) {
-        if (socket == 0) {
-            *irq_mmio_phandle = xplic_phandles[socket];
-            *irq_virtio_phandle = xplic_phandles[socket];
-            *irq_pcie_phandle = xplic_phandles[socket];
-        }
-        if (socket == 1) {
-            *irq_virtio_phandle = xplic_phandles[socket];
-            *irq_pcie_phandle = xplic_phandles[socket];
-        }
-        if (socket == 2) {
-            *irq_pcie_phandle = xplic_phandles[socket];
+    if (virt_use_kvm_aia(s)) {
+        *irq_mmio_phandle = xplic_phandles[0];
+        *irq_virtio_phandle = xplic_phandles[0];
+        *irq_pcie_phandle = xplic_phandles[0];
+    } else {
+        for (socket = 0; socket < socket_count; socket++) {
+            if (socket == 0) {
+                *irq_mmio_phandle = xplic_phandles[socket];
+                *irq_virtio_phandle = xplic_phandles[socket];
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
+            if (socket == 1) {
+                *irq_virtio_phandle = xplic_phandles[socket];
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
+            if (socket == 2) {
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         }
     }
 
+    if (virt_use_kvm_aia(s)) {
+        kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
+                             VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
+                             memmap[VIRT_APLIC_S].base,
+                             memmap[VIRT_IMSIC_S].base,
+                             s->aia_guests);
+    }
+
     if (riscv_is_32bit(&s->soc[0])) {
 #if HOST_LONG_BITS == 64
         /* limit RAM size in a 32-bit system */
-- 
2.41.0

From: Conor Dooley <conor.dooley@microchip.com>

On a dtb dumped from the virt machine, dt-validate complains:
soc: pmu: {'riscv,event-to-mhpmcounters': [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280], [65563, 65563, 524280], [65569, 65569, 524280]], 'compatible': ['riscv,pmu']} should not be valid under {'type': 'object'}
        from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
That's pretty cryptic, but running the dtb back through dtc produces
something a lot more reasonable:
Warning (simple_bus_reg): /soc/pmu: missing or empty reg/ranges property

Moving the riscv,pmu node out of the soc bus solves the problem.

Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20230727-groom-decline-2c57ce42841c@spud>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_pmu(RISCVVirtState *s)
     MachineState *ms = MACHINE(s);
     RISCVCPU hart = s->soc[0].harts[0];
 
-    pmu_name = g_strdup_printf("/soc/pmu");
+    pmu_name = g_strdup_printf("/pmu");
     qemu_fdt_add_subnode(ms->fdt, pmu_name);
     qemu_fdt_setprop_string(ms->fdt, pmu_name, "compatible", "riscv,pmu");
     riscv_pmu_generate_fdt_node(ms->fdt, hart.cfg.pmu_num, pmu_name);
-- 
2.41.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

The Svadu specification updated the name of the *envcfg bit from
HADE to ADUE.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20230816141916.66898-1-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h   |  8 ++++----
 target/riscv/cpu.c        |  4 ++--
 target/riscv/cpu_helper.c |  6 +++---
 target/riscv/csr.c        | 12 ++++++------
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MENVCFG_CBIE                       (3UL << 4)
 #define MENVCFG_CBCFE                      BIT(6)
 #define MENVCFG_CBZE                       BIT(7)
-#define MENVCFG_HADE                       (1ULL << 61)
+#define MENVCFG_ADUE                       (1ULL << 61)
 #define MENVCFG_PBMTE                      (1ULL << 62)
 #define MENVCFG_STCE                       (1ULL << 63)
 
 /* For RV32 */
-#define MENVCFGH_HADE                      BIT(29)
+#define MENVCFGH_ADUE                      BIT(29)
 #define MENVCFGH_PBMTE                     BIT(30)
 #define MENVCFGH_STCE                      BIT(31)
 
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define HENVCFG_CBIE                       MENVCFG_CBIE
 #define HENVCFG_CBCFE                      MENVCFG_CBCFE
 #define HENVCFG_CBZE                       MENVCFG_CBZE
-#define HENVCFG_HADE                       MENVCFG_HADE
+#define HENVCFG_ADUE                       MENVCFG_ADUE
 #define HENVCFG_PBMTE                      MENVCFG_PBMTE
 #define HENVCFG_STCE                       MENVCFG_STCE
 
 /* For RV32 */
-#define HENVCFGH_HADE                       MENVCFGH_HADE
+#define HENVCFGH_ADUE                       MENVCFGH_ADUE
 #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
 #define HENVCFGH_STCE                       MENVCFGH_STCE
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
     env->two_stage_lookup = false;
 
     env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
-                   (cpu->cfg.ext_svadu ? MENVCFG_HADE : 0);
+                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
     env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
-                   (cpu->cfg.ext_svadu ? HENVCFG_HADE : 0);
+                   (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
 
     /* Initialized default priorities of local interrupts. */
     for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     bool pbmte = env->menvcfg & MENVCFG_PBMTE;
-    bool hade = env->menvcfg & MENVCFG_HADE;
+    bool adue = env->menvcfg & MENVCFG_ADUE;
 
     if (first_stage && two_stage && env->virt_enabled) {
         pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
-        hade = hade && (env->henvcfg & HENVCFG_HADE);
+        adue = adue && (env->henvcfg & HENVCFG_ADUE);
     }
 
     int ptshift = (levels - 1) * ptidxbits;
@@ -XXX,XX +XXX,XX @@ restart:
 
     /* Page table updates need to be atomic with MTTCG enabled */
     if (updated_pte != pte && !is_debug) {
-        if (!hade) {
+        if (!adue) {
             return TRANSLATE_FAIL;
         }
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
     if (riscv_cpu_mxl(env) == MXL_RV64) {
         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                (cfg->ext_svadu ? MENVCFG_HADE : 0);
+                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
     }
     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                    (cfg->ext_svadu ? MENVCFG_HADE : 0);
+                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
     uint64_t valh = (uint64_t)val << 32;
 
     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
      * henvcfg.hade is read_only 0 when menvcfg.hade = 0
      */
-    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
+    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                            env->menvcfg);
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
     }
 
     if (riscv_cpu_mxl(env) == MXL_RV64) {
-        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE);
+        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
     }
 
     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
         return ret;
     }
 
-    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
+    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                             env->menvcfg)) >> 32;
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
-                                    HENVCFG_HADE);
+                                    HENVCFG_ADUE);
     uint64_t valh = (uint64_t)val << 32;
     RISCVException ret;
 
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

In the same emulated RISC-V host, the 'host' KVM CPU takes 4 times
longer to boot than the 'rv64' KVM CPU.

The reason is an unintended behavior of riscv_cpu_satp_mode_finalize()
when satp_mode.supported = 0, i.e. when cpu_init() does not set
satp_mode_max_supported(). satp_mode_max_from_map(map) does:

31 - __builtin_clz(map)

This means that, if satp_mode.supported = 0, satp_mode_supported_max
wil be '31 - 32'. But this is C, so satp_mode_supported_max will gladly
set it to UINT_MAX (4294967295). After that, if the user didn't set a
satp_mode, set_satp_mode_default_map(cpu) will make

cfg.satp_mode.map = cfg.satp_mode.supported

So satp_mode.map = 0. And then satp_mode_map_max will be set to
satp_mode_max_from_map(cpu->cfg.satp_mode.map), i.e. also UINT_MAX. The
guard "satp_mode_map_max > satp_mode_supported_max" doesn't protect us
here since both are UINT_MAX.

And finally we have 2 loops:

for (int i = satp_mode_map_max - 1; i >= 0; --i) {

Which are, in fact, 2 loops from UINT_MAX -1 to -1. This is where the
extra delay when booting the 'host' CPU is coming from.

Commit 43d1de32f8 already set a precedence for satp_mode.supported = 0
in a different manner. We're doing the same here. If supported == 0,
interpret as 'the CPU wants the OS to handle satp mode alone' and skip
satp_mode_finalize().

We'll also put a guard in satp_mode_max_from_map() to assert out if map
is 0 since the function is not ready to deal with it.

Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
Fixes: 6f23aaeb9b ("riscv: Allow user to set the satp mode")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230817152903.694926-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static uint8_t satp_mode_from_str(const char *satp_mode_str)
 
 uint8_t satp_mode_max_from_map(uint32_t map)
 {
+    /*
+     * 'map = 0' will make us return (31 - 32), which C will
+     * happily overflow to UINT_MAX. There's no good result to
+     * return if 'map = 0' (e.g. returning 0 will be ambiguous
+     * with the result for 'map = 1').
+     *
+     * Assert out if map = 0. Callers will have to deal with
+     * it outside of this function.
+     */
+    g_assert(map > 0);
+
     /* map here has at least one bit set, so no problem with clz */
     return 31 - __builtin_clz(map);
 }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
 static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
 {
     bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
-    uint8_t satp_mode_map_max;
-    uint8_t satp_mode_supported_max =
-                        satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
+    uint8_t satp_mode_map_max, satp_mode_supported_max;
+
+    /* The CPU wants the OS to decide which satp mode to use */
+    if (cpu->cfg.satp_mode.supported == 0) {
+        return;
+    }
+
+    satp_mode_supported_max =
+                    satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
 
     if (cpu->cfg.satp_mode.map == 0) {
         if (cpu->cfg.satp_mode.init == 0) {
-- 
2.41.0

From: Vineet Gupta <vineetg@rivosinc.com>

zicond is now codegen supported in both llvm and gcc.

This change allows seamless enabling/testing of zicond in downstream
projects. e.g. currently riscv-gnu-toolchain parses elf attributes
to create a cmdline for qemu but fails short of enabling it because of
the "x-" prefix.

Signed-off-by: Vineet Gupta <vineetg@rivosinc.com>
Message-ID: <20230808181715.436395-1-vineetg@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("zcf", RISCVCPU, cfg.ext_zcf, false),
     DEFINE_PROP_BOOL("zcmp", RISCVCPU, cfg.ext_zcmp, false),
     DEFINE_PROP_BOOL("zcmt", RISCVCPU, cfg.ext_zcmt, false),
+    DEFINE_PROP_BOOL("zicond", RISCVCPU, cfg.ext_zicond, false),
 
     /* Vendor-specific custom extensions */
     DEFINE_PROP_BOOL("xtheadba", RISCVCPU, cfg.ext_xtheadba, false),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
 
     /* These are experimental so mark with 'x-' */
-    DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
 
     /* ePMP 0.9.3 */
     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

A build with --enable-debug and without KVM will fail as follows:

/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_riscv_virt.c.o: in function `virt_machine_init':
./qemu/build/../hw/riscv/virt.c:1465: undefined reference to `kvm_riscv_aia_create'

This happens because the code block with "if virt_use_kvm_aia(s)" isn't
being ignored by the debug build, resulting in an undefined reference to
a KVM only function.

Add a 'kvm_enabled()' conditional together with virt_use_kvm_aia() will
make the compiler crop the kvm_riscv_aia_create() call entirely from a
non-KVM build. Note that adding the 'kvm_enabled()' conditional inside
virt_use_kvm_aia() won't fix the build because this function would need
to be inlined multiple times to make the compiler zero out the entire
block.

While we're at it, use kvm_enabled() in all instances where
virt_use_kvm_aia() is checked to allow the compiler to elide these other
kvm-only instances as well.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Fixes: dbdb99948e ("target/riscv: select KVM AIA in riscv virt machine")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230830133503.711138-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
     }
 
     /* KVM AIA only has one APLIC instance */
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         create_fdt_socket_aplic(s, memmap, 0,
                                 msi_m_phandle, msi_s_phandle, phandle,
                                 &intc_phandles[0], xplic_phandles,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
     g_free(intc_phandles);
 
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         *irq_mmio_phandle = xplic_phandles[0];
         *irq_virtio_phandle = xplic_phandles[0];
         *irq_pcie_phandle = xplic_phandles[0];
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         }
     }
 
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
                              VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
                              memmap[VIRT_APLIC_S].base,
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 6df0b37e2ab breaks a --enable-debug build in a non-KVM
environment with the following error:

/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_intc_riscv_aplic.c.o: in function `riscv_kvm_aplic_request':
./qemu/build/../hw/intc/riscv_aplic.c:486: undefined reference to `kvm_set_irq'
collect2: error: ld returned 1 exit status

This happens because the debug build will poke into the
'if (is_kvm_aia(aplic->msimode))' block and fail to find a reference to
the KVM only function riscv_kvm_aplic_request().

There are multiple solutions to fix this. We'll go with the same
solution from the previous patch, i.e. add a kvm_enabled() conditional
to filter out the block. But there's a catch: riscv_kvm_aplic_request()
is a local function that would end up being used if the compiler crops
the block, and this won't work. Quoting Richard Henderson's explanation
in [1]:

"(...) the compiler won't eliminate entire unused functions with -O0"

We'll solve it by moving riscv_kvm_aplic_request() to kvm.c and add its
declaration in kvm_riscv.h, where all other KVM specific public
functions are already declared. Other archs handles KVM specific code in
this manner and we expect to do the same from now on.

[1] https://lore.kernel.org/qemu-riscv/d2f1ad02-eb03-138f-9d08-db676deeed05@linaro.org/

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230830133503.711138-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h | 1 +
 hw/intc/riscv_aplic.c    | 8 ++------
 target/riscv/kvm.c       | 5 +++++
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
                           uint64_t aia_irq_num, uint64_t aia_msi_num,
                           uint64_t aplic_base, uint64_t imsic_base,
                           uint64_t guest_num);
+void riscv_kvm_aplic_request(void *opaque, int irq, int level);
 
 #endif
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
+#include "kvm_riscv.h"
 #include "migration/vmstate.h"
 
 #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
     return topi;
 }
 
-static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
-{
-    kvm_set_irq(kvm_state, irq, !!level);
-}
-
 static void riscv_aplic_request(void *opaque, int irq, int level)
 {
     bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        if (is_kvm_aia(aplic->msimode)) {
+        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
         } else {
             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/runstate.h"
 #include "hw/riscv/numa.h"
 
+void riscv_kvm_aplic_request(void *opaque, int irq, int level)
+{
+    kvm_set_irq(kvm_state, irq, !!level);
+}
+
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
 {
-- 
2.41.0

From: Robbin Ehn <rehn@rivosinc.com>

This patch adds the new extensions in
linux 6.5 to the hwprobe syscall.

And fixes RVC check to OR with correct value.
The previous variable contains 0 therefore it
did work.

Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <bc82203b72d7efb30f1b4a8f9eb3d94699799dc8.camel@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/syscall.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
 #define RISCV_HWPROBE_KEY_IMA_EXT_0     4
 #define     RISCV_HWPROBE_IMA_FD       (1 << 0)
 #define     RISCV_HWPROBE_IMA_C        (1 << 1)
+#define     RISCV_HWPROBE_IMA_V        (1 << 2)
+#define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
+#define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
+#define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
 
 #define RISCV_HWPROBE_KEY_CPUPERF_0     5
 #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
                     riscv_has_ext(env, RVD) ?
                     RISCV_HWPROBE_IMA_FD : 0;
             value |= riscv_has_ext(env, RVC) ?
-                     RISCV_HWPROBE_IMA_C : pair->value;
+                     RISCV_HWPROBE_IMA_C : 0;
+            value |= riscv_has_ext(env, RVV) ?
+                     RISCV_HWPROBE_IMA_V : 0;
+            value |= cfg->ext_zba ?
+                     RISCV_HWPROBE_EXT_ZBA : 0;
+            value |= cfg->ext_zbb ?
+                     RISCV_HWPROBE_EXT_ZBB : 0;
+            value |= cfg->ext_zbs ?
+                     RISCV_HWPROBE_EXT_ZBS : 0;
             __put_user(value, &pair->value);
             break;
         case RISCV_HWPROBE_KEY_CPUPERF_0:
-- 
2.41.0

From: Ard Biesheuvel <ardb@kernel.org>

Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
implement the first half of the key schedule derivation. This does not
actually involve shifting rows, so clone the same value into all four
columns of the AES vector to counter that operation.

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230831154118.138727-1-ardb@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/crypto_helper.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
 
     uint8_t enc_rnum = rnum;
     uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
-    uint8_t rcon_ = 0;
-    target_ulong result;
+    AESState t, rc = {};
 
     if (enc_rnum != 0xA) {
         temp = ror32(temp, 8); /* Rotate right by 8 */
-        rcon_ = round_consts[enc_rnum];
+        rc.w[0] = rc.w[1] = round_consts[enc_rnum];
     }
 
-    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
-           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
-           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
-           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
+    t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
+    aesenc_SB_SR_AK(&t, &t, &rc, false);
 
-    temp ^= rcon_;
-
-    result = ((uint64_t)temp << 32) | temp;
-
-    return result;
+    return t.d[0];
 }
 
 target_ulong HELPER(aes64im)(target_ulong rs1)
-- 
2.41.0

From: Akihiko Odaki <akihiko.odaki@daynix.com>

riscv_trigger_init() had been called on reset events that can happen
several times for a CPU and it allocated timers for itrigger. If old
timers were present, they were simply overwritten by the new timers,
resulting in a memory leak.

Divide riscv_trigger_init() into two functions, namely
riscv_trigger_realize() and riscv_trigger_reset() and call them in
appropriate timing. The timer allocation will happen only once for a
CPU in riscv_trigger_realize().

Fixes: 5a4ae64cac ("target/riscv: Add itrigger support when icount is enabled")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230818034059.9146-1-akihiko.odaki@daynix.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.h |  3 ++-
 target/riscv/cpu.c   |  8 +++++++-
 target/riscv/debug.c | 15 ++++++++++++---
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs);
 bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
 
-void riscv_trigger_init(CPURISCVState *env);
+void riscv_trigger_realize(CPURISCVState *env);
+void riscv_trigger_reset_hold(CPURISCVState *env);
 
 bool riscv_itrigger_enabled(CPURISCVState *env);
 void riscv_itrigger_update_priv(CPURISCVState *env);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
 
 #ifndef CONFIG_USER_ONLY
     if (cpu->cfg.debug) {
-        riscv_trigger_init(env);
+        riscv_trigger_reset_hold(env);
     }
 
     if (kvm_enabled()) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 
     riscv_cpu_register_gdb_regs_for_features(cs);
 
+#ifndef CONFIG_USER_ONLY
+    if (cpu->cfg.debug) {
+        riscv_trigger_realize(&cpu->env);
+    }
+#endif
+
     qemu_init_vcpu(cs);
     cpu_reset(cs);
 
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
     return false;
 }
 
-void riscv_trigger_init(CPURISCVState *env)
+void riscv_trigger_realize(CPURISCVState *env)
+{
+    int i;
+
+    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
+        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                              riscv_itrigger_timer_cb, env);
+    }
+}
+
+void riscv_trigger_reset_hold(CPURISCVState *env)
 {
     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
     int i;
@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
         env->tdata3[i] = 0;
         env->cpu_breakpoint[i] = NULL;
         env->cpu_watchpoint[i] = NULL;
-        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                              riscv_itrigger_timer_cb, env);
+        timer_del(env->itrigger_timer[i]);
     }
 }
-- 
2.41.0

From: Leon Schuermann <leons@opentitan.org>

When the rule-lock bypass (RLB) bit is set in the mseccfg CSR, the PMP
configuration lock bits must not apply. While this behavior is
implemented for the pmpcfgX CSRs, this bit is not respected for
changes to the pmpaddrX CSRs. This patch ensures that pmpaddrX CSR
writes work even on locked regions when the global rule-lock bypass is
enabled.

Signed-off-by: Leon Schuermann <leons@opentitan.org>
Reviewed-by: Mayuresh Chitale <mchitale@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230829215046.1430463-1-leon@is.currently.online>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t pmp_get_a_field(uint8_t cfg)
  */
 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
 {
+    /* mseccfg.RLB is set */
+    if (MSECCFG_RLB_ISSET(env)) {
+        return 0;
+    }
 
     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
         return 1;
-- 
2.41.0

From: Tommy Wu <tommy.wu@sifive.com>

According to the new spec, when vsiselect has a reserved value, attempts
from M-mode or HS-mode to access vsireg, or from VS-mode to access
sireg, should preferably raise an illegal instruction exception.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-ID: <20230816061647.600672-1-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
 static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                      target_ulong new_val, target_ulong wr_mask)
 {
-    bool virt;
+    bool virt, isel_reserved;
     uint8_t *iprio;
     int ret = -EINVAL;
     target_ulong priv, isel, vgein;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
 
     /* Decode register details from CSR number */
     virt = false;
+    isel_reserved = false;
     switch (csrno) {
     case CSR_MIREG:
         iprio = env->miprio;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                                                   riscv_cpu_mxl_bits(env)),
                                     val, new_val, wr_mask);
         }
+    } else {
+        isel_reserved = true;
     }
 
 done:
     if (ret) {
-        return (env->virt_enabled && virt) ?
+        return (env->virt_enabled && virt && !isel_reserved) ?
                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
     }
     return RISCV_EXCP_NONE;
-- 
2.41.0

From: Nikita Shubin <n.shubin@yadro.com>

As per ISA:

"For CSRRWI, if rd=x0, then the instruction shall not read the CSR and
shall not cause any of the side effects that might occur on a CSR read."

trans_csrrwi() and trans_csrrw() call do_csrw() if rd=x0, do_csrw() calls
riscv_csrrw_do64(), via helper_csrw() passing NULL as *ret_value.

Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230808090914.17634-1-nikita.shubin@maquefel.me>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
                                        target_ulong write_mask)
 {
     RISCVException ret;
-    target_ulong old_value;
+    target_ulong old_value = 0;
 
     /* execute combined read/write operation if it exists */
     if (csr_ops[csrno].op) {
         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
     }
 
-    /* if no accessor exists then return failure */
-    if (!csr_ops[csrno].read) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-    /* read old value */
-    ret = csr_ops[csrno].read(env, csrno, &old_value);
-    if (ret != RISCV_EXCP_NONE) {
-        return ret;
+    /*
+     * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
+     * and we can't throw side effects caused by CSR reads.
+     */
+    if (ret_value) {
+        /* if no accessor exists then return failure */
+        if (!csr_ops[csrno].read) {
+            return RISCV_EXCP_ILLEGAL_INST;
+        }
+        /* read old value */
+        ret = csr_ops[csrno].read(env, csrno, &old_value);
+        if (ret != RISCV_EXCP_NONE) {
+            return ret;
+        }
     }
 
     /* write value if writable and write mask set, otherwise drop writes */
-- 
2.41.0