Series comparison

-[PULL 00/61] riscv-to-apply queue
+[PULL v2 00/45] riscv-to-apply queue
-From: Alistair Francis <alistair.francis@wdc.com>
+The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:
-The following changes since commit 2c89b5af5e72ab8c9d544c6e30399528b2238827:
+  Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)
   Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20220120-1' into staging (2022-01-20 16:13:17 +0000)
 are available in the Git repository at:
-  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20220121-1
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230911
-for you to fetch changes up to f297245f6a780f496fb171af6fcd21ff3e6783c3:
+for you to fetch changes up to e7a03409f29e2da59297d55afbaec98c96e43e3a:
-  target/riscv: Relax UXL field for debugging (2022-01-21 15:52:57 +1000)
+  target/riscv: don't read CSR in riscv_csrrw_do64 (2023-09-11 11:45:55 +1000)
 ----------------------------------------------------------------
-Third RISC-V PR for QEMU 7.0
+First RISC-V PR for 8.2
- * Fixes for OpenTitan timer
+ * Remove 'host' CPU from TCG
- * Correction of OpenTitan PLIC stride length
+ * riscv_htif Fixup printing on big endian hosts
- * RISC-V KVM support
+ * Add zmmul isa string
- * Device tree code cleanup
+ * Add smepmp isa string
- * Support for the Zve64f and Zve32f extensions
+ * Fix page_check_range use in fault-only-first
- * OpenSBI binary loading support for the Spike machine
+ * Use existing lookup tables for MixColumns
- * Removal of OpenSBI ELFs
+ * Add RISC-V vector cryptographic instruction set support
- * Support for the UXL field in xstatus
+ * Implement WARL behaviour for mcountinhibit/mcounteren
  * Add Zihintntl extension ISA string to DTS
  * Fix zfa fleq.d and fltq.d
  * Fix upper/lower mtime write calculation
  * Make rtc variable names consistent
  * Use abi type for linux-user target_ucontext
  * Add RISC-V KVM AIA Support
  * Fix riscv,pmu DT node path in the virt machine
  * Update CSR bits name for svadu extension
  * Mark zicond non-experimental
  * Fix satp_mode_finalize() when satp_mode.supported = 0
  * Fix non-KVM --enable-debug build
  * Add new extensions to hwprobe
  * Use accelerated helper for AES64KS1I
  * Allocate itrigger timers only once
  * Respect mseccfg.RLB for pmpaddrX changes
  * Align the AIA model to v1.0 ratified spec
  * Don't read the CSR in riscv_csrrw_do64
 ----------------------------------------------------------------
-Anup Patel (3):
+Akihiko Odaki (1):
-      hw/riscv: spike: Allow using binary firmware as bios
+      target/riscv: Allocate itrigger timers only once
       hw/riscv: Remove macros for ELF BIOS image names
       roms/opensbi: Remove ELF images
-Frank Chang (17):
+Ard Biesheuvel (2):
-      target/riscv: rvv-1.0: Add Zve64f extension into RISC-V
+      target/riscv: Use existing lookup tables for MixColumns
-      target/riscv: rvv-1.0: Add Zve64f support for configuration insns
+      target/riscv: Use accelerated helper for AES64KS1I
       target/riscv: rvv-1.0: Add Zve64f support for load and store insns
       target/riscv: rvv-1.0: Add Zve64f support for vmulh variant insns
       target/riscv: rvv-1.0: Add Zve64f support for vsmul.vv and vsmul.vx insns
       target/riscv: rvv-1.0: Add Zve64f support for scalar fp insns
       target/riscv: rvv-1.0: Add Zve64f support for single-width fp reduction insns
       target/riscv: rvv-1.0: Add Zve64f support for widening type-convert insns
       target/riscv: rvv-1.0: Add Zve64f support for narrowing type-convert insns
       target/riscv: rvv-1.0: Allow Zve64f extension to be turned on
       target/riscv: rvv-1.0: Add Zve32f extension into RISC-V
       target/riscv: rvv-1.0: Add Zve32f support for configuration insns
       target/riscv: rvv-1.0: Add Zve32f support for scalar fp insns
       target/riscv: rvv-1.0: Add Zve32f support for single-width fp reduction insns
       target/riscv: rvv-1.0: Add Zve32f support for widening type-convert insns
       target/riscv: rvv-1.0: Add Zve32f support for narrowing type-convert insns
       target/riscv: rvv-1.0: Allow Zve32f extension to be turned on
-LIU Zhiwei (23):
+Conor Dooley (1):
-      target/riscv: Adjust pmpcfg access with mxl
+      hw/riscv: virt: Fix riscv,pmu DT node path
       target/riscv: Don't save pc when exception return
       target/riscv: Sign extend link reg for jal and jalr
       target/riscv: Sign extend pc for different XLEN
       target/riscv: Create xl field in env
       target/riscv: Ignore the pc bits above XLEN
       target/riscv: Extend pc for runtime pc write
       target/riscv: Use gdb xml according to max mxlen
       target/riscv: Relax debug check for pm write
       target/riscv: Adjust csr write mask with XLEN
       target/riscv: Create current pm fields in env
       target/riscv: Alloc tcg global for cur_pm[mask|base]
       target/riscv: Calculate address according to XLEN
       target/riscv: Split pm_enabled into mask and base
       target/riscv: Split out the vill from vtype
       target/riscv: Adjust vsetvl according to XLEN
       target/riscv: Remove VILL field in VTYPE
       target/riscv: Fix check range for first fault only
       target/riscv: Adjust vector address with mask
       target/riscv: Adjust scalar reg in vector with XLEN
       target/riscv: Set default XLEN for hypervisor
       target/riscv: Enable uxl field write
       target/riscv: Relax UXL field for debugging
-Thomas Huth (1):
+Daniel Henrique Barboza (6):
-      softmmu/device_tree: Silence compiler warning with --enable-sanitizers
+      target/riscv/cpu.c: do not run 'host' CPU with TCG
       target/riscv/cpu.c: add zmmul isa string
       target/riscv/cpu.c: add smepmp isa string
       target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
       hw/riscv/virt.c: fix non-KVM --enable-debug build
       hw/intc/riscv_aplic.c fix non-KVM --enable-debug build
-Wilfred Mallawa (3):
+Dickon Hood (2):
-      hw: timer: ibex_timer: Fixup reading w/o register
+      target/riscv: Refactor translation of vector-widening instruction
-      riscv: opentitan: fixup plic stride len
+      target/riscv: Add Zvbb ISA extension support
       hw: timer: ibex_timer: update/add reg address
-Yanan Wang (1):
+Jason Chien (3):
-      softmmu/device_tree: Remove redundant pointer assignment
+      target/riscv: Add Zihintntl extension ISA string to DTS
       hw/intc: Fix upper/lower mtime write calculation
       hw/intc: Make rtc variable names consistent
-Yifei Jiang (13):
+Kiran Ostrolenk (4):
-      update-linux-headers: Add asm-riscv/kvm.h
+      target/riscv: Refactor some of the generic vector functionality
-      target/riscv: Add target/riscv/kvm.c to place the public kvm interface
+      target/riscv: Refactor vector-vector translation macro
-      target/riscv: Implement function kvm_arch_init_vcpu
+      target/riscv: Refactor some of the generic vector functionality
-      target/riscv: Implement kvm_arch_get_registers
+      target/riscv: Add Zvknh ISA extension support
       target/riscv: Implement kvm_arch_put_registers
       target/riscv: Support start kernel directly by KVM
       target/riscv: Support setting external interrupt by KVM
       target/riscv: Handle KVM_EXIT_RISCV_SBI exit
       target/riscv: Add host cpu type
       target/riscv: Add kvm_riscv_get/put_regs_timer
       target/riscv: Implement virtual time adjusting with vm state changing
       target/riscv: Support virtual time context synchronization
       target/riscv: enable riscv kvm accel
- meson.build                                    |   2 +
+LIU Zhiwei (3):
- include/hw/char/riscv_htif.h                   |   5 +-
+      target/riscv: Fix page_check_range use in fault-only-first
- include/hw/riscv/boot.h                        |   3 +-
+      target/riscv: Fix zfa fleq.d and fltq.d
- include/hw/riscv/spike.h                       |   1 +
+      linux-user/riscv: Use abi type for target_ucontext
  include/hw/timer/ibex_timer.h                  |   1 -
  linux-headers/asm-riscv/kvm.h                  | 128 ++++++
  target/riscv/cpu.h                             |  58 ++-
  target/riscv/cpu_bits.h                        |   3 +
  target/riscv/helper.h                          |   4 +-
  target/riscv/kvm_riscv.h                       |  25 ++
  target/riscv/sbi_ecall_interface.h             |  72 ++++
  hw/char/riscv_htif.c                           |  33 +-
  hw/intc/sifive_plic.c                          |  20 +-
  hw/riscv/boot.c                                |  16 +-
  hw/riscv/opentitan.c                           |   2 +-
  hw/riscv/spike.c                               |  45 ++-
  hw/riscv/virt.c                                |  83 ++--
  hw/timer/ibex_timer.c                          |  25 +-
  softmmu/device_tree.c                          |  11 +-
  target/riscv/cpu.c                             |  77 +++-
  target/riscv/cpu_helper.c                      |  99 ++---
  target/riscv/csr.c                             |  90 ++++-
  target/riscv/gdbstub.c                         |  71 +++-
  target/riscv/kvm-stub.c                        |  30 ++
  target/riscv/kvm.c                             | 535 +++++++++++++++++++++++++
  target/riscv/machine.c                         |  46 ++-
  target/riscv/op_helper.c                       |   7 +-
  target/riscv/pmp.c                             |  12 +-
  target/riscv/translate.c                       |  94 +++--
  target/riscv/vector_helper.c                   |  39 +-
  target/riscv/insn_trans/trans_privileged.c.inc |   9 +-
  target/riscv/insn_trans/trans_rva.c.inc        |   9 +-
  target/riscv/insn_trans/trans_rvd.c.inc        |  19 +-
  target/riscv/insn_trans/trans_rvf.c.inc        |  19 +-
  target/riscv/insn_trans/trans_rvi.c.inc        |  39 +-
  target/riscv/insn_trans/trans_rvv.c.inc        | 225 +++++++++--
  .gitlab-ci.d/opensbi.yml                       |   2 -
  pc-bios/meson.build                            |   2 -
  pc-bios/opensbi-riscv32-generic-fw_dynamic.elf | Bin 838904 -> 0 bytes
  pc-bios/opensbi-riscv64-generic-fw_dynamic.elf | Bin 934696 -> 0 bytes
  roms/Makefile                                  |   2 -
  target/riscv/meson.build                       |   1 +
 files changed, 1608 insertions(+), 356 deletions(-)
  create mode 100644 linux-headers/asm-riscv/kvm.h
  create mode 100644 target/riscv/kvm_riscv.h
  create mode 100644 target/riscv/sbi_ecall_interface.h
  create mode 100644 target/riscv/kvm-stub.c
  create mode 100644 target/riscv/kvm.c
  delete mode 100644 pc-bios/opensbi-riscv32-generic-fw_dynamic.elf
  delete mode 100644 pc-bios/opensbi-riscv64-generic-fw_dynamic.elf
+Lawrence Hunter (2):
+      target/riscv: Add Zvbc ISA extension support
+      target/riscv: Add Zvksh ISA extension support
+Leon Schuermann (1):
+      target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes
+Max Chou (3):
+      crypto: Create sm4_subword
+      crypto: Add SM4 constant parameter CK
+      target/riscv: Add Zvksed ISA extension support
+Nazar Kazakov (4):
+      target/riscv: Remove redundant "cpu_vl == 0" checks
+      target/riscv: Move vector translation checks
+      target/riscv: Add Zvkned ISA extension support
+      target/riscv: Add Zvkg ISA extension support
+Nikita Shubin (1):
+      target/riscv: don't read CSR in riscv_csrrw_do64
+Rob Bradford (1):
+      target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren
+Robbin Ehn (1):
+      linux-user/riscv: Add new extensions to hwprobe
+Thomas Huth (2):
+      hw/char/riscv_htif: Fix printing of console characters on big endian hosts
+      hw/char/riscv_htif: Fix the console syscall on big endian hosts
+Tommy Wu (1):
+      target/riscv: Align the AIA model to v1.0 ratified spec
+Vineet Gupta (1):
+      riscv: zicond: make non-experimental
+Weiwei Li (1):
+      target/riscv: Update CSR bits name for svadu extension
+Yong-Xuan Wang (5):
+      target/riscv: support the AIA device emulation with KVM enabled
+      target/riscv: check the in-kernel irqchip support
+      target/riscv: Create an KVM AIA irqchip
+      target/riscv: update APLIC and IMSIC to support KVM AIA
+      target/riscv: select KVM AIA in riscv virt machine
+ include/crypto/aes.h                      |   7 +
+ include/crypto/sm4.h                      |   9 +
+ target/riscv/cpu_bits.h                   |   8 +-
+ target/riscv/cpu_cfg.h                    |   9 +
+ target/riscv/debug.h                      |   3 +-
+ target/riscv/helper.h                     |  98 +++
+ target/riscv/kvm_riscv.h                  |   5 +
+ target/riscv/vector_internals.h           | 228 +++++++
+ target/riscv/insn32.decode                |  58 ++
+ crypto/aes.c                              |   4 +-
+ crypto/sm4.c                              |  10 +
+ hw/char/riscv_htif.c                      |  12 +-
+ hw/intc/riscv_aclint.c                    |  11 +-
+ hw/intc/riscv_aplic.c                     |  52 +-
+ hw/intc/riscv_imsic.c                     |  25 +-
+ hw/riscv/virt.c                           | 374 ++++++------
+ linux-user/riscv/signal.c                 |   4 +-
+ linux-user/syscall.c                      |  14 +-
+ target/arm/tcg/crypto_helper.c            |  10 +-
+ target/riscv/cpu.c                        |  83 ++-
+ target/riscv/cpu_helper.c                 |   6 +-
+ target/riscv/crypto_helper.c              |  51 +-
+ target/riscv/csr.c                        |  54 +-
+ target/riscv/debug.c                      |  15 +-
+ target/riscv/kvm.c                        | 201 ++++++-
+ target/riscv/pmp.c                        |   4 +
+ target/riscv/translate.c                  |   1 +
+ target/riscv/vcrypto_helper.c             | 970 ++++++++++++++++++++++++++++++
+ target/riscv/vector_helper.c              | 245 +-------
+ target/riscv/vector_internals.c           |  81 +++
+ target/riscv/insn_trans/trans_rvv.c.inc   | 171 +++---
+ target/riscv/insn_trans/trans_rvvk.c.inc  | 606 +++++++++++++++++++
+ target/riscv/insn_trans/trans_rvzfa.c.inc |   4 +-
+ target/riscv/meson.build                  |   4 +-
+files changed, 2785 insertions(+), 652 deletions(-)
+ create mode 100644 target/riscv/vector_internals.h
+ create mode 100644 target/riscv/vcrypto_helper.c
+ create mode 100644 target/riscv/vector_internals.c
+ create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc

-[PULL 01/61] hw: timer: ibex_timer: Fixup reading w/o register
+Deleted patch
-From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
-This change fixes a bug where a write only register is read.
-As per https://docs.opentitan.org/hw/ip/rv_timer/doc/#register-table
-the 'INTR_TEST0' register is write only.
-Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20220110051606.4031241-1-alistair.francis@opensource.wdc.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/hw/timer/ibex_timer.h |  1 -
- hw/timer/ibex_timer.c         | 14 +++++---------
-files changed, 5 insertions(+), 10 deletions(-)
-diff --git a/include/hw/timer/ibex_timer.h b/include/hw/timer/ibex_timer.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/timer/ibex_timer.h
-+++ b/include/hw/timer/ibex_timer.h
-@@ -XXX,XX +XXX,XX @@ struct IbexTimerState {
-     uint32_t timer_compare_upper0;
-     uint32_t timer_intr_enable;
-     uint32_t timer_intr_state;
--    uint32_t timer_intr_test;
-     uint32_t timebase_freq;
-diff --git a/hw/timer/ibex_timer.c b/hw/timer/ibex_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/ibex_timer.c
-+++ b/hw/timer/ibex_timer.c
-@@ -XXX,XX +XXX,XX @@ static void ibex_timer_reset(DeviceState *dev)
-     s->timer_compare_upper0 = 0xFFFFFFFF;
-     s->timer_intr_enable = 0x00000000;
-     s->timer_intr_state = 0x00000000;
--    s->timer_intr_test = 0x00000000;
-     ibex_timer_update_irqs(s);
- }
-@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_timer_read(void *opaque, hwaddr addr,
-         retvalue = s->timer_intr_state;
-         break;
-     case R_INTR_TEST:
--        retvalue = s->timer_intr_test;
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "Attempted to read INTR_TEST, a write only register");
-         break;
-     default:
-         qemu_log_mask(LOG_GUEST_ERROR,
-@@ -XXX,XX +XXX,XX @@ static void ibex_timer_write(void *opaque, hwaddr addr,
-         s->timer_intr_state &= ~val;
-         break;
-     case R_INTR_TEST:
--        s->timer_intr_test = val;
--        if (s->timer_intr_enable &
--            s->timer_intr_test &
--            R_INTR_ENABLE_IE_0_MASK) {
-+        if (s->timer_intr_enable & val & R_INTR_ENABLE_IE_0_MASK) {
-             s->timer_intr_state |= R_INTR_STATE_IS_0_MASK;
-             qemu_set_irq(s->irq, true);
-         }
-@@ -XXX,XX +XXX,XX @@ static int ibex_timer_post_load(void *opaque, int version_id)
- static const VMStateDescription vmstate_ibex_timer = {
-     .name = TYPE_IBEX_TIMER,
--    .version_id = 1,
--    .minimum_version_id = 1,
-+    .version_id = 2,
-+    .minimum_version_id = 2,
-     .post_load = ibex_timer_post_load,
-     .fields = (VMStateField[]) {
-         VMSTATE_UINT32(timer_ctrl, IbexTimerState),
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_ibex_timer = {
-         VMSTATE_UINT32(timer_compare_upper0, IbexTimerState),
-         VMSTATE_UINT32(timer_intr_enable, IbexTimerState),
-         VMSTATE_UINT32(timer_intr_state, IbexTimerState),
--        VMSTATE_UINT32(timer_intr_test, IbexTimerState),
-         VMSTATE_END_OF_LIST()
-     }
- };
---
-.31.1

-[PULL 02/61] riscv: opentitan: fixup plic stride len
+Deleted patch
-From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
-The following change was made to rectify incorrectly set stride length
-on the PLIC [1]. Where it should be 32bit and not 24bit (0x18). This was
-discovered whilst attempting to fix a bug where a timer_interrupt was
-not serviced on TockOS-OpenTitan.
-[1] https://docs.opentitan.org/hw/top_earlgrey/ip_autogen/rv_plic/doc/
-Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Tested-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 20220111071025.4169189-1-alistair.francis@opensource.wdc.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/opentitan.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/opentitan.c
-+++ b/hw/riscv/opentitan.c
-@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
-     qdev_prop_set_uint32(DEVICE(&s->plic), "priority-base", 0x00);
-     qdev_prop_set_uint32(DEVICE(&s->plic), "pending-base", 0x1000);
-     qdev_prop_set_uint32(DEVICE(&s->plic), "enable-base", 0x2000);
--    qdev_prop_set_uint32(DEVICE(&s->plic), "enable-stride", 0x18);
-+    qdev_prop_set_uint32(DEVICE(&s->plic), "enable-stride", 32);
-     qdev_prop_set_uint32(DEVICE(&s->plic), "context-base", 0x200000);
-     qdev_prop_set_uint32(DEVICE(&s->plic), "context-stride", 8);
-     qdev_prop_set_uint32(DEVICE(&s->plic), "aperture-size", memmap[IBEX_DEV_PLIC].size);
---
-.31.1

-[PULL 03/61] hw: timer: ibex_timer: update/add reg address
+Deleted patch
-From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
-The following changes:
-. Fixes the incorrectly set CTRL register address. As
-per [1] https://docs.opentitan.org/hw/ip/rv_timer/doc/#register-table
-The CTRL register is @ 0x04.
-This was found when attempting to fixup a bug where a timer_interrupt
-was not serviced on TockOS-OpenTitan.
-. Adds ALERT_TEST register as documented on [1], adding repective
-   switch cases to error handle and later implement functionality.
-Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Tested-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 20220111071025.4169189-2-alistair.francis@opensource.wdc.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/timer/ibex_timer.c | 11 ++++++++++-
-file changed, 10 insertions(+), 1 deletion(-)
-diff --git a/hw/timer/ibex_timer.c b/hw/timer/ibex_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/ibex_timer.c
-+++ b/hw/timer/ibex_timer.c
-@@ -XXX,XX +XXX,XX @@
- #include "target/riscv/cpu.h"
- #include "migration/vmstate.h"
--REG32(CTRL, 0x00)
-+REG32(ALERT_TEST, 0x00)
-+    FIELD(ALERT_TEST, FATAL_FAULT, 0, 1)
-+REG32(CTRL, 0x04)
-     FIELD(CTRL, ACTIVE, 0, 1)
- REG32(CFG0, 0x100)
-     FIELD(CFG0, PRESCALE, 0, 12)
-@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_timer_read(void *opaque, hwaddr addr,
-     uint64_t retvalue = 0;
-     switch (addr >> 2) {
-+    case R_ALERT_TEST:
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                        "Attempted to read ALERT_TEST, a write only register");
-+        break;
-     case R_CTRL:
-         retvalue = s->timer_ctrl;
-         break;
-@@ -XXX,XX +XXX,XX @@ static void ibex_timer_write(void *opaque, hwaddr addr,
-     uint32_t val = val64;
-     switch (addr >> 2) {
-+    case R_ALERT_TEST:
-+        qemu_log_mask(LOG_UNIMP, "Alert triggering not supported");
-+        break;
-     case R_CTRL:
-         s->timer_ctrl = val;
-         break;
---
-.31.1

-[PULL 04/61] update-linux-headers: Add asm-riscv/kvm.h
+Deleted patch
-From: Yifei Jiang <jiangyifei@huawei.com>
-Add asm-riscv/kvm.h for RISC-V KVM.
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Anup Patel <anup.patel@wdc.com>
-Message-id: 20220112081329.1835-2-jiangyifei@huawei.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- linux-headers/asm-riscv/kvm.h | 128 ++++++++++++++++++++++++++++++++++
-file changed, 128 insertions(+)
- create mode 100644 linux-headers/asm-riscv/kvm.h
-diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/linux-headers/asm-riscv/kvm.h
-@@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-+/*
-+ * Copyright (C) 2019 Western Digital Corporation or its affiliates.
-+ *
-+ * Authors:
-+ *     Anup Patel <anup.patel@wdc.com>
-+ */
-+
-+#ifndef __LINUX_KVM_RISCV_H
-+#define __LINUX_KVM_RISCV_H
-+
-+#ifndef __ASSEMBLY__
-+
-+#include <linux/types.h>
-+#include <asm/ptrace.h>
-+
-+#define __KVM_HAVE_READONLY_MEM
-+
-+#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
-+
-+#define KVM_INTERRUPT_SET    -1U
-+#define KVM_INTERRUPT_UNSET    -2U
-+
-+/* for KVM_GET_REGS and KVM_SET_REGS */
-+struct kvm_regs {
-+};
-+
-+/* for KVM_GET_FPU and KVM_SET_FPU */
-+struct kvm_fpu {
-+};
-+
-+/* KVM Debug exit structure */
-+struct kvm_debug_exit_arch {
-+};
-+
-+/* for KVM_SET_GUEST_DEBUG */
-+struct kvm_guest_debug_arch {
-+};
-+
-+/* definition of registers in kvm_run */
-+struct kvm_sync_regs {
-+};
-+
-+/* for KVM_GET_SREGS and KVM_SET_SREGS */
-+struct kvm_sregs {
-+};
-+
-+/* CONFIG registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
-+struct kvm_riscv_config {
-+    unsigned long isa;
-+};
-+
-+/* CORE registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
-+struct kvm_riscv_core {
-+    struct user_regs_struct regs;
-+    unsigned long mode;
-+};
-+
-+/* Possible privilege modes for kvm_riscv_core */
-+#define KVM_RISCV_MODE_S    1
-+#define KVM_RISCV_MODE_U    0
-+
-+/* CSR registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
-+struct kvm_riscv_csr {
-+    unsigned long sstatus;
-+    unsigned long sie;
-+    unsigned long stvec;
-+    unsigned long sscratch;
-+    unsigned long sepc;
-+    unsigned long scause;
-+    unsigned long stval;
-+    unsigned long sip;
-+    unsigned long satp;
-+    unsigned long scounteren;
-+};
-+
-+/* TIMER registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
-+struct kvm_riscv_timer {
-+    __u64 frequency;
-+    __u64 time;
-+    __u64 compare;
-+    __u64 state;
-+};
-+
-+/* Possible states for kvm_riscv_timer */
-+#define KVM_RISCV_TIMER_STATE_OFF    0
-+#define KVM_RISCV_TIMER_STATE_ON    1
-+
-+#define KVM_REG_SIZE(id)        \
-+    (1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
-+
-+/* If you need to interpret the index values, here is the key: */
-+#define KVM_REG_RISCV_TYPE_MASK        0x00000000FF000000
-+#define KVM_REG_RISCV_TYPE_SHIFT    24
-+
-+/* Config registers are mapped as type 1 */
-+#define KVM_REG_RISCV_CONFIG        (0x01 << KVM_REG_RISCV_TYPE_SHIFT)
-+#define KVM_REG_RISCV_CONFIG_REG(name)    \
-+    (offsetof(struct kvm_riscv_config, name) / sizeof(unsigned long))
-+
-+/* Core registers are mapped as type 2 */
-+#define KVM_REG_RISCV_CORE        (0x02 << KVM_REG_RISCV_TYPE_SHIFT)
-+#define KVM_REG_RISCV_CORE_REG(name)    \
-+        (offsetof(struct kvm_riscv_core, name) / sizeof(unsigned long))
-+
-+/* Control and status registers are mapped as type 3 */
-+#define KVM_REG_RISCV_CSR        (0x03 << KVM_REG_RISCV_TYPE_SHIFT)
-+#define KVM_REG_RISCV_CSR_REG(name)    \
-+        (offsetof(struct kvm_riscv_csr, name) / sizeof(unsigned long))
-+
-+/* Timer registers are mapped as type 4 */
-+#define KVM_REG_RISCV_TIMER        (0x04 << KVM_REG_RISCV_TYPE_SHIFT)
-+#define KVM_REG_RISCV_TIMER_REG(name)    \
-+        (offsetof(struct kvm_riscv_timer, name) / sizeof(__u64))
-+
-+/* F extension registers are mapped as type 5 */
-+#define KVM_REG_RISCV_FP_F        (0x05 << KVM_REG_RISCV_TYPE_SHIFT)
-+#define KVM_REG_RISCV_FP_F_REG(name)    \
-+        (offsetof(struct __riscv_f_ext_state, name) / sizeof(__u32))
-+
-+/* D extension registers are mapped as type 6 */
-+#define KVM_REG_RISCV_FP_D        (0x06 << KVM_REG_RISCV_TYPE_SHIFT)
-+#define KVM_REG_RISCV_FP_D_REG(name)    \
-+        (offsetof(struct __riscv_d_ext_state, name) / sizeof(__u64))
-+
-+#endif
-+
-+#endif /* __LINUX_KVM_RISCV_H */
---
-.31.1

-[PULL 46/61] target/riscv: Use gdb xml according to max mxlen
+[PULL v2 01/45] target/riscv/cpu.c: do not run 'host' CPU with TCG
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+The 'host' CPU is available in a CONFIG_KVM build and it's currently
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+available for all accels, but is a KVM only CPU. This means that in a
 RISC-V KVM capable host we can do things like this:
 $ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
 qemu-system-riscv64: H extension requires priv spec 1.12.0
 This CPU does not have a priv spec because we don't filter its extensions
 via priv spec. We shouldn't be reaching riscv_cpu_realize_tcg() at all
 with the 'host' CPU.
 We don't have a way to filter the 'host' CPU out of the available CPU
 options (-cpu help) if the build includes both KVM and TCG. What we can
 do is to error out during riscv_cpu_realize_tcg() if the user chooses
 the 'host' CPU with accel=tcg:
 $ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
 qemu-system-riscv64: 'host' CPU is not compatible with TCG acceleration
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-9-zhiwei_liu@c-sky.com
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-Id: <20230721133411.474105-1-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c     |  8 ++---
+ target/riscv/cpu.c | 5 +++++
- target/riscv/gdbstub.c | 71 +++++++++++++++++++++++++++++++-----------
+file changed, 5 insertions(+)
 files changed, 55 insertions(+), 24 deletions(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
      RISCVCPU *cpu = RISCV_CPU(dev);
      CPURISCVState *env = &cpu->env;
-     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
-+    CPUClass *cc = CPU_CLASS(mcc);
-     int priv_version = 0;
      Error *local_err = NULL;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
++    if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_CPU_HOST)) {
-     switch (env->misa_mxl_max) {
++        error_setg(errp, "'host' CPU is not compatible with TCG acceleration");
- #ifdef TARGET_RISCV64
++        return;
      case MXL_RV64:
 +        cc->gdb_core_xml_file = "riscv-64bit-cpu.xml";
          break;
      case MXL_RV128:
          break;
  #endif
      case MXL_RV32:
 +        cc->gdb_core_xml_file = "riscv-32bit-cpu.xml";
          break;
      default:
          g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
      cc->gdb_read_register = riscv_cpu_gdb_read_register;
      cc->gdb_write_register = riscv_cpu_gdb_write_register;
      cc->gdb_num_core_regs = 33;
 -#if defined(TARGET_RISCV32)
 -    cc->gdb_core_xml_file = "riscv-32bit-cpu.xml";
 -#elif defined(TARGET_RISCV64)
 -    cc->gdb_core_xml_file = "riscv-64bit-cpu.xml";
 -#endif
      cc->gdb_stop_before_watchpoint = true;
      cc->disas_set_info = riscv_cpu_disas_set_info;
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/gdbstub.c
 +++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
  {
      RISCVCPU *cpu = RISCV_CPU(cs);
      CPURISCVState *env = &cpu->env;
 +    target_ulong tmp;
      if (n < 32) {
 -        return gdb_get_regl(mem_buf, env->gpr[n]);
 +        tmp = env->gpr[n];
      } else if (n == 32) {
 -        return gdb_get_regl(mem_buf, env->pc);
 +        tmp = env->pc;
 +    } else {
 +        return 0;
 +    }
 +
-+    switch (env->misa_mxl_max) {
+     riscv_cpu_validate_misa_mxl(cpu, &local_err);
-+    case MXL_RV32:
+     if (local_err != NULL) {
-+        return gdb_get_reg32(mem_buf, tmp);
+         error_propagate(errp, local_err);
 +    case MXL_RV64:
 +        return gdb_get_reg64(mem_buf, tmp);
 +    default:
 +        g_assert_not_reached();
      }
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
  {
      RISCVCPU *cpu = RISCV_CPU(cs);
      CPURISCVState *env = &cpu->env;
 -
 -    if (n == 0) {
 -        /* discard writes to x0 */
 -        return sizeof(target_ulong);
 -    } else if (n < 32) {
 -        env->gpr[n] = ldtul_p(mem_buf);
 -        return sizeof(target_ulong);
 +    int length = 0;
 +    target_ulong tmp;
 +
 +    switch (env->misa_mxl_max) {
 +    case MXL_RV32:
 +        tmp = (int32_t)ldl_p(mem_buf);
 +        length = 4;
 +        break;
 +    case MXL_RV64:
 +        if (env->xl < MXL_RV64) {
 +            tmp = (int32_t)ldq_p(mem_buf);
 +        } else {
 +            tmp = ldq_p(mem_buf);
 +        }
 +        length = 8;
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    if (n > 0 && n < 32) {
 +        env->gpr[n] = tmp;
      } else if (n == 32) {
 -        env->pc = ldtul_p(mem_buf);
 -        return sizeof(target_ulong);
 +        env->pc = tmp;
      }
 -    return 0;
 +
 +    return length;
  }
  static int riscv_gdb_get_fpu(CPURISCVState *env, GByteArray *buf, int n)
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
                                                                cs->gdb_num_regs),
                                   "riscv-vector.xml", 0);
      }
 -#if defined(TARGET_RISCV32)
 -    gdb_register_coprocessor(cs, riscv_gdb_get_virtual, riscv_gdb_set_virtual,
 -                             1, "riscv-32bit-virtual.xml", 0);
 -#elif defined(TARGET_RISCV64)
 -    gdb_register_coprocessor(cs, riscv_gdb_get_virtual, riscv_gdb_set_virtual,
 -                             1, "riscv-64bit-virtual.xml", 0);
 -#endif
 +    switch (env->misa_mxl_max) {
 +    case MXL_RV32:
 +        gdb_register_coprocessor(cs, riscv_gdb_get_virtual,
 +                                 riscv_gdb_set_virtual,
 +                                 1, "riscv-32bit-virtual.xml", 0);
 +        break;
 +    case MXL_RV64:
 +        gdb_register_coprocessor(cs, riscv_gdb_get_virtual,
 +                                 riscv_gdb_set_virtual,
 +                                 1, "riscv-64bit-virtual.xml", 0);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
      gdb_register_coprocessor(cs, riscv_gdb_get_csr, riscv_gdb_set_csr,
                               riscv_gen_dynamic_csr_xml(cs, cs->gdb_num_regs),
 --
-.31.1
+.41.0

-[PULL 36/61] hw/riscv: spike: Allow using binary firmware as bios
+[PULL v2 02/45] hw/char/riscv_htif: Fix printing of console characters on big endian hosts
-From: Anup Patel <apatel@ventanamicro.com>
+From: Thomas Huth <thuth@redhat.com>
-Currently, we have to use OpenSBI firmware ELF as bios for the spike
+The character that should be printed is stored in the 64 bit "payload"
-machine because the HTIF console requires ELF for parsing "fromhost"
+variable. The code currently tries to print it by taking the address
-and "tohost" symbols.
+of the variable and passing this pointer to qemu_chr_fe_write(). However,
 this only works on little endian hosts where the least significant bits
 are stored on the lowest address. To do this in a portable way, we have
 to store the value in an uint8_t variable instead.
-The latest OpenSBI can now optionally pick-up HTIF register address
+Fixes: 5033606780 ("RISC-V HTIF Console")
-from HTIF DT node so using this feature spike machine can now use
+Signed-off-by: Thomas Huth <thuth@redhat.com>
 OpenSBI firmware BIN as bios.
 Signed-off-by: Anup Patel <apatel@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-Id: <20230721094720.902454-2-thuth@redhat.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/char/riscv_htif.h |  5 ++++-
+ hw/char/riscv_htif.c | 3 ++-
- include/hw/riscv/spike.h     |  1 +
+file changed, 2 insertions(+), 1 deletion(-)
  hw/char/riscv_htif.c         | 33 +++++++++++++++++++----------
  hw/riscv/spike.c             | 41 ++++++++++++++++++++++--------------
 files changed, 52 insertions(+), 28 deletions(-)
-diff --git a/include/hw/char/riscv_htif.h b/include/hw/char/riscv_htif.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/char/riscv_htif.h
-+++ b/include/hw/char/riscv_htif.h
-@@ -XXX,XX +XXX,XX @@ extern const MemoryRegionOps htif_io_ops;
- void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
-     uint64_t st_size);
-+/* Check if HTIF uses ELF symbols */
-+bool htif_uses_elf_symbols(void);
-+
- /* legacy pre qom */
- HTIFState *htif_mm_init(MemoryRegion *address_space, MemoryRegion *main_mem,
--    CPURISCVState *env, Chardev *chr);
-+    CPURISCVState *env, Chardev *chr, uint64_t nonelf_base);
- #endif
-diff --git a/include/hw/riscv/spike.h b/include/hw/riscv/spike.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/spike.h
-+++ b/include/hw/riscv/spike.h
-@@ -XXX,XX +XXX,XX @@ struct SpikeState {
- enum {
-     SPIKE_MROM,
-+    SPIKE_HTIF,
-     SPIKE_CLINT,
-     SPIKE_DRAM
- };
 diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/riscv_htif.c
 +++ b/hw/char/riscv_htif.c
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps htif_mm_ops = {
+@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
-     .write = htif_mm_write,
+             s->tohost = 0; /* clear to indicate we read */
- };
+             return;
+         } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
-+bool htif_uses_elf_symbols(void)
+-            qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1);
-+{
++            uint8_t ch = (uint8_t)payload;
-+    return (address_symbol_set == 3) ? true : false;
++            qemu_chr_fe_write(&s->chr, &ch, 1);
-+}
+             resp = 0x100 | (uint8_t)payload;
-+
+         } else {
- HTIFState *htif_mm_init(MemoryRegion *address_space, MemoryRegion *main_mem,
+             qemu_log("HTIF device %d: unknown command\n", device);
 -    CPURISCVState *env, Chardev *chr)
 +    CPURISCVState *env, Chardev *chr, uint64_t nonelf_base)
  {
 -    uint64_t base = MIN(tohost_addr, fromhost_addr);
 -    uint64_t size = MAX(tohost_addr + 8, fromhost_addr + 8) - base;
 -    uint64_t tohost_offset = tohost_addr - base;
 -    uint64_t fromhost_offset = fromhost_addr - base;
 +    uint64_t base, size, tohost_offset, fromhost_offset;
 +
 +    if (!htif_uses_elf_symbols()) {
 +        fromhost_addr = nonelf_base;
 +        tohost_addr = nonelf_base + 8;
 +    }
 +
 +    base = MIN(tohost_addr, fromhost_addr);
 +    size = MAX(tohost_addr + 8, fromhost_addr + 8) - base;
 +    tohost_offset = tohost_addr - base;
 +    fromhost_offset = fromhost_addr - base;
      HTIFState *s = g_malloc0(sizeof(HTIFState));
      s->address_space = address_space;
@@ -XXX,XX +XXX,XX @@ HTIFState *htif_mm_init(MemoryRegion *address_space, MemoryRegion *main_mem,
      qemu_chr_fe_init(&s->chr, chr, &error_abort);
      qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event,
          htif_be_change, s, NULL, true);
 -    if (address_symbol_set == 3) {
 -        memory_region_init_io(&s->mmio, NULL, &htif_mm_ops, s,
 -                              TYPE_HTIF_UART, size);
 -        memory_region_add_subregion_overlap(address_space, base,
 -                                            &s->mmio, 1);
 -    }
 +
 +    memory_region_init_io(&s->mmio, NULL, &htif_mm_ops, s,
 +                          TYPE_HTIF_UART, size);
 +    memory_region_add_subregion_overlap(address_space, base,
 +                                        &s->mmio, 1);
      return s;
  }
 diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/spike.c
 +++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@
  static const MemMapEntry spike_memmap[] = {
      [SPIKE_MROM] =     {     0x1000,     0xf000 },
 +    [SPIKE_HTIF] =     {  0x1000000,     0x1000 },
      [SPIKE_CLINT] =    {  0x2000000,    0x10000 },
      [SPIKE_DRAM] =     { 0x80000000,        0x0 },
  };
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
      qemu_fdt_add_subnode(fdt, "/htif");
      qemu_fdt_setprop_string(fdt, "/htif", "compatible", "ucb,htif0");
 +    if (!htif_uses_elf_symbols()) {
 +        qemu_fdt_setprop_cells(fdt, "/htif", "reg",
 +            0x0, memmap[SPIKE_HTIF].base, 0x0, memmap[SPIKE_HTIF].size);
 +    }
      qemu_fdt_add_subnode(fdt, "/soc");
      qemu_fdt_setprop(fdt, "/soc", "ranges", NULL, 0);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
      if (cmdline) {
          qemu_fdt_add_subnode(fdt, "/chosen");
          qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", cmdline);
 +        qemu_fdt_setprop_string(fdt, "/chosen", "stdout-path", "/htif");
      }
  }
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      memory_region_add_subregion(system_memory, memmap[SPIKE_DRAM].base,
          machine->ram);
 -    /* create device tree */
 -    create_fdt(s, memmap, machine->ram_size, machine->kernel_cmdline,
 -               riscv_is_32bit(&s->soc[0]));
 -
      /* boot rom */
      memory_region_init_rom(mask_rom, NULL, "riscv.spike.mrom",
                             memmap[SPIKE_MROM].size, &error_fatal);
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
                                      htif_symbol_callback);
      }
 +    /* Load kernel */
      if (machine->kernel_filename) {
          kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc[0],
                                                           firmware_end_addr);
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
          kernel_entry = riscv_load_kernel(machine->kernel_filename,
                                           kernel_start_addr,
                                           htif_symbol_callback);
 -
 -        if (machine->initrd_filename) {
 -            hwaddr start;
 -            hwaddr end = riscv_load_initrd(machine->initrd_filename,
 -                                           machine->ram_size, kernel_entry,
 -                                           &start);
 -            qemu_fdt_setprop_cell(s->fdt, "/chosen",
 -                                  "linux,initrd-start", start);
 -            qemu_fdt_setprop_cell(s->fdt, "/chosen", "linux,initrd-end",
 -                                  end);
 -        }
      } else {
         /*
          * If dynamic firmware is used, it doesn't know where is the next mode
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
          kernel_entry = 0;
      }
 +    /* Create device tree */
 +    create_fdt(s, memmap, machine->ram_size, machine->kernel_cmdline,
 +               riscv_is_32bit(&s->soc[0]));
 +
 +    /* Load initrd */
 +    if (machine->kernel_filename && machine->initrd_filename) {
 +        hwaddr start;
 +        hwaddr end = riscv_load_initrd(machine->initrd_filename,
 +                                       machine->ram_size, kernel_entry,
 +                                       &start);
 +        qemu_fdt_setprop_cell(s->fdt, "/chosen",
 +                              "linux,initrd-start", start);
 +        qemu_fdt_setprop_cell(s->fdt, "/chosen", "linux,initrd-end",
 +                              end);
 +    }
 +
      /* Compute the fdt load address in dram */
      fdt_load_addr = riscv_load_fdt(memmap[SPIKE_DRAM].base,
                                     machine->ram_size, s->fdt);
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      /* initialize HTIF using symbols found in load_kernel */
      htif_mm_init(system_memory, mask_rom,
 -                 &s->soc[0].harts[0].env, serial_hd(0));
 +                 &s->soc[0].harts[0].env, serial_hd(0),
 +                 memmap[SPIKE_HTIF].base);
  }
  static void spike_machine_instance_init(Object *obj)
 --
-.31.1
+.41.0

-[PULL 17/61] softmmu/device_tree: Silence compiler warning with --enable-sanitizers
+[PULL v2 03/45] hw/char/riscv_htif: Fix the console syscall on big endian hosts
 From: Thomas Huth <thuth@redhat.com>
-If I configure my build with --enable-sanitizers, my GCC (v8.5.0)
+Values that have been read via cpu_physical_memory_read() from the
-complains:
+guest's memory have to be swapped in case the host endianess differs
 from the guest.
-.../softmmu/device_tree.c: In function ‘qemu_fdt_add_path’:
+Fixes: a6e13e31d5 ("riscv_htif: Support console output via proxy syscall")
 .../softmmu/device_tree.c:560:18: error: ‘retval’ may be used uninitialized
  in this function [-Werror=maybe-uninitialized]
      int namelen, retval;
                   ^~~~~~
 It's a false warning since the while loop is always executed at least
 once (p has to be non-NULL, otherwise the derefence in the if-statement
 earlier will crash). Thus let's switch to a do-while loop here instead
 to make the compiler happy in all cases.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Andrew Jones <drjones@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
+Reviewed-by: Bin Meng <bmeng@tinylab.org>
-Message-id: 20220107133844.145039-1-thuth@redhat.com
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-Id: <20230721094720.902454-3-thuth@redhat.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- softmmu/device_tree.c | 4 ++--
+ hw/char/riscv_htif.c | 9 +++++----
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 5 insertions(+), 4 deletions(-)
-diff --git a/softmmu/device_tree.c b/softmmu/device_tree.c
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
 index XXXXXXX..XXXXXXX 100644
---- a/softmmu/device_tree.c
+--- a/hw/char/riscv_htif.c
-+++ b/softmmu/device_tree.c
++++ b/hw/char/riscv_htif.c
-@@ -XXX,XX +XXX,XX @@ int qemu_fdt_add_path(void *fdt, const char *path)
+@@ -XXX,XX +XXX,XX @@
-         return -1;
+ #include "qemu/timer.h"
-     }
+ #include "qemu/error-report.h"
+ #include "exec/address-spaces.h"
--    while (p) {
++#include "exec/tswap.h"
-+    do {
+ #include "sysemu/dma.h"
-         name = p + 1;
-         p = strchr(name, '/');
+ #define RISCV_DEBUG_HTIF 0
-         namelen = p != NULL ? p - name : strlen(name);
+@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
-@@ -XXX,XX +XXX,XX @@ int qemu_fdt_add_path(void *fdt, const char *path)
+             } else {
-         }
+                 uint64_t syscall[8];
+                 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
-         parent = retval;
+-                if (syscall[0] == PK_SYS_WRITE &&
--    }
+-                    syscall[1] == HTIF_DEV_CONSOLE &&
-+    } while (p);
+-                    syscall[3] == HTIF_CONSOLE_CMD_PUTC) {
++                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
-     return retval;
++                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
- }
++                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
                      uint8_t ch;
 -                    cpu_physical_memory_read(syscall[2], &ch, 1);
 +                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
                      qemu_chr_fe_write(&s->chr, &ch, 1);
                      resp = 0x100 | (uint8_t)payload;
                  } else {
 --
-.31.1
+.41.0

-[PULL 35/61] target/riscv: rvv-1.0: Allow Zve32f extension to be turned on
+[PULL v2 04/45] target/riscv/cpu.c: add zmmul isa string
-From: Frank Chang <frank.chang@sifive.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+zmmul was promoted from experimental to ratified in commit 6d00ffad4e95.
 Add a riscv,isa string for it.
 Fixes: 6d00ffad4e95 ("target/riscv: move zmmul out of the experimental properties")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220118014522.13613-18-frank.chang@sifive.com
+Message-Id: <20230720132424.371132-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu.c | 1 +
 file changed, 1 insertion(+)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
+     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
-     DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
-     DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
-+    DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
++    ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
-     DEFINE_PROP_BOOL("Zve64f", RISCVCPU, cfg.ext_zve64f, false),
+     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
-     DEFINE_PROP_BOOL("mmu", RISCVCPU, cfg.mmu, true),
+     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
-     DEFINE_PROP_BOOL("pmp", RISCVCPU, cfg.pmp, true),
+     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
 --
-.31.1
+.41.0

-[PULL 28/61] target/riscv: rvv-1.0: Allow Zve64f extension to be turned on
+[PULL v2 05/45] target/riscv/cpu.c: add smepmp isa string
-From: Frank Chang <frank.chang@sifive.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+The cpu->cfg.epmp extension is still experimental, but it already has a
 'smepmp' riscv,isa string. Add it.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220118014522.13613-11-frank.chang@sifive.com
+Message-Id: <20230720132424.371132-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu.c | 1 +
 file changed, 1 insertion(+)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-     DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
-     DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-+    DEFINE_PROP_BOOL("Zve64f", RISCVCPU, cfg.ext_zve64f, false),
++    ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, epmp),
-     DEFINE_PROP_BOOL("mmu", RISCVCPU, cfg.mmu, true),
+     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
-     DEFINE_PROP_BOOL("pmp", RISCVCPU, cfg.pmp, true),
+     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
+     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
 --
-.31.1
+.41.0

-[PULL 56/61] target/riscv: Fix check range for first fault only
+[PULL v2 06/45] target/riscv: Fix page_check_range use in fault-only-first
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Only check the range that has passed the address translation.
+Commit bef6f008b98(accel/tcg: Return bool from page_check_range) converts
 integer return value to bool type. However, it wrongly converted the use
 of the API in riscv fault-only-first, where page_check_range < = 0, should
 be converted to !page_check_range.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230729031618.821-1-zhiwei_liu@linux.alibaba.com>
 Message-id: 20220120122050.41546-19-zhiwei_liu@c-sky.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/vector_helper.c | 4 ++--
+ target/riscv/vector_helper.c | 2 +-
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
 @@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
                                           cpu_mmu_index(env, false));
                  if (host) {
  #ifdef CONFIG_USER_ONLY
--                    if (page_check_range(addr, nf << esz, PAGE_READ) < 0) {
+-                    if (page_check_range(addr, offset, PAGE_READ)) {
-+                    if (page_check_range(addr, offset, PAGE_READ) < 0) {
++                    if (!page_check_range(addr, offset, PAGE_READ)) {
                          vl = i;
                          goto ProbeSuccess;
                      }
- #else
--                    probe_pages(env, addr, nf << esz, ra, MMU_DATA_LOAD);
-+                    probe_pages(env, addr, offset, ra, MMU_DATA_LOAD);
- #endif
-                 } else {
-                     vl = i;
 --
-.31.1
+.41.0

-[PULL 41/61] target/riscv: Sign extend link reg for jal and jalr
+[PULL v2 07/45] target/riscv: Use existing lookup tables for MixColumns
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Ard Biesheuvel <ardb@kernel.org>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+The AES MixColumns and InvMixColumns operations are relatively
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+expensive 4x4 matrix multiplications in GF(2^8), which is why C
-Message-id: 20220120122050.41546-4-zhiwei_liu@c-sky.com
+implementations usually rely on precomputed lookup tables rather than
 performing the calculations on demand.
 Given that we already carry those tables in QEMU, we can just grab the
 right value in the implementation of the RISC-V AES32 instructions. Note
 that the tables in question are permuted according to the respective
 Sbox, so we can omit the Sbox lookup as well in this case.
 Cc: Richard Henderson <richard.henderson@linaro.org>
 Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
 Cc: Zewen Ye <lustrew@foxmail.com>
 Cc: Weiwei Li <liweiwei@iscas.ac.cn>
 Cc: Junqiang Wang <wangjunqiang@iscas.ac.cn>
 Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230731084043.1791984-1-ardb@kernel.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/translate.c                | 4 +---
+ include/crypto/aes.h         |  7 +++++++
- target/riscv/insn_trans/trans_rvi.c.inc | 4 +---
+ crypto/aes.c                 |  4 ++--
-files changed, 2 insertions(+), 6 deletions(-)
+ target/riscv/crypto_helper.c | 34 ++++------------------------------
 files changed, 13 insertions(+), 32 deletions(-)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/include/crypto/aes.h b/include/crypto/aes.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/include/crypto/aes.h
-+++ b/target/riscv/translate.c
++++ b/include/crypto/aes.h
-@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
+@@ -XXX,XX +XXX,XX @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
-             return;
+ extern const uint8_t AES_sbox[256];
  extern const uint8_t AES_isbox[256];
 +/*
 +AES_Te0[x] = S [x].[02, 01, 01, 03];
 +AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
 +*/
 +
 +extern const uint32_t AES_Te0[256], AES_Td0[256];
 +
  #endif
 diff --git a/crypto/aes.c b/crypto/aes.c
 index XXXXXXX..XXXXXXX 100644
 --- a/crypto/aes.c
 +++ b/crypto/aes.c
@@ -XXX,XX +XXX,XX @@ AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
  AES_Td4[x] = Si[x].[01, 01, 01, 01];
  */
 -static const uint32_t AES_Te0[256] = {
 +const uint32_t AES_Te0[256] = {
 xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
 xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
 x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
@@ -XXX,XX +XXX,XX @@ static const uint32_t AES_Te4[256] = {
 xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
  };
 -static const uint32_t AES_Td0[256] = {
 +const uint32_t AES_Td0[256] = {
 x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
 x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
 x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
 diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/crypto_helper.c
 +++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "crypto/aes-round.h"
  #include "crypto/sm4.h"
 -#define AES_XTIME(a) \
 -    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
 -
 -#define AES_GFMUL(a, b) (( \
 -    (((b) & 0x1) ? (a) : 0) ^ \
 -    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
 -    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
 -    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
 -
 -static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
 -{
 -    uint32_t u;
 -
 -    if (fwd) {
 -        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
 -            (AES_GFMUL(x, 2) << 0);
 -    } else {
 -        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
 -            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
 -    }
 -    return u;
 -}
 -
  #define sext32_xlen(x) (target_ulong)(int32_t)(x)
  static inline target_ulong aes32_operation(target_ulong shamt,
@@ -XXX,XX +XXX,XX @@ static inline target_ulong aes32_operation(target_ulong shamt,
                                             bool enc, bool mix)
  {
      uint8_t si = rs2 >> shamt;
 -    uint8_t so;
      uint32_t mixed;
      target_ulong res;
      if (enc) {
 -        so = AES_sbox[si];
          if (mix) {
 -            mixed = aes_mixcolumn_byte(so, true);
 +            mixed = be32_to_cpu(AES_Te0[si]);
          } else {
 -            mixed = so;
 +            mixed = AES_sbox[si];
          }
      } else {
 -        so = AES_isbox[si];
          if (mix) {
 -            mixed = aes_mixcolumn_byte(so, false);
 +            mixed = be32_to_cpu(AES_Td0[si]);
          } else {
 -            mixed = so;
 +            mixed = AES_isbox[si];
          }
      }
--    if (rd != 0) {
+     mixed = rol32(mixed, shamt);
 -        tcg_gen_movi_tl(cpu_gpr[rd], ctx->pc_succ_insn);
 -    }
 +    gen_set_gpri(ctx, rd, ctx->pc_succ_insn);
      gen_goto_tb(ctx, 0, ctx->base.pc_next + imm); /* must use this for safety */
      ctx->base.is_jmp = DISAS_NORETURN;
  }
 diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvi.c.inc
 +++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
          tcg_temp_free(t0);
      }
 -    if (a->rd != 0) {
 -        tcg_gen_movi_tl(cpu_gpr[a->rd], ctx->pc_succ_insn);
 -    }
 +    gen_set_gpri(ctx, a->rd, ctx->pc_succ_insn);
      tcg_gen_lookup_and_goto_ptr();
      if (misaligned) {
 --
-.31.1
+.41.0

-[PULL 05/61] target/riscv: Add target/riscv/kvm.c to place the public kvm interface
+[PULL v2 08/45] target/riscv: Refactor some of the generic vector functionality
-From: Yifei Jiang <jiangyifei@huawei.com>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Add target/riscv/kvm.c to place kvm_arch_* function needed by
+Take some functions/macros out of `vector_helper` and put them in a new
-kvm/kvm-all.c.
+module called `vector_internals`. This ensures they can be used by both
 vector and vector-crypto helpers (latter implemented in proceeding
 commits).
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Reviewed-by: Anup Patel <anup.patel@wdc.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220112081329.1835-3-jiangyifei@huawei.com
+Message-ID: <20230711165917.2629866-2-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c       | 133 +++++++++++++++++++++++++++++++++++++++
+ target/riscv/vector_internals.h | 182 +++++++++++++++++++++++++++++
- target/riscv/meson.build |   1 +
+ target/riscv/vector_helper.c    | 201 +-------------------------------
-files changed, 134 insertions(+)
+ target/riscv/vector_internals.c |  81 +++++++++++++
- create mode 100644 target/riscv/kvm.c
+ target/riscv/meson.build        |   1 +
 files changed, 265 insertions(+), 200 deletions(-)
  create mode 100644 target/riscv/vector_internals.h
  create mode 100644 target/riscv/vector_internals.c
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/vector_internals.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * RISC-V implementation of KVM hooks
++ * RISC-V Vector Extension Internals
 + *
-+ * Copyright (c) 2020 Huawei Technologies Co., Ltd
++ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
++#ifndef TARGET_RISCV_VECTOR_INTERNALS_H
++#define TARGET_RISCV_VECTOR_INTERNALS_H
++
 +#include "qemu/osdep.h"
-+#include <sys/ioctl.h>
++#include "qemu/bitops.h"
 +
 +#include <linux/kvm.h>
 +
 +#include "qemu-common.h"
 +#include "qemu/timer.h"
 +#include "qemu/error-report.h"
 +#include "qemu/main-loop.h"
 +#include "sysemu/sysemu.h"
 +#include "sysemu/kvm.h"
 +#include "sysemu/kvm_int.h"
 +#include "cpu.h"
-+#include "trace.h"
++#include "tcg/tcg-gvec-desc.h"
-+#include "hw/pci/pci.h"
++#include "internals.h"
-+#include "exec/memattrs.h"
++
-+#include "exec/address-spaces.h"
++static inline uint32_t vext_nf(uint32_t desc)
-+#include "hw/boards.h"
++{
-+#include "hw/irq.h"
++    return FIELD_EX32(simd_data(desc), VDATA, NF);
-+#include "qemu/log.h"
++}
-+#include "hw/loader.h"
++
-+
++/*
-+const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
++ * Note that vector data is stored in host-endian 64-bit chunks,
-+    KVM_CAP_LAST_INFO
++ * so addressing units smaller than that needs a host-endian fixup.
-+};
++ */
-+
++#if HOST_BIG_ENDIAN
-+int kvm_arch_get_registers(CPUState *cs)
++#define H1(x)   ((x) ^ 7)
-+{
++#define H1_2(x) ((x) ^ 6)
-+    return 0;
++#define H1_4(x) ((x) ^ 4)
-+}
++#define H2(x)   ((x) ^ 3)
-+
++#define H4(x)   ((x) ^ 1)
-+int kvm_arch_put_registers(CPUState *cs, int level)
++#define H8(x)   ((x))
-+{
++#else
-+    return 0;
++#define H1(x)   (x)
-+}
++#define H1_2(x) (x)
-+
++#define H1_4(x) (x)
-+int kvm_arch_release_virq_post(int virq)
++#define H2(x)   (x)
-+{
++#define H4(x)   (x)
-+    return 0;
++#define H8(x)   (x)
-+}
++#endif
 +
-+int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
++/*
-+                             uint64_t address, uint32_t data, PCIDevice *dev)
++ * Encode LMUL to lmul as following:
-+{
++ *     LMUL    vlmul    lmul
-+    return 0;
++ *      1       000       0
-+}
++ *      2       001       1
-+
++ *      4       010       2
-+int kvm_arch_destroy_vcpu(CPUState *cs)
++ *      8       011       3
-+{
++ *      -       100       -
-+    return 0;
++ *     1/8      101      -3
-+}
++ *     1/4      110      -2
-+
++ *     1/2      111      -1
-+unsigned long kvm_arch_vcpu_id(CPUState *cpu)
++ */
-+{
++static inline int32_t vext_lmul(uint32_t desc)
-+    return cpu->cpu_index;
++{
-+}
++    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
-+
++}
-+void kvm_arch_init_irq_routing(KVMState *s)
++
-+{
++static inline uint32_t vext_vm(uint32_t desc)
-+}
++{
-+
++    return FIELD_EX32(simd_data(desc), VDATA, VM);
-+int kvm_arch_init_vcpu(CPUState *cs)
++}
-+{
++
-+    return 0;
++static inline uint32_t vext_vma(uint32_t desc)
-+}
++{
-+
++    return FIELD_EX32(simd_data(desc), VDATA, VMA);
-+int kvm_arch_msi_data_to_gsi(uint32_t data)
++}
-+{
++
-+    abort();
++static inline uint32_t vext_vta(uint32_t desc)
-+}
++{
-+
++    return FIELD_EX32(simd_data(desc), VDATA, VTA);
-+int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
++}
-+                                int vector, PCIDevice *dev)
++
-+{
++static inline uint32_t vext_vta_all_1s(uint32_t desc)
-+    return 0;
++{
-+}
++    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
-+
++}
-+int kvm_arch_init(MachineState *ms, KVMState *s)
++
-+{
++/*
-+    return 0;
++ * Earlier designs (pre-0.9) had a varying number of bits
-+}
++ * per mask value (MLEN). In the 0.9 design, MLEN=1.
-+
++ * (Section 4.5)
-+int kvm_arch_irqchip_create(KVMState *s)
++ */
-+{
++static inline int vext_elem_mask(void *v0, int index)
-+    return 0;
++{
-+}
++    int idx = index / 64;
-+
++    int pos = index  % 64;
-+int kvm_arch_process_async_events(CPUState *cs)
++    return (((uint64_t *)v0)[idx] >> pos) & 1;
-+{
++}
-+    return 0;
++
-+}
++/*
-+
++ * Get number of total elements, including prestart, body and tail elements.
-+void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
++ * Note that when LMUL < 1, the tail includes the elements past VLMAX that
-+{
++ * are held in the same vector register.
-+}
++ */
-+
++static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
-+MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
++                                            uint32_t esz)
 +{
-+    return MEMTXATTRS_UNSPECIFIED;
++    uint32_t vlenb = simd_maxsz(desc);
-+}
++    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
-+
++    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
-+bool kvm_arch_stop_on_emulation_error(CPUState *cs)
++                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
-+{
++    return (vlenb << emul) / esz;
-+    return true;
++}
-+}
++
-+
++/* set agnostic elements to 1s */
-+int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
++void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
-+{
++                       uint32_t tot);
-+    return 0;
++
-+}
++/* expand macro args before macro */
-+
++#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
-+bool kvm_arch_cpu_check_are_resettable(void)
++
-+{
++/* (TD, T1, T2, TX1, TX2) */
-+    return true;
++#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
 +#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
 +#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
 +#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 +
 +/* operation of two vector elements */
 +typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
 +
 +#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
 +static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
 +{                                                               \
 +    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
 +    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
 +    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
 +}
 +
 +void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
 +                CPURISCVState *env, uint32_t desc,
 +                opivv2_fn *fn, uint32_t esz);
 +
 +/* generate the helpers for OPIVV */
 +#define GEN_VEXT_VV(NAME, ESZ)                            \
 +void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
 +                  void *vs2, CPURISCVState *env,          \
 +                  uint32_t desc)                          \
 +{                                                         \
 +    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
 +               do_##NAME, ESZ);                           \
 +}
 +
 +typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
 +
 +/*
 + * (T1)s1 gives the real operator type.
 + * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
 + */
 +#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
 +static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
 +{                                                                   \
 +    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
 +    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
 +}
 +
 +void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
 +                CPURISCVState *env, uint32_t desc,
 +                opivx2_fn fn, uint32_t esz);
 +
 +/* generate the helpers for OPIVX */
 +#define GEN_VEXT_VX(NAME, ESZ)                            \
 +void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
 +                  void *vs2, CPURISCVState *env,          \
 +                  uint32_t desc)                          \
 +{                                                         \
 +    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
 +               do_##NAME, ESZ);                           \
 +}
 +
 +#endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "fpu/softfloat.h"
  #include "tcg/tcg-gvec-desc.h"
  #include "internals.h"
 +#include "vector_internals.h"
  #include <math.h>
  target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
      return vl;
  }
 -/*
 - * Note that vector data is stored in host-endian 64-bit chunks,
 - * so addressing units smaller than that needs a host-endian fixup.
 - */
 -#if HOST_BIG_ENDIAN
 -#define H1(x)   ((x) ^ 7)
 -#define H1_2(x) ((x) ^ 6)
 -#define H1_4(x) ((x) ^ 4)
 -#define H2(x)   ((x) ^ 3)
 -#define H4(x)   ((x) ^ 1)
 -#define H8(x)   ((x))
 -#else
 -#define H1(x)   (x)
 -#define H1_2(x) (x)
 -#define H1_4(x) (x)
 -#define H2(x)   (x)
 -#define H4(x)   (x)
 -#define H8(x)   (x)
 -#endif
 -
 -static inline uint32_t vext_nf(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, NF);
 -}
 -
 -static inline uint32_t vext_vm(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VM);
 -}
 -
 -/*
 - * Encode LMUL to lmul as following:
 - *     LMUL    vlmul    lmul
 - *      1       000       0
 - *      2       001       1
 - *      4       010       2
 - *      8       011       3
 - *      -       100       -
 - *     1/8      101      -3
 - *     1/4      110      -2
 - *     1/2      111      -1
 - */
 -static inline int32_t vext_lmul(uint32_t desc)
 -{
 -    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
 -}
 -
 -static inline uint32_t vext_vta(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VTA);
 -}
 -
 -static inline uint32_t vext_vma(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VMA);
 -}
 -
 -static inline uint32_t vext_vta_all_1s(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
 -}
 -
  /*
   * Get the maximum number of elements can be operated.
   *
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
      return scale < 0 ? vlenb >> -scale : vlenb << scale;
  }
 -/*
 - * Get number of total elements, including prestart, body and tail elements.
 - * Note that when LMUL < 1, the tail includes the elements past VLMAX that
 - * are held in the same vector register.
 - */
 -static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
 -                                            uint32_t esz)
 -{
 -    uint32_t vlenb = simd_maxsz(desc);
 -    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
 -    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
 -                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
 -    return (vlenb << emul) / esz;
 -}
 -
  static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
  {
      return (addr & ~env->cur_pmmask) | env->cur_pmbase;
@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
      }
  }
 -/* set agnostic elements to 1s */
 -static void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 -                              uint32_t tot)
 -{
 -    if (is_agnostic == 0) {
 -        /* policy undisturbed */
 -        return;
 -    }
 -    if (tot - cnt == 0) {
 -        return;
 -    }
 -    memset(base + cnt, -1, tot - cnt);
 -}
 -
  static inline void vext_set_elem_mask(void *v0, int index,
                                        uint8_t value)
  {
@@ -XXX,XX +XXX,XX @@ static inline void vext_set_elem_mask(void *v0, int index,
      ((uint64_t *)v0)[idx] = deposit64(old, pos, 1, value);
  }
 -/*
 - * Earlier designs (pre-0.9) had a varying number of bits
 - * per mask value (MLEN). In the 0.9 design, MLEN=1.
 - * (Section 4.5)
 - */
 -static inline int vext_elem_mask(void *v0, int index)
 -{
 -    int idx = index / 64;
 -    int pos = index  % 64;
 -    return (((uint64_t *)v0)[idx] >> pos) & 1;
 -}
 -
  /* elements operations for load and store */
  typedef void vext_ldst_elem_fn(CPURISCVState *env, abi_ptr addr,
                                 uint32_t idx, void *vd, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
   * Vector Integer Arithmetic Instructions
   */
 -/* expand macro args before macro */
 -#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
 -
  /* (TD, T1, T2, TX1, TX2) */
  #define OP_SSS_B int8_t, int8_t, int8_t, int8_t, int8_t
  #define OP_SSS_H int16_t, int16_t, int16_t, int16_t, int16_t
  #define OP_SSS_W int32_t, int32_t, int32_t, int32_t, int32_t
  #define OP_SSS_D int64_t, int64_t, int64_t, int64_t, int64_t
 -#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
 -#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
 -#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
 -#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
  #define OP_SUS_B int8_t, uint8_t, int8_t, uint8_t, int8_t
  #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
  #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
  #define NOP_UUU_H uint16_t, uint16_t, uint32_t, uint16_t, uint32_t
  #define NOP_UUU_W uint32_t, uint32_t, uint64_t, uint32_t, uint64_t
 -/* operation of two vector elements */
 -typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
 -
 -#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
 -static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
 -{                                                               \
 -    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
 -    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
 -    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
 -}
  #define DO_SUB(N, M) (N - M)
  #define DO_RSUB(N, M) (M - N)
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vsub_vv_h, OP_SSS_H, H2, H2, H2, DO_SUB)
  RVVCALL(OPIVV2, vsub_vv_w, OP_SSS_W, H4, H4, H4, DO_SUB)
  RVVCALL(OPIVV2, vsub_vv_d, OP_SSS_D, H8, H8, H8, DO_SUB)
 -static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
 -                       CPURISCVState *env, uint32_t desc,
 -                       opivv2_fn *fn, uint32_t esz)
 -{
 -    uint32_t vm = vext_vm(desc);
 -    uint32_t vl = env->vl;
 -    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 -    uint32_t vta = vext_vta(desc);
 -    uint32_t vma = vext_vma(desc);
 -    uint32_t i;
 -
 -    for (i = env->vstart; i < vl; i++) {
 -        if (!vm && !vext_elem_mask(v0, i)) {
 -            /* set masked-off elements to 1s */
 -            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
 -            continue;
 -        }
 -        fn(vd, vs1, vs2, i);
 -    }
 -    env->vstart = 0;
 -    /* set tail elements to 1s */
 -    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
 -}
 -
 -/* generate the helpers for OPIVV */
 -#define GEN_VEXT_VV(NAME, ESZ)                            \
 -void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
 -                  void *vs2, CPURISCVState *env,          \
 -                  uint32_t desc)                          \
 -{                                                         \
 -    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
 -               do_##NAME, ESZ);                           \
 -}
 -
  GEN_VEXT_VV(vadd_vv_b, 1)
  GEN_VEXT_VV(vadd_vv_h, 2)
  GEN_VEXT_VV(vadd_vv_w, 4)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV(vsub_vv_h, 2)
  GEN_VEXT_VV(vsub_vv_w, 4)
  GEN_VEXT_VV(vsub_vv_d, 8)
 -typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
 -
 -/*
 - * (T1)s1 gives the real operator type.
 - * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
 - */
 -#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
 -static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
 -{                                                                   \
 -    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
 -    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
 -}
  RVVCALL(OPIVX2, vadd_vx_b, OP_SSS_B, H1, H1, DO_ADD)
  RVVCALL(OPIVX2, vadd_vx_h, OP_SSS_H, H2, H2, DO_ADD)
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vrsub_vx_h, OP_SSS_H, H2, H2, DO_RSUB)
  RVVCALL(OPIVX2, vrsub_vx_w, OP_SSS_W, H4, H4, DO_RSUB)
  RVVCALL(OPIVX2, vrsub_vx_d, OP_SSS_D, H8, H8, DO_RSUB)
 -static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
 -                       CPURISCVState *env, uint32_t desc,
 -                       opivx2_fn fn, uint32_t esz)
 -{
 -    uint32_t vm = vext_vm(desc);
 -    uint32_t vl = env->vl;
 -    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 -    uint32_t vta = vext_vta(desc);
 -    uint32_t vma = vext_vma(desc);
 -    uint32_t i;
 -
 -    for (i = env->vstart; i < vl; i++) {
 -        if (!vm && !vext_elem_mask(v0, i)) {
 -            /* set masked-off elements to 1s */
 -            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
 -            continue;
 -        }
 -        fn(vd, s1, vs2, i);
 -    }
 -    env->vstart = 0;
 -    /* set tail elements to 1s */
 -    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
 -}
 -
 -/* generate the helpers for OPIVX */
 -#define GEN_VEXT_VX(NAME, ESZ)                            \
 -void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
 -                  void *vs2, CPURISCVState *env,          \
 -                  uint32_t desc)                          \
 -{                                                         \
 -    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
 -               do_##NAME, ESZ);                           \
 -}
 -
  GEN_VEXT_VX(vadd_vx_b, 1)
  GEN_VEXT_VX(vadd_vx_h, 2)
  GEN_VEXT_VX(vadd_vx_w, 4)
 diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * RISC-V Vector Extension Internals
 + *
 + * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "vector_internals.h"
 +
 +/* set agnostic elements to 1s */
 +void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 +                       uint32_t tot)
 +{
 +    if (is_agnostic == 0) {
 +        /* policy undisturbed */
 +        return;
 +    }
 +    if (tot - cnt == 0) {
 +        return ;
 +    }
 +    memset(base + cnt, -1, tot - cnt);
 +}
 +
 +void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
 +                CPURISCVState *env, uint32_t desc,
 +                opivv2_fn *fn, uint32_t esz)
 +{
 +    uint32_t vm = vext_vm(desc);
 +    uint32_t vl = env->vl;
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t vma = vext_vma(desc);
 +    uint32_t i;
 +
 +    for (i = env->vstart; i < vl; i++) {
 +        if (!vm && !vext_elem_mask(v0, i)) {
 +            /* set masked-off elements to 1s */
 +            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
 +            continue;
 +        }
 +        fn(vd, vs1, vs2, i);
 +    }
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
 +}
 +
 +void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
 +                CPURISCVState *env, uint32_t desc,
 +                opivx2_fn fn, uint32_t esz)
 +{
 +    uint32_t vm = vext_vm(desc);
 +    uint32_t vl = env->vl;
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t vma = vext_vma(desc);
 +    uint32_t i;
 +
 +    for (i = env->vstart; i < vl; i++) {
 +        if (!vm && !vext_elem_mask(v0, i)) {
 +            /* set masked-off elements to 1s */
 +            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
 +            continue;
 +        }
 +        fn(vd, s1, vs2, i);
 +    }
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
 +}
 diff --git a/target/riscv/meson.build b/target/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/meson.build
 +++ b/target/riscv/meson.build
 @@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
+   'gdbstub.c',
+   'op_helper.c',
+   'vector_helper.c',
++  'vector_internals.c',
+   'bitmanip_helper.c',
    'translate.c',
-   'm128_helper.c'
+   'm128_helper.c',
  ))
 +riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'))
  riscv_softmmu_ss = ss.source_set()
  riscv_softmmu_ss.add(files(
 --
-.31.1
+.41.0

-[PULL 21/61] target/riscv: rvv-1.0: Add Zve64f support for load and store insns
+[PULL v2 09/45] target/riscv: Refactor vector-vector translation macro
-From: Frank Chang <frank.chang@sifive.com>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-All Zve* extensions support all vector load and store instructions,
+Refactor the non SEW-specific stuff out of `GEN_OPIVV_TRANS` into
-except Zve64* extensions do not support EEW=64 for index values when
+function `opivv_trans` (similar to `opivi_trans`). `opivv_trans` will be
-XLEN=32.
+used in proceeding vector-crypto commits.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220118014522.13613-4-frank.chang@sifive.com
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-3-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvv.c.inc | 19 +++++++++++++++----
+ target/riscv/insn_trans/trans_rvv.c.inc | 62 +++++++++++++------------
-file changed, 15 insertions(+), 4 deletions(-)
+file changed, 32 insertions(+), 30 deletions(-)
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool vext_check_st_index(DisasContext *s, int vd, int vs2, int nf,
+@@ -XXX,XX +XXX,XX @@ GEN_OPIWX_WIDEN_TRANS(vwadd_wx)
-                                 uint8_t eew)
+ GEN_OPIWX_WIDEN_TRANS(vwsubu_wx)
- {
+ GEN_OPIWX_WIDEN_TRANS(vwsub_wx)
-     int8_t emul = eew - s->sew + s->lmul;
--    return (emul >= -3 && emul <= 3) &&
++static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
--            require_align(vs2, emul) &&
++                        gen_helper_gvec_4_ptr *fn, DisasContext *s)
--            require_align(vd, s->lmul) &&
++{
--            require_nf(vd, nf, s->lmul);
++    uint32_t data = 0;
-+    bool ret = (emul >= -3 && emul <= 3) &&
++    TCGLabel *over = gen_new_label();
-+               require_align(vs2, emul) &&
++    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-+               require_align(vd, s->lmul) &&
++    tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 +               require_nf(vd, nf, s->lmul);
 +
-+    /*
++    data = FIELD_DP32(data, VDATA, VM, vm);
-+     * All Zve* extensions support all vector load and store instructions,
++    data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
-+     * except Zve64* extensions do not support EEW=64 for index values
++    data = FIELD_DP32(data, VDATA, VTA, s->vta);
-+     * when XLEN=32. (Section 18.2)
++    data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
-+     */
++    data = FIELD_DP32(data, VDATA, VMA, s->vma);
-+    if (get_xl(s) == MXL_RV32) {
++    tcg_gen_gvec_4_ptr(vreg_ofs(s, vd), vreg_ofs(s, 0), vreg_ofs(s, vs1),
-+        ret &= (!has_ext(s, RVV) && s->ext_zve64f ? eew != MO_64 : true);
++                       vreg_ofs(s, vs2), cpu_env, s->cfg_ptr->vlen / 8,
-+    }
++                       s->cfg_ptr->vlen / 8, data, fn);
 +    mark_vs_dirty(s);
 +    gen_set_label(over);
 +    return true;
 +}
 +
-+    return ret;
+ /* Vector Integer Add-with-Carry / Subtract-with-Borrow Instructions */
  /* OPIVV without GVEC IR */
 -#define GEN_OPIVV_TRANS(NAME, CHECK)                               \
 -static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
 -{                                                                  \
 -    if (CHECK(s, a)) {                                             \
 -        uint32_t data = 0;                                         \
 -        static gen_helper_gvec_4_ptr * const fns[4] = {            \
 -            gen_helper_##NAME##_b, gen_helper_##NAME##_h,          \
 -            gen_helper_##NAME##_w, gen_helper_##NAME##_d,          \
 -        };                                                         \
 -        TCGLabel *over = gen_new_label();                          \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
 -        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
 -                                                                   \
 -        data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
 -        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
 -        data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
 -        data =                                                     \
 -            FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);\
 -        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
 -        tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
 -                           vreg_ofs(s, a->rs1),                    \
 -                           vreg_ofs(s, a->rs2), cpu_env,           \
 -                           s->cfg_ptr->vlen / 8,                   \
 -                           s->cfg_ptr->vlen / 8, data,             \
 -                           fns[s->sew]);                           \
 -        mark_vs_dirty(s);                                          \
 -        gen_set_label(over);                                       \
 -        return true;                                               \
 -    }                                                              \
 -    return false;                                                  \
 +#define GEN_OPIVV_TRANS(NAME, CHECK)                                     \
 +static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
 +{                                                                        \
 +    if (CHECK(s, a)) {                                                   \
 +        static gen_helper_gvec_4_ptr * const fns[4] = {                  \
 +            gen_helper_##NAME##_b, gen_helper_##NAME##_h,                \
 +            gen_helper_##NAME##_w, gen_helper_##NAME##_d,                \
 +        };                                                               \
 +        return opivv_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s);\
 +    }                                                                    \
 +    return false;                                                        \
  }
  /*
 --
-.31.1
+.41.0

-[PULL 20/61] target/riscv: rvv-1.0: Add Zve64f support for configuration insns
+[PULL v2 10/45] target/riscv: Remove redundant "cpu_vl == 0" checks
-From: Frank Chang <frank.chang@sifive.com>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-All Zve* extensions support the vector configuration instructions.
+Remove the redundant "vl == 0" check which is already included within the  vstart >= vl check, when vl == 0.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Message-id: 20220118014522.13613-3-frank.chang@sifive.com
+Signed-off-by: Max Chou <max.chou@sifive.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20230711165917.2629866-4-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvv.c.inc | 6 ++++--
+ target/riscv/insn_trans/trans_rvv.c.inc | 31 +------------------------
-file changed, 4 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+), 30 deletions(-)
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
+@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
- {
+     TCGv_i32 desc;
-     TCGv s1, dst;
+     TCGLabel *over = gen_new_label();
--    if (!require_rvv(s) || !has_ext(s, RVV)) {
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-+    if (!require_rvv(s) ||
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-+        !(has_ext(s, RVV) || s->ext_zve64f)) {
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
      TCGv_i32 desc;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
      TCGv_i32 desc;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
      TCGv_i32 desc;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
          return false;
      }
-@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
      uint32_t data = 0;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
      uint32_t data = 0;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
      if (checkfn(s, a)) {
          uint32_t data = 0;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
      if (opiwv_widen_check(s, a)) {
          uint32_t data = 0;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
  {
-     TCGv dst;
+     uint32_t data = 0;
+     TCGLabel *over = gen_new_label();
--    if (!require_rvv(s) || !has_ext(s, RVV)) {
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-+    if (!require_rvv(s) ||
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-+        !(has_ext(s, RVV) || s->ext_zve64f)) {
-         return false;
+     data = FIELD_DP32(data, VDATA, VM, vm);
-     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+             gen_helper_##NAME##_w,                                 \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
                  gen_helper_vmv_v_v_w, gen_helper_vmv_v_v_d,
              };
              TCGLabel *over = gen_new_label();
 -            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
              tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
              tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
          vext_check_ss(s, a->rd, 0, 1)) {
          TCGv s1;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          s1 = get_gpr(s, a->rs1, EXT_SIGN);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
                  gen_helper_vmv_v_x_w, gen_helper_vmv_v_x_d,
              };
              TCGLabel *over = gen_new_label();
 -            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
              tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
              s1 = tcg_constant_i64(simm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm(s, RISCV_FRM_DYN);                              \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
      TCGv_i64 t1;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
          };                                                       \
          TCGLabel *over = gen_new_label();                        \
          gen_set_rm(s, RISCV_FRM_DYN);                            \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);        \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);\
                                                                   \
          data = FIELD_DP32(data, VDATA, VM, a->vm);               \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm(s, RISCV_FRM_DYN);                              \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
          uint32_t data = 0;
          TCGLabel *over = gen_new_label();
          gen_set_rm_chkfrm(s, rm);
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
                  gen_helper_vmv_v_x_d,
              };
              TCGLabel *over = gen_new_label();
 -            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
              tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
              t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm_chkfrm(s, FRM);                                 \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm(s, RISCV_FRM_DYN);                              \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm_chkfrm(s, FRM);                                 \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          };                                                         \
          TCGLabel *over = gen_new_label();                          \
          gen_set_rm_chkfrm(s, FRM);                                 \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
          uint32_t data = 0;                                         \
          gen_helper_gvec_4_ptr *fn = gen_helper_##NAME;             \
          TCGLabel *over = gen_new_label();                          \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                     \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
          require_vm(a->vm, a->rd)) {
          uint32_t data = 0;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_s_x(DisasContext *s, arg_vmv_s_x *a)
          TCGv s1;
          TCGLabel *over = gen_new_label();
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
          TCGv_i64 t1;
          TCGLabel *over = gen_new_label();
 -        /* if vl == 0 or vstart >= vl, skip vector register write back */
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
 +        /* if vstart >= vl, skip vector register write back */
          tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
          /* NaN-box f[rs1] */
@@ -XXX,XX +XXX,XX @@ static bool int_ext_op(DisasContext *s, arg_rmr *a, uint8_t seq)
      uint32_t data = 0;
      gen_helper_gvec_3_ptr *fn;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      static gen_helper_gvec_3_ptr * const fns[6][4] = {
 --
-.31.1
+.41.0

-[PULL 09/61] target/riscv: Support start kernel directly by KVM
+[PULL v2 11/45] target/riscv: Add Zvbc ISA extension support
-From: Yifei Jiang <jiangyifei@huawei.com>
+From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-Get kernel and fdt start address in virt.c, and pass them to KVM
+This commit adds support for the Zvbc vector-crypto extension, which
-when cpu reset. Add kvm_riscv.h to place riscv specific interface.
+consists of the following instructions:
-In addition, PLIC is created without M-mode PLIC contexts when KVM
+* vclmulh.[vx,vv]
-is enabled.
+* vclmul.[vx,vv]
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
+Translation functions are defined in
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+`target/riscv/vcrypto_helper.c`.
-Reviewed-by: Anup Patel <anup@brainfault.org>
-Message-id: 20220112081329.1835-7-jiangyifei@huawei.com
+Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Co-authored-by: Max Chou <max.chou@sifive.com>
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 [max.chou@sifive.com: Exposed x-zvbc property]
 Message-ID: <20230711165917.2629866-5-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/boot.h  |  1 +
+ target/riscv/cpu_cfg.h                   |  1 +
- target/riscv/cpu.h       |  3 ++
+ target/riscv/helper.h                    |  6 +++
- target/riscv/kvm_riscv.h | 24 ++++++++++++
+ target/riscv/insn32.decode               |  6 +++
- hw/intc/sifive_plic.c    | 20 +++++++---
+ target/riscv/cpu.c                       |  9 ++++
- hw/riscv/boot.c          | 16 +++++++-
+ target/riscv/translate.c                 |  1 +
- hw/riscv/virt.c          | 83 ++++++++++++++++++++++++++++------------
+ target/riscv/vcrypto_helper.c            | 59 ++++++++++++++++++++++
- target/riscv/cpu.c       |  8 ++++
+ target/riscv/insn_trans/trans_rvvk.c.inc | 62 ++++++++++++++++++++++++
- target/riscv/kvm-stub.c  | 25 ++++++++++++
+ target/riscv/meson.build                 |  3 +-
- target/riscv/kvm.c       | 14 +++++++
+files changed, 146 insertions(+), 1 deletion(-)
- target/riscv/meson.build |  2 +-
+ create mode 100644 target/riscv/vcrypto_helper.c
-files changed, 164 insertions(+), 32 deletions(-)
+ create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc
- create mode 100644 target/riscv/kvm_riscv.h
- create mode 100644 target/riscv/kvm-stub.c
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
-diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
+--- a/target/riscv/cpu_cfg.h
-index XXXXXXX..XXXXXXX 100644
++++ b/target/riscv/cpu_cfg.h
---- a/include/hw/riscv/boot.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-+++ b/include/hw/riscv/boot.h
+     bool ext_zve32f;
-@@ -XXX,XX +XXX,XX @@ void riscv_rom_copy_firmware_info(MachineState *machine, hwaddr rom_base,
+     bool ext_zve64f;
-                                   hwaddr rom_size,
+     bool ext_zve64d;
-                                   uint32_t reset_vec_size,
++    bool ext_zvbc;
-                                   uint64_t kernel_entry);
+     bool ext_zmmul;
-+void riscv_setup_direct_kernel(hwaddr kernel_addr, hwaddr fdt_addr);
+     bool ext_zvfbfmin;
+     bool ext_zvfbfwma;
- #endif /* RISCV_BOOT_H */
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/helper.h
---- a/target/riscv/cpu.h
++++ b/target/riscv/helper.h
-+++ b/target/riscv/cpu.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
-@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
+ DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
-     /* Fields from here on are preserved across CPU reset. */
+ DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
-     QEMUTimer *timer; /* Internal timer */
++
-+
++/* Vector crypto functions */
-+    hwaddr kernel_addr;
++DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
-+    hwaddr fdt_addr;
++DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
  # *** Zvfbfwma Standard Extension ***
  vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
  vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
 +
 +# *** Zvbc vector crypto extension ***
 +vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
 +vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
 +vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
 +vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
      ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
      ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
 +    ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
      ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
      ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
      ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
 +    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
 +        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
 +        return;
 +    }
 +
      if (cpu->cfg.ext_zk) {
          cpu->cfg.ext_zkn = true;
          cpu->cfg.ext_zkr = true;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
      DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
 +    /* Vector cryptography extensions */
 +    DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 +
      DEFINE_PROP_END_OF_LIST(),
  };
- OBJECT_DECLARE_TYPE(RISCVCPU, RISCVCPUClass,
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
+index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
  #include "insn_trans/trans_rvzfa.c.inc"
  #include "insn_trans/trans_rvzfh.c.inc"
  #include "insn_trans/trans_rvk.c.inc"
 +#include "insn_trans/trans_rvvk.c.inc"
  #include "insn_trans/trans_privileged.c.inc"
  #include "insn_trans/trans_svinval.c.inc"
  #include "insn_trans/trans_rvbf16.c.inc"
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/target/riscv/kvm_riscv.h
++++ b/target/riscv/vcrypto_helper.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * QEMU KVM support -- RISC-V specific functions.
++ * RISC-V Vector Crypto Extension Helpers for QEMU.
 + *
-+ * Copyright (c) 2020 Huawei Technologies Co., Ltd
++ * Copyright (C) 2023 SiFive, Inc.
 + * Written by Codethink Ltd and SiFive.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#ifndef QEMU_KVM_RISCV_H
++#include "qemu/osdep.h"
-+#define QEMU_KVM_RISCV_H
++#include "qemu/host-utils.h"
-+
++#include "qemu/bitops.h"
-+void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
++#include "cpu.h"
-+
++#include "exec/memop.h"
-+#endif
++#include "exec/exec-all.h"
-diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
++#include "exec/helper-proto.h"
-index XXXXXXX..XXXXXXX 100644
++#include "internals.h"
---- a/hw/intc/sifive_plic.c
++#include "vector_internals.h"
-+++ b/hw/intc/sifive_plic.c
++
-@@ -XXX,XX +XXX,XX @@
++static uint64_t clmul64(uint64_t y, uint64_t x)
- #include "target/riscv/cpu.h"
++{
- #include "migration/vmstate.h"
++    uint64_t result = 0;
- #include "hw/irq.h"
++    for (int j = 63; j >= 0; j--) {
-+#include "sysemu/kvm.h"
++        if ((y >> j) & 1) {
++            result ^= (x << j);
  static bool addr_between(uint32_t addr, uint32_t base, uint32_t num)
  {
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
      uint32_t context_stride, uint32_t aperture_size)
  {
      DeviceState *dev = qdev_new(TYPE_SIFIVE_PLIC);
 -    int i;
 +    int i, j = 0;
 +    SiFivePLICState *plic;
      assert(enable_stride == (enable_stride & -enable_stride));
      assert(context_stride == (context_stride & -context_stride));
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
      sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +    plic = SIFIVE_PLIC(dev);
      for (i = 0; i < num_harts; i++) {
          CPUState *cpu = qemu_get_cpu(hartid_base + i);
 -        qdev_connect_gpio_out(dev, i,
 -                              qdev_get_gpio_in(DEVICE(cpu), IRQ_S_EXT));
 -        qdev_connect_gpio_out(dev, num_harts + i,
 -                              qdev_get_gpio_in(DEVICE(cpu), IRQ_M_EXT));
 +        if (plic->addr_config[j].mode == PLICMode_M) {
 +            j++;
 +            qdev_connect_gpio_out(dev, num_harts + i,
 +                                  qdev_get_gpio_in(DEVICE(cpu), IRQ_M_EXT));
 +        }
-+
++    }
-+        if (plic->addr_config[j].mode == PLICMode_S) {
++    return result;
-+            j++;
++}
-+            qdev_connect_gpio_out(dev, i,
++
-+                                  qdev_get_gpio_in(DEVICE(cpu), IRQ_S_EXT));
++static uint64_t clmulh64(uint64_t y, uint64_t x)
 +{
 +    uint64_t result = 0;
 +    for (int j = 63; j >= 1; j--) {
 +        if ((y >> j) & 1) {
 +            result ^= (x >> (64 - j));
 +        }
-     }
++    }
++    return result;
-     return dev;
++}
-diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
++
-index XXXXXXX..XXXXXXX 100644
++RVVCALL(OPIVV2, vclmul_vv, OP_UUU_D, H8, H8, H8, clmul64)
---- a/hw/riscv/boot.c
++GEN_VEXT_VV(vclmul_vv, 8)
-+++ b/hw/riscv/boot.c
++RVVCALL(OPIVX2, vclmul_vx, OP_UUU_D, H8, H8, clmul64)
-@@ -XXX,XX +XXX,XX @@
++GEN_VEXT_VX(vclmul_vx, 8)
- #include "elf.h"
++RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
- #include "sysemu/device_tree.h"
++GEN_VEXT_VV(vclmulh_vv, 8)
- #include "sysemu/qtest.h"
++RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
-+#include "sysemu/kvm.h"
++GEN_VEXT_VX(vclmulh_vx, 8)
+diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
  #include <libfdt.h>
@@ -XXX,XX +XXX,XX @@ char *riscv_plic_hart_config_string(int hart_count)
          CPUState *cs = qemu_get_cpu(i);
          CPURISCVState *env = &RISCV_CPU(cs)->env;
 -        if (riscv_has_ext(env, RVS)) {
 +        if (kvm_enabled()) {
 +            vals[i] = "S";
 +        } else if (riscv_has_ext(env, RVS)) {
              vals[i] = "MS";
          } else {
              vals[i] = "M";
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts
      return;
  }
 +
 +void riscv_setup_direct_kernel(hwaddr kernel_addr, hwaddr fdt_addr)
 +{
 +    CPUState *cs;
 +
 +    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
 +        RISCVCPU *riscv_cpu = RISCV_CPU(cs);
 +        riscv_cpu->env.kernel_addr = kernel_addr;
 +        riscv_cpu->env.fdt_addr = fdt_addr;
 +    }
 +}
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
  #include "chardev/char.h"
  #include "sysemu/device_tree.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/kvm.h"
  #include "hw/pci/pci.h"
  #include "hw/pci-host/gpex.h"
  #include "hw/display/ramfb.h"
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
          "sifive,plic-1.0.0", "riscv,plic0"
      };
 -    plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
 +    if (kvm_enabled()) {
 +        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 +    } else {
 +        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
 +    }
      for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 -        plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
 -        plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
 -        plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
 +        if (kvm_enabled()) {
 +            plic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 +            plic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 +        } else {
 +            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
 +            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
 +            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
 +            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
 +        }
      }
      plic_phandles[socket] = (*phandle)++;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
          create_fdt_socket_memory(s, memmap, socket);
 -        if (s->have_aclint) {
 -            create_fdt_socket_aclint(s, memmap, socket, intc_phandles);
 -        } else {
 -            create_fdt_socket_clint(s, memmap, socket, intc_phandles);
 +        if (!kvm_enabled()) {
 +            if (s->have_aclint) {
 +                create_fdt_socket_aclint(s, memmap, socket, intc_phandles);
 +            } else {
 +                create_fdt_socket_clint(s, memmap, socket, intc_phandles);
 +            }
          }
          create_fdt_socket_plic(s, memmap, socket, phandle,
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                                  hart_count, &error_abort);
          sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_abort);
 -        /* Per-socket CLINT */
 -        riscv_aclint_swi_create(
 -            memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
 -            base_hartid, hart_count, false);
 -        riscv_aclint_mtimer_create(
 -            memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size +
 -                RISCV_ACLINT_SWI_SIZE,
 -            RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
 -            RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
 -            RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
 -
 -        /* Per-socket ACLINT SSWI */
 -        if (s->have_aclint) {
 +        if (!kvm_enabled()) {
 +            /* Per-socket CLINT */
              riscv_aclint_swi_create(
 -                memmap[VIRT_ACLINT_SSWI].base +
 -                    i * memmap[VIRT_ACLINT_SSWI].size,
 -                base_hartid, hart_count, true);
 +                memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
 +                base_hartid, hart_count, false);
 +            riscv_aclint_mtimer_create(
 +                memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size +
 +                    RISCV_ACLINT_SWI_SIZE,
 +                RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
 +                RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
 +                RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
 +
 +            /* Per-socket ACLINT SSWI */
 +            if (s->have_aclint) {
 +                riscv_aclint_swi_create(
 +                    memmap[VIRT_ACLINT_SSWI].base +
 +                        i * memmap[VIRT_ACLINT_SSWI].size,
 +                    base_hartid, hart_count, true);
 +            }
          }
          /* Per-socket PLIC hart topology configuration string */
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
      memory_region_add_subregion(system_memory, memmap[VIRT_MROM].base,
                                  mask_rom);
 +    /*
 +     * Only direct boot kernel is currently supported for KVM VM,
 +     * so the "-bios" parameter is ignored and treated like "-bios none"
 +     * when KVM is enabled.
 +     */
 +    if (kvm_enabled()) {
 +        g_free(machine->firmware);
 +        machine->firmware = g_strdup("none");
 +    }
 +
      if (riscv_is_32bit(&s->soc[0])) {
          firmware_end_addr = riscv_find_and_load_firmware(machine,
                                      RISCV32_BIOS_BIN, start_addr, NULL);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                                virt_memmap[VIRT_MROM].size, kernel_entry,
                                fdt_load_addr, machine->fdt);
 +    /*
 +     * Only direct boot kernel is currently supported for KVM VM,
 +     * So here setup kernel start address and fdt address.
 +     * TODO:Support firmware loading and integrate to TCG start
 +     */
 +    if (kvm_enabled()) {
 +        riscv_setup_direct_kernel(kernel_entry, fdt_load_addr);
 +    }
 +
      /* SiFive Test MMIO device */
      sifive_test_create(memmap[VIRT_TEST].base);
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/qdev-properties.h"
  #include "migration/vmstate.h"
  #include "fpu/softfloat-helpers.h"
 +#include "sysemu/kvm.h"
 +#include "kvm_riscv.h"
  /* RISC-V CPU definitions */
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
      cs->exception_index = RISCV_EXCP_NONE;
      env->load_res = -1;
      set_default_nan_mode(1, &env->fp_status);
 +
 +#ifndef CONFIG_USER_ONLY
 +    if (kvm_enabled()) {
 +        kvm_riscv_reset_vcpu(cpu);
 +    }
 +#endif
  }
  static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
 diff --git a/target/riscv/kvm-stub.c b/target/riscv/kvm-stub.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/target/riscv/kvm-stub.c
++++ b/target/riscv/insn_trans/trans_rvvk.c.inc
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * QEMU KVM RISC-V specific function stubs
++ * RISC-V translation routines for the vector crypto extension.
 + *
-+ * Copyright (c) 2020 Huawei Technologies Co., Ltd
++ * Copyright (C) 2023 SiFive, Inc.
 + * Written by Codethink Ltd and SiFive.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
-+#include "qemu/osdep.h"
++
-+#include "cpu.h"
++/*
-+#include "kvm_riscv.h"
++ * Zvbc
-+
++ */
-+void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
++
-+{
++#define GEN_VV_MASKED_TRANS(NAME, CHECK)                     \
-+    abort();
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)   \
-+}
++    {                                                        \
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
++        if (CHECK(s, a)) {                                   \
-index XXXXXXX..XXXXXXX 100644
++            return opivv_trans(a->rd, a->rs1, a->rs2, a->vm, \
---- a/target/riscv/kvm.c
++                               gen_helper_##NAME, s);        \
-+++ b/target/riscv/kvm.c
++        }                                                    \
-@@ -XXX,XX +XXX,XX @@
++        return false;                                        \
- #include "hw/irq.h"
++    }
- #include "qemu/log.h"
++
- #include "hw/loader.h"
++static bool vclmul_vv_check(DisasContext *s, arg_rmrr *a)
-+#include "kvm_riscv.h"
++{
++    return opivv_check(s, a) &&
- static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
++           s->cfg_ptr->ext_zvbc == true &&
-                                  uint64_t idx)
++           s->sew == MO_64;
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
++}
-     return 0;
++
- }
++GEN_VV_MASKED_TRANS(vclmul_vv, vclmul_vv_check)
++GEN_VV_MASKED_TRANS(vclmulh_vv, vclmul_vv_check)
-+void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
++
-+{
++#define GEN_VX_MASKED_TRANS(NAME, CHECK)                     \
-+    CPURISCVState *env = &cpu->env;
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)   \
-+
++    {                                                        \
-+    if (!kvm_enabled()) {
++        if (CHECK(s, a)) {                                   \
-+        return;
++            return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, \
-+    }
++                               gen_helper_##NAME, s);        \
-+    env->pc = cpu->env.kernel_addr;
++        }                                                    \
-+    env->gpr[10] = kvm_arch_vcpu_id(CPU(cpu)); /* a0 */
++        return false;                                        \
-+    env->gpr[11] = cpu->env.fdt_addr;          /* a1 */
++    }
-+    env->satp = 0;
++
-+}
++static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
-+
++{
- bool kvm_arch_cpu_check_are_resettable(void)
++    return opivx_check(s, a) &&
- {
++           s->cfg_ptr->ext_zvbc == true &&
-     return true;
++           s->sew == MO_64;
 +}
 +
 +GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
 +GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
 diff --git a/target/riscv/meson.build b/target/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/meson.build
 +++ b/target/riscv/meson.build
 @@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
    'translate.c',
-   'm128_helper.c'
+   'm128_helper.c',
    'crypto_helper.c',
 -  'zce_helper.c'
 +  'zce_helper.c',
 +  'vcrypto_helper.c'
  ))
--riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'))
+ riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
-+riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
  riscv_softmmu_ss = ss.source_set()
  riscv_softmmu_ss.add(files(
 --
-.31.1
+.41.0

-[PULL 34/61] target/riscv: rvv-1.0: Add Zve32f support for narrowing type-convert insns
+[PULL v2 12/45] target/riscv: Move vector translation checks
-From: Frank Chang <frank.chang@sifive.com>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Vector narrowing conversion instructions are provided to and from all
+Move the checks out of `do_opiv{v,x,i}_gvec{,_shift}` functions
-supported integer EEWs for Zve32f extension.
+and into the corresponding macros. This enables the functions to be
 reused in proceeding commits without check duplication.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220118014522.13613-17-frank.chang@sifive.com
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-6-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvv.c.inc | 3 +++
+ target/riscv/insn_trans/trans_rvv.c.inc | 28 +++++++++++--------------
-file changed, 3 insertions(+)
+file changed, 12 insertions(+), 16 deletions(-)
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool opfxv_narrow_check(DisasContext *s, arg_rmr *a)
+@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
-     return opfv_narrow_check(s, a) &&
+               gen_helper_gvec_4_ptr *fn)
-            require_rvf(s) &&
+ {
-            (s->sew != MO_64) &&
+     TCGLabel *over = gen_new_label();
-+           require_zve32f(s) &&
+-    if (!opivv_check(s, a)) {
-            require_zve64f(s);
+-        return false;
 -    }
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          gen_helper_##NAME##_b, gen_helper_##NAME##_h,              \
          gen_helper_##NAME##_w, gen_helper_##NAME##_d,              \
      };                                                             \
 +    if (!opivv_check(s, a)) {                                      \
 +        return false;                                              \
 +    }                                                              \
      return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);   \
  }
-@@ -XXX,XX +XXX,XX @@ static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
+@@ -XXX,XX +XXX,XX @@ static inline bool
-     return opfv_narrow_check(s, a) &&
+ do_opivx_gvec(DisasContext *s, arg_rmrr *a, GVecGen2sFn *gvec_fn,
-            require_scale_rvf(s) &&
+               gen_helper_opivx *fn)
-            (s->sew != MO_8) &&
+ {
-+           require_scale_zve32f(s) &&
+-    if (!opivx_check(s, a)) {
-            require_scale_zve64f(s);
+-        return false;
 -    }
 -
      if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
          TCGv_i64 src1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          gen_helper_##NAME##_b, gen_helper_##NAME##_h,              \
          gen_helper_##NAME##_w, gen_helper_##NAME##_d,              \
      };                                                             \
 +    if (!opivx_check(s, a)) {                                      \
 +        return false;                                              \
 +    }                                                              \
      return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);   \
  }
-@@ -XXX,XX +XXX,XX @@ static bool opxfv_narrow_check(DisasContext *s, arg_rmr *a)
+@@ -XXX,XX +XXX,XX @@ static inline bool
-            vext_check_isa_ill(s) &&
+ do_opivi_gvec(DisasContext *s, arg_rmrr *a, GVecGen2iFn *gvec_fn,
-            /* OPFV narrowing instructions ignore vs1 check */
+               gen_helper_opivx *fn, imm_mode_t imm_mode)
-            vext_check_sd(s, a->rd, a->rs2, a->vm) &&
+ {
-+           require_scale_zve32f(s) &&
+-    if (!opivx_check(s, a)) {
-            require_scale_zve64f(s);
+-        return false;
 -    }
 -
      if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
          gvec_fn(s->sew, vreg_ofs(s, a->rd), vreg_ofs(s, a->rs2),
                  extract_imm(s, a->rs1, imm_mode), MAXSZ(s), MAXSZ(s));
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          gen_helper_##OPIVX##_b, gen_helper_##OPIVX##_h,            \
          gen_helper_##OPIVX##_w, gen_helper_##OPIVX##_d,            \
      };                                                             \
 +    if (!opivx_check(s, a)) {                                      \
 +        return false;                                              \
 +    }                                                              \
      return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF,                 \
                           fns[s->sew], IMM_MODE);                   \
  }
+@@ -XXX,XX +XXX,XX @@ static inline bool
+ do_opivx_gvec_shift(DisasContext *s, arg_rmrr *a, GVecGen2sFn32 *gvec_fn,
+                     gen_helper_opivx *fn)
+ {
+-    if (!opivx_check(s, a)) {
+-        return false;
+-    }
+-
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
+         TCGv_i32 src1 = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
+         gen_helper_##NAME##_b, gen_helper_##NAME##_h,                     \
+         gen_helper_##NAME##_w, gen_helper_##NAME##_d,                     \
+     };                                                                    \
+-                                                                          \
++    if (!opivx_check(s, a)) {                                             \
++        return false;                                                     \
++    }                                                                     \
+     return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);    \
+ }
 --
-.31.1
+.41.0

-[PULL 33/61] target/riscv: rvv-1.0: Add Zve32f support for widening type-convert insns
+[PULL v2 13/45] target/riscv: Refactor translation of vector-widening instruction
-From: Frank Chang <frank.chang@sifive.com>
+From: Dickon Hood <dickon.hood@codethink.co.uk>
-Vector widening conversion instructions are provided to and from all
+Zvbb (implemented in later commit) has a widening instruction, which
-supported integer EEWs for Zve32f extension.
+requires an extra check on the enabled extensions.  Refactor
 GEN_OPIVX_WIDEN_TRANS() to take a check function to avoid reimplementing
 it.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220118014522.13613-16-frank.chang@sifive.com
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-7-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvv.c.inc | 18 ++++++++++++++++++
+ target/riscv/insn_trans/trans_rvv.c.inc | 52 +++++++++++--------------
-file changed, 18 insertions(+)
+file changed, 23 insertions(+), 29 deletions(-)
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool require_zve32f(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ static bool opivx_widen_check(DisasContext *s, arg_rmrr *a)
-     return s->ext_zve32f ? s->sew <= MO_32 : true;
+            vext_check_ds(s, a->rd, a->rs2, a->vm);
  }
-+static bool require_scale_zve32f(DisasContext *s)
+-static bool do_opivx_widen(DisasContext *s, arg_rmrr *a,
-+{
+-                           gen_helper_opivx *fn)
-+    /* RVV + Zve32f = RVV. */
+-{
-+    if (has_ext(s, RVV)) {
+-    if (opivx_widen_check(s, a)) {
-+        return true;
+-        return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, fn, s);
-+    }
+-    }
-+
+-    return false;
-+    /* Zve32f doesn't support FP64. (Section 18.2) */
+-}
-+    return s->ext_zve64f ? s->sew <= MO_16 : true;
+-
-+}
+-#define GEN_OPIVX_WIDEN_TRANS(NAME) \
-+
+-static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
- static bool require_zve64f(DisasContext *s)
+-{                                                            \
- {
+-    static gen_helper_opivx * const fns[3] = {               \
-     /* RVV + Zve64f = RVV. */
+-        gen_helper_##NAME##_b,                               \
-@@ -XXX,XX +XXX,XX @@ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
+-        gen_helper_##NAME##_h,                               \
-            (s->sew != MO_8) &&
+-        gen_helper_##NAME##_w                                \
-            vext_check_isa_ill(s) &&
+-    };                                                       \
-            vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm) &&
+-    return do_opivx_widen(s, a, fns[s->sew]);                \
-+           require_scale_zve32f(s) &&
++#define GEN_OPIVX_WIDEN_TRANS(NAME, CHECK) \
-            require_scale_zve64f(s);
++static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
 +{                                                                         \
 +    if (CHECK(s, a)) {                                                    \
 +        static gen_helper_opivx * const fns[3] = {                        \
 +            gen_helper_##NAME##_b,                                        \
 +            gen_helper_##NAME##_h,                                        \
 +            gen_helper_##NAME##_w                                         \
 +        };                                                                \
 +        return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s); \
 +    }                                                                     \
 +    return false;                                                         \
  }
-@@ -XXX,XX +XXX,XX @@ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
+-GEN_OPIVX_WIDEN_TRANS(vwaddu_vx)
-            (s->sew != MO_8) &&
+-GEN_OPIVX_WIDEN_TRANS(vwadd_vx)
-            vext_check_isa_ill(s) &&
+-GEN_OPIVX_WIDEN_TRANS(vwsubu_vx)
-            vext_check_ds(s, a->rd, a->rs2, a->vm) &&
+-GEN_OPIVX_WIDEN_TRANS(vwsub_vx)
-+           require_scale_zve32f(s) &&
++GEN_OPIVX_WIDEN_TRANS(vwaddu_vx, opivx_widen_check)
-            require_scale_zve64f(s);
++GEN_OPIVX_WIDEN_TRANS(vwadd_vx, opivx_widen_check)
- }
++GEN_OPIVX_WIDEN_TRANS(vwsubu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwsub_vx, opivx_widen_check)
-@@ -XXX,XX +XXX,XX @@ static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
-            (s->sew != MO_8) &&
+ /* WIDEN OPIVV with WIDEN */
-            vext_check_isa_ill(s) &&
+ static bool opiwv_widen_check(DisasContext *s, arg_rmrr *a)
-            vext_check_dds(s, a->rd, a->rs1, a->rs2, a->vm) &&
+@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vrem_vx, opivx_check)
-+           require_scale_zve32f(s) &&
+ GEN_OPIVV_WIDEN_TRANS(vwmul_vv, opivv_widen_check)
-            require_scale_zve64f(s);
+ GEN_OPIVV_WIDEN_TRANS(vwmulu_vv, opivv_widen_check)
- }
+ GEN_OPIVV_WIDEN_TRANS(vwmulsu_vv, opivv_widen_check)
+-GEN_OPIVX_WIDEN_TRANS(vwmul_vx)
-@@ -XXX,XX +XXX,XX @@ static bool opfwf_widen_check(DisasContext *s, arg_rmrr *a)
+-GEN_OPIVX_WIDEN_TRANS(vwmulu_vx)
-            (s->sew != MO_8) &&
+-GEN_OPIVX_WIDEN_TRANS(vwmulsu_vx)
-            vext_check_isa_ill(s) &&
++GEN_OPIVX_WIDEN_TRANS(vwmul_vx, opivx_widen_check)
-            vext_check_dd(s, a->rd, a->rs2, a->vm) &&
++GEN_OPIVX_WIDEN_TRANS(vwmulu_vx, opivx_widen_check)
-+           require_scale_zve32f(s) &&
++GEN_OPIVX_WIDEN_TRANS(vwmulsu_vx, opivx_widen_check)
-            require_scale_zve64f(s);
- }
+ /* Vector Single-Width Integer Multiply-Add Instructions */
+ GEN_OPIVV_TRANS(vmacc_vv, opivv_check)
-@@ -XXX,XX +XXX,XX @@ static bool opxfv_widen_check(DisasContext *s, arg_rmr *a)
+@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vnmsub_vx, opivx_check)
- {
+ GEN_OPIVV_WIDEN_TRANS(vwmaccu_vv, opivv_widen_check)
-     return opfv_widen_check(s, a) &&
+ GEN_OPIVV_WIDEN_TRANS(vwmacc_vv, opivv_widen_check)
-            require_rvf(s) &&
+ GEN_OPIVV_WIDEN_TRANS(vwmaccsu_vv, opivv_widen_check)
-+           require_zve32f(s) &&
+-GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx)
-            require_zve64f(s);
+-GEN_OPIVX_WIDEN_TRANS(vwmacc_vx)
- }
+-GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx)
+-GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx)
-@@ -XXX,XX +XXX,XX @@ static bool opffv_widen_check(DisasContext *s, arg_rmr *a)
++GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx, opivx_widen_check)
-     return opfv_widen_check(s, a) &&
++GEN_OPIVX_WIDEN_TRANS(vwmacc_vx, opivx_widen_check)
-            require_scale_rvf(s) &&
++GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx, opivx_widen_check)
-            (s->sew != MO_8) &&
++GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx, opivx_widen_check)
-+           require_scale_zve32f(s) &&
-            require_scale_zve64f(s);
+ /* Vector Integer Merge and Move Instructions */
- }
+ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
@@ -XXX,XX +XXX,XX @@ static bool opfxv_widen_check(DisasContext *s, arg_rmr *a)
             vext_check_isa_ill(s) &&
             /* OPFV widening instructions ignore vs1 check */
             vext_check_ds(s, a->rd, a->rs2, a->vm) &&
 +           require_scale_zve32f(s) &&
             require_scale_zve64f(s);
  }
 --
-.31.1
+.41.0

-[PULL 54/61] target/riscv: Adjust vsetvl according to XLEN
+[PULL v2 14/45] target/riscv: Refactor some of the generic vector functionality
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+Move some macros out of `vector_helper` and into `vector_internals`.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+This ensures they can be used by both vector and vector-crypto helpers
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+(latter implemented in proceeding commits).
-Message-id: 20220120122050.41546-17-zhiwei_liu@c-sky.com
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-8-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h           | 5 +++++
+ target/riscv/vector_internals.h | 46 +++++++++++++++++++++++++++++++++
- target/riscv/vector_helper.c | 7 +++++--
+ target/riscv/vector_helper.c    | 42 ------------------------------
-files changed, 10 insertions(+), 2 deletions(-)
+files changed, 46 insertions(+), 42 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/vector_internals.h
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/vector_internals.h
-@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
- }
+ /* expand macro args before macro */
- #endif
+ #define RVVCALL(macro, ...)  macro(__VA_ARGS__)
-+static inline int riscv_cpu_xlen(CPURISCVState *env)
++/* (TD, T2, TX2) */
-+{
++#define OP_UU_B uint8_t, uint8_t, uint8_t
-+    return 16 << env->xl;
++#define OP_UU_H uint16_t, uint16_t, uint16_t
 +#define OP_UU_W uint32_t, uint32_t, uint32_t
 +#define OP_UU_D uint64_t, uint64_t, uint64_t
 +
  /* (TD, T1, T2, TX1, TX2) */
  #define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
  #define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
  #define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
  #define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 +#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 +static void do_##NAME(void *vd, void *vs2, int i)      \
 +{                                                      \
 +    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
 +    *((TD *)vd + HD(i)) = OP(s2);                      \
 +}
 +
- /*
++#define GEN_VEXT_V(NAME, ESZ)                          \
-  * Encode LMUL to lmul as follows:
++void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-  *     LMUL    vlmul    lmul
++                  CPURISCVState *env, uint32_t desc)   \
 +{                                                      \
 +    uint32_t vm = vext_vm(desc);                       \
 +    uint32_t vl = env->vl;                             \
 +    uint32_t total_elems =                             \
 +        vext_get_total_elems(env, desc, ESZ);          \
 +    uint32_t vta = vext_vta(desc);                     \
 +    uint32_t vma = vext_vma(desc);                     \
 +    uint32_t i;                                        \
 +                                                       \
 +    for (i = env->vstart; i < vl; i++) {               \
 +        if (!vm && !vext_elem_mask(v0, i)) {           \
 +            /* set masked-off elements to 1s */        \
 +            vext_set_elems_1s(vd, vma, i * ESZ,        \
 +                              (i + 1) * ESZ);          \
 +            continue;                                  \
 +        }                                              \
 +        do_##NAME(vd, vs2, i);                         \
 +    }                                                  \
 +    env->vstart = 0;                                   \
 +    /* set tail elements to 1s */                      \
 +    vext_set_elems_1s(vd, vta, vl * ESZ,               \
 +                      total_elems * ESZ);              \
 +}
 +
  /* operation of two vector elements */
  typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
                 do_##NAME, ESZ);                           \
  }
 +/* Three of the widening shortening macros: */
 +/* (TD, T1, T2, TX1, TX2) */
 +#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
 +#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
 +#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
 +
  #endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
-     uint64_t lmul = FIELD_EX64(s2, VTYPE, VLMUL);
+ #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
-     uint16_t sew = 8 << FIELD_EX64(s2, VTYPE, VSEW);
+ #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
-     uint8_t ediv = FIELD_EX64(s2, VTYPE, VEDIV);
+ #define OP_SUS_D int64_t, uint64_t, int64_t, uint64_t, int64_t
--    bool vill = FIELD_EX64(s2, VTYPE, VILL);
+-#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
--    target_ulong reserved = FIELD_EX64(s2, VTYPE, RESERVED);
+-#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
-+    int xlen = riscv_cpu_xlen(env);
+-#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
-+    bool vill = (s2 >> (xlen - 1)) & 0x1;
+ #define WOP_SSS_B int16_t, int8_t, int8_t, int16_t, int16_t
-+    target_ulong reserved = s2 &
+ #define WOP_SSS_H int32_t, int16_t, int16_t, int32_t, int32_t
-+                            MAKE_64BIT_MASK(R_VTYPE_RESERVED_SHIFT,
+ #define WOP_SSS_W int64_t, int32_t, int32_t, int64_t, int64_t
-+                                            xlen - 1 - R_VTYPE_RESERVED_SHIFT);
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_h, 4)
+ GEN_VEXT_VF(vfwnmsac_vf_w, 8)
-     if (lmul & 4) {
-         /* Fractional LMUL. */
+ /* Vector Floating-Point Square-Root Instruction */
 -/* (TD, T2, TX2) */
 -#define OP_UU_H uint16_t, uint16_t, uint16_t
 -#define OP_UU_W uint32_t, uint32_t, uint32_t
 -#define OP_UU_D uint64_t, uint64_t, uint64_t
 -
  #define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
  static void do_##NAME(void *vd, void *vs2, int i,      \
                        CPURISCVState *env)              \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
  GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
  /* Vector Floating-Point Classify Instruction */
 -#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 -static void do_##NAME(void *vd, void *vs2, int i)      \
 -{                                                      \
 -    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
 -    *((TD *)vd + HD(i)) = OP(s2);                      \
 -}
 -
 -#define GEN_VEXT_V(NAME, ESZ)                          \
 -void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
 -                  CPURISCVState *env, uint32_t desc)   \
 -{                                                      \
 -    uint32_t vm = vext_vm(desc);                       \
 -    uint32_t vl = env->vl;                             \
 -    uint32_t total_elems =                             \
 -        vext_get_total_elems(env, desc, ESZ);          \
 -    uint32_t vta = vext_vta(desc);                     \
 -    uint32_t vma = vext_vma(desc);                     \
 -    uint32_t i;                                        \
 -                                                       \
 -    for (i = env->vstart; i < vl; i++) {               \
 -        if (!vm && !vext_elem_mask(v0, i)) {           \
 -            /* set masked-off elements to 1s */        \
 -            vext_set_elems_1s(vd, vma, i * ESZ,        \
 -                              (i + 1) * ESZ);          \
 -            continue;                                  \
 -        }                                              \
 -        do_##NAME(vd, vs2, i);                         \
 -    }                                                  \
 -    env->vstart = 0;                                   \
 -    /* set tail elements to 1s */                      \
 -    vext_set_elems_1s(vd, vta, vl * ESZ,               \
 -                      total_elems * ESZ);              \
 -}
 -
  target_ulong fclass_h(uint64_t frs1)
  {
      float16 f = frs1;
 --
-.31.1
+.41.0

-[PULL 07/61] target/riscv: Implement kvm_arch_get_registers
+[PULL v2 15/45] target/riscv: Add Zvbb ISA extension support
-From: Yifei Jiang <jiangyifei@huawei.com>
+From: Dickon Hood <dickon.hood@codethink.co.uk>
-Get GPR CSR and FP registers from kvm by KVM_GET_ONE_REG ioctl.
+This commit adds support for the Zvbb vector-crypto extension, which
 consists of the following instructions:
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
+* vrol.[vv,vx]
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
+* vror.[vv,vx,vi]
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+* vbrev8.v
-Reviewed-by: Anup Patel <anup.patel@wdc.com>
+* vrev8.v
-Message-id: 20220112081329.1835-5-jiangyifei@huawei.com
+* vandn.[vv,vx]
 * vbrev.v
 * vclz.v
 * vctz.v
 * vcpop.v
 * vwsll.[vv,vx,vi]
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
 Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 [max.chou@sifive.com: Fix imm mode of vror.vi]
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvbb property]
 Message-ID: <20230711165917.2629866-9-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 112 ++++++++++++++++++++++++++++++++++++++++++++-
+ target/riscv/cpu_cfg.h                   |   1 +
-file changed, 111 insertions(+), 1 deletion(-)
+ target/riscv/helper.h                    |  62 +++++++++
  target/riscv/insn32.decode               |  20 +++
  target/riscv/cpu.c                       |  12 ++
  target/riscv/vcrypto_helper.c            | 138 +++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 164 +++++++++++++++++++++++
 files changed, 397 insertions(+)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/kvm.c
++++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     return id;
+     bool ext_zve32f;
- }
+     bool ext_zve64f;
+     bool ext_zve64d;
-+#define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
++    bool ext_zvbb;
-+                 KVM_REG_RISCV_CORE_REG(name))
+     bool ext_zvbc;
-+
+     bool ext_zmmul;
-+#define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
+     bool ext_zvfbfmin;
-+                 KVM_REG_RISCV_CSR_REG(name))
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
-+
+index XXXXXXX..XXXXXXX 100644
-+#define RISCV_FP_F_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_F, idx)
+--- a/target/riscv/helper.h
-+
++++ b/target/riscv/helper.h
-+#define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
-+
+ DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
-+#define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
+ DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
-+    do { \
+ DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
-+        int ret = kvm_get_one_reg(cs, RISCV_CSR_REG(env, csr), &reg); \
++
-+        if (ret) { \
++DEF_HELPER_6(vror_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
-+            return ret; \
++DEF_HELPER_6(vror_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
-+        } \
++DEF_HELPER_6(vror_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
-+    } while (0)
++DEF_HELPER_6(vror_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +
-+static int kvm_riscv_get_regs_core(CPUState *cs)
++DEF_HELPER_6(vror_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vrol_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vrol_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_5(vrev8_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_d, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vclz_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_d, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vwsll_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vandn_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
  %imm_u    12:s20                 !function=ex_shift_12
  %imm_bs   30:2                   !function=ex_shift_3
  %imm_rnum 20:4
 +%imm_z6   26:1 15:5
  # Argument sets:
  &empty
@@ -XXX,XX +XXX,XX @@
  @r_vm    ...... vm:1 ..... ..... ... ..... ....... &rmrr %rs2 %rs1 %rd
  @r_vm_1  ...... . ..... ..... ... ..... .......    &rmrr vm=1 %rs2 %rs1 %rd
  @r_vm_0  ...... . ..... ..... ... ..... .......    &rmrr vm=0 %rs2 %rs1 %rd
 +@r2_zimm6  ..... . vm:1 ..... ..... ... ..... .......  &rmrr %rs2 rs1=%imm_z6 %rd
  @r2_zimm11 . zimm:11  ..... ... ..... ....... %rs1 %rd
  @r2_zimm10 .. zimm:10  ..... ... ..... ....... %rs1 %rd
  @r2_s    .......   ..... ..... ... ..... ....... %rs2 %rs1
@@ -XXX,XX +XXX,XX @@ vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
  vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
  vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
  vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
 +
 +# *** Zvbb vector crypto extension ***
 +vrol_vv     010101 . ..... ..... 000 ..... 1010111 @r_vm
 +vrol_vx     010101 . ..... ..... 100 ..... 1010111 @r_vm
 +vror_vv     010100 . ..... ..... 000 ..... 1010111 @r_vm
 +vror_vx     010100 . ..... ..... 100 ..... 1010111 @r_vm
 +vror_vi     01010. . ..... ..... 011 ..... 1010111 @r2_zimm6
 +vbrev8_v    010010 . ..... 01000 010 ..... 1010111 @r2_vm
 +vrev8_v     010010 . ..... 01001 010 ..... 1010111 @r2_vm
 +vandn_vv    000001 . ..... ..... 000 ..... 1010111 @r_vm
 +vandn_vx    000001 . ..... ..... 100 ..... 1010111 @r_vm
 +vbrev_v     010010 . ..... 01010 010 ..... 1010111 @r2_vm
 +vclz_v      010010 . ..... 01100 010 ..... 1010111 @r2_vm
 +vctz_v      010010 . ..... 01101 010 ..... 1010111 @r2_vm
 +vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
 +vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
 +vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
 +vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
      ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
      ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
 +    ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
      ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
      ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
      ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
 +    /*
 +     * In principle Zve*x would also suffice here, were they supported
 +     * in qemu
 +     */
 +    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
 +        error_setg(errp,
 +                   "Vector crypto extensions require V or Zve* extensions");
 +        return;
 +    }
 +
      if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
          error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
      /* Vector cryptography extensions */
 +    DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
      DEFINE_PROP_END_OF_LIST(),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qemu/host-utils.h"
  #include "qemu/bitops.h"
 +#include "qemu/bswap.h"
  #include "cpu.h"
  #include "exec/memop.h"
  #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
  GEN_VEXT_VV(vclmulh_vv, 8)
  RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
  GEN_VEXT_VX(vclmulh_vx, 8)
 +
 +RVVCALL(OPIVV2, vror_vv_b, OP_UUU_B, H1, H1, H1, ror8)
 +RVVCALL(OPIVV2, vror_vv_h, OP_UUU_H, H2, H2, H2, ror16)
 +RVVCALL(OPIVV2, vror_vv_w, OP_UUU_W, H4, H4, H4, ror32)
 +RVVCALL(OPIVV2, vror_vv_d, OP_UUU_D, H8, H8, H8, ror64)
 +GEN_VEXT_VV(vror_vv_b, 1)
 +GEN_VEXT_VV(vror_vv_h, 2)
 +GEN_VEXT_VV(vror_vv_w, 4)
 +GEN_VEXT_VV(vror_vv_d, 8)
 +
 +RVVCALL(OPIVX2, vror_vx_b, OP_UUU_B, H1, H1, ror8)
 +RVVCALL(OPIVX2, vror_vx_h, OP_UUU_H, H2, H2, ror16)
 +RVVCALL(OPIVX2, vror_vx_w, OP_UUU_W, H4, H4, ror32)
 +RVVCALL(OPIVX2, vror_vx_d, OP_UUU_D, H8, H8, ror64)
 +GEN_VEXT_VX(vror_vx_b, 1)
 +GEN_VEXT_VX(vror_vx_h, 2)
 +GEN_VEXT_VX(vror_vx_w, 4)
 +GEN_VEXT_VX(vror_vx_d, 8)
 +
 +RVVCALL(OPIVV2, vrol_vv_b, OP_UUU_B, H1, H1, H1, rol8)
 +RVVCALL(OPIVV2, vrol_vv_h, OP_UUU_H, H2, H2, H2, rol16)
 +RVVCALL(OPIVV2, vrol_vv_w, OP_UUU_W, H4, H4, H4, rol32)
 +RVVCALL(OPIVV2, vrol_vv_d, OP_UUU_D, H8, H8, H8, rol64)
 +GEN_VEXT_VV(vrol_vv_b, 1)
 +GEN_VEXT_VV(vrol_vv_h, 2)
 +GEN_VEXT_VV(vrol_vv_w, 4)
 +GEN_VEXT_VV(vrol_vv_d, 8)
 +
 +RVVCALL(OPIVX2, vrol_vx_b, OP_UUU_B, H1, H1, rol8)
 +RVVCALL(OPIVX2, vrol_vx_h, OP_UUU_H, H2, H2, rol16)
 +RVVCALL(OPIVX2, vrol_vx_w, OP_UUU_W, H4, H4, rol32)
 +RVVCALL(OPIVX2, vrol_vx_d, OP_UUU_D, H8, H8, rol64)
 +GEN_VEXT_VX(vrol_vx_b, 1)
 +GEN_VEXT_VX(vrol_vx_h, 2)
 +GEN_VEXT_VX(vrol_vx_w, 4)
 +GEN_VEXT_VX(vrol_vx_d, 8)
 +
 +static uint64_t brev8(uint64_t val)
 +{
-+    int ret = 0;
++    val = ((val & 0x5555555555555555ull) << 1) |
-+    int i;
++          ((val & 0xAAAAAAAAAAAAAAAAull) >> 1);
-+    target_ulong reg;
++    val = ((val & 0x3333333333333333ull) << 2) |
-+    CPURISCVState *env = &RISCV_CPU(cs)->env;
++          ((val & 0xCCCCCCCCCCCCCCCCull) >> 2);
-+
++    val = ((val & 0x0F0F0F0F0F0F0F0Full) << 4) |
-+    ret = kvm_get_one_reg(cs, RISCV_CORE_REG(env, regs.pc), &reg);
++          ((val & 0xF0F0F0F0F0F0F0F0ull) >> 4);
-+    if (ret) {
++
-+        return ret;
++    return val;
 +    }
 +    env->pc = reg;
 +
 +    for (i = 1; i < 32; i++) {
 +        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
 +        ret = kvm_get_one_reg(cs, id, &reg);
 +        if (ret) {
 +            return ret;
 +        }
 +        env->gpr[i] = reg;
 +    }
 +
 +    return ret;
 +}
 +
-+static int kvm_riscv_get_regs_csr(CPUState *cs)
++RVVCALL(OPIVV1, vbrev8_v_b, OP_UU_B, H1, H1, brev8)
 +RVVCALL(OPIVV1, vbrev8_v_h, OP_UU_H, H2, H2, brev8)
 +RVVCALL(OPIVV1, vbrev8_v_w, OP_UU_W, H4, H4, brev8)
 +RVVCALL(OPIVV1, vbrev8_v_d, OP_UU_D, H8, H8, brev8)
 +GEN_VEXT_V(vbrev8_v_b, 1)
 +GEN_VEXT_V(vbrev8_v_h, 2)
 +GEN_VEXT_V(vbrev8_v_w, 4)
 +GEN_VEXT_V(vbrev8_v_d, 8)
 +
 +#define DO_IDENTITY(a) (a)
 +RVVCALL(OPIVV1, vrev8_v_b, OP_UU_B, H1, H1, DO_IDENTITY)
 +RVVCALL(OPIVV1, vrev8_v_h, OP_UU_H, H2, H2, bswap16)
 +RVVCALL(OPIVV1, vrev8_v_w, OP_UU_W, H4, H4, bswap32)
 +RVVCALL(OPIVV1, vrev8_v_d, OP_UU_D, H8, H8, bswap64)
 +GEN_VEXT_V(vrev8_v_b, 1)
 +GEN_VEXT_V(vrev8_v_h, 2)
 +GEN_VEXT_V(vrev8_v_w, 4)
 +GEN_VEXT_V(vrev8_v_d, 8)
 +
 +#define DO_ANDN(a, b) ((a) & ~(b))
 +RVVCALL(OPIVV2, vandn_vv_b, OP_UUU_B, H1, H1, H1, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_h, OP_UUU_H, H2, H2, H2, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_w, OP_UUU_W, H4, H4, H4, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_d, OP_UUU_D, H8, H8, H8, DO_ANDN)
 +GEN_VEXT_VV(vandn_vv_b, 1)
 +GEN_VEXT_VV(vandn_vv_h, 2)
 +GEN_VEXT_VV(vandn_vv_w, 4)
 +GEN_VEXT_VV(vandn_vv_d, 8)
 +
 +RVVCALL(OPIVX2, vandn_vx_b, OP_UUU_B, H1, H1, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_h, OP_UUU_H, H2, H2, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_w, OP_UUU_W, H4, H4, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_d, OP_UUU_D, H8, H8, DO_ANDN)
 +GEN_VEXT_VX(vandn_vx_b, 1)
 +GEN_VEXT_VX(vandn_vx_h, 2)
 +GEN_VEXT_VX(vandn_vx_w, 4)
 +GEN_VEXT_VX(vandn_vx_d, 8)
 +
 +RVVCALL(OPIVV1, vbrev_v_b, OP_UU_B, H1, H1, revbit8)
 +RVVCALL(OPIVV1, vbrev_v_h, OP_UU_H, H2, H2, revbit16)
 +RVVCALL(OPIVV1, vbrev_v_w, OP_UU_W, H4, H4, revbit32)
 +RVVCALL(OPIVV1, vbrev_v_d, OP_UU_D, H8, H8, revbit64)
 +GEN_VEXT_V(vbrev_v_b, 1)
 +GEN_VEXT_V(vbrev_v_h, 2)
 +GEN_VEXT_V(vbrev_v_w, 4)
 +GEN_VEXT_V(vbrev_v_d, 8)
 +
 +RVVCALL(OPIVV1, vclz_v_b, OP_UU_B, H1, H1, clz8)
 +RVVCALL(OPIVV1, vclz_v_h, OP_UU_H, H2, H2, clz16)
 +RVVCALL(OPIVV1, vclz_v_w, OP_UU_W, H4, H4, clz32)
 +RVVCALL(OPIVV1, vclz_v_d, OP_UU_D, H8, H8, clz64)
 +GEN_VEXT_V(vclz_v_b, 1)
 +GEN_VEXT_V(vclz_v_h, 2)
 +GEN_VEXT_V(vclz_v_w, 4)
 +GEN_VEXT_V(vclz_v_d, 8)
 +
 +RVVCALL(OPIVV1, vctz_v_b, OP_UU_B, H1, H1, ctz8)
 +RVVCALL(OPIVV1, vctz_v_h, OP_UU_H, H2, H2, ctz16)
 +RVVCALL(OPIVV1, vctz_v_w, OP_UU_W, H4, H4, ctz32)
 +RVVCALL(OPIVV1, vctz_v_d, OP_UU_D, H8, H8, ctz64)
 +GEN_VEXT_V(vctz_v_b, 1)
 +GEN_VEXT_V(vctz_v_h, 2)
 +GEN_VEXT_V(vctz_v_w, 4)
 +GEN_VEXT_V(vctz_v_d, 8)
 +
 +RVVCALL(OPIVV1, vcpop_v_b, OP_UU_B, H1, H1, ctpop8)
 +RVVCALL(OPIVV1, vcpop_v_h, OP_UU_H, H2, H2, ctpop16)
 +RVVCALL(OPIVV1, vcpop_v_w, OP_UU_W, H4, H4, ctpop32)
 +RVVCALL(OPIVV1, vcpop_v_d, OP_UU_D, H8, H8, ctpop64)
 +GEN_VEXT_V(vcpop_v_b, 1)
 +GEN_VEXT_V(vcpop_v_h, 2)
 +GEN_VEXT_V(vcpop_v_w, 4)
 +GEN_VEXT_V(vcpop_v_d, 8)
 +
 +#define DO_SLL(N, M) (N << (M & (sizeof(N) * 8 - 1)))
 +RVVCALL(OPIVV2, vwsll_vv_b, WOP_UUU_B, H2, H1, H1, DO_SLL)
 +RVVCALL(OPIVV2, vwsll_vv_h, WOP_UUU_H, H4, H2, H2, DO_SLL)
 +RVVCALL(OPIVV2, vwsll_vv_w, WOP_UUU_W, H8, H4, H4, DO_SLL)
 +GEN_VEXT_VV(vwsll_vv_b, 2)
 +GEN_VEXT_VV(vwsll_vv_h, 4)
 +GEN_VEXT_VV(vwsll_vv_w, 8)
 +
 +RVVCALL(OPIVX2, vwsll_vx_b, WOP_UUU_B, H2, H1, DO_SLL)
 +RVVCALL(OPIVX2, vwsll_vx_h, WOP_UUU_H, H4, H2, DO_SLL)
 +RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
 +GEN_VEXT_VX(vwsll_vx_b, 2)
 +GEN_VEXT_VX(vwsll_vx_h, 4)
 +GEN_VEXT_VX(vwsll_vx_w, 8)
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
  GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
  GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
 +
 +/*
 + * Zvbb
 + */
 +
 +#define GEN_OPIVI_GVEC_TRANS_CHECK(NAME, IMM_MODE, OPIVX, SUF, CHECK)   \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)              \
 +    {                                                                   \
 +        if (CHECK(s, a)) {                                              \
 +            static gen_helper_opivx *const fns[4] = {                   \
 +                gen_helper_##OPIVX##_b,                                 \
 +                gen_helper_##OPIVX##_h,                                 \
 +                gen_helper_##OPIVX##_w,                                 \
 +                gen_helper_##OPIVX##_d,                                 \
 +            };                                                          \
 +            return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew], \
 +                                 IMM_MODE);                             \
 +        }                                                               \
 +        return false;                                                   \
 +    }
 +
 +#define GEN_OPIVV_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
 +    {                                                                    \
 +        if (CHECK(s, a)) {                                               \
 +            static gen_helper_gvec_4_ptr *const fns[4] = {               \
 +                gen_helper_##NAME##_b,                                   \
 +                gen_helper_##NAME##_h,                                   \
 +                gen_helper_##NAME##_w,                                   \
 +                gen_helper_##NAME##_d,                                   \
 +            };                                                           \
 +            return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
 +        }                                                                \
 +        return false;                                                    \
 +    }
 +
 +#define GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(NAME, SUF, CHECK)       \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
 +    {                                                            \
 +        if (CHECK(s, a)) {                                       \
 +            static gen_helper_opivx *const fns[4] = {            \
 +                gen_helper_##NAME##_b,                           \
 +                gen_helper_##NAME##_h,                           \
 +                gen_helper_##NAME##_w,                           \
 +                gen_helper_##NAME##_d,                           \
 +            };                                                   \
 +            return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, \
 +                                       fns[s->sew]);             \
 +        }                                                        \
 +        return false;                                            \
 +    }
 +
 +static bool zvbb_vv_check(DisasContext *s, arg_rmrr *a)
 +{
-+    int ret = 0;
++    return opivv_check(s, a) && s->cfg_ptr->ext_zvbb == true;
 +    CPURISCVState *env = &RISCV_CPU(cs)->env;
 +
 +    KVM_RISCV_GET_CSR(cs, env, sstatus, env->mstatus);
 +    KVM_RISCV_GET_CSR(cs, env, sie, env->mie);
 +    KVM_RISCV_GET_CSR(cs, env, stvec, env->stvec);
 +    KVM_RISCV_GET_CSR(cs, env, sscratch, env->sscratch);
 +    KVM_RISCV_GET_CSR(cs, env, sepc, env->sepc);
 +    KVM_RISCV_GET_CSR(cs, env, scause, env->scause);
 +    KVM_RISCV_GET_CSR(cs, env, stval, env->stval);
 +    KVM_RISCV_GET_CSR(cs, env, sip, env->mip);
 +    KVM_RISCV_GET_CSR(cs, env, satp, env->satp);
 +    return ret;
 +}
 +
-+static int kvm_riscv_get_regs_fp(CPUState *cs)
++static bool zvbb_vx_check(DisasContext *s, arg_rmrr *a)
 +{
-+    int ret = 0;
++    return opivx_check(s, a) && s->cfg_ptr->ext_zvbb == true;
 +    int i;
 +    CPURISCVState *env = &RISCV_CPU(cs)->env;
 +
 +    if (riscv_has_ext(env, RVD)) {
 +        uint64_t reg;
 +        for (i = 0; i < 32; i++) {
 +            ret = kvm_get_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
 +            if (ret) {
 +                return ret;
 +            }
 +            env->fpr[i] = reg;
 +        }
 +        return ret;
 +    }
 +
 +    if (riscv_has_ext(env, RVF)) {
 +        uint32_t reg;
 +        for (i = 0; i < 32; i++) {
 +            ret = kvm_get_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
 +            if (ret) {
 +                return ret;
 +            }
 +            env->fpr[i] = reg;
 +        }
 +        return ret;
 +    }
 +
 +    return ret;
 +}
 +
- const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
++/* vrol.v[vx] */
-     KVM_CAP_LAST_INFO
++GEN_OPIVV_GVEC_TRANS_CHECK(vrol_vv, rotlv, zvbb_vv_check)
- };
++GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vrol_vx, rotls, zvbb_vx_check)
++
- int kvm_arch_get_registers(CPUState *cs)
++/* vror.v[vxi] */
- {
++GEN_OPIVV_GVEC_TRANS_CHECK(vror_vv, rotrv, zvbb_vv_check)
--    return 0;
++GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vror_vx, rotrs, zvbb_vx_check)
-+    int ret = 0;
++GEN_OPIVI_GVEC_TRANS_CHECK(vror_vi, IMM_TRUNC_SEW, vror_vx, rotri, zvbb_vx_check)
 +
-+    ret = kvm_riscv_get_regs_core(cs);
++#define GEN_OPIVX_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
-+    if (ret) {
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
-+        return ret;
++    {                                                                    \
-+    }
++        if (CHECK(s, a)) {                                               \
-+
++            static gen_helper_opivx *const fns[4] = {                    \
-+    ret = kvm_riscv_get_regs_csr(cs);
++                gen_helper_##NAME##_b,                                   \
-+    if (ret) {
++                gen_helper_##NAME##_h,                                   \
-+        return ret;
++                gen_helper_##NAME##_w,                                   \
-+    }
++                gen_helper_##NAME##_d,                                   \
-+
++            };                                                           \
-+    ret = kvm_riscv_get_regs_fp(cs);
++            return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
-+    if (ret) {
++        }                                                                \
-+        return ret;
++        return false;                                                    \
 +    }
 +
-+    return ret;
++/* vandn.v[vx] */
- }
++GEN_OPIVV_GVEC_TRANS_CHECK(vandn_vv, andc, zvbb_vv_check)
++GEN_OPIVX_GVEC_TRANS_CHECK(vandn_vx, andcs, zvbb_vx_check)
- int kvm_arch_put_registers(CPUState *cs, int level)
++
 +#define GEN_OPIV_TRANS(NAME, CHECK)                                        \
 +    static bool trans_##NAME(DisasContext *s, arg_rmr *a)                  \
 +    {                                                                      \
 +        if (CHECK(s, a)) {                                                 \
 +            uint32_t data = 0;                                             \
 +            static gen_helper_gvec_3_ptr *const fns[4] = {                 \
 +                gen_helper_##NAME##_b,                                     \
 +                gen_helper_##NAME##_h,                                     \
 +                gen_helper_##NAME##_w,                                     \
 +                gen_helper_##NAME##_d,                                     \
 +            };                                                             \
 +            TCGLabel *over = gen_new_label();                              \
 +            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);     \
 +                                                                           \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                     \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                 \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                   \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s); \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                   \
 +            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),         \
 +                               vreg_ofs(s, a->rs2), cpu_env,               \
 +                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, \
 +                               data, fns[s->sew]);                         \
 +            mark_vs_dirty(s);                                              \
 +            gen_set_label(over);                                           \
 +            return true;                                                   \
 +        }                                                                  \
 +        return false;                                                      \
 +    }
 +
 +static bool zvbb_opiv_check(DisasContext *s, arg_rmr *a)
 +{
 +    return s->cfg_ptr->ext_zvbb == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           vext_check_ss(s, a->rd, a->rs2, a->vm);
 +}
 +
 +GEN_OPIV_TRANS(vbrev8_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vrev8_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vbrev_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vclz_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vctz_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vcpop_v, zvbb_opiv_check)
 +
 +static bool vwsll_vv_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return s->cfg_ptr->ext_zvbb && opivv_widen_check(s, a);
 +}
 +
 +static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return s->cfg_ptr->ext_zvbb && opivx_widen_check(s, a);
 +}
 +
 +/* OPIVI without GVEC IR */
 +#define GEN_OPIVI_WIDEN_TRANS(NAME, IMM_MODE, OPIVX, CHECK)                  \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
 +    {                                                                        \
 +        if (CHECK(s, a)) {                                                   \
 +            static gen_helper_opivx *const fns[3] = {                        \
 +                gen_helper_##OPIVX##_b,                                      \
 +                gen_helper_##OPIVX##_h,                                      \
 +                gen_helper_##OPIVX##_w,                                      \
 +            };                                                               \
 +            return opivi_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s, \
 +                               IMM_MODE);                                    \
 +        }                                                                    \
 +        return false;                                                        \
 +    }
 +
 +GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
 +GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
 +GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
 --
-.31.1
+.41.0

-[PULL 12/61] target/riscv: Add host cpu type
+[PULL v2 16/45] target/riscv: Add Zvkned ISA extension support
-From: Yifei Jiang <jiangyifei@huawei.com>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-'host' type cpu is set isa to RV32 or RV64 simply, more isa info
+This commit adds support for the Zvkned vector-crypto extension, which
-will obtain from KVM in kvm_arch_init_vcpu()
+consists of the following instructions:
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
+* vaesef.[vv,vs]
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
+* vaesdf.[vv,vs]
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+* vaesdm.[vv,vs]
-Reviewed-by: Anup Patel <anup.patel@wdc.com>
+* vaesz.vs
-Message-id: 20220112081329.1835-10-jiangyifei@huawei.com
+* vaesem.[vv,vs]
 * vaeskf1.vi
 * vaeskf2.vi
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Imported aes-round.h and exposed x-zvkned
 property]
 [max.chou@sifive.com: Fixed endian issues and replaced the vstart & vl
 egs checking by helper function]
 [max.chou@sifive.com: Replaced bswap32 calls in aes key expanding]
 Message-ID: <20230711165917.2629866-10-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h |  1 +
+ target/riscv/cpu_cfg.h                   |   1 +
- target/riscv/cpu.c | 15 +++++++++++++++
+ target/riscv/helper.h                    |  14 ++
-files changed, 16 insertions(+)
+ target/riscv/insn32.decode               |  14 ++
  target/riscv/cpu.c                       |   4 +-
  target/riscv/vcrypto_helper.c            | 202 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 147 +++++++++++++++++
 files changed, 381 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zve64d;
      bool ext_zvbb;
      bool ext_zvbc;
 +    bool ext_zvkned;
      bool ext_zmmul;
      bool ext_zvfbfmin;
      bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
  DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
  DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
  DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_2(egs_check, void, i32, env)
 +
 +DEF_HELPER_4(vaesef_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesef_vs, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesdf_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesdf_vs, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesem_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesem_vs, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesdm_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
 +DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
 +DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
 @@ -XXX,XX +XXX,XX @@
- #define TYPE_RISCV_CPU_SIFIVE_E51       RISCV_CPU_TYPE_NAME("sifive-e51")
+ @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
- #define TYPE_RISCV_CPU_SIFIVE_U34       RISCV_CPU_TYPE_NAME("sifive-u34")
+ @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
- #define TYPE_RISCV_CPU_SIFIVE_U54       RISCV_CPU_TYPE_NAME("sifive-u54")
+ @r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
-+#define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
++@r2_vm_1 ...... . ..... ..... ... ..... ....... &rmr vm=1 %rs2 %rd
+ @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
- #if defined(TARGET_RISCV32)
+ @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
- # define TYPE_RISCV_CPU_BASE            TYPE_RISCV_CPU_BASE32
+ @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
@@ -XXX,XX +XXX,XX @@ vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
  vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
  vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
  vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
 +
 +# *** Zvkned vector crypto extension ***
 +vaesef_vv   101000 1 ..... 00011 010 ..... 1110111 @r2_vm_1
 +vaesef_vs   101001 1 ..... 00011 010 ..... 1110111 @r2_vm_1
 +vaesdf_vv   101000 1 ..... 00001 010 ..... 1110111 @r2_vm_1
 +vaesdf_vs   101001 1 ..... 00001 010 ..... 1110111 @r2_vm_1
 +vaesem_vv   101000 1 ..... 00010 010 ..... 1110111 @r2_vm_1
 +vaesem_vs   101001 1 ..... 00010 010 ..... 1110111 @r2_vm_1
 +vaesdm_vv   101000 1 ..... 00000 010 ..... 1110111 @r2_vm_1
 +vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
 +vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
 +vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void rv32_imafcu_nommu_cpu_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
- }
+     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
- #endif
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
+     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
-+#if defined(CONFIG_KVM)
++    ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
-+static void riscv_host_cpu_init(Object *obj)
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-+{
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
-+    CPURISCVState *env = &RISCV_CPU(obj)->env;
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-+#if defined(TARGET_RISCV32)
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-+    set_misa(env, MXL_RV32, 0);
+      * In principle Zve*x would also suffice here, were they supported
-+#elif defined(TARGET_RISCV64)
+      * in qemu
-+    set_misa(env, MXL_RV64, 0);
+      */
-+#endif
+-    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
-+}
++    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
-+#endif
+         error_setg(errp,
-+
+                    "Vector crypto extensions require V or Zve* extensions");
- static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
+         return;
- {
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     ObjectClass *oc;
+     /* Vector cryptography extensions */
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
+     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
-         .class_init = riscv_cpu_class_init,
+     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
-     },
++    DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
-     DEFINE_CPU(TYPE_RISCV_CPU_ANY,              riscv_any_cpu_init),
-+#if defined(CONFIG_KVM)
+     DEFINE_PROP_END_OF_LIST(),
-+    DEFINE_CPU(TYPE_RISCV_CPU_HOST,             riscv_host_cpu_init),
+ };
-+#endif
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
- #if defined(TARGET_RISCV32)
+index XXXXXXX..XXXXXXX 100644
-     DEFINE_CPU(TYPE_RISCV_CPU_BASE32,           rv32_base_cpu_init),
+--- a/target/riscv/vcrypto_helper.c
-     DEFINE_CPU(TYPE_RISCV_CPU_IBEX,             rv32_ibex_cpu_init),
++++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/bitops.h"
  #include "qemu/bswap.h"
  #include "cpu.h"
 +#include "crypto/aes.h"
 +#include "crypto/aes-round.h"
  #include "exec/memop.h"
  #include "exec/exec-all.h"
  #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
  GEN_VEXT_VX(vwsll_vx_b, 2)
  GEN_VEXT_VX(vwsll_vx_h, 4)
  GEN_VEXT_VX(vwsll_vx_w, 8)
 +
 +void HELPER(egs_check)(uint32_t egs, CPURISCVState *env)
 +{
 +    uint32_t vl = env->vl;
 +    uint32_t vstart = env->vstart;
 +
 +    if (vl % egs != 0 || vstart % egs != 0) {
 +        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
 +    }
 +}
 +
 +static inline void xor_round_key(AESState *round_state, AESState *round_key)
 +{
 +    round_state->v = round_state->v ^ round_key->v;
 +}
 +
 +#define GEN_ZVKNED_HELPER_VV(NAME, ...)                                   \
 +    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
 +                      uint32_t desc)                                      \
 +    {                                                                     \
 +        uint32_t vl = env->vl;                                            \
 +        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
 +        uint32_t vta = vext_vta(desc);                                    \
 +                                                                          \
 +        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
 +            AESState round_key;                                           \
 +            round_key.d[0] = *((uint64_t *)vs2 + H8(i * 2 + 0));          \
 +            round_key.d[1] = *((uint64_t *)vs2 + H8(i * 2 + 1));          \
 +            AESState round_state;                                         \
 +            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
 +            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
 +            __VA_ARGS__;                                                  \
 +            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
 +            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
 +        }                                                                 \
 +        env->vstart = 0;                                                  \
 +        /* set tail elements to 1s */                                     \
 +        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
 +    }
 +
 +#define GEN_ZVKNED_HELPER_VS(NAME, ...)                                   \
 +    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
 +                      uint32_t desc)                                      \
 +    {                                                                     \
 +        uint32_t vl = env->vl;                                            \
 +        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
 +        uint32_t vta = vext_vta(desc);                                    \
 +                                                                          \
 +        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
 +            AESState round_key;                                           \
 +            round_key.d[0] = *((uint64_t *)vs2 + H8(0));                  \
 +            round_key.d[1] = *((uint64_t *)vs2 + H8(1));                  \
 +            AESState round_state;                                         \
 +            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
 +            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
 +            __VA_ARGS__;                                                  \
 +            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
 +            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
 +        }                                                                 \
 +        env->vstart = 0;                                                  \
 +        /* set tail elements to 1s */                                     \
 +        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
 +    }
 +
 +GEN_ZVKNED_HELPER_VV(vaesef_vv, aesenc_SB_SR_AK(&round_state,
 +                                                &round_state,
 +                                                &round_key,
 +                                                false);)
 +GEN_ZVKNED_HELPER_VS(vaesef_vs, aesenc_SB_SR_AK(&round_state,
 +                                                &round_state,
 +                                                &round_key,
 +                                                false);)
 +GEN_ZVKNED_HELPER_VV(vaesdf_vv, aesdec_ISB_ISR_AK(&round_state,
 +                                                  &round_state,
 +                                                  &round_key,
 +                                                  false);)
 +GEN_ZVKNED_HELPER_VS(vaesdf_vs, aesdec_ISB_ISR_AK(&round_state,
 +                                                  &round_state,
 +                                                  &round_key,
 +                                                  false);)
 +GEN_ZVKNED_HELPER_VV(vaesem_vv, aesenc_SB_SR_MC_AK(&round_state,
 +                                                   &round_state,
 +                                                   &round_key,
 +                                                   false);)
 +GEN_ZVKNED_HELPER_VS(vaesem_vs, aesenc_SB_SR_MC_AK(&round_state,
 +                                                   &round_state,
 +                                                   &round_key,
 +                                                   false);)
 +GEN_ZVKNED_HELPER_VV(vaesdm_vv, aesdec_ISB_ISR_AK_IMC(&round_state,
 +                                                      &round_state,
 +                                                      &round_key,
 +                                                      false);)
 +GEN_ZVKNED_HELPER_VS(vaesdm_vs, aesdec_ISB_ISR_AK_IMC(&round_state,
 +                                                      &round_state,
 +                                                      &round_key,
 +                                                      false);)
 +GEN_ZVKNED_HELPER_VS(vaesz_vs, xor_round_key(&round_state, &round_key);)
 +
 +void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
 +                        CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +    uint32_t vl = env->vl;
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +    uint32_t vta = vext_vta(desc);
 +
 +    uimm &= 0b1111;
 +    if (uimm > 10 || uimm == 0) {
 +        uimm ^= 0b1000;
 +    }
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint32_t rk[8], tmp;
 +        static const uint32_t rcon[] = {
 +            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
 +            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
 +        };
 +
 +        rk[0] = vs2[i * 4 + H4(0)];
 +        rk[1] = vs2[i * 4 + H4(1)];
 +        rk[2] = vs2[i * 4 + H4(2)];
 +        rk[3] = vs2[i * 4 + H4(3)];
 +        tmp = ror32(rk[3], 8);
 +
 +        rk[4] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
 +                         ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
 +                         ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
 +                         ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
 +                      ^ rcon[uimm - 1];
 +        rk[5] = rk[1] ^ rk[4];
 +        rk[6] = rk[2] ^ rk[5];
 +        rk[7] = rk[3] ^ rk[6];
 +
 +        vd[i * 4 + H4(0)] = rk[4];
 +        vd[i * 4 + H4(1)] = rk[5];
 +        vd[i * 4 + H4(2)] = rk[6];
 +        vd[i * 4 + H4(3)] = rk[7];
 +    }
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 +}
 +
 +void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
 +                        CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +    uint32_t vl = env->vl;
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +    uint32_t vta = vext_vta(desc);
 +
 +    uimm &= 0b1111;
 +    if (uimm > 14 || uimm < 2) {
 +        uimm ^= 0b1000;
 +    }
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint32_t rk[12], tmp;
 +        static const uint32_t rcon[] = {
 +            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
 +            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
 +        };
 +
 +        rk[0] = vd[i * 4 + H4(0)];
 +        rk[1] = vd[i * 4 + H4(1)];
 +        rk[2] = vd[i * 4 + H4(2)];
 +        rk[3] = vd[i * 4 + H4(3)];
 +        rk[4] = vs2[i * 4 + H4(0)];
 +        rk[5] = vs2[i * 4 + H4(1)];
 +        rk[6] = vs2[i * 4 + H4(2)];
 +        rk[7] = vs2[i * 4 + H4(3)];
 +
 +        if (uimm % 2 == 0) {
 +            tmp = ror32(rk[7], 8);
 +            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
 +                             ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
 +                             ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
 +                             ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
 +                          ^ rcon[(uimm - 1) / 2];
 +        } else {
 +            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(rk[7] >> 24) & 0xff] << 24) |
 +                             ((uint32_t)AES_sbox[(rk[7] >> 16) & 0xff] << 16) |
 +                             ((uint32_t)AES_sbox[(rk[7] >> 8) & 0xff] << 8) |
 +                             ((uint32_t)AES_sbox[(rk[7] >> 0) & 0xff] << 0));
 +        }
 +        rk[9] = rk[1] ^ rk[8];
 +        rk[10] = rk[2] ^ rk[9];
 +        rk[11] = rk[3] ^ rk[10];
 +
 +        vd[i * 4 + H4(0)] = rk[8];
 +        vd[i * 4 + H4(1)] = rk[9];
 +        vd[i * 4 + H4(2)] = rk[10];
 +        vd[i * 4 + H4(3)] = rk[11];
 +    }
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
  GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
  GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
  GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
 +
 +/*
 + * Zvkned
 + */
 +
 +#define ZVKNED_EGS 4
 +
 +#define GEN_V_UNMASKED_TRANS(NAME, CHECK, EGS)                                \
 +    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
 +    {                                                                         \
 +        if (CHECK(s, a)) {                                                    \
 +            TCGv_ptr rd_v, rs2_v;                                             \
 +            TCGv_i32 desc, egs;                                               \
 +            uint32_t data = 0;                                                \
 +            TCGLabel *over = gen_new_label();                                 \
 +                                                                              \
 +            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
 +                /* save opcode for unwinding in case we throw an exception */ \
 +                decode_save_opc(s);                                           \
 +                egs = tcg_constant_i32(EGS);                                  \
 +                gen_helper_egs_check(egs, cpu_env);                           \
 +                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
 +            }                                                                 \
 +                                                                              \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
 +            rd_v = tcg_temp_new_ptr();                                        \
 +            rs2_v = tcg_temp_new_ptr();                                       \
 +            desc = tcg_constant_i32(                                          \
 +                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
 +            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
 +            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
 +            gen_helper_##NAME(rd_v, rs2_v, cpu_env, desc);                    \
 +            mark_vs_dirty(s);                                                 \
 +            gen_set_label(over);                                              \
 +            return true;                                                      \
 +        }                                                                     \
 +        return false;                                                         \
 +    }
 +
 +static bool vaes_check_vv(DisasContext *s, arg_rmr *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul) &&
 +           s->sew == MO_32;
 +}
 +
 +static bool vaes_check_overlap(DisasContext *s, int vd, int vs2)
 +{
 +    int8_t op_size = s->lmul <= 0 ? 1 : 1 << s->lmul;
 +    return !is_overlapped(vd, op_size, vs2, 1);
 +}
 +
 +static bool vaes_check_vs(DisasContext *s, arg_rmr *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return vaes_check_overlap(s, a->rd, a->rs2) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           require_align(a->rd, s->lmul) &&
 +           s->sew == MO_32;
 +}
 +
 +GEN_V_UNMASKED_TRANS(vaesef_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesef_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdf_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdf_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdm_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdm_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesz_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesem_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesem_vs, vaes_check_vs, ZVKNED_EGS)
 +
 +#define GEN_VI_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
 +    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
 +    {                                                                         \
 +        if (CHECK(s, a)) {                                                    \
 +            TCGv_ptr rd_v, rs2_v;                                             \
 +            TCGv_i32 uimm_v, desc, egs;                                       \
 +            uint32_t data = 0;                                                \
 +            TCGLabel *over = gen_new_label();                                 \
 +                                                                              \
 +            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
 +                /* save opcode for unwinding in case we throw an exception */ \
 +                decode_save_opc(s);                                           \
 +                egs = tcg_constant_i32(EGS);                                  \
 +                gen_helper_egs_check(egs, cpu_env);                           \
 +                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
 +            }                                                                 \
 +                                                                              \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
 +                                                                              \
 +            rd_v = tcg_temp_new_ptr();                                        \
 +            rs2_v = tcg_temp_new_ptr();                                       \
 +            uimm_v = tcg_constant_i32(a->rs1);                                \
 +            desc = tcg_constant_i32(                                          \
 +                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
 +            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
 +            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
 +            gen_helper_##NAME(rd_v, rs2_v, uimm_v, cpu_env, desc);            \
 +            mark_vs_dirty(s);                                                 \
 +            gen_set_label(over);                                              \
 +            return true;                                                      \
 +        }                                                                     \
 +        return false;                                                         \
 +    }
 +
 +static bool vaeskf1_check(DisasContext *s, arg_vaeskf1_vi *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32 &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32 &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
 +GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
 --
-.31.1
+.41.0

-[PULL 49/61] target/riscv: Create current pm fields in env
+[PULL v2 17/45] target/riscv: Add Zvknh ISA extension support
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+This commit adds support for the Zvknh vector-crypto extension, which
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+consists of the following instructions:
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220120122050.41546-12-zhiwei_liu@c-sky.com
+* vsha2ms.vv
 * vsha2c[hl].vv
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvknha & x-zvknhb properties]
 [max.chou@sifive.com: Replaced SEW selection to happened during
 translation]
 Message-ID: <20230711165917.2629866-11-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        |  4 ++++
+ target/riscv/cpu_cfg.h                   |   2 +
- target/riscv/cpu.c        |  1 +
+ target/riscv/helper.h                    |   6 +
- target/riscv/cpu_helper.c | 43 +++++++++++++++++++++++++++++++++++++++
+ target/riscv/insn32.decode               |   5 +
- target/riscv/csr.c        | 19 +++++++++++++++++
+ target/riscv/cpu.c                       |  13 +-
- target/riscv/machine.c    |  1 +
+ target/riscv/vcrypto_helper.c            | 238 +++++++++++++++++++++++
-files changed, 68 insertions(+)
+ target/riscv/insn_trans/trans_rvvk.c.inc | 129 ++++++++++++
 files changed, 390 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     target_ulong upmmask;
+     bool ext_zvbb;
-     target_ulong upmbase;
+     bool ext_zvbc;
- #endif
+     bool ext_zvkned;
-+    target_ulong cur_pmmask;
++    bool ext_zvknha;
-+    target_ulong cur_pmbase;
++    bool ext_zvknhb;
+     bool ext_zmmul;
-     float_status fp_status;
+     bool ext_zvfbfmin;
+     bool ext_zvfbfwma;
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_get_vlmax(RISCVCPU *cpu, target_ulong vtype)
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
- void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
+index XXXXXXX..XXXXXXX 100644
-                           target_ulong *cs_base, uint32_t *pflags);
+--- a/target/riscv/helper.h
++++ b/target/riscv/helper.h
-+void riscv_cpu_update_mask(CPURISCVState *env);
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
-+
+ DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
- RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
+ DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
-                            target_ulong *ret_value,
+ DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
-                            target_ulong new_value, target_ulong write_mask);
++
 +DEF_HELPER_5(vsha2ms_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
  vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
  vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
 +# *** Zvknh vector crypto extension ***
 +vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     env->mmte |= (PM_EXT_INITIAL | MMTE_M_PM_CURRENT);
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
- #endif
+     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
-     env->xl = riscv_cpu_mxl(env);
+     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
-+    riscv_cpu_update_mask(env);
++    ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
-     cs->exception_index = RISCV_EXCP_NONE;
++    ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
-     env->load_res = -1;
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-     set_default_nan_mode(1, &env->fp_status);
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * In principle Zve*x would also suffice here, were they supported
       * in qemu
       */
 -    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
 +    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
 +        !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
      }
 -    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
 -        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
 +    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
 +        error_setg(
 +            errp,
 +            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
          return;
      }
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
 +    DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
 +    DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/vcrypto_helper.c
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/vcrypto_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
+@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
-     *pflags = flags;
+     /* set tail elements to 1s */
      vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
  }
++
-+void riscv_cpu_update_mask(CPURISCVState *env)
++static inline uint32_t sig0_sha256(uint32_t x)
 +{
-+    target_ulong mask = -1, base = 0;
++    return ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3);
-+    /*
++}
-+     * TODO: Current RVJ spec does not specify
++
-+     * how the extension interacts with XLEN.
++static inline uint32_t sig1_sha256(uint32_t x)
-+     */
++{
-+#ifndef CONFIG_USER_ONLY
++    return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
-+    if (riscv_has_ext(env, RVJ)) {
++}
-+        switch (env->priv) {
++
-+        case PRV_M:
++static inline uint64_t sig0_sha512(uint64_t x)
-+            if (env->mmte & M_PM_ENABLE) {
++{
-+                mask = env->mpmmask;
++    return ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7);
-+                base = env->mpmbase;
++}
-+            }
++
-+            break;
++static inline uint64_t sig1_sha512(uint64_t x)
-+        case PRV_S:
++{
-+            if (env->mmte & S_PM_ENABLE) {
++    return ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6);
-+                mask = env->spmmask;
++}
-+                base = env->spmbase;
++
-+            }
++static inline void vsha2ms_e32(uint32_t *vd, uint32_t *vs1, uint32_t *vs2)
-+            break;
++{
-+        case PRV_U:
++    uint32_t res[4];
-+            if (env->mmte & U_PM_ENABLE) {
++    res[0] = sig1_sha256(vs1[H4(2)]) + vs2[H4(1)] + sig0_sha256(vd[H4(1)]) +
-+                mask = env->upmmask;
++             vd[H4(0)];
-+                base = env->upmbase;
++    res[1] = sig1_sha256(vs1[H4(3)]) + vs2[H4(2)] + sig0_sha256(vd[H4(2)]) +
-+            }
++             vd[H4(1)];
-+            break;
++    res[2] =
-+        default:
++        sig1_sha256(res[0]) + vs2[H4(3)] + sig0_sha256(vd[H4(3)]) + vd[H4(2)];
-+            g_assert_not_reached();
++    res[3] =
 +        sig1_sha256(res[1]) + vs1[H4(0)] + sig0_sha256(vs2[H4(0)]) + vd[H4(3)];
 +    vd[H4(3)] = res[3];
 +    vd[H4(2)] = res[2];
 +    vd[H4(1)] = res[1];
 +    vd[H4(0)] = res[0];
 +}
 +
 +static inline void vsha2ms_e64(uint64_t *vd, uint64_t *vs1, uint64_t *vs2)
 +{
 +    uint64_t res[4];
 +    res[0] = sig1_sha512(vs1[2]) + vs2[1] + sig0_sha512(vd[1]) + vd[0];
 +    res[1] = sig1_sha512(vs1[3]) + vs2[2] + sig0_sha512(vd[2]) + vd[1];
 +    res[2] = sig1_sha512(res[0]) + vs2[3] + sig0_sha512(vd[3]) + vd[2];
 +    res[3] = sig1_sha512(res[1]) + vs1[0] + sig0_sha512(vs2[0]) + vd[3];
 +    vd[3] = res[3];
 +    vd[2] = res[2];
 +    vd[1] = res[1];
 +    vd[0] = res[0];
 +}
 +
 +void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                        uint32_t desc)
 +{
 +    uint32_t sew = FIELD_EX64(env->vtype, VTYPE, VSEW);
 +    uint32_t esz = sew == MO_32 ? 4 : 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        if (sew == MO_32) {
 +            vsha2ms_e32(((uint32_t *)vd) + i * 4, ((uint32_t *)vs1) + i * 4,
 +                        ((uint32_t *)vs2) + i * 4);
 +        } else {
 +            /* If not 32 then SEW should be 64 */
 +            vsha2ms_e64(((uint64_t *)vd) + i * 4, ((uint64_t *)vs1) + i * 4,
 +                        ((uint64_t *)vs2) + i * 4);
 +        }
 +    }
-+#endif
++    /* set tail elements to 1s */
-+    if (env->xl == MXL_RV32) {
++    total_elems = vext_get_total_elems(env, desc, esz);
-+        env->cur_pmmask = mask & UINT32_MAX;
++    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
-+        env->cur_pmbase = base & UINT32_MAX;
++    env->vstart = 0;
-+    } else {
++}
-+        env->cur_pmmask = mask;
++
-+        env->cur_pmbase = base;
++static inline uint64_t sum0_64(uint64_t x)
-+    }
++{
-+}
++    return ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39);
-+
++}
- #ifndef CONFIG_USER_ONLY
++
- static int riscv_cpu_local_irq_pending(CPURISCVState *env)
++static inline uint32_t sum0_32(uint32_t x)
- {
++{
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
++    return ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22);
-     /* tlb_flush is unnecessary as mode is contained in mmu_idx */
++}
-     env->priv = newpriv;
++
-     env->xl = cpu_recompute_xl(env);
++static inline uint64_t sum1_64(uint64_t x)
-+    riscv_cpu_update_mask(env);
++{
++    return ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41);
-     /*
++}
-      * Clear the load reservation - otherwise a reservation placed in one
++
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
++static inline uint32_t sum1_32(uint32_t x)
 +{
 +    return ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25);
 +}
 +
 +#define ch(x, y, z) ((x & y) ^ ((~x) & z))
 +
 +#define maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
 +
 +static void vsha2c_64(uint64_t *vs2, uint64_t *vd, uint64_t *vs1)
 +{
 +    uint64_t a = vs2[3], b = vs2[2], e = vs2[1], f = vs2[0];
 +    uint64_t c = vd[3], d = vd[2], g = vd[1], h = vd[0];
 +    uint64_t W0 = vs1[0], W1 = vs1[1];
 +    uint64_t T1 = h + sum1_64(e) + ch(e, f, g) + W0;
 +    uint64_t T2 = sum0_64(a) + maj(a, b, c);
 +
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    T1 = h + sum1_64(e) + ch(e, f, g) + W1;
 +    T2 = sum0_64(a) + maj(a, b, c);
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    vd[0] = f;
 +    vd[1] = e;
 +    vd[2] = b;
 +    vd[3] = a;
 +}
 +
 +static void vsha2c_32(uint32_t *vs2, uint32_t *vd, uint32_t *vs1)
 +{
 +    uint32_t a = vs2[H4(3)], b = vs2[H4(2)], e = vs2[H4(1)], f = vs2[H4(0)];
 +    uint32_t c = vd[H4(3)], d = vd[H4(2)], g = vd[H4(1)], h = vd[H4(0)];
 +    uint32_t W0 = vs1[H4(0)], W1 = vs1[H4(1)];
 +    uint32_t T1 = h + sum1_32(e) + ch(e, f, g) + W0;
 +    uint32_t T2 = sum0_32(a) + maj(a, b, c);
 +
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    T1 = h + sum1_32(e) + ch(e, f, g) + W1;
 +    T2 = sum0_32(a) + maj(a, b, c);
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    vd[H4(0)] = f;
 +    vd[H4(1)] = e;
 +    vd[H4(2)] = b;
 +    vd[H4(3)] = a;
 +}
 +
 +void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 4;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
 +                  ((uint32_t *)vs1) + 4 * i + 2);
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
 +                  ((uint64_t *)vs1) + 4 * i + 2);
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 4;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
 +                  (((uint32_t *)vs1) + 4 * i));
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    uint32_t esz = 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
 +                  (((uint64_t *)vs1) + 4 * i));
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/target/riscv/insn_trans/trans_rvvk.c.inc
-+++ b/target/riscv/csr.c
++++ b/target/riscv/insn_trans/trans_rvvk.c.inc
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mmte(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
-     /* hardwiring pm.instruction bit to 0, since it's not supported yet */
-     wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
+ GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
-     env->mmte = wpri_val | PM_EXT_DIRTY;
+ GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
-+    riscv_cpu_update_mask(env);
++
++/*
-     /* Set XS and SD bits, since PM CSRs are dirty */
++ * Zvknh
-     mstatus = env->mstatus | MSTATUS_XS;
++ */
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
++
-     uint64_t mstatus;
++#define ZVKNH_EGS 4
++
-     env->mpmmask = val;
++#define GEN_VV_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
-+    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
-+        env->cur_pmmask = val;
++    {                                                                         \
-+    }
++        if (CHECK(s, a)) {                                                    \
-     env->mmte |= PM_EXT_DIRTY;
++            uint32_t data = 0;                                                \
++            TCGLabel *over = gen_new_label();                                 \
-     /* Set XS and SD bits, since PM CSRs are dirty */
++            TCGv_i32 egs;                                                     \
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmmask(CPURISCVState *env, int csrno,
++                                                                              \
-         return RISCV_EXCP_NONE;
++            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
-     }
++                /* save opcode for unwinding in case we throw an exception */ \
-     env->spmmask = val;
++                decode_save_opc(s);                                           \
-+    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
++                egs = tcg_constant_i32(EGS);                                  \
-+        env->cur_pmmask = val;
++                gen_helper_egs_check(egs, cpu_env);                           \
-+    }
++                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
-     env->mmte |= PM_EXT_DIRTY;
++            }                                                                 \
++                                                                              \
-     /* Set XS and SD bits, since PM CSRs are dirty */
++            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmmask(CPURISCVState *env, int csrno,
++            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
-         return RISCV_EXCP_NONE;
++            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
-     }
++            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
-     env->upmmask = val;
++            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
-+    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
++                                                                              \
-+        env->cur_pmmask = val;
++            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),       \
-+    }
++                               vreg_ofs(s, a->rs2), cpu_env,                  \
-     env->mmte |= PM_EXT_DIRTY;
++                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8,    \
++                               data, gen_helper_##NAME);                      \
-     /* Set XS and SD bits, since PM CSRs are dirty */
++                                                                              \
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
++            mark_vs_dirty(s);                                                 \
-     uint64_t mstatus;
++            gen_set_label(over);                                              \
++            return true;                                                      \
-     env->mpmbase = val;
++        }                                                                     \
-+    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
++        return false;                                                         \
-+        env->cur_pmbase = val;
++    }
-+    }
++
-     env->mmte |= PM_EXT_DIRTY;
++static bool vsha_check_sew(DisasContext *s)
++{
-     /* Set XS and SD bits, since PM CSRs are dirty */
++    return (s->cfg_ptr->ext_zvknha == true && s->sew == MO_32) ||
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmbase(CPURISCVState *env, int csrno,
++           (s->cfg_ptr->ext_zvknhb == true &&
-         return RISCV_EXCP_NONE;
++            (s->sew == MO_32 || s->sew == MO_64));
-     }
++}
-     env->spmbase = val;
++
-+    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
++static bool vsha_check(DisasContext *s, arg_rmrr *a)
-+        env->cur_pmbase = val;
++{
-+    }
++    int egw_bytes = ZVKNH_EGS << s->sew;
-     env->mmte |= PM_EXT_DIRTY;
++    int mult = 1 << MAX(s->lmul, 0);
++    return opivv_check(s, a) &&
-     /* Set XS and SD bits, since PM CSRs are dirty */
++           vsha_check_sew(s) &&
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
++           MAXSZ(s) >= egw_bytes &&
-         return RISCV_EXCP_NONE;
++           !is_overlapped(a->rd, mult, a->rs1, mult) &&
-     }
++           !is_overlapped(a->rd, mult, a->rs2, mult) &&
-     env->upmbase = val;
++           s->lmul >= 0;
-+    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
++}
-+        env->cur_pmbase = val;
++
-+    }
++GEN_VV_UNMASKED_TRANS(vsha2ms_vv, vsha_check, ZVKNH_EGS)
-     env->mmte |= PM_EXT_DIRTY;
++
++static bool trans_vsha2cl_vv(DisasContext *s, arg_rmrr *a)
-     /* Set XS and SD bits, since PM CSRs are dirty */
++{
-diff --git a/target/riscv/machine.c b/target/riscv/machine.c
++    if (vsha_check(s, a)) {
-index XXXXXXX..XXXXXXX 100644
++        uint32_t data = 0;
---- a/target/riscv/machine.c
++        TCGLabel *over = gen_new_label();
-+++ b/target/riscv/machine.c
++        TCGv_i32 egs;
-@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_post_load(void *opaque, int version_id)
++
-     CPURISCVState *env = &cpu->env;
++        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
++            /* save opcode for unwinding in case we throw an exception */
-     env->xl = cpu_recompute_xl(env);
++            decode_save_opc(s);
-+    riscv_cpu_update_mask(env);
++            egs = tcg_constant_i32(ZVKNH_EGS);
-     return 0;
++            gen_helper_egs_check(egs, cpu_env);
- }
++            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
++        }
 +
 +        data = FIELD_DP32(data, VDATA, VM, a->vm);
 +        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
 +        data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);
 +
 +        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
 +            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
 +            s->cfg_ptr->vlen / 8, data,
 +            s->sew == MO_32 ?
 +                gen_helper_vsha2cl32_vv : gen_helper_vsha2cl64_vv);
 +
 +        mark_vs_dirty(s);
 +        gen_set_label(over);
 +        return true;
 +    }
 +    return false;
 +}
 +
 +static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
 +{
 +    if (vsha_check(s, a)) {
 +        uint32_t data = 0;
 +        TCGLabel *over = gen_new_label();
 +        TCGv_i32 egs;
 +
 +        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
 +            /* save opcode for unwinding in case we throw an exception */
 +            decode_save_opc(s);
 +            egs = tcg_constant_i32(ZVKNH_EGS);
 +            gen_helper_egs_check(egs, cpu_env);
 +            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 +        }
 +
 +        data = FIELD_DP32(data, VDATA, VM, a->vm);
 +        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
 +        data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);
 +
 +        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
 +            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
 +            s->cfg_ptr->vlen / 8, data,
 +            s->sew == MO_32 ?
 +                gen_helper_vsha2ch32_vv : gen_helper_vsha2ch64_vv);
 +
 +        mark_vs_dirty(s);
 +        gen_set_label(over);
 +        return true;
 +    }
 +    return false;
 +}
 --
-.31.1
+.41.0

-[PULL 19/61] target/riscv: rvv-1.0: Add Zve64f extension into RISC-V
+[PULL v2 18/45] target/riscv: Add Zvksh ISA extension support
-From: Frank Chang <frank.chang@sifive.com>
+From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+This commit adds support for the Zvksh vector-crypto extension, which
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+consists of the following instructions:
-Message-id: 20220118014522.13613-2-frank.chang@sifive.com
 * vsm3me.vv
 * vsm3c.vi
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvksh property]
 Message-ID: <20230711165917.2629866-12-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        | 1 +
+ target/riscv/cpu_cfg.h                   |   1 +
- target/riscv/cpu.c        | 4 ++++
+ target/riscv/helper.h                    |   3 +
- target/riscv/cpu_helper.c | 5 ++++-
+ target/riscv/insn32.decode               |   4 +
- target/riscv/csr.c        | 6 +++++-
+ target/riscv/cpu.c                       |   6 +-
- target/riscv/translate.c  | 2 ++
+ target/riscv/vcrypto_helper.c            | 134 +++++++++++++++++++++++
-files changed, 16 insertions(+), 2 deletions(-)
+ target/riscv/insn_trans/trans_rvvk.c.inc |  31 ++++++
+files changed, 177 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
---- a/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
-+++ b/target/riscv/cpu.h
+--- a/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPU {
++++ b/target/riscv/cpu_cfg.h
-         bool ext_icsr;
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-         bool ext_zfh;
+     bool ext_zvkned;
-         bool ext_zfhmin;
+     bool ext_zvknha;
-+        bool ext_zve64f;
+     bool ext_zvknhb;
++    bool ext_zvksh;
-         char *priv_spec;
+     bool ext_zmmul;
-         char *user_spec;
+     bool ext_zvfbfmin;
      bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vsm3me_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
 +# *** Zvksh vector crypto extension ***
 +vsm3me_vv   100000 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-             }
+     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
-             set_vext_version(env, vext_version);
+     ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
-         }
+     ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
-+        if (cpu->cfg.ext_zve64f && !cpu->cfg.ext_f) {
++    ISA_EXT_DATA_ENTRY(zvksh, PRIV_VERSION_1_12_0, ext_zvksh),
-+            error_setg(errp, "Zve64f extension depends upon RVF.");
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-+            return;
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
-+        }
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-         if (cpu->cfg.ext_j) {
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-             ext |= RVJ;
+      * In principle Zve*x would also suffice here, were they supported
-         }
+      * in qemu
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+      */
-index XXXXXXX..XXXXXXX 100644
+-    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
---- a/target/riscv/cpu_helper.c
+-        !cpu->cfg.ext_zve32f) {
-+++ b/target/riscv/cpu_helper.c
++    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha ||
-@@ -XXX,XX +XXX,XX @@ static RISCVMXL cpu_get_xl(CPURISCVState *env)
++         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
- void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
+         error_setg(errp,
-                           target_ulong *cs_base, uint32_t *pflags)
+                    "Vector crypto extensions require V or Zve* extensions");
- {
+         return;
-+    CPUState *cs = env_cpu(env);
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-+    RISCVCPU *cpu = RISCV_CPU(cs);
+     DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
-+
+     DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
-     uint32_t flags = 0;
+     DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
++    DEFINE_PROP_BOOL("x-zvksh", RISCVCPU, cfg.ext_zvksh, false),
-     *pc = env->pc;
-     *cs_base = 0;
+     DEFINE_PROP_END_OF_LIST(),
+ };
--    if (riscv_has_ext(env, RVV)) {
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
-+    if (riscv_has_ext(env, RVV) || cpu->cfg.ext_zve64f) {
+index XXXXXXX..XXXXXXX 100644
-         /*
+--- a/target/riscv/vcrypto_helper.c
-          * If env->vl equals to VLMAX, we can use generic vector operation
++++ b/target/riscv/vcrypto_helper.c
-          * expanders (GVEC) to accerlate the vector operations.
+@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+     vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
-index XXXXXXX..XXXXXXX 100644
+     env->vstart = 0;
---- a/target/riscv/csr.c
+ }
-+++ b/target/riscv/csr.c
++
-@@ -XXX,XX +XXX,XX @@ static RISCVException fs(CPURISCVState *env, int csrno)
++static inline uint32_t p1(uint32_t x)
++{
- static RISCVException vs(CPURISCVState *env, int csrno)
++    return x ^ rol32(x, 15) ^ rol32(x, 23);
- {
++}
--    if (env->misa_ext & RVV) {
++
-+    CPUState *cs = env_cpu(env);
++static inline uint32_t zvksh_w(uint32_t m16, uint32_t m9, uint32_t m3,
-+    RISCVCPU *cpu = RISCV_CPU(cs);
++                               uint32_t m13, uint32_t m6)
-+
++{
-+    if (env->misa_ext & RVV ||
++    return p1(m16 ^ m9 ^ rol32(m3, 15)) ^ rol32(m13, 7) ^ m6;
-+        cpu->cfg.ext_zve64f) {
++}
- #if !defined(CONFIG_USER_ONLY)
++
-         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
++void HELPER(vsm3me_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
-             return RISCV_EXCP_ILLEGAL_INST;
++                       CPURISCVState *env, uint32_t desc)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
++{
-index XXXXXXX..XXXXXXX 100644
++    uint32_t esz = memop_size(FIELD_EX64(env->vtype, VTYPE, VSEW));
---- a/target/riscv/translate.c
++    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-+++ b/target/riscv/translate.c
++    uint32_t vta = vext_vta(desc);
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
++    uint32_t *vd = vd_vptr;
-     bool ext_ifencei;
++    uint32_t *vs1 = vs1_vptr;
-     bool ext_zfh;
++    uint32_t *vs2 = vs2_vptr;
-     bool ext_zfhmin;
++
-+    bool ext_zve64f;
++    for (int i = env->vstart / 8; i < env->vl / 8; i++) {
-     bool hlsx;
++        uint32_t w[24];
-     /* vector extension */
++        for (int j = 0; j < 8; j++) {
-     bool vill;
++            w[j] = bswap32(vs1[H4((i * 8) + j)]);
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
++            w[j + 8] = bswap32(vs2[H4((i * 8) + j)]);
-     ctx->ext_ifencei = cpu->cfg.ext_ifencei;
++        }
-     ctx->ext_zfh = cpu->cfg.ext_zfh;
++        for (int j = 0; j < 8; j++) {
-     ctx->ext_zfhmin = cpu->cfg.ext_zfhmin;
++            w[j + 16] =
-+    ctx->ext_zve64f = cpu->cfg.ext_zve64f;
++                zvksh_w(w[j], w[j + 7], w[j + 13], w[j + 3], w[j + 10]);
-     ctx->vlen = cpu->cfg.vlen;
++        }
-     ctx->elen = cpu->cfg.elen;
++        for (int j = 0; j < 8; j++) {
-     ctx->mstatus_hs_fs = FIELD_EX32(tb_flags, TB_FLAGS, MSTATUS_HS_FS);
++            vd[(i * 8) + j] = bswap32(w[H4(j + 16)]);
 +        }
 +    }
 +    vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +static inline uint32_t ff1(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return x ^ y ^ z;
 +}
 +
 +static inline uint32_t ff2(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return (x & y) | (x & z) | (y & z);
 +}
 +
 +static inline uint32_t ff_j(uint32_t x, uint32_t y, uint32_t z, uint32_t j)
 +{
 +    return (j <= 15) ? ff1(x, y, z) : ff2(x, y, z);
 +}
 +
 +static inline uint32_t gg1(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return x ^ y ^ z;
 +}
 +
 +static inline uint32_t gg2(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return (x & y) | (~x & z);
 +}
 +
 +static inline uint32_t gg_j(uint32_t x, uint32_t y, uint32_t z, uint32_t j)
 +{
 +    return (j <= 15) ? gg1(x, y, z) : gg2(x, y, z);
 +}
 +
 +static inline uint32_t t_j(uint32_t j)
 +{
 +    return (j <= 15) ? 0x79cc4519 : 0x7a879d8a;
 +}
 +
 +static inline uint32_t p_0(uint32_t x)
 +{
 +    return x ^ rol32(x, 9) ^ rol32(x, 17);
 +}
 +
 +static void sm3c(uint32_t *vd, uint32_t *vs1, uint32_t *vs2, uint32_t uimm)
 +{
 +    uint32_t x0, x1;
 +    uint32_t j;
 +    uint32_t ss1, ss2, tt1, tt2;
 +    x0 = vs2[0] ^ vs2[4];
 +    x1 = vs2[1] ^ vs2[5];
 +    j = 2 * uimm;
 +    ss1 = rol32(rol32(vs1[0], 12) + vs1[4] + rol32(t_j(j), j % 32), 7);
 +    ss2 = ss1 ^ rol32(vs1[0], 12);
 +    tt1 = ff_j(vs1[0], vs1[1], vs1[2], j) + vs1[3] + ss2 + x0;
 +    tt2 = gg_j(vs1[4], vs1[5], vs1[6], j) + vs1[7] + ss1 + vs2[0];
 +    vs1[3] = vs1[2];
 +    vd[3] = rol32(vs1[1], 9);
 +    vs1[1] = vs1[0];
 +    vd[1] = tt1;
 +    vs1[7] = vs1[6];
 +    vd[7] = rol32(vs1[5], 19);
 +    vs1[5] = vs1[4];
 +    vd[5] = p_0(tt2);
 +    j = 2 * uimm + 1;
 +    ss1 = rol32(rol32(vd[1], 12) + vd[5] + rol32(t_j(j), j % 32), 7);
 +    ss2 = ss1 ^ rol32(vd[1], 12);
 +    tt1 = ff_j(vd[1], vs1[1], vd[3], j) + vs1[3] + ss2 + x1;
 +    tt2 = gg_j(vd[5], vs1[5], vd[7], j) + vs1[7] + ss1 + vs2[1];
 +    vd[2] = rol32(vs1[1], 9);
 +    vd[0] = tt1;
 +    vd[6] = rol32(vs1[5], 19);
 +    vd[4] = p_0(tt2);
 +}
 +
 +void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
 +                      CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t esz = memop_size(FIELD_EX64(env->vtype, VTYPE, VSEW));
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +    uint32_t v1[8], v2[8], v3[8];
 +
 +    for (int i = env->vstart / 8; i < env->vl / 8; i++) {
 +        for (int k = 0; k < 8; k++) {
 +            v2[k] = bswap32(vd[H4(i * 8 + k)]);
 +            v3[k] = bswap32(vs2[H4(i * 8 + k)]);
 +        }
 +        sm3c(v1, v2, v3, uimm);
 +        for (int k = 0; k < 8; k++) {
 +            vd[i * 8 + k] = bswap32(v1[H4(k)]);
 +        }
 +    }
 +    vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
      }
      return false;
  }
 +
 +/*
 + * Zvksh
 + */
 +
 +#define ZVKSH_EGS 8
 +
 +static inline bool vsm3_check(DisasContext *s, arg_rmrr *a)
 +{
 +    int egw_bytes = ZVKSH_EGS << s->sew;
 +    int mult = 1 << MAX(s->lmul, 0);
 +    return s->cfg_ptr->ext_zvksh == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           !is_overlapped(a->rd, mult, a->rs2, mult) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32;
 +}
 +
 +static inline bool vsm3me_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return vsm3_check(s, a) && vext_check_sss(s, a->rd, a->rs1, a->rs2, a->vm);
 +}
 +
 +static inline bool vsm3c_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return vsm3_check(s, a) && vext_check_ss(s, a->rd, a->rs2, a->vm);
 +}
 +
 +GEN_VV_UNMASKED_TRANS(vsm3me_vv, vsm3me_check, ZVKSH_EGS)
 +GEN_VI_UNMASKED_TRANS(vsm3c_vi, vsm3c_check, ZVKSH_EGS)
 --
-.31.1
+.41.0

-[PULL 40/61] target/riscv: Don't save pc when exception return
+[PULL v2 19/45] target/riscv: Add Zvkg ISA extension support
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-As pc will be written by the xepc in exception return, just ignore
+This commit adds support for the Zvkg vector-crypto extension, which
-pc in translation.
+consists of the following instructions:
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+* vgmul.vv
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+* vghsh.vv
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-3-zhiwei_liu@c-sky.com
+Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvkg property]
 [max.chou@sifive.com: Replaced uint by int for cross win32 build]
 Message-ID: <20230711165917.2629866-13-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/helper.h                          | 4 ++--
+ target/riscv/cpu_cfg.h                   |  1 +
- target/riscv/op_helper.c                       | 4 ++--
+ target/riscv/helper.h                    |  3 +
- target/riscv/insn_trans/trans_privileged.c.inc | 7 ++-----
+ target/riscv/insn32.decode               |  4 ++
-files changed, 6 insertions(+), 9 deletions(-)
+ target/riscv/cpu.c                       |  6 +-
+ target/riscv/vcrypto_helper.c            | 72 ++++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 30 ++++++++++
 files changed, 114 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zve64d;
      bool ext_zvbb;
      bool ext_zvbc;
 +    bool ext_zvkg;
      bool ext_zvkned;
      bool ext_zvknha;
      bool ext_zvknhb;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(csrr_i128, tl, env, int)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
- DEF_HELPER_4(csrw_i128, void, env, int, tl, tl)
- DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
+ DEF_HELPER_5(vsm3me_vv, void, ptr, ptr, ptr, env, i32)
- #ifndef CONFIG_USER_ONLY
+ DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
--DEF_HELPER_2(sret, tl, env, tl)
++
--DEF_HELPER_2(mret, tl, env, tl)
++DEF_HELPER_5(vghsh_vv, void, ptr, ptr, ptr, env, i32)
-+DEF_HELPER_1(sret, tl, env)
++DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
-+DEF_HELPER_1(mret, tl, env)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
- DEF_HELPER_1(wfi, void, env)
+index XXXXXXX..XXXXXXX 100644
- DEF_HELPER_1(tlb_flush, void, env)
+--- a/target/riscv/insn32.decode
- #endif
++++ b/target/riscv/insn32.decode
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
+@@ -XXX,XX +XXX,XX @@ vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
-index XXXXXXX..XXXXXXX 100644
+ # *** Zvksh vector crypto extension ***
---- a/target/riscv/op_helper.c
+ vsm3me_vv   100000 1 ..... ..... 010 ..... 1110111 @r_vm_1
-+++ b/target/riscv/op_helper.c
+ vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
-@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrrw_i128(CPURISCVState *env, int csr,
++
++# *** Zvkg vector crypto extension ***
- #ifndef CONFIG_USER_ONLY
++vghsh_vv    101100 1 ..... ..... 010 ..... 1110111 @r_vm_1
++vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
--target_ulong helper_sret(CPURISCVState *env, target_ulong cpu_pc_deb)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-+target_ulong helper_sret(CPURISCVState *env)
+index XXXXXXX..XXXXXXX 100644
- {
+--- a/target/riscv/cpu.c
-     uint64_t mstatus;
++++ b/target/riscv/cpu.c
-     target_ulong prev_priv, prev_virt;
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env, target_ulong cpu_pc_deb)
+     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
-     return retpc;
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
      ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
 +    ISA_EXT_DATA_ENTRY(zvkg, PRIV_VERSION_1_12_0, ext_zvkg),
      ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
      ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
      ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * In principle Zve*x would also suffice here, were they supported
       * in qemu
       */
 -    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha ||
 -         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
 +    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkg || cpu->cfg.ext_zvkned ||
 +         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      /* Vector cryptography extensions */
      DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 +    DEFINE_PROP_BOOL("x-zvkg", RISCVCPU, cfg.ext_zvkg, false),
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
      DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
      vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
      env->vstart = 0;
  }
++
--target_ulong helper_mret(CPURISCVState *env, target_ulong cpu_pc_deb)
++void HELPER(vghsh_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
-+target_ulong helper_mret(CPURISCVState *env)
++                      CPURISCVState *env, uint32_t desc)
- {
++{
-     if (!(env->priv >= PRV_M)) {
++    uint64_t *vd = vd_vptr;
-         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
++    uint64_t *vs1 = vs1_vptr;
-diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
++    uint64_t *vs2 = vs2_vptr;
-index XXXXXXX..XXXXXXX 100644
++    uint32_t vta = vext_vta(desc);
---- a/target/riscv/insn_trans/trans_privileged.c.inc
++    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
-+++ b/target/riscv/insn_trans/trans_privileged.c.inc
++
-@@ -XXX,XX +XXX,XX @@ static bool trans_uret(DisasContext *ctx, arg_uret *a)
++    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
- static bool trans_sret(DisasContext *ctx, arg_sret *a)
++        uint64_t Y[2] = {vd[i * 2 + 0], vd[i * 2 + 1]};
- {
++        uint64_t H[2] = {brev8(vs2[i * 2 + 0]), brev8(vs2[i * 2 + 1])};
- #ifndef CONFIG_USER_ONLY
++        uint64_t X[2] = {vs1[i * 2 + 0], vs1[i * 2 + 1]};
--    tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
++        uint64_t Z[2] = {0, 0};
--
++
-     if (has_ext(ctx, RVS)) {
++        uint64_t S[2] = {brev8(Y[0] ^ X[0]), brev8(Y[1] ^ X[1])};
--        gen_helper_sret(cpu_pc, cpu_env, cpu_pc);
++
-+        gen_helper_sret(cpu_pc, cpu_env);
++        for (int j = 0; j < 128; j++) {
-         tcg_gen_exit_tb(NULL, 0); /* no chaining */
++            if ((S[j / 64] >> (j % 64)) & 1) {
-         ctx->base.is_jmp = DISAS_NORETURN;
++                Z[0] ^= H[0];
-     } else {
++                Z[1] ^= H[1];
-@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
++            }
- static bool trans_mret(DisasContext *ctx, arg_mret *a)
++            bool reduce = ((H[1] >> 63) & 1);
- {
++            H[1] = H[1] << 1 | H[0] >> 63;
- #ifndef CONFIG_USER_ONLY
++            H[0] = H[0] << 1;
--    tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
++            if (reduce) {
--    gen_helper_mret(cpu_pc, cpu_env, cpu_pc);
++                H[0] ^= 0x87;
-+    gen_helper_mret(cpu_pc, cpu_env);
++            }
-     tcg_gen_exit_tb(NULL, 0); /* no chaining */
++        }
-     ctx->base.is_jmp = DISAS_NORETURN;
++
-     return true;
++        vd[i * 2 + 0] = brev8(Z[0]);
 +        vd[i * 2 + 1] = brev8(Z[1]);
 +    }
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
 +                      uint32_t desc)
 +{
 +    uint64_t *vd = vd_vptr;
 +    uint64_t *vs2 = vs2_vptr;
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint64_t Y[2] = {brev8(vd[i * 2 + 0]), brev8(vd[i * 2 + 1])};
 +        uint64_t H[2] = {brev8(vs2[i * 2 + 0]), brev8(vs2[i * 2 + 1])};
 +        uint64_t Z[2] = {0, 0};
 +
 +        for (int j = 0; j < 128; j++) {
 +            if ((Y[j / 64] >> (j % 64)) & 1) {
 +                Z[0] ^= H[0];
 +                Z[1] ^= H[1];
 +            }
 +            bool reduce = ((H[1] >> 63) & 1);
 +            H[1] = H[1] << 1 | H[0] >> 63;
 +            H[0] = H[0] << 1;
 +            if (reduce) {
 +                H[0] ^= 0x87;
 +            }
 +        }
 +
 +        vd[i * 2 + 0] = brev8(Z[0]);
 +        vd[i * 2 + 1] = brev8(Z[1]);
 +    }
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static inline bool vsm3c_check(DisasContext *s, arg_rmrr *a)
  GEN_VV_UNMASKED_TRANS(vsm3me_vv, vsm3me_check, ZVKSH_EGS)
  GEN_VI_UNMASKED_TRANS(vsm3c_vi, vsm3c_check, ZVKSH_EGS)
 +
 +/*
 + * Zvkg
 + */
 +
 +#define ZVKG_EGS 4
 +
 +static bool vgmul_check(DisasContext *s, arg_rmr *a)
 +{
 +    int egw_bytes = ZVKG_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkg == true &&
 +           vext_check_isa_ill(s) &&
 +           require_rvv(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           vext_check_ss(s, a->rd, a->rs2, a->vm) &&
 +           s->sew == MO_32;
 +}
 +
 +GEN_V_UNMASKED_TRANS(vgmul_vv, vgmul_check, ZVKG_EGS)
 +
 +static bool vghsh_check(DisasContext *s, arg_rmrr *a)
 +{
 +    int egw_bytes = ZVKG_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkg == true &&
 +           opivv_check(s, a) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32;
 +}
 +
 +GEN_VV_UNMASKED_TRANS(vghsh_vv, vghsh_check, ZVKG_EGS)
 --
-.31.1
+.41.0

-[PULL 26/61] target/riscv: rvv-1.0: Add Zve64f support for widening type-convert insns
+[PULL v2 20/45] crypto: Create sm4_subword
-From: Frank Chang <frank.chang@sifive.com>
+From: Max Chou <max.chou@sifive.com>
-Vector widening conversion instructions are provided to and from all
+Allows sharing of sm4_subword between different targets.
 supported integer EEWs for Zve64f extension.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Message-id: 20220118014522.13613-9-frank.chang@sifive.com
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-14-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvv.c.inc | 32 +++++++++++++++++++------
+ include/crypto/sm4.h           |  8 ++++++++
-file changed, 25 insertions(+), 7 deletions(-)
+ target/arm/tcg/crypto_helper.c | 10 ++--------
 files changed, 10 insertions(+), 8 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
+diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
+--- a/include/crypto/sm4.h
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
++++ b/include/crypto/sm4.h
-@@ -XXX,XX +XXX,XX @@ static bool require_zve64f(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@
-     return s->ext_zve64f ? s->sew <= MO_32 : true;
- }
+ extern const uint8_t sm4_sbox[256];
-+static bool require_scale_zve64f(DisasContext *s)
++static inline uint32_t sm4_subword(uint32_t word)
 +{
-+    /* RVV + Zve64f = RVV. */
++    return sm4_sbox[word & 0xff] |
-+    if (has_ext(s, RVV)) {
++           sm4_sbox[(word >> 8) & 0xff] << 8 |
-+        return true;
++           sm4_sbox[(word >> 16) & 0xff] << 16 |
-+    }
++           sm4_sbox[(word >> 24) & 0xff] << 24;
 +
 +    /* Zve64f doesn't support FP64. (Section 18.2) */
 +    return s->ext_zve64f ? s->sew <= MO_16 : true;
 +}
 +
- /* Destination vector register group cannot overlap source mask register. */
+ #endif
- static bool require_vm(int vm, int vd)
+diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
- {
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
+--- a/target/arm/tcg/crypto_helper.c
-            require_scale_rvf(s) &&
++++ b/target/arm/tcg/crypto_helper.c
-            (s->sew != MO_8) &&
+@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
-            vext_check_isa_ill(s) &&
+             CR_ST_WORD(d, (i + 3) % 4) ^
--           vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm);
+             CR_ST_WORD(n, i);
-+           vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm) &&
-+           require_scale_zve64f(s);
+-        t = sm4_sbox[t & 0xff] |
- }
+-            sm4_sbox[(t >> 8) & 0xff] << 8 |
+-            sm4_sbox[(t >> 16) & 0xff] << 16 |
- /* OPFVV with WIDEN */
+-            sm4_sbox[(t >> 24) & 0xff] << 24;
-@@ -XXX,XX +XXX,XX @@ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
++        t = sm4_subword(t);
-            require_scale_rvf(s) &&
-            (s->sew != MO_8) &&
+         CR_ST_WORD(d, i) ^= t ^ rol32(t, 2) ^ rol32(t, 10) ^ rol32(t, 18) ^
-            vext_check_isa_ill(s) &&
+                             rol32(t, 24);
--           vext_check_ds(s, a->rd, a->rs2, a->vm);
+@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4ekey(uint64_t *rd, uint64_t *rn, uint64_t *rm)
-+           vext_check_ds(s, a->rd, a->rs2, a->vm) &&
+             CR_ST_WORD(d, (i + 3) % 4) ^
-+           require_scale_zve64f(s);
+             CR_ST_WORD(m, i);
- }
+-        t = sm4_sbox[t & 0xff] |
- /* OPFVF with WIDEN */
+-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-@@ -XXX,XX +XXX,XX @@ static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
+-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-            require_scale_rvf(s) &&
+-            sm4_sbox[(t >> 24) & 0xff] << 24;
-            (s->sew != MO_8) &&
++        t = sm4_subword(t);
-            vext_check_isa_ill(s) &&
--           vext_check_dds(s, a->rd, a->rs1, a->rs2, a->vm);
+         CR_ST_WORD(d, i) ^= t ^ rol32(t, 13) ^ rol32(t, 23);
-+           vext_check_dds(s, a->rd, a->rs1, a->rs2, a->vm) &&
+     }
 +           require_scale_zve64f(s);
  }
  /* WIDEN OPFVV with WIDEN */
@@ -XXX,XX +XXX,XX @@ static bool opfwf_widen_check(DisasContext *s, arg_rmrr *a)
             require_scale_rvf(s) &&
             (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
 -           vext_check_dd(s, a->rd, a->rs2, a->vm);
 +           vext_check_dd(s, a->rd, a->rs2, a->vm) &&
 +           require_scale_zve64f(s);
  }
  /* WIDEN OPFVF with WIDEN */
@@ -XXX,XX +XXX,XX @@ static bool opfv_widen_check(DisasContext *s, arg_rmr *a)
  static bool opxfv_widen_check(DisasContext *s, arg_rmr *a)
  {
      return opfv_widen_check(s, a) &&
 -           require_rvf(s);
 +           require_rvf(s) &&
 +           require_zve64f(s);
  }
  static bool opffv_widen_check(DisasContext *s, arg_rmr *a)
  {
      return opfv_widen_check(s, a) &&
             require_scale_rvf(s) &&
 -           (s->sew != MO_8);
 +           (s->sew != MO_8) &&
 +           require_scale_zve64f(s);
  }
  #define GEN_OPFV_WIDEN_TRANS(NAME, CHECK, HELPER, FRM)             \
@@ -XXX,XX +XXX,XX @@ static bool opfxv_widen_check(DisasContext *s, arg_rmr *a)
             require_scale_rvf(s) &&
             vext_check_isa_ill(s) &&
             /* OPFV widening instructions ignore vs1 check */
 -           vext_check_ds(s, a->rd, a->rs2, a->vm);
 +           vext_check_ds(s, a->rd, a->rs2, a->vm) &&
 +           require_scale_zve64f(s);
  }
  #define GEN_OPFXV_WIDEN_TRANS(NAME)                                \
 --
-.31.1
+.41.0

-[PULL 13/61] target/riscv: Add kvm_riscv_get/put_regs_timer
+[PULL v2 21/45] crypto: Add SM4 constant parameter CK
-From: Yifei Jiang <jiangyifei@huawei.com>
+From: Max Chou <max.chou@sifive.com>
-Add kvm_riscv_get/put_regs_timer to synchronize virtual time context
+Adds sm4_ck constant for use in sm4 cryptography across different targets.
 from KVM.
-To set register of RISCV_TIMER_REG(state) will occur a error from KVM
+Signed-off-by: Max Chou <max.chou@sifive.com>
-on kvm_timer_state == 0. It's better to adapt in KVM, but it doesn't matter
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-that adaping in QEMU.
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-15-max.chou@sifive.com>
 Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
 Signed-off-by: Mingwang Li <limingwang@huawei.com>
 Reviewed-by: Anup Patel <anup.patel@wdc.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20220112081329.1835-11-jiangyifei@huawei.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h |  7 +++++
+ include/crypto/sm4.h |  1 +
- target/riscv/kvm.c | 72 ++++++++++++++++++++++++++++++++++++++++++++++
+ crypto/sm4.c         | 10 ++++++++++
-files changed, 79 insertions(+)
+files changed, 11 insertions(+)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/include/crypto/sm4.h
-+++ b/target/riscv/cpu.h
++++ b/include/crypto/sm4.h
-@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
+@@ -XXX,XX +XXX,XX @@
+ #define QEMU_SM4_H
-     hwaddr kernel_addr;
-     hwaddr fdt_addr;
+ extern const uint8_t sm4_sbox[256];
-+
++extern const uint32_t sm4_ck[32];
-+    /* kvm timer */
-+    bool kvm_timer_dirty;
+ static inline uint32_t sm4_subword(uint32_t word)
-+    uint64_t kvm_timer_time;
+ {
-+    uint64_t kvm_timer_compare;
+diff --git a/crypto/sm4.c b/crypto/sm4.c
-+    uint64_t kvm_timer_state;
+index XXXXXXX..XXXXXXX 100644
-+    uint64_t kvm_timer_frequency;
+--- a/crypto/sm4.c
 +++ b/crypto/sm4.c
@@ -XXX,XX +XXX,XX @@ uint8_t const sm4_sbox[] = {
 x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
  };
- OBJECT_DECLARE_TYPE(RISCVCPU, RISCVCPUClass,
++uint32_t const sm4_ck[] = {
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
++    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
-index XXXXXXX..XXXXXXX 100644
++    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
---- a/target/riscv/kvm.c
++    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
-+++ b/target/riscv/kvm.c
++    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
-@@ -XXX,XX +XXX,XX @@
++    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
- #include "kvm_riscv.h"
++    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
- #include "sbi_ecall_interface.h"
++    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
- #include "chardev/char-fe.h"
++    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
-+#include "migration/migration.h"
++};
  static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                   uint64_t idx)
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
  #define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
                   KVM_REG_RISCV_CSR_REG(name))
 +#define RISCV_TIMER_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_TIMER, \
 +                 KVM_REG_RISCV_TIMER_REG(name))
 +
  #define RISCV_FP_F_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_F, idx)
  #define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
          } \
      } while (0)
 +#define KVM_RISCV_GET_TIMER(cs, env, name, reg) \
 +    do { \
 +        int ret = kvm_get_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
 +        if (ret) { \
 +            abort(); \
 +        } \
 +    } while (0)
 +
 +#define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
 +    do { \
 +        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, time), &reg); \
 +        if (ret) { \
 +            abort(); \
 +        } \
 +    } while (0)
 +
  static int kvm_riscv_get_regs_core(CPUState *cs)
  {
      int ret = 0;
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_fp(CPUState *cs)
      return ret;
  }
 +static void kvm_riscv_get_regs_timer(CPUState *cs)
 +{
 +    CPURISCVState *env = &RISCV_CPU(cs)->env;
 +
 +    if (env->kvm_timer_dirty) {
 +        return;
 +    }
 +
 +    KVM_RISCV_GET_TIMER(cs, env, time, env->kvm_timer_time);
 +    KVM_RISCV_GET_TIMER(cs, env, compare, env->kvm_timer_compare);
 +    KVM_RISCV_GET_TIMER(cs, env, state, env->kvm_timer_state);
 +    KVM_RISCV_GET_TIMER(cs, env, frequency, env->kvm_timer_frequency);
 +
 +    env->kvm_timer_dirty = true;
 +}
 +
 +static void kvm_riscv_put_regs_timer(CPUState *cs)
 +{
 +    uint64_t reg;
 +    CPURISCVState *env = &RISCV_CPU(cs)->env;
 +
 +    if (!env->kvm_timer_dirty) {
 +        return;
 +    }
 +
 +    KVM_RISCV_SET_TIMER(cs, env, time, env->kvm_timer_time);
 +    KVM_RISCV_SET_TIMER(cs, env, compare, env->kvm_timer_compare);
 +
 +    /*
 +     * To set register of RISCV_TIMER_REG(state) will occur a error from KVM
 +     * on env->kvm_timer_state == 0, It's better to adapt in KVM, but it
 +     * doesn't matter that adaping in QEMU now.
 +     * TODO If KVM changes, adapt here.
 +     */
 +    if (env->kvm_timer_state) {
 +        KVM_RISCV_SET_TIMER(cs, env, state, env->kvm_timer_state);
 +    }
 +
 +    /*
 +     * For now, migration will not work between Hosts with different timer
 +     * frequency. Therefore, we should check whether they are the same here
 +     * during the migration.
 +     */
 +    if (migration_is_running(migrate_get_current()->state)) {
 +        KVM_RISCV_GET_TIMER(cs, env, frequency, reg);
 +        if (reg != env->kvm_timer_frequency) {
 +            error_report("Dst Hosts timer frequency != Src Hosts");
 +        }
 +    }
 +
 +    env->kvm_timer_dirty = false;
 +}
  const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
      KVM_CAP_LAST_INFO
 --
-.31.1
+.41.0

-[PULL 10/61] target/riscv: Support setting external interrupt by KVM
+[PULL v2 22/45] target/riscv: Add Zvksed ISA extension support
-From: Yifei Jiang <jiangyifei@huawei.com>
+From: Max Chou <max.chou@sifive.com>
-When KVM is enabled, set the S-mode external interrupt through
+This commit adds support for the Zvksed vector-crypto extension, which
-kvm_riscv_set_irq function.
+consists of the following instructions:
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
+* vsm4k.vi
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
+* vsm4r.[vv,vs]
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Anup Patel <anup.patel@wdc.com>
+Translation functions are defined in
-Message-id: 20220112081329.1835-8-jiangyifei@huawei.com
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 [lawrence.hunter@codethink.co.uk: Moved SM4 functions from
 crypto_helper.c to vcrypto_helper.c]
 [nazar.kazakov@codethink.co.uk: Added alignment checks, refactored code to
 use macros, and minor style changes]
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-16-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm_riscv.h |  1 +
+ target/riscv/cpu_cfg.h                   |   1 +
- target/riscv/cpu.c       |  6 +++++-
+ target/riscv/helper.h                    |   4 +
- target/riscv/kvm-stub.c  |  5 +++++
+ target/riscv/insn32.decode               |   5 +
- target/riscv/kvm.c       | 17 +++++++++++++++++
+ target/riscv/cpu.c                       |   5 +-
-files changed, 28 insertions(+), 1 deletion(-)
+ target/riscv/vcrypto_helper.c            | 127 +++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvvk.c.inc |  43 ++++++++
-diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
+files changed, 184 insertions(+), 1 deletion(-)
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm_riscv.h
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
-+++ b/target/riscv/kvm_riscv.h
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@
+--- a/target/riscv/cpu_cfg.h
- #define QEMU_KVM_RISCV_H
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
- void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
+     bool ext_zvkned;
-+void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
+     bool ext_zvknha;
+     bool ext_zvknhb;
- #endif
++    bool ext_zvksed;
      bool ext_zvksh;
      bool ext_zmmul;
      bool ext_zvfbfmin;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
  DEF_HELPER_5(vghsh_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vsm4k_vi, void, ptr, ptr, i32, env, i32)
 +DEF_HELPER_4(vsm4r_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vsm4r_vs, void, ptr, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
  # *** Zvkg vector crypto extension ***
  vghsh_vv    101100 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
 +
 +# *** Zvksed vector crypto extension ***
 +vsm4k_vi    100001 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsm4r_vv    101000 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 +vsm4r_vs    101001 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_irq(void *opaque, int irq, int level)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     case IRQ_S_EXT:
+     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
-     case IRQ_VS_EXT:
+     ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
-     case IRQ_M_EXT:
+     ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
--        riscv_cpu_update_mip(cpu, 1 << irq, BOOL_TO_MASK(level));
++    ISA_EXT_DATA_ENTRY(zvksed, PRIV_VERSION_1_12_0, ext_zvksed),
-+        if (kvm_enabled()) {
+     ISA_EXT_DATA_ENTRY(zvksh, PRIV_VERSION_1_12_0, ext_zvksh),
-+            kvm_riscv_set_irq(cpu, irq, level);
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-+        } else {
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
-+            riscv_cpu_update_mip(cpu, 1 << irq, BOOL_TO_MASK(level));
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-+        }
+      * in qemu
-         break;
+      */
-     default:
+     if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkg || cpu->cfg.ext_zvkned ||
-         g_assert_not_reached();
+-         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
-diff --git a/target/riscv/kvm-stub.c b/target/riscv/kvm-stub.c
++         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksed || cpu->cfg.ext_zvksh) &&
-index XXXXXXX..XXXXXXX 100644
++        !cpu->cfg.ext_zve32f) {
---- a/target/riscv/kvm-stub.c
+         error_setg(errp,
-+++ b/target/riscv/kvm-stub.c
+                    "Vector crypto extensions require V or Zve* extensions");
-@@ -XXX,XX +XXX,XX @@ void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
+         return;
- {
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     abort();
+     DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
      DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 +    DEFINE_PROP_BOOL("x-zvksed", RISCVCPU, cfg.ext_zvksed, false),
      DEFINE_PROP_BOOL("x-zvksh", RISCVCPU, cfg.ext_zvksh, false),
      DEFINE_PROP_END_OF_LIST(),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "crypto/aes.h"
  #include "crypto/aes-round.h"
 +#include "crypto/sm4.h"
  #include "exec/memop.h"
  #include "exec/exec-all.h"
  #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
      vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
      env->vstart = 0;
  }
 +
-+void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level)
++void HELPER(vsm4k_vi)(void *vd, void *vs2, uint32_t uimm5, CPURISCVState *env,
-+{
++                      uint32_t desc)
-+    abort();
++{
-+}
++    const uint32_t egs = 4;
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
++    uint32_t rnd = uimm5 & 0x7;
-index XXXXXXX..XXXXXXX 100644
++    uint32_t group_start = env->vstart / egs;
---- a/target/riscv/kvm.c
++    uint32_t group_end = env->vl / egs;
-+++ b/target/riscv/kvm.c
++    uint32_t esz = sizeof(uint32_t);
-@@ -XXX,XX +XXX,XX @@ void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
++    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-     env->satp = 0;
++
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            rk[j - vstart] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            tmp[j] = rk[j];
 +        }
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            uint32_t b, s;
 +            b = tmp[j + 1] ^ tmp[j + 2] ^ tmp[j + 3] ^ sm4_ck[rnd * 4 + j];
 +
 +            s = sm4_subword(b);
 +
 +            tmp[j + 4] = tmp[j] ^ (s ^ rol32(s, 13) ^ rol32(s, 23));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 +
 +static void do_sm4_round(uint32_t *rk, uint32_t *buf)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t s, b;
 +
 +    for (uint32_t j = egs; j < egs * 2; ++j) {
 +        b = buf[j - 3] ^ buf[j - 2] ^ buf[j - 1] ^ rk[j - 4];
 +
 +        s = sm4_subword(b);
 +
 +        buf[j] = buf[j - 4] ^ (s ^ rol32(s, 2) ^ rol32(s, 10) ^ rol32(s, 18) ^
 +                               rol32(s, 24));
 +    }
 +}
 +
 +void HELPER(vsm4r_vv)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            rk[j - vstart] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            tmp[j - vstart] = *((uint32_t *)vd + H4(j));
 +        }
 +
 +        do_sm4_round(rk, tmp);
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 +
 +void HELPER(vsm4r_vs)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            rk[j] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            tmp[j - vstart] = *((uint32_t *)vd + H4(j));
 +        }
 +
 +        do_sm4_round(rk, tmp);
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vghsh_check(DisasContext *s, arg_rmrr *a)
  }
-+void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level)
+ GEN_VV_UNMASKED_TRANS(vghsh_vv, vghsh_check, ZVKG_EGS)
-+{
++
-+    int ret;
++/*
-+    unsigned virq = level ? KVM_INTERRUPT_SET : KVM_INTERRUPT_UNSET;
++ * Zvksed
-+
++ */
-+    if (irq != IRQ_S_EXT) {
++
-+        perror("kvm riscv set irq != IRQ_S_EXT\n");
++#define ZVKSED_EGS 4
-+        abort();
++
-+    }
++static bool zvksed_check(DisasContext *s)
-+
++{
-+    ret = kvm_vcpu_ioctl(CPU(cpu), KVM_INTERRUPT, &virq);
++    int egw_bytes = ZVKSED_EGS << s->sew;
-+    if (ret < 0) {
++    return s->cfg_ptr->ext_zvksed == true &&
-+        perror("Set irq failed");
++           require_rvv(s) &&
-+        abort();
++           vext_check_isa_ill(s) &&
-+    }
++           MAXSZ(s) >= egw_bytes &&
-+}
++           s->sew == MO_32;
-+
++}
- bool kvm_arch_cpu_check_are_resettable(void)
++
- {
++static bool vsm4k_vi_check(DisasContext *s, arg_rmrr *a)
-     return true;
++{
 +    return zvksed_check(s) &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +GEN_VI_UNMASKED_TRANS(vsm4k_vi, vsm4k_vi_check, ZVKSED_EGS)
 +
 +static bool vsm4r_vv_check(DisasContext *s, arg_rmr *a)
 +{
 +    return zvksed_check(s) &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +GEN_V_UNMASKED_TRANS(vsm4r_vv, vsm4r_vv_check, ZVKSED_EGS)
 +
 +static bool vsm4r_vs_check(DisasContext *s, arg_rmr *a)
 +{
 +    return zvksed_check(s) &&
 +           !is_overlapped(a->rd, 1 << MAX(s->lmul, 0), a->rs2, 1) &&
 +           require_align(a->rd, s->lmul);
 +}
 +
 +GEN_V_UNMASKED_TRANS(vsm4r_vs, vsm4r_vs_check, ZVKSED_EGS)
 --
-.31.1
+.41.0

-[PULL 53/61] target/riscv: Split out the vill from vtype
+[PULL v2 23/45] target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Rob Bradford <rbradford@rivosinc.com>
-We need not specially process vtype when XLEN changes.
+These are WARL fields - zero out the bits for unavailable counters and
 special case the TM bit in mcountinhibit which is hardwired to zero.
 This patch achieves this by modifying the value written so that any use
 of the field will see the correctly masked bits.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+Tested by modifying OpenSBI to write max value to these CSRs and upon
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+subsequent read the appropriate number of bits for number of PMUs is
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+enabled and the TM bit is zero in mcountinhibit.
-Message-id: 20220120122050.41546-16-zhiwei_liu@c-sky.com
 Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Atish Patra <atishp@rivosinc.com>
 Message-ID: <20230802124906.24197-1-rbradford@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h           |  1 +
+ target/riscv/csr.c | 11 +++++++++--
- target/riscv/cpu_helper.c    |  3 +--
+file changed, 9 insertions(+), 2 deletions(-)
  target/riscv/csr.c           | 13 ++++++++++++-
  target/riscv/machine.c       |  5 +++--
  target/riscv/vector_helper.c |  3 ++-
 files changed, 19 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
-     target_ulong vl;
-     target_ulong vstart;
-     target_ulong vtype;
-+    bool vill;
-     target_ulong pc;
-     target_ulong load_res;
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
-+++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
-         uint32_t maxsz = vlmax << sew;
-         bool vl_eq_vlmax = (env->vstart == 0) && (vlmax == env->vl) &&
-                            (maxsz >= 8);
--        flags = FIELD_DP32(flags, TB_FLAGS, VILL,
--                    FIELD_EX64(env->vtype, VTYPE, VILL));
-+        flags = FIELD_DP32(flags, TB_FLAGS, VILL, env->vill);
-         flags = FIELD_DP32(flags, TB_FLAGS, SEW, sew);
-         flags = FIELD_DP32(flags, TB_FLAGS, LMUL,
-                     FIELD_EX64(env->vtype, VTYPE, VLMUL));
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_fcsr(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
  static RISCVException read_vtype(CPURISCVState *env, int csrno,
                                   target_ulong *val)
  {
--    *val = env->vtype;
+     int cidx;
-+    uint64_t vill;
+     PMUCTRState *counter;
-+    switch (env->xl) {
++    RISCVCPU *cpu = env_archcpu(env);
-+    case MXL_RV32:
-+        vill = (uint32_t)env->vill << 31;
+-    env->mcountinhibit = val;
-+        break;
++    /* WARL register - disable unavailable counters; TM bit is always 0 */
-+    case MXL_RV64:
++    env->mcountinhibit =
-+        vill = (uint64_t)env->vill << 63;
++        val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR);
-+        break;
-+    default:
+     /* Check if any other counter is also monitoring cycles/instructions */
-+        g_assert_not_reached();
+     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
-+    }
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
-+    *val = (target_ulong)vill | env->vtype;
+ static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
                                         target_ulong val)
  {
 -    env->mcounteren = val;
 +    RISCVCPU *cpu = env_archcpu(env);
 +
 +    /* WARL register - disable unavailable counters */
 +    env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
 +                             COUNTEREN_IR);
      return RISCV_EXCP_NONE;
  }
-diff --git a/target/riscv/machine.c b/target/riscv/machine.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/machine.c
-+++ b/target/riscv/machine.c
-@@ -XXX,XX +XXX,XX @@ static bool vector_needed(void *opaque)
- static const VMStateDescription vmstate_vector = {
-     .name = "cpu/vector",
--    .version_id = 1,
--    .minimum_version_id = 1,
-+    .version_id = 2,
-+    .minimum_version_id = 2,
-     .needed = vector_needed,
-     .fields = (VMStateField[]) {
-             VMSTATE_UINT64_ARRAY(env.vreg, RISCVCPU, 32 * RV_VLEN_MAX / 64),
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_vector = {
-             VMSTATE_UINTTL(env.vl, RISCVCPU),
-             VMSTATE_UINTTL(env.vstart, RISCVCPU),
-             VMSTATE_UINTTL(env.vtype, RISCVCPU),
-+            VMSTATE_BOOL(env.vill, RISCVCPU),
-             VMSTATE_END_OF_LIST()
-         }
- };
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
-+++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
-         || (ediv != 0)
-         || (reserved != 0)) {
-         /* only set vill bit. */
--        env->vtype = FIELD_DP64(0, VTYPE, VILL, 1);
-+        env->vill = 1;
-+        env->vtype = 0;
-         env->vl = 0;
-         env->vstart = 0;
-         return 0;
 --
-.31.1
+.41.0

-[PULL 29/61] target/riscv: rvv-1.0: Add Zve32f extension into RISC-V
+[PULL v2 24/45] target/riscv: Add Zihintntl extension ISA string to DTS
-From: Frank Chang <frank.chang@sifive.com>
+From: Jason Chien <jason.chien@sifive.com>
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+RVA23 Profiles states:
 The RVA23 profiles are intended to be used for 64-bit application
 processors that will run rich OS stacks from standard binary OS
 distributions and with a substantial number of third-party binary user
 applications that will be supported over a considerable length of time
 in the field.
 The chapter 4 of the unprivileged spec introduces the Zihintntl extension
 and Zihintntl is a mandatory extension presented in RVA23 Profiles, whose
 purpose is to enable application and operating system portability across
 different implementations. Thus the DTS should contain the Zihintntl ISA
 string in order to pass to software.
 The unprivileged spec states:
 Like any HINTs, these instructions may be freely ignored. Hence, although
 they are described in terms of cache-based memory hierarchies, they do not
 mandate the provision of caches.
 These instructions are encoded with non-used opcode, e.g. ADD x0, x0, x2,
 which QEMU already supports, and QEMU does not emulate cache. Therefore
 these instructions can be considered as a no-op, and we only need to add
 a new property for the Zihintntl extension.
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220118014522.13613-12-frank.chang@sifive.com
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
 Message-ID: <20230726074049.19505-2-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        | 1 +
+ target/riscv/cpu_cfg.h | 1 +
- target/riscv/cpu.c        | 4 ++--
+ target/riscv/cpu.c     | 2 ++
- target/riscv/cpu_helper.c | 2 +-
+files changed, 3 insertions(+)
  target/riscv/csr.c        | 2 +-
  target/riscv/translate.c  | 2 ++
 files changed, 7 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPU {
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-         bool ext_icsr;
+     bool ext_icbom;
-         bool ext_zfh;
+     bool ext_icboz;
-         bool ext_zfhmin;
+     bool ext_zicond;
-+        bool ext_zve32f;
++    bool ext_zihintntl;
-         bool ext_zve64f;
+     bool ext_zihintpause;
+     bool ext_smstateen;
-         char *priv_spec;
+     bool ext_sstc;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-             }
+     ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
-             set_vext_version(env, vext_version);
+     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
-         }
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
--        if (cpu->cfg.ext_zve64f && !cpu->cfg.ext_f) {
++    ISA_EXT_DATA_ENTRY(zihintntl, PRIV_VERSION_1_10_0, ext_zihintntl),
--            error_setg(errp, "Zve64f extension depends upon RVF.");
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
-+        if ((cpu->cfg.ext_zve32f || cpu->cfg.ext_zve64f) && !cpu->cfg.ext_f) {
+     ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
-+            error_setg(errp, "Zve32f/Zve64f extension depends upon RVF.");
+     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
-             return;
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-         }
+     DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
-         if (cpu->cfg.ext_j) {
+     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
-index XXXXXXX..XXXXXXX 100644
++    DEFINE_PROP_BOOL("Zihintntl", RISCVCPU, cfg.ext_zihintntl, true),
---- a/target/riscv/cpu_helper.c
+     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
-+++ b/target/riscv/cpu_helper.c
+     DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
+     DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
      *pc = env->pc;
      *cs_base = 0;
 -    if (riscv_has_ext(env, RVV) || cpu->cfg.ext_zve64f) {
 +    if (riscv_has_ext(env, RVV) || cpu->cfg.ext_zve32f || cpu->cfg.ext_zve64f) {
          /*
           * If env->vl equals to VLMAX, we can use generic vector operation
           * expanders (GVEC) to accerlate the vector operations.
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException vs(CPURISCVState *env, int csrno)
      RISCVCPU *cpu = RISCV_CPU(cs);
      if (env->misa_ext & RVV ||
 -        cpu->cfg.ext_zve64f) {
 +        cpu->cfg.ext_zve32f || cpu->cfg.ext_zve64f) {
  #if !defined(CONFIG_USER_ONLY)
          if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
              return RISCV_EXCP_ILLEGAL_INST;
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      bool ext_ifencei;
      bool ext_zfh;
      bool ext_zfhmin;
 +    bool ext_zve32f;
      bool ext_zve64f;
      bool hlsx;
      /* vector extension */
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      ctx->ext_ifencei = cpu->cfg.ext_ifencei;
      ctx->ext_zfh = cpu->cfg.ext_zfh;
      ctx->ext_zfhmin = cpu->cfg.ext_zfhmin;
 +    ctx->ext_zve32f = cpu->cfg.ext_zve32f;
      ctx->ext_zve64f = cpu->cfg.ext_zve64f;
      ctx->vlen = cpu->cfg.vlen;
      ctx->elen = cpu->cfg.elen;
 --
-.31.1
+.41.0

-[PULL 51/61] target/riscv: Calculate address according to XLEN
+[PULL v2 25/45] target/riscv: Fix zfa fleq.d and fltq.d
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Define one common function to compute a canonical address from a register
+Commit a47842d ("riscv: Add support for the Zfa extension") implemented the zfa extension.
-plus offset. Merge gen_pm_adjust_address into this function.
+However, it has some typos for fleq.d and fltq.d. Both of them misused the fltq.s
 helper function.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+Fixes: a47842d ("riscv: Add support for the Zfa extension")
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-id: 20220120122050.41546-14-zhiwei_liu@c-sky.com
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Message-ID: <20230728003906.768-1-zhiwei_liu@linux.alibaba.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/translate.c                | 25 ++++++++++++-------------
+ target/riscv/insn_trans/trans_rvzfa.c.inc | 4 ++--
- target/riscv/insn_trans/trans_rva.c.inc |  9 +++------
+file changed, 2 insertions(+), 2 deletions(-)
  target/riscv/insn_trans/trans_rvd.c.inc | 19 ++-----------------
  target/riscv/insn_trans/trans_rvf.c.inc | 19 ++-----------------
  target/riscv/insn_trans/trans_rvi.c.inc | 18 ++----------------
 files changed, 21 insertions(+), 69 deletions(-)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/target/riscv/insn_trans/trans_rvzfa.c.inc
-+++ b/target/riscv/translate.c
++++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
-@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
+@@ -XXX,XX +XXX,XX @@ bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
-     ctx->base.is_jmp = DISAS_NORETURN;
+     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
- }
+     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
--/*
+-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
-- * Generates address adjustment for PointerMasking
++    gen_helper_fleq_d(dest, cpu_env, src1, src2);
 - */
 -static TCGv gen_pm_adjust_address(DisasContext *s, TCGv src)
 +/* Compute a canonical address from a register plus offset. */
 +static TCGv get_address(DisasContext *ctx, int rs1, int imm)
  {
 -    TCGv temp;
 -    if (!s->pm_enabled) {
 -        /* Load unmodified address */
 -        return src;
 -    } else {
 -        temp = temp_new(s);
 -        tcg_gen_andc_tl(temp, src, pm_mask);
 -        tcg_gen_or_tl(temp, temp, pm_base);
 -        return temp;
 +    TCGv addr = temp_new(ctx);
 +    TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
 +
 +    tcg_gen_addi_tl(addr, src1, imm);
 +    if (ctx->pm_enabled) {
 +        tcg_gen_and_tl(addr, addr, pm_mask);
 +        tcg_gen_or_tl(addr, addr, pm_base);
 +    } else if (get_xl(ctx) == MXL_RV32) {
 +        tcg_gen_ext32u_tl(addr, addr);
      }
 +    return addr;
  }
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/riscv/insn_trans/trans_rva.c.inc b/target/riscv/insn_trans/trans_rva.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rva.c.inc
 +++ b/target/riscv/insn_trans/trans_rva.c.inc
@@ -XXX,XX +XXX,XX @@
  static bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop)
  {
 -    TCGv src1 = get_gpr(ctx, a->rs1, EXT_ZERO);
 +    TCGv src1 = get_address(ctx, a->rs1, 0);
      if (a->rl) {
          tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
      }
 -    src1 = gen_pm_adjust_address(ctx, src1);
      tcg_gen_qemu_ld_tl(load_val, src1, ctx->mem_idx, mop);
      if (a->aq) {
          tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
@@ -XXX,XX +XXX,XX @@ static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
      TCGLabel *l1 = gen_new_label();
      TCGLabel *l2 = gen_new_label();
 -    src1 = get_gpr(ctx, a->rs1, EXT_ZERO);
 -    src1 = gen_pm_adjust_address(ctx, src1);
 +    src1 = get_address(ctx, a->rs1, 0);
      tcg_gen_brcond_tl(TCG_COND_NE, load_res, src1, l1);
      /*
@@ -XXX,XX +XXX,XX @@ static bool gen_amo(DisasContext *ctx, arg_atomic *a,
                      MemOp mop)
  {
      TCGv dest = dest_gpr(ctx, a->rd);
 -    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
 +    TCGv src1 = get_address(ctx, a->rs1, 0);
      TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
 -    src1 = gen_pm_adjust_address(ctx, src1);
      func(dest, src1, src2, ctx->mem_idx, mop);
      gen_set_gpr(ctx, a->rd, dest);
-diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvd.c.inc
-+++ b/target/riscv/insn_trans/trans_rvd.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_fld(DisasContext *ctx, arg_fld *a)
-     REQUIRE_FPU;
-     REQUIRE_EXT(ctx, RVD);
--    addr = get_gpr(ctx, a->rs1, EXT_NONE);
--    if (a->imm) {
--        TCGv temp = temp_new(ctx);
--        tcg_gen_addi_tl(temp, addr, a->imm);
--        addr = temp;
--    }
--    addr = gen_pm_adjust_address(ctx, addr);
--
-+    addr = get_address(ctx, a->rs1, a->imm);
-     tcg_gen_qemu_ld_i64(cpu_fpr[a->rd], addr, ctx->mem_idx, MO_TEUQ);
-     mark_fs_dirty(ctx);
-@@ -XXX,XX +XXX,XX @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
-     REQUIRE_FPU;
-     REQUIRE_EXT(ctx, RVD);
--    addr = get_gpr(ctx, a->rs1, EXT_NONE);
--    if (a->imm) {
--        TCGv temp = temp_new(ctx);
--        tcg_gen_addi_tl(temp, addr, a->imm);
--        addr = temp;
--    }
--    addr = gen_pm_adjust_address(ctx, addr);
--
-+    addr = get_address(ctx, a->rs1, a->imm);
-     tcg_gen_qemu_st_i64(cpu_fpr[a->rs2], addr, ctx->mem_idx, MO_TEUQ);
--
      return true;
  }
+@@ -XXX,XX +XXX,XX @@ bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
-diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
+     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
-index XXXXXXX..XXXXXXX 100644
+     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
---- a/target/riscv/insn_trans/trans_rvf.c.inc
-+++ b/target/riscv/insn_trans/trans_rvf.c.inc
+-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
-@@ -XXX,XX +XXX,XX @@ static bool trans_flw(DisasContext *ctx, arg_flw *a)
++    gen_helper_fltq_d(dest, cpu_env, src1, src2);
      REQUIRE_FPU;
      REQUIRE_EXT(ctx, RVF);
 -    addr = get_gpr(ctx, a->rs1, EXT_NONE);
 -    if (a->imm) {
 -        TCGv temp = temp_new(ctx);
 -        tcg_gen_addi_tl(temp, addr, a->imm);
 -        addr = temp;
 -    }
 -    addr = gen_pm_adjust_address(ctx, addr);
 -
 +    addr = get_address(ctx, a->rs1, a->imm);
      dest = cpu_fpr[a->rd];
      tcg_gen_qemu_ld_i64(dest, addr, ctx->mem_idx, MO_TEUL);
      gen_nanbox_s(dest, dest);
@@ -XXX,XX +XXX,XX @@ static bool trans_fsw(DisasContext *ctx, arg_fsw *a)
      REQUIRE_FPU;
      REQUIRE_EXT(ctx, RVF);
 -    addr = get_gpr(ctx, a->rs1, EXT_NONE);
 -    if (a->imm) {
 -        TCGv temp = tcg_temp_new();
 -        tcg_gen_addi_tl(temp, addr, a->imm);
 -        addr = temp;
 -    }
 -    addr = gen_pm_adjust_address(ctx, addr);
 -
 +    addr = get_address(ctx, a->rs1, a->imm);
      tcg_gen_qemu_st_i64(cpu_fpr[a->rs2], addr, ctx->mem_idx, MO_TEUL);
 -
      return true;
  }
 diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvi.c.inc
 +++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_bgeu(DisasContext *ctx, arg_bgeu *a)
  static bool gen_load_tl(DisasContext *ctx, arg_lb *a, MemOp memop)
  {
      TCGv dest = dest_gpr(ctx, a->rd);
 -    TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
 -
 -    if (a->imm) {
 -        TCGv temp = temp_new(ctx);
 -        tcg_gen_addi_tl(temp, addr, a->imm);
 -        addr = temp;
 -    }
 -    addr = gen_pm_adjust_address(ctx, addr);
 +    TCGv addr = get_address(ctx, a->rs1, a->imm);
      tcg_gen_qemu_ld_tl(dest, addr, ctx->mem_idx, memop);
      gen_set_gpr(ctx, a->rd, dest);
-@@ -XXX,XX +XXX,XX @@ static bool trans_ldu(DisasContext *ctx, arg_ldu *a)
- static bool gen_store_tl(DisasContext *ctx, arg_sb *a, MemOp memop)
- {
--    TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
-+    TCGv addr = get_address(ctx, a->rs1, a->imm);
-     TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
--    if (a->imm) {
--        TCGv temp = temp_new(ctx);
--        tcg_gen_addi_tl(temp, addr, a->imm);
--        addr = temp;
--    }
--    addr = gen_pm_adjust_address(ctx, addr);
--
-     tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, memop);
      return true;
  }
 --
-.31.1
+.41.0

-[PULL 58/61] target/riscv: Adjust scalar reg in vector with XLEN
+[PULL v2 26/45] hw/intc: Fix upper/lower mtime write calculation
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Jason Chien <jason.chien@sifive.com>
-When sew <= 32bits, not need to extend scalar reg.
+When writing the upper mtime, we should keep the original lower mtime
-When sew > 32bits, if xlen is less that sew, we should sign extend
+whose value is given by cpu_riscv_read_rtc() instead of
-the scalar register, except explicitly specified by the spec.
+cpu_riscv_read_rtc_raw(). The same logic applies to writes to lower mtime.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-21-zhiwei_liu@c-sky.com
+Message-ID: <20230728082502.26439-1-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvv.c.inc | 2 +-
+ hw/intc/riscv_aclint.c | 5 +++--
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
+diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
+--- a/hw/intc/riscv_aclint.c
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
++++ b/hw/intc/riscv_aclint.c
-@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
-     dest = tcg_temp_new_ptr();
+         return;
-     mask = tcg_temp_new_ptr();
+     } else if (addr == mtimer->time_base || addr == mtimer->time_base + 4) {
-     src2 = tcg_temp_new_ptr();
+         uint64_t rtc_r = cpu_riscv_read_rtc_raw(mtimer->timebase_freq);
--    src1 = get_gpr(s, rs1, EXT_NONE);
++        uint64_t rtc = cpu_riscv_read_rtc(mtimer);
-+    src1 = get_gpr(s, rs1, EXT_SIGN);
+         if (addr == mtimer->time_base) {
-     data = FIELD_DP32(data, VDATA, VM, vm);
+             if (size == 4) {
-     data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+                 /* time_lo for RV32/RV64 */
 -                mtimer->time_delta = ((rtc_r & ~0xFFFFFFFFULL) | value) - rtc_r;
 +                mtimer->time_delta = ((rtc & ~0xFFFFFFFFULL) | value) - rtc_r;
              } else {
                  /* time for RV64 */
                  mtimer->time_delta = value - rtc_r;
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
          } else {
              if (size == 4) {
                  /* time_hi for RV32/RV64 */
 -                mtimer->time_delta = (value << 32 | (rtc_r & 0xFFFFFFFF)) - rtc_r;
 +                mtimer->time_delta = (value << 32 | (rtc & 0xFFFFFFFF)) - rtc_r;
              } else {
                  qemu_log_mask(LOG_GUEST_ERROR,
                                "aclint-mtimer: invalid time_hi write: %08x",
 --
-.31.1
+.41.0

-[PULL 52/61] target/riscv: Split pm_enabled into mask and base
+[PULL v2 27/45] hw/intc: Make rtc variable names consistent
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Jason Chien <jason.chien@sifive.com>
-Use cached cur_pmmask and cur_pmbase to infer the
+The variables whose values are given by cpu_riscv_read_rtc() should be named
-current PM mode.
+"rtc". The variables whose value are given by cpu_riscv_read_rtc_raw()
 should be named "rtc_r".
-This may decrease the TCG IR by one when pm_enabled
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
 is true and pm_base_enabled is false.
 Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-15-zhiwei_liu@c-sky.com
+Message-ID: <20230728082502.26439-2-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        |  3 ++-
+ hw/intc/riscv_aclint.c | 6 +++---
- target/riscv/cpu_helper.c | 24 ++++++------------------
+file changed, 3 insertions(+), 3 deletions(-)
  target/riscv/translate.c  | 12 ++++++++----
 files changed, 16 insertions(+), 23 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/hw/intc/riscv_aclint.c
-+++ b/target/riscv/cpu.h
++++ b/hw/intc/riscv_aclint.c
-@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, MSTATUS_HS_VS, 18, 2)
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
- /* The combination of MXL/SXL/UXL that applies to the current cpu mode. */
+     uint64_t next;
- FIELD(TB_FLAGS, XL, 20, 2)
+     uint64_t diff;
- /* If PointerMasking should be applied */
--FIELD(TB_FLAGS, PM_ENABLED, 22, 1)
+-    uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
-+FIELD(TB_FLAGS, PM_MASK_ENABLED, 22, 1)
++    uint64_t rtc = cpu_riscv_read_rtc(mtimer);
-+FIELD(TB_FLAGS, PM_BASE_ENABLED, 23, 1)
+     /* Compute the relative hartid w.r.t the socket */
- #ifdef TARGET_RISCV32
+     hartid = hartid - mtimer->hartid_base;
- #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+     mtimer->timecmp[hartid] = value;
-index XXXXXXX..XXXXXXX 100644
+-    if (mtimer->timecmp[hartid] <= rtc_r) {
---- a/target/riscv/cpu_helper.c
++    if (mtimer->timecmp[hartid] <= rtc) {
-+++ b/target/riscv/cpu_helper.c
+         /*
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
+          * If we're setting an MTIMECMP value in the "past",
-         flags = FIELD_DP32(flags, TB_FLAGS, MSTATUS_HS_VS,
+          * immediately raise the timer interrupt
-                            get_field(env->mstatus_hs, MSTATUS_VS));
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
-     }
--    if (riscv_has_ext(env, RVJ)) {
+     /* otherwise, set up the future timer interrupt */
--        int priv = flags & TB_FLAGS_PRIV_MMU_MASK;
+     qemu_irq_lower(mtimer->timer_irqs[hartid]);
--        bool pm_enabled = false;
+-    diff = mtimer->timecmp[hartid] - rtc_r;
--        switch (priv) {
++    diff = mtimer->timecmp[hartid] - rtc;
--        case PRV_U:
+     /* back to ns (note args switched in muldiv64) */
--            pm_enabled = env->mmte & U_PM_ENABLE;
+     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
 -            break;
 -        case PRV_S:
 -            pm_enabled = env->mmte & S_PM_ENABLE;
 -            break;
 -        case PRV_M:
 -            pm_enabled = env->mmte & M_PM_ENABLE;
 -            break;
 -        default:
 -            g_assert_not_reached();
 -        }
 -        flags = FIELD_DP32(flags, TB_FLAGS, PM_ENABLED, pm_enabled);
 -    }
  #endif
      flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
 +    if (env->cur_pmmask < (env->xl == MXL_RV32 ? UINT32_MAX : UINT64_MAX)) {
 +        flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
 +    }
 +    if (env->cur_pmbase != 0) {
 +        flags = FIELD_DP32(flags, TB_FLAGS, PM_BASE_ENABLED, 1);
 +    }
      *pflags = flags;
  }
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      /* Space for 3 operands plus 1 extra for address computation. */
      TCGv temp[4];
      /* PointerMasking extension */
 -    bool pm_enabled;
 +    bool pm_mask_enabled;
 +    bool pm_base_enabled;
  } DisasContext;
  static inline bool has_ext(DisasContext *ctx, uint32_t ext)
@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
      TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
      tcg_gen_addi_tl(addr, src1, imm);
 -    if (ctx->pm_enabled) {
 +    if (ctx->pm_mask_enabled) {
          tcg_gen_and_tl(addr, addr, pm_mask);
 -        tcg_gen_or_tl(addr, addr, pm_base);
      } else if (get_xl(ctx) == MXL_RV32) {
          tcg_gen_ext32u_tl(addr, addr);
      }
 +    if (ctx->pm_base_enabled) {
 +        tcg_gen_or_tl(addr, addr, pm_base);
 +    }
      return addr;
  }
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      ctx->cs = cs;
      ctx->ntemp = 0;
      memset(ctx->temp, 0, sizeof(ctx->temp));
 -    ctx->pm_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_ENABLED);
 +    ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
 +    ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
      ctx->zero = tcg_constant_tl(0);
  }
 --
-.31.1
+.41.0

-[PULL 30/61] target/riscv: rvv-1.0: Add Zve32f support for configuration insns
+[PULL v2 28/45] linux-user/riscv: Use abi type for target_ucontext
-From: Frank Chang <frank.chang@sifive.com>
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-All Zve* extensions support the vector configuration instructions.
+We should not use types dependend on host arch for target_ucontext.
 This bug is found when run rv32 applications.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220118014522.13613-13-frank.chang@sifive.com
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-ID: <20230811055438.1945-1-zhiwei_liu@linux.alibaba.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvv.c.inc | 4 ++--
+ linux-user/riscv/signal.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
+diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
+--- a/linux-user/riscv/signal.c
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
++++ b/linux-user/riscv/signal.c
-@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
+@@ -XXX,XX +XXX,XX @@ struct target_sigcontext {
-     TCGv s1, dst;
+ }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
-     if (!require_rvv(s) ||
+ struct target_ucontext {
--        !(has_ext(s, RVV) || s->ext_zve64f)) {
+-    unsigned long uc_flags;
-+        !(has_ext(s, RVV) || s->ext_zve32f || s->ext_zve64f)) {
+-    struct target_ucontext *uc_link;
-         return false;
++    abi_ulong uc_flags;
-     }
++    abi_ptr uc_link;
+     target_stack_t uc_stack;
-@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
+     target_sigset_t uc_sigmask;
-     TCGv dst;
+     uint8_t   __unused[1024 / 8 - sizeof(target_sigset_t)];
      if (!require_rvv(s) ||
 -        !(has_ext(s, RVV) || s->ext_zve64f)) {
 +        !(has_ext(s, RVV) || s->ext_zve32f || s->ext_zve64f)) {
          return false;
      }
 --
-.31.1
+.41.0

-[PULL 31/61] target/riscv: rvv-1.0: Add Zve32f support for scalar fp insns
+[PULL v2 29/45] target/riscv: support the AIA device emulation with KVM enabled
-From: Frank Chang <frank.chang@sifive.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Zve32f extension requires the scalar processor to implement the F
+In this patch, we create the APLIC and IMSIC FDT helper functions and
-extension and implement all vector floating-point instructions for
+remove M mode AIA devices when using KVM acceleration.
 floating-point operands with EEW=32 (i.e., no widening floating-point
 operations).
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Message-id: 20220118014522.13613-14-frank.chang@sifive.com
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20230727102439.22554-2-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvv.c.inc | 21 +++++++++++++++++++++
+ hw/riscv/virt.c | 290 +++++++++++++++++++++++-------------------------
-file changed, 21 insertions(+)
+file changed, 137 insertions(+), 153 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
+--- a/hw/riscv/virt.c
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
++++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static bool require_scale_rvf(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ static uint32_t imsic_num_bits(uint32_t count)
-     }
+     return ret;
  }
-+static bool require_zve32f(DisasContext *s)
+-static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
 -                             uint32_t *phandle, uint32_t *intc_phandles,
 -                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
 +static void create_fdt_one_imsic(RISCVVirtState *s, hwaddr base_addr,
 +                                 uint32_t *intc_phandles, uint32_t msi_phandle,
 +                                 bool m_mode, uint32_t imsic_guest_bits)
  {
      int cpu, socket;
      char *imsic_name;
      MachineState *ms = MACHINE(s);
      int socket_count = riscv_socket_count(ms);
 -    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
 +    uint32_t imsic_max_hart_per_socket;
      uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
 -    *msi_m_phandle = (*phandle)++;
 -    *msi_s_phandle = (*phandle)++;
      imsic_cells = g_new0(uint32_t, ms->smp.cpus * 2);
      imsic_regs = g_new0(uint32_t, socket_count * 4);
 -    /* M-level IMSIC node */
      for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
          imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
 +        imsic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
      }
 -    imsic_max_hart_per_socket = 0;
 -    for (socket = 0; socket < socket_count; socket++) {
 -        imsic_addr = memmap[VIRT_IMSIC_M].base +
 -                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 -        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
 -        imsic_regs[socket * 4 + 0] = 0;
 -        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
 -        imsic_regs[socket * 4 + 2] = 0;
 -        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
 -        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
 -            imsic_max_hart_per_socket = s->soc[socket].num_harts;
 -        }
 -    }
 -    imsic_name = g_strdup_printf("/soc/imsics@%lx",
 -        (unsigned long)memmap[VIRT_IMSIC_M].base);
 -    qemu_fdt_add_subnode(ms->fdt, imsic_name);
 -    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
 -        "riscv,imsics");
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
 -        FDT_IMSIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
 -        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
 -        socket_count * sizeof(uint32_t) * 4);
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
 -        VIRT_IRQCHIP_NUM_MSIS);
 -    if (socket_count > 1) {
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
 -            imsic_num_bits(imsic_max_hart_per_socket));
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
 -            imsic_num_bits(socket_count));
 -        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
 -            IMSIC_MMIO_GROUP_MIN_SHIFT);
 -    }
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_m_phandle);
 -
 -    g_free(imsic_name);
 -    /* S-level IMSIC node */
 -    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
 -        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 -    }
 -    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
      imsic_max_hart_per_socket = 0;
      for (socket = 0; socket < socket_count; socket++) {
 -        imsic_addr = memmap[VIRT_IMSIC_S].base +
 -                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 +        imsic_addr = base_addr + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
          imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
                       s->soc[socket].num_harts;
          imsic_regs[socket * 4 + 0] = 0;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
              imsic_max_hart_per_socket = s->soc[socket].num_harts;
          }
      }
 -    imsic_name = g_strdup_printf("/soc/imsics@%lx",
 -        (unsigned long)memmap[VIRT_IMSIC_S].base);
 +
 +    imsic_name = g_strdup_printf("/soc/imsics@%lx", (unsigned long)base_addr);
      qemu_fdt_add_subnode(ms->fdt, imsic_name);
 -    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
 -        "riscv,imsics");
 +    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible", "riscv,imsics");
      qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
 -        FDT_IMSIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
 -        NULL, 0);
 +                          FDT_IMSIC_INT_CELLS);
 +    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller", NULL, 0);
      qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
 -        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
 +                     imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
      qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
 -        socket_count * sizeof(uint32_t) * 4);
 +                     socket_count * sizeof(uint32_t) * 4);
      qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
 -        VIRT_IRQCHIP_NUM_MSIS);
 +                     VIRT_IRQCHIP_NUM_MSIS);
 +
      if (imsic_guest_bits) {
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,guest-index-bits",
 -            imsic_guest_bits);
 +                              imsic_guest_bits);
      }
 +
      if (socket_count > 1) {
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
 -            imsic_num_bits(imsic_max_hart_per_socket));
 +                              imsic_num_bits(imsic_max_hart_per_socket));
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
 -            imsic_num_bits(socket_count));
 +                              imsic_num_bits(socket_count));
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
 -            IMSIC_MMIO_GROUP_MIN_SHIFT);
 +                              IMSIC_MMIO_GROUP_MIN_SHIFT);
      }
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_s_phandle);
 -    g_free(imsic_name);
 +    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", msi_phandle);
 +    g_free(imsic_name);
      g_free(imsic_regs);
      g_free(imsic_cells);
  }
 -static void create_fdt_socket_aplic(RISCVVirtState *s,
 -                                    const MemMapEntry *memmap, int socket,
 -                                    uint32_t msi_m_phandle,
 -                                    uint32_t msi_s_phandle,
 -                                    uint32_t *phandle,
 -                                    uint32_t *intc_phandles,
 -                                    uint32_t *aplic_phandles)
 +static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
 +                             uint32_t *phandle, uint32_t *intc_phandles,
 +                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
 +{
-+    /* RVV + Zve32f = RVV. */
++    *msi_m_phandle = (*phandle)++;
-+    if (has_ext(s, RVV)) {
++    *msi_s_phandle = (*phandle)++;
-+        return true;
++
 +    if (!kvm_enabled()) {
 +        /* M-level IMSIC node */
 +        create_fdt_one_imsic(s, memmap[VIRT_IMSIC_M].base, intc_phandles,
 +                             *msi_m_phandle, true, 0);
 +    }
 +
-+    /* Zve32f doesn't support FP64. (Section 18.2) */
++    /* S-level IMSIC node */
-+    return s->ext_zve32f ? s->sew <= MO_32 : true;
++    create_fdt_one_imsic(s, memmap[VIRT_IMSIC_S].base, intc_phandles,
 +                         *msi_s_phandle, false,
 +                         imsic_num_bits(s->aia_guests + 1));
 +
 +}
 +
- static bool require_zve64f(DisasContext *s)
++static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
 +                                 unsigned long aplic_addr, uint32_t aplic_size,
 +                                 uint32_t msi_phandle,
 +                                 uint32_t *intc_phandles,
 +                                 uint32_t aplic_phandle,
 +                                 uint32_t aplic_child_phandle,
 +                                 bool m_mode)
  {
-     /* RVV + Zve64f = RVV. */
+     int cpu;
-@@ -XXX,XX +XXX,XX @@ static bool opfvv_check(DisasContext *s, arg_rmrr *a)
+     char *aplic_name;
-            require_rvf(s) &&
+     uint32_t *aplic_cells;
-            vext_check_isa_ill(s) &&
+-    unsigned long aplic_addr;
-            vext_check_sss(s, a->rd, a->rs1, a->rs2, a->vm) &&
+     MachineState *ms = MACHINE(s);
-+           require_zve32f(s) &&
+-    uint32_t aplic_m_phandle, aplic_s_phandle;
-            require_zve64f(s);
 -    aplic_m_phandle = (*phandle)++;
 -    aplic_s_phandle = (*phandle)++;
      aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 -    /* M-level APLIC node */
      for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
          aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
 +        aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
      }
 -    aplic_addr = memmap[VIRT_APLIC_M].base +
 -                 (memmap[VIRT_APLIC_M].size * socket);
 +
      aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
      qemu_fdt_add_subnode(ms->fdt, aplic_name);
      qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
      qemu_fdt_setprop_cell(ms->fdt, aplic_name,
 -        "#interrupt-cells", FDT_APLIC_INT_CELLS);
 +                          "#interrupt-cells", FDT_APLIC_INT_CELLS);
      qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
 +
      if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
          qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
 -            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +                         aplic_cells,
 +                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
      } else {
 -        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
 -            msi_m_phandle);
 +        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
      }
 +
      qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
 -        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
 +                           0x0, aplic_addr, 0x0, aplic_size);
      qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
 -        VIRT_IRQCHIP_NUM_SOURCES);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
 -        aplic_s_phandle);
 -    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
 -        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
 +                          VIRT_IRQCHIP_NUM_SOURCES);
 +
 +    if (aplic_child_phandle) {
 +        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
 +                              aplic_child_phandle);
 +        qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
 +                               aplic_child_phandle, 0x1,
 +                               VIRT_IRQCHIP_NUM_SOURCES);
 +    }
 +
      riscv_socket_fdt_write_id(ms, aplic_name, socket);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_m_phandle);
 +    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_phandle);
 +
      g_free(aplic_name);
 +    g_free(aplic_cells);
 +}
 -    /* S-level APLIC node */
 -    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 -        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 +static void create_fdt_socket_aplic(RISCVVirtState *s,
 +                                    const MemMapEntry *memmap, int socket,
 +                                    uint32_t msi_m_phandle,
 +                                    uint32_t msi_s_phandle,
 +                                    uint32_t *phandle,
 +                                    uint32_t *intc_phandles,
 +                                    uint32_t *aplic_phandles)
 +{
 +    char *aplic_name;
 +    unsigned long aplic_addr;
 +    MachineState *ms = MACHINE(s);
 +    uint32_t aplic_m_phandle, aplic_s_phandle;
 +
 +    aplic_m_phandle = (*phandle)++;
 +    aplic_s_phandle = (*phandle)++;
 +
 +    if (!kvm_enabled()) {
 +        /* M-level APLIC node */
 +        aplic_addr = memmap[VIRT_APLIC_M].base +
 +                     (memmap[VIRT_APLIC_M].size * socket);
 +        create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
 +                             msi_m_phandle, intc_phandles,
 +                             aplic_m_phandle, aplic_s_phandle,
 +                             true);
      }
 +
 +    /* S-level APLIC node */
      aplic_addr = memmap[VIRT_APLIC_S].base +
                   (memmap[VIRT_APLIC_S].size * socket);
 +    create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
 +                         msi_s_phandle, intc_phandles,
 +                         aplic_s_phandle, 0,
 +                         false);
 +
      aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 -    qemu_fdt_add_subnode(ms->fdt, aplic_name);
 -    qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name,
 -        "#interrupt-cells", FDT_APLIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
 -    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
 -        qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
 -            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 -    } else {
 -        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
 -            msi_s_phandle);
 -    }
 -    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
 -        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
 -        VIRT_IRQCHIP_NUM_SOURCES);
 -    riscv_socket_fdt_write_id(ms, aplic_name, socket);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_s_phandle);
      if (!socket) {
          platform_bus_add_all_fdt_nodes(ms->fdt, aplic_name,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
      g_free(aplic_name);
 -    g_free(aplic_cells);
      aplic_phandles[socket] = aplic_s_phandle;
  }
-@@ -XXX,XX +XXX,XX @@ static bool opfvf_check(DisasContext *s, arg_rmrr *a)
+@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
-            require_rvf(s) &&
+     int i;
-            vext_check_isa_ill(s) &&
+     hwaddr addr;
-            vext_check_ss(s, a->rd, a->rs2, a->vm) &&
+     uint32_t guest_bits;
-+           require_zve32f(s) &&
+-    DeviceState *aplic_m;
-            require_zve64f(s);
+-    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
 +    DeviceState *aplic_s = NULL;
 +    DeviceState *aplic_m = NULL;
 +    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
      if (msimode) {
 -        /* Per-socket M-level IMSICs */
 -        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 -        for (i = 0; i < hart_count; i++) {
 -            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
 -                               base_hartid + i, true, 1,
 -                               VIRT_IRQCHIP_NUM_MSIS);
 +        if (!kvm_enabled()) {
 +            /* Per-socket M-level IMSICs */
 +            addr = memmap[VIRT_IMSIC_M].base +
 +                   socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 +            for (i = 0; i < hart_count; i++) {
 +                riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
 +                                   base_hartid + i, true, 1,
 +                                   VIRT_IRQCHIP_NUM_MSIS);
 +            }
          }
          /* Per-socket S-level IMSICs */
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
          }
      }
 -    /* Per-socket M-level APLIC */
 -    aplic_m = riscv_aplic_create(
 -        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
 -        memmap[VIRT_APLIC_M].size,
 -        (msimode) ? 0 : base_hartid,
 -        (msimode) ? 0 : hart_count,
 -        VIRT_IRQCHIP_NUM_SOURCES,
 -        VIRT_IRQCHIP_NUM_PRIO_BITS,
 -        msimode, true, NULL);
 -
 -    if (aplic_m) {
 -        /* Per-socket S-level APLIC */
 -        riscv_aplic_create(
 -            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
 -            memmap[VIRT_APLIC_S].size,
 -            (msimode) ? 0 : base_hartid,
 -            (msimode) ? 0 : hart_count,
 -            VIRT_IRQCHIP_NUM_SOURCES,
 -            VIRT_IRQCHIP_NUM_PRIO_BITS,
 -            msimode, false, aplic_m);
 +    if (!kvm_enabled()) {
 +        /* Per-socket M-level APLIC */
 +        aplic_m = riscv_aplic_create(memmap[VIRT_APLIC_M].base +
 +                                     socket * memmap[VIRT_APLIC_M].size,
 +                                     memmap[VIRT_APLIC_M].size,
 +                                     (msimode) ? 0 : base_hartid,
 +                                     (msimode) ? 0 : hart_count,
 +                                     VIRT_IRQCHIP_NUM_SOURCES,
 +                                     VIRT_IRQCHIP_NUM_PRIO_BITS,
 +                                     msimode, true, NULL);
      }
 -    return aplic_m;
 +    /* Per-socket S-level APLIC */
 +    aplic_s = riscv_aplic_create(memmap[VIRT_APLIC_S].base +
 +                                 socket * memmap[VIRT_APLIC_S].size,
 +                                 memmap[VIRT_APLIC_S].size,
 +                                 (msimode) ? 0 : base_hartid,
 +                                 (msimode) ? 0 : hart_count,
 +                                 VIRT_IRQCHIP_NUM_SOURCES,
 +                                 VIRT_IRQCHIP_NUM_PRIO_BITS,
 +                                 msimode, false, aplic_m);
 +
 +    return kvm_enabled() ? aplic_s : aplic_m;
  }
-@@ -XXX,XX +XXX,XX @@ static bool opfv_check(DisasContext *s, arg_rmr *a)
+ static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
             vext_check_isa_ill(s) &&
             /* OPFV instructions ignore vs1 check */
             vext_check_ss(s, a->rd, a->rs2, a->vm) &&
 +           require_zve32f(s) &&
             require_zve64f(s);
  }
@@ -XXX,XX +XXX,XX @@ static bool opfvv_cmp_check(DisasContext *s, arg_rmrr *a)
             require_rvf(s) &&
             vext_check_isa_ill(s) &&
             vext_check_mss(s, a->rd, a->rs1, a->rs2) &&
 +           require_zve32f(s) &&
             require_zve64f(s);
  }
@@ -XXX,XX +XXX,XX @@ static bool opfvf_cmp_check(DisasContext *s, arg_rmrr *a)
             require_rvf(s) &&
             vext_check_isa_ill(s) &&
             vext_check_ms(s, a->rd, a->rs2) &&
 +           require_zve32f(s) &&
             require_zve64f(s);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
          require_rvf(s) &&
          vext_check_isa_ill(s) &&
          require_align(a->rd, s->lmul) &&
 +        require_zve32f(s) &&
          require_zve64f(s)) {
          gen_set_rm(s, RISCV_FRM_DYN);
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_f_s(DisasContext *s, arg_vfmv_f_s *a)
      if (require_rvv(s) &&
          require_rvf(s) &&
          vext_check_isa_ill(s) &&
 +        require_zve32f(s) &&
          require_zve64f(s)) {
          gen_set_rm(s, RISCV_FRM_DYN);
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
      if (require_rvv(s) &&
          require_rvf(s) &&
          vext_check_isa_ill(s) &&
 +        require_zve32f(s) &&
          require_zve64f(s)) {
          gen_set_rm(s, RISCV_FRM_DYN);
@@ -XXX,XX +XXX,XX @@ static bool fslideup_check(DisasContext *s, arg_rmrr *a)
  {
      return slideup_check(s, a) &&
             require_rvf(s) &&
 +           require_zve32f(s) &&
             require_zve64f(s);
  }
@@ -XXX,XX +XXX,XX @@ static bool fslidedown_check(DisasContext *s, arg_rmrr *a)
  {
      return slidedown_check(s, a) &&
             require_rvf(s) &&
 +           require_zve32f(s) &&
             require_zve64f(s);
  }
 --
-.31.1
+.41.0

-[PULL 06/61] target/riscv: Implement function kvm_arch_init_vcpu
+[PULL v2 30/45] target/riscv: check the in-kernel irqchip support
-From: Yifei Jiang <jiangyifei@huawei.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Get isa info from kvm while kvm init.
+We check the in-kernel irqchip support when using KVM acceleration.
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Anup Patel <anup.patel@wdc.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-id: 20220112081329.1835-4-jiangyifei@huawei.com
+Message-ID: <20230727102439.22554-3-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 34 +++++++++++++++++++++++++++++++++-
+ target/riscv/kvm.c | 10 +++++++++-
-file changed, 33 insertions(+), 1 deletion(-)
+file changed, 9 insertions(+), 1 deletion(-)
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
- #include "qemu/log.h"
- #include "hw/loader.h"
+ int kvm_arch_irqchip_create(KVMState *s)
 +static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
 +                                 uint64_t idx)
 +{
 +    uint64_t id = KVM_REG_RISCV | type | idx;
 +
 +    switch (riscv_cpu_mxl(env)) {
 +    case MXL_RV32:
 +        id |= KVM_REG_SIZE_U32;
 +        break;
 +    case MXL_RV64:
 +        id |= KVM_REG_SIZE_U64;
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    return id;
 +}
 +
  const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
      KVM_CAP_LAST_INFO
  };
@@ -XXX,XX +XXX,XX @@ void kvm_arch_init_irq_routing(KVMState *s)
  int kvm_arch_init_vcpu(CPUState *cs)
  {
 -    return 0;
-+    int ret = 0;
++    if (kvm_kernel_irqchip_split()) {
-+    target_ulong isa;
++        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
-+    RISCVCPU *cpu = RISCV_CPU(cs);
++        exit(1);
-+    CPURISCVState *env = &cpu->env;
++    }
 +    uint64_t id;
 +
-+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
++    /*
-+                          KVM_REG_RISCV_CONFIG_REG(isa));
++     * We can create the VAIA using the newer device control API.
-+    ret = kvm_get_one_reg(cs, id, &isa);
++     */
-+    if (ret) {
++    return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
 +        return ret;
 +    }
 +    env->misa_ext = isa;
 +
 +    return ret;
  }
- int kvm_arch_msi_data_to_gsi(uint32_t data)
+ int kvm_arch_process_async_events(CPUState *cs)
 --
-.31.1
+.41.0

-[PULL 11/61] target/riscv: Handle KVM_EXIT_RISCV_SBI exit
+[PULL v2 31/45] target/riscv: Create an KVM AIA irqchip
-From: Yifei Jiang <jiangyifei@huawei.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Use char-fe to handle console sbi call, which implement early
+We create a vAIA chip by using the KVM_DEV_TYPE_RISCV_AIA and then set up
-console io while apply 'earlycon=sbi' into kernel parameters.
+the chip with the KVM_DEV_RISCV_AIA_GRP_* APIs.
 We also extend KVM accelerator to specify the KVM AIA mode. The "riscv-aia"
 parameter is passed along with --accel in QEMU command-line.
 ) "riscv-aia=emul": IMSIC is emulated by hypervisor
 ) "riscv-aia=hwaccel": use hardware guest IMSIC
 ) "riscv-aia=auto": use the hardware guest IMSICs whenever available
                      otherwise we fallback to software emulation.
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Reviewed-by: Anup Patel <anup.patel@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-id: 20220112081329.1835-9-jiangyifei@huawei.com
+Message-ID: <20230727102439.22554-4-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/sbi_ecall_interface.h | 72 ++++++++++++++++++++++++++++++
+ target/riscv/kvm_riscv.h |   4 +
- target/riscv/kvm.c                 | 42 ++++++++++++++++-
+ target/riscv/kvm.c       | 186 +++++++++++++++++++++++++++++++++++++++
-files changed, 113 insertions(+), 1 deletion(-)
+files changed, 190 insertions(+)
  create mode 100644 target/riscv/sbi_ecall_interface.h
-diff --git a/target/riscv/sbi_ecall_interface.h b/target/riscv/sbi_ecall_interface.h
+diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/target/riscv/kvm_riscv.h
---- /dev/null
++++ b/target/riscv/kvm_riscv.h
 +++ b/target/riscv/sbi_ecall_interface.h
 @@ -XXX,XX +XXX,XX @@
-+/*
+ void kvm_riscv_init_user_properties(Object *cpu_obj);
-+ * SPDX-License-Identifier: BSD-2-Clause
+ void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
-+ *
+ void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
-+ * Copyright (c) 2019 Western Digital Corporation or its affiliates.
++void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
-+ *
++                          uint64_t aia_irq_num, uint64_t aia_msi_num,
-+ * Authors:
++                          uint64_t aplic_base, uint64_t imsic_base,
-+ *   Anup Patel <anup.patel@wdc.com>
++                          uint64_t guest_num);
-+ */
-+
+ #endif
 +#ifndef __SBI_ECALL_INTERFACE_H__
 +#define __SBI_ECALL_INTERFACE_H__
 +
 +/* clang-format off */
 +
 +/* SBI Extension IDs */
 +#define SBI_EXT_0_1_SET_TIMER           0x0
 +#define SBI_EXT_0_1_CONSOLE_PUTCHAR     0x1
 +#define SBI_EXT_0_1_CONSOLE_GETCHAR     0x2
 +#define SBI_EXT_0_1_CLEAR_IPI           0x3
 +#define SBI_EXT_0_1_SEND_IPI            0x4
 +#define SBI_EXT_0_1_REMOTE_FENCE_I      0x5
 +#define SBI_EXT_0_1_REMOTE_SFENCE_VMA   0x6
 +#define SBI_EXT_0_1_REMOTE_SFENCE_VMA_ASID 0x7
 +#define SBI_EXT_0_1_SHUTDOWN            0x8
 +#define SBI_EXT_BASE                    0x10
 +#define SBI_EXT_TIME                    0x54494D45
 +#define SBI_EXT_IPI                     0x735049
 +#define SBI_EXT_RFENCE                  0x52464E43
 +#define SBI_EXT_HSM                     0x48534D
 +
 +/* SBI function IDs for BASE extension*/
 +#define SBI_EXT_BASE_GET_SPEC_VERSION   0x0
 +#define SBI_EXT_BASE_GET_IMP_ID         0x1
 +#define SBI_EXT_BASE_GET_IMP_VERSION    0x2
 +#define SBI_EXT_BASE_PROBE_EXT          0x3
 +#define SBI_EXT_BASE_GET_MVENDORID      0x4
 +#define SBI_EXT_BASE_GET_MARCHID        0x5
 +#define SBI_EXT_BASE_GET_MIMPID         0x6
 +
 +/* SBI function IDs for TIME extension*/
 +#define SBI_EXT_TIME_SET_TIMER          0x0
 +
 +/* SBI function IDs for IPI extension*/
 +#define SBI_EXT_IPI_SEND_IPI            0x0
 +
 +/* SBI function IDs for RFENCE extension*/
 +#define SBI_EXT_RFENCE_REMOTE_FENCE_I       0x0
 +#define SBI_EXT_RFENCE_REMOTE_SFENCE_VMA    0x1
 +#define SBI_EXT_RFENCE_REMOTE_SFENCE_VMA_ASID  0x2
 +#define SBI_EXT_RFENCE_REMOTE_HFENCE_GVMA   0x3
 +#define SBI_EXT_RFENCE_REMOTE_HFENCE_GVMA_VMID 0x4
 +#define SBI_EXT_RFENCE_REMOTE_HFENCE_VVMA   0x5
 +#define SBI_EXT_RFENCE_REMOTE_HFENCE_VVMA_ASID 0x6
 +
 +/* SBI function IDs for HSM extension */
 +#define SBI_EXT_HSM_HART_START          0x0
 +#define SBI_EXT_HSM_HART_STOP           0x1
 +#define SBI_EXT_HSM_HART_GET_STATUS     0x2
 +
 +#define SBI_HSM_HART_STATUS_STARTED     0x0
 +#define SBI_HSM_HART_STATUS_STOPPED     0x1
 +#define SBI_HSM_HART_STATUS_START_PENDING   0x2
 +#define SBI_HSM_HART_STATUS_STOP_PENDING    0x3
 +
 +#define SBI_SPEC_VERSION_MAJOR_OFFSET   24
 +#define SBI_SPEC_VERSION_MAJOR_MASK     0x7f
 +#define SBI_SPEC_VERSION_MINOR_MASK     0xffffff
 +#define SBI_EXT_VENDOR_START            0x09000000
 +#define SBI_EXT_VENDOR_END              0x09FFFFFF
 +/* clang-format on */
 +
 +#endif
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
 @@ -XXX,XX +XXX,XX @@
+ #include "exec/address-spaces.h"
+ #include "hw/boards.h"
+ #include "hw/irq.h"
++#include "hw/intc/riscv_imsic.h"
  #include "qemu/log.h"
  #include "hw/loader.h"
  #include "kvm_riscv.h"
-+#include "sbi_ecall_interface.h"
+@@ -XXX,XX +XXX,XX @@
-+#include "chardev/char-fe.h"
+ #include "chardev/char-fe.h"
  #include "migration/migration.h"
  #include "sysemu/runstate.h"
 +#include "hw/riscv/numa.h"
  static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                   uint64_t idx)
-@@ -XXX,XX +XXX,XX @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ bool kvm_arch_cpu_check_are_resettable(void)
      return true;
  }
-+static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
++static int aia_mode;
-+{
++
-+    int ret = 0;
++static const char *kvm_aia_mode_str(uint64_t mode)
-+    unsigned char ch;
++{
-+    switch (run->riscv_sbi.extension_id) {
++    switch (mode) {
-+    case SBI_EXT_0_1_CONSOLE_PUTCHAR:
++    case KVM_DEV_RISCV_AIA_MODE_EMUL:
-+        ch = run->riscv_sbi.args[0];
++        return "emul";
-+        qemu_chr_fe_write(serial_hd(0)->be, &ch, sizeof(ch));
++    case KVM_DEV_RISCV_AIA_MODE_HWACCEL:
-+        break;
++        return "hwaccel";
-+    case SBI_EXT_0_1_CONSOLE_GETCHAR:
++    case KVM_DEV_RISCV_AIA_MODE_AUTO:
-+        ret = qemu_chr_fe_read_all(serial_hd(0)->be, &ch, sizeof(ch));
++    default:
-+        if (ret == sizeof(ch)) {
++        return "auto";
-+            run->riscv_sbi.args[0] = ch;
++    };
-+        } else {
++}
-+            run->riscv_sbi.args[0] = -1;
++
 +static char *riscv_get_kvm_aia(Object *obj, Error **errp)
 +{
 +    return g_strdup(kvm_aia_mode_str(aia_mode));
 +}
 +
 +static void riscv_set_kvm_aia(Object *obj, const char *val, Error **errp)
 +{
 +    if (!strcmp(val, "emul")) {
 +        aia_mode = KVM_DEV_RISCV_AIA_MODE_EMUL;
 +    } else if (!strcmp(val, "hwaccel")) {
 +        aia_mode = KVM_DEV_RISCV_AIA_MODE_HWACCEL;
 +    } else if (!strcmp(val, "auto")) {
 +        aia_mode = KVM_DEV_RISCV_AIA_MODE_AUTO;
 +    } else {
 +        error_setg(errp, "Invalid KVM AIA mode");
 +        error_append_hint(errp, "Valid values are emul, hwaccel, and auto.\n");
 +    }
 +}
 +
  void kvm_arch_accel_class_init(ObjectClass *oc)
  {
 +    object_class_property_add_str(oc, "riscv-aia", riscv_get_kvm_aia,
 +                                  riscv_set_kvm_aia);
 +    object_class_property_set_description(oc, "riscv-aia",
 +                                          "Set KVM AIA mode. Valid values are "
 +                                          "emul, hwaccel, and auto. Default "
 +                                          "is auto.");
 +    object_property_set_default_str(object_class_property_find(oc, "riscv-aia"),
 +                                    "auto");
 +}
 +
 +void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
 +                          uint64_t aia_irq_num, uint64_t aia_msi_num,
 +                          uint64_t aplic_base, uint64_t imsic_base,
 +                          uint64_t guest_num)
 +{
 +    int ret, i;
 +    int aia_fd = -1;
 +    uint64_t default_aia_mode;
 +    uint64_t socket_count = riscv_socket_count(machine);
 +    uint64_t max_hart_per_socket = 0;
 +    uint64_t socket, base_hart, hart_count, socket_imsic_base, imsic_addr;
 +    uint64_t socket_bits, hart_bits, guest_bits;
 +
 +    aia_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_RISCV_AIA, false);
 +
 +    if (aia_fd < 0) {
 +        error_report("Unable to create in-kernel irqchip");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_MODE,
 +                            &default_aia_mode, false, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to get current KVM AIA mode");
 +        exit(1);
 +    }
 +    qemu_log("KVM AIA: default mode is %s\n",
 +             kvm_aia_mode_str(default_aia_mode));
 +
 +    if (default_aia_mode != aia_mode) {
 +        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                                KVM_DEV_RISCV_AIA_CONFIG_MODE,
 +                                &aia_mode, true, NULL);
 +        if (ret < 0)
 +            warn_report("KVM AIA: failed to set KVM AIA mode");
 +        else
 +            qemu_log("KVM AIA: set current mode to %s\n",
 +                     kvm_aia_mode_str(aia_mode));
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
 +                            &aia_irq_num, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set number of input irq lines");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_IDS,
 +                            &aia_msi_num, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set number of msi");
 +        exit(1);
 +    }
 +
 +    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
 +                            &socket_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set group_bits");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
 +                            &group_shift, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set group_shift");
 +        exit(1);
 +    }
 +
 +    guest_bits = guest_num == 0 ? 0 :
 +                 find_last_bit(&guest_num, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GUEST_BITS,
 +                            &guest_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set guest_bits");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
 +                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
 +                            &aplic_base, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set the base address of APLIC");
 +        exit(1);
 +    }
 +
 +    for (socket = 0; socket < socket_count; socket++) {
 +        socket_imsic_base = imsic_base + socket * (1U << group_shift);
 +        hart_count = riscv_socket_hart_count(machine, socket);
 +        base_hart = riscv_socket_first_hartid(machine, socket);
 +
 +        if (max_hart_per_socket < hart_count) {
 +            max_hart_per_socket = hart_count;
 +        }
-+        break;
++
-+    default:
++        for (i = 0; i < hart_count; i++) {
-+        qemu_log_mask(LOG_UNIMP,
++            imsic_addr = socket_imsic_base + i * IMSIC_HART_SIZE(guest_bits);
-+                      "%s: un-handled SBI EXIT, specific reasons is %lu\n",
++            ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
-+                      __func__, run->riscv_sbi.extension_id);
++                                    KVM_DEV_RISCV_AIA_ADDR_IMSIC(i + base_hart),
-+        ret = -1;
++                                    &imsic_addr, true, NULL);
-+        break;
++            if (ret < 0) {
-+    }
++                error_report("KVM AIA: failed to set the IMSIC address for hart %d", i);
-+    return ret;
++                exit(1);
-+}
++            }
-+
++        }
- int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
++    }
- {
++
--    return 0;
++    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
-+    int ret = 0;
++    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-+    switch (run->exit_reason) {
++                            KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
-+    case KVM_EXIT_RISCV_SBI:
++                            &hart_bits, true, NULL);
-+        ret = kvm_riscv_handle_sbi(cs, run);
++    if (ret < 0) {
-+        break;
++        error_report("KVM AIA: failed to set hart_bits");
-+    default:
++        exit(1);
-+        qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",
++    }
-+                      __func__, run->exit_reason);
++
-+        ret = -1;
++    if (kvm_has_gsi_routing()) {
-+        break;
++        for (uint64_t idx = 0; idx < aia_irq_num + 1; ++idx) {
-+    }
++            /* KVM AIA only has one APLIC instance */
-+    return ret;
++            kvm_irqchip_add_irq_route(kvm_state, idx, 0, idx);
 +        }
 +        kvm_gsi_routing_allowed = true;
 +        kvm_irqchip_commit_routes(kvm_state);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CTRL,
 +                            KVM_DEV_RISCV_AIA_CTRL_INIT,
 +                            NULL, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: initialized fail");
 +        exit(1);
 +    }
 +
 +    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
  }
- void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
 --
-.31.1
+.41.0

-[PULL 08/61] target/riscv: Implement kvm_arch_put_registers
+[PULL v2 32/45] target/riscv: update APLIC and IMSIC to support KVM AIA
-From: Yifei Jiang <jiangyifei@huawei.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Put GPR CSR and FP registers to kvm by KVM_SET_ONE_REG ioctl
+KVM AIA can't emulate APLIC only. When "aia=aplic" parameter is passed,
 APLIC devices is emulated by QEMU. For "aia=aplic-imsic", remove the
 mmio operations of APLIC when using KVM AIA and send wired interrupt
 signal via KVM_IRQ_LINE API.
 After KVM AIA enabled, MSI messages are delivered by KVM_SIGNAL_MSI API
 when the IMSICs receive mmio write requests.
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Anup Patel <anup.patel@wdc.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-id: 20220112081329.1835-6-jiangyifei@huawei.com
+Message-ID: <20230727102439.22554-5-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 104 ++++++++++++++++++++++++++++++++++++++++++++-
+ hw/intc/riscv_aplic.c | 56 ++++++++++++++++++++++++++++++-------------
-file changed, 103 insertions(+), 1 deletion(-)
+ hw/intc/riscv_imsic.c | 25 +++++++++++++++----
 files changed, 61 insertions(+), 20 deletions(-)
-diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/kvm.c
+--- a/hw/intc/riscv_aplic.c
-+++ b/target/riscv/kvm.c
++++ b/hw/intc/riscv_aplic.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
+@@ -XXX,XX +XXX,XX @@
-         } \
+ #include "hw/irq.h"
-     } while (0)
+ #include "target/riscv/cpu.h"
+ #include "sysemu/sysemu.h"
-+#define KVM_RISCV_SET_CSR(cs, env, csr, reg) \
++#include "sysemu/kvm.h"
-+    do { \
+ #include "migration/vmstate.h"
-+        int ret = kvm_set_one_reg(cs, RISCV_CSR_REG(env, csr), &reg); \
-+        if (ret) { \
+ #define APLIC_MAX_IDC                  (1UL << 14)
-+            return ret; \
+@@ -XXX,XX +XXX,XX @@
-+        } \
-+    } while (0)
+ #define APLIC_IDC_CLAIMI               0x1c
-+
- static int kvm_riscv_get_regs_core(CPUState *cs)
++/*
- {
++ * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
-     int ret = 0;
++ * APLIC Wired.
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_core(CPUState *cs)
++ */
-     return ret;
++static bool is_kvm_aia(bool msimode)
  }
 +static int kvm_riscv_put_regs_core(CPUState *cs)
 +{
-+    int ret = 0;
++    return kvm_irqchip_in_kernel() && msimode;
 +    int i;
 +    target_ulong reg;
 +    CPURISCVState *env = &RISCV_CPU(cs)->env;
 +
 +    reg = env->pc;
 +    ret = kvm_set_one_reg(cs, RISCV_CORE_REG(env, regs.pc), &reg);
 +    if (ret) {
 +        return ret;
 +    }
 +
 +    for (i = 1; i < 32; i++) {
 +        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
 +        reg = env->gpr[i];
 +        ret = kvm_set_one_reg(cs, id, &reg);
 +        if (ret) {
 +            return ret;
 +        }
 +    }
 +
 +    return ret;
 +}
 +
- static int kvm_riscv_get_regs_csr(CPUState *cs)
+ static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
                                              uint32_t word)
  {
-     int ret = 0;
+@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_csr(CPUState *cs)
+     return topi;
      return ret;
  }
-+static int kvm_riscv_put_regs_csr(CPUState *cs)
++static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 +{
-+    int ret = 0;
++    kvm_set_irq(kvm_state, irq, !!level);
 +    CPURISCVState *env = &RISCV_CPU(cs)->env;
 +
 +    KVM_RISCV_SET_CSR(cs, env, sstatus, env->mstatus);
 +    KVM_RISCV_SET_CSR(cs, env, sie, env->mie);
 +    KVM_RISCV_SET_CSR(cs, env, stvec, env->stvec);
 +    KVM_RISCV_SET_CSR(cs, env, sscratch, env->sscratch);
 +    KVM_RISCV_SET_CSR(cs, env, sepc, env->sepc);
 +    KVM_RISCV_SET_CSR(cs, env, scause, env->scause);
 +    KVM_RISCV_SET_CSR(cs, env, stval, env->stval);
 +    KVM_RISCV_SET_CSR(cs, env, sip, env->mip);
 +    KVM_RISCV_SET_CSR(cs, env, satp, env->satp);
 +
 +    return ret;
 +}
 +
- static int kvm_riscv_get_regs_fp(CPUState *cs)
+ static void riscv_aplic_request(void *opaque, int irq, int level)
  {
-     int ret = 0;
+     bool update = false;
-@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_fp(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
-     return ret;
+     uint32_t i;
- }
+     RISCVAPLICState *aplic = RISCV_APLIC(dev);
-+static int kvm_riscv_put_regs_fp(CPUState *cs)
+-    aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
-+{
+-    aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
-+    int ret = 0;
+-    aplic->state = g_new0(uint32_t, aplic->num_irqs);
-+    int i;
+-    aplic->target = g_new0(uint32_t, aplic->num_irqs);
-+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+-    if (!aplic->msimode) {
 -        for (i = 0; i < aplic->num_irqs; i++) {
 -            aplic->target[i] = 1;
 +    if (!is_kvm_aia(aplic->msimode)) {
 +        aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
 +        aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
 +        aplic->state = g_new0(uint32_t, aplic->num_irqs);
 +        aplic->target = g_new0(uint32_t, aplic->num_irqs);
 +        if (!aplic->msimode) {
 +            for (i = 0; i < aplic->num_irqs; i++) {
 +                aplic->target[i] = 1;
 +            }
          }
 -    }
 -    aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
 -    aplic->iforce = g_new0(uint32_t, aplic->num_harts);
 -    aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 +        aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
 +        aplic->iforce = g_new0(uint32_t, aplic->num_harts);
 +        aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 -    memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops, aplic,
 -                          TYPE_RISCV_APLIC, aplic->aperture_size);
 -    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
 +        memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
 +                              aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
 +        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
 +    }
      /*
       * Only root APLICs have hardware IRQ lines. All non-root APLICs
       * have IRQ lines delegated by their parent APLIC.
       */
      if (!aplic->parent) {
 -        qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 +        if (is_kvm_aia(aplic->msimode)) {
 +            qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
 +        } else {
 +            qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 +        }
      }
      /* Create output IRQ lines for non-MSI mode */
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
      qdev_prop_set_bit(dev, "mmode", mmode);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +
-+    if (riscv_has_ext(env, RVD)) {
++    if (!is_kvm_aia(msimode)) {
-+        uint64_t reg;
++        sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +        for (i = 0; i < 32; i++) {
 +            reg = env->fpr[i];
 +            ret = kvm_set_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
 +            if (ret) {
 +                return ret;
 +            }
 +        }
 +        return ret;
 +    }
+     if (parent) {
+         riscv_aplic_add_child(parent, dev);
+diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/riscv_imsic.c
++++ b/hw/intc/riscv_imsic.c
+@@ -XXX,XX +XXX,XX @@
+ #include "target/riscv/cpu.h"
+ #include "target/riscv/cpu_bits.h"
+ #include "sysemu/sysemu.h"
++#include "sysemu/kvm.h"
+ #include "migration/vmstate.h"
+ #define IMSIC_MMIO_PAGE_LE             0x00
+@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
+         goto err;
+     }
++#if defined(CONFIG_KVM)
++    if (kvm_irqchip_in_kernel()) {
++        struct kvm_msi msi;
 +
-+    if (riscv_has_ext(env, RVF)) {
++        msi.address_lo = extract64(imsic->mmio.addr + addr, 0, 32);
-+        uint32_t reg;
++        msi.address_hi = extract64(imsic->mmio.addr + addr, 32, 32);
-+        for (i = 0; i < 32; i++) {
++        msi.data = le32_to_cpu(value);
-+            reg = env->fpr[i];
++
-+            ret = kvm_set_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
++        kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
-+            if (ret) {
++
-+                return ret;
++        return;
 +            }
 +        }
 +        return ret;
 +    }
++#endif
 +
-+    return ret;
+     /* Writes only supported for MSI little-endian registers */
-+}
+     page = addr >> IMSIC_MMIO_PAGE_SHIFT;
-+
+     if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
-+
+@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
- const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
+     CPUState *cpu = cpu_by_arch_id(imsic->hartid);
-     KVM_CAP_LAST_INFO
+     CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
- };
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
+-    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
+-    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
- int kvm_arch_put_registers(CPUState *cs, int level)
+-    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
- {
+-    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
--    return 0;
++    if (!kvm_irqchip_in_kernel()) {
-+    int ret = 0;
++        imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
-+
++        imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
-+    ret = kvm_riscv_put_regs_core(cs);
++        imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
-+    if (ret) {
++        imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
 +        return ret;
 +    }
-+
-+    ret = kvm_riscv_put_regs_csr(cs);
+     memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
-+    if (ret) {
+                           imsic, TYPE_RISCV_IMSIC,
 +        return ret;
 +    }
 +
 +    ret = kvm_riscv_put_regs_fp(cs);
 +    if (ret) {
 +        return ret;
 +    }
 +
 +    return ret;
  }
  int kvm_arch_release_virq_post(int virq)
 --
-.31.1
+.41.0

-[PULL 57/61] target/riscv: Adjust vector address with mask
+[PULL v2 33/45] target/riscv: select KVM AIA in riscv virt machine
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-The mask comes from the pointer masking extension, or the max value
+Select KVM AIA when the host kernel has in-kernel AIA chip support.
-corresponding to XLEN bits.
+Since KVM AIA only has one APLIC instance, we map the QEMU APLIC
 devices to KVM APLIC.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-id: 20220120122050.41546-20-zhiwei_liu@c-sky.com
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20230727102439.22554-6-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/vector_helper.c | 25 +++++++++++++++----------
+ hw/riscv/virt.c | 94 +++++++++++++++++++++++++++++++++----------------
-file changed, 15 insertions(+), 10 deletions(-)
+file changed, 63 insertions(+), 31 deletions(-)
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
+--- a/hw/riscv/virt.c
-+++ b/target/riscv/vector_helper.c
++++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t esz)
+@@ -XXX,XX +XXX,XX @@
-     return scale < 0 ? vlenb >> -scale : vlenb << scale;
+ #include "hw/riscv/virt.h"
- }
+ #include "hw/riscv/boot.h"
+ #include "hw/riscv/numa.h"
-+static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
++#include "kvm_riscv.h"
  #include "hw/intc/riscv_aclint.h"
  #include "hw/intc/riscv_aplic.h"
  #include "hw/intc/riscv_imsic.h"
@@ -XXX,XX +XXX,XX @@
  #error "Can't accommodate all IMSIC groups in address space"
  #endif
 +/* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
 +static bool virt_use_kvm_aia(RISCVVirtState *s)
 +{
-+    return (addr & env->cur_pmmask) | env->cur_pmbase;
++    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 +}
 +
- /*
+ static const MemMapEntry virt_memmap[] = {
-  * This function checks watchpoint before real load operation.
+     [VIRT_DEBUG] =        {        0x0,         0x100 },
-  *
+     [VIRT_MROM] =         {     0x1000,        0xf000 },
-@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
-     target_ulong pagelen = -(addr | TARGET_PAGE_MASK);
+                                  uint32_t *intc_phandles,
-     target_ulong curlen = MIN(pagelen, len);
+                                  uint32_t aplic_phandle,
+                                  uint32_t aplic_child_phandle,
--    probe_access(env, addr, curlen, access_type,
+-                                 bool m_mode)
-+    probe_access(env, adjust_addr(env, addr), curlen, access_type,
++                                 bool m_mode, int num_harts)
-                  cpu_mmu_index(env, false), ra);
+ {
-     if (len > curlen) {
+     int cpu;
-         addr += curlen;
+     char *aplic_name;
-         curlen = len - curlen;
+     uint32_t *aplic_cells;
--        probe_access(env, addr, curlen, access_type,
+     MachineState *ms = MACHINE(s);
-+        probe_access(env, adjust_addr(env, addr), curlen, access_type,
-                      cpu_mmu_index(env, false), ra);
+-    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 +    aplic_cells = g_new0(uint32_t, num_harts * 2);
 -    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 +    for (cpu = 0; cpu < num_harts; cpu++) {
          aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
          aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
      }
- }
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
-@@ -XXX,XX +XXX,XX @@ vext_ldst_stride(void *vd, void *v0, target_ulong base,
-         k = 0;
+     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
-         while (k < nf) {
+         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-             target_ulong addr = base + stride * i + (k << esz);
+-                         aplic_cells,
--            ldst_elem(env, addr, i + k * max_elems, vd, ra);
+-                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
-+            ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
++                         aplic_cells, num_harts * sizeof(uint32_t) * 2);
-             k++;
+     } else {
          qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
      }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
                                      uint32_t msi_s_phandle,
                                      uint32_t *phandle,
                                      uint32_t *intc_phandles,
 -                                    uint32_t *aplic_phandles)
 +                                    uint32_t *aplic_phandles,
 +                                    int num_harts)
  {
      char *aplic_name;
      unsigned long aplic_addr;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
          create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
                               msi_m_phandle, intc_phandles,
                               aplic_m_phandle, aplic_s_phandle,
 -                             true);
 +                             true, num_harts);
      }
      /* S-level APLIC node */
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
      create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
                           msi_s_phandle, intc_phandles,
                           aplic_s_phandle, 0,
 -                         false);
 +                         false, num_harts);
      aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
          *msi_pcie_phandle = msi_s_phandle;
      }
 -    phandle_pos = ms->smp.cpus;
 -    for (socket = (socket_count - 1); socket >= 0; socket--) {
 -        phandle_pos -= s->soc[socket].num_harts;
 -
 -        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
 -            create_fdt_socket_plic(s, memmap, socket, phandle,
 -                &intc_phandles[phandle_pos], xplic_phandles);
 -        } else {
 -            create_fdt_socket_aplic(s, memmap, socket,
 -                msi_m_phandle, msi_s_phandle, phandle,
 -                &intc_phandles[phandle_pos], xplic_phandles);
 +    /* KVM AIA only has one APLIC instance */
 +    if (virt_use_kvm_aia(s)) {
 +        create_fdt_socket_aplic(s, memmap, 0,
 +                                msi_m_phandle, msi_s_phandle, phandle,
 +                                &intc_phandles[0], xplic_phandles,
 +                                ms->smp.cpus);
 +    } else {
 +        phandle_pos = ms->smp.cpus;
 +        for (socket = (socket_count - 1); socket >= 0; socket--) {
 +            phandle_pos -= s->soc[socket].num_harts;
 +
 +            if (s->aia_type == VIRT_AIA_TYPE_NONE) {
 +                create_fdt_socket_plic(s, memmap, socket, phandle,
 +                                       &intc_phandles[phandle_pos],
 +                                       xplic_phandles);
 +            } else {
 +                create_fdt_socket_aplic(s, memmap, socket,
 +                                        msi_m_phandle, msi_s_phandle, phandle,
 +                                        &intc_phandles[phandle_pos],
 +                                        xplic_phandles,
 +                                        s->soc[socket].num_harts);
 +            }
          }
      }
-@@ -XXX,XX +XXX,XX @@ vext_ldst_us(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
-         k = 0;
+     g_free(intc_phandles);
-         while (k < nf) {
-             target_ulong addr = base + ((i * nf + k) << esz);
+-    for (socket = 0; socket < socket_count; socket++) {
--            ldst_elem(env, addr, i + k * max_elems, vd, ra);
+-        if (socket == 0) {
-+            ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
+-            *irq_mmio_phandle = xplic_phandles[socket];
-             k++;
+-            *irq_virtio_phandle = xplic_phandles[socket];
 -            *irq_pcie_phandle = xplic_phandles[socket];
 -        }
 -        if (socket == 1) {
 -            *irq_virtio_phandle = xplic_phandles[socket];
 -            *irq_pcie_phandle = xplic_phandles[socket];
 -        }
 -        if (socket == 2) {
 -            *irq_pcie_phandle = xplic_phandles[socket];
 +    if (virt_use_kvm_aia(s)) {
 +        *irq_mmio_phandle = xplic_phandles[0];
 +        *irq_virtio_phandle = xplic_phandles[0];
 +        *irq_pcie_phandle = xplic_phandles[0];
 +    } else {
 +        for (socket = 0; socket < socket_count; socket++) {
 +            if (socket == 0) {
 +                *irq_mmio_phandle = xplic_phandles[socket];
 +                *irq_virtio_phandle = xplic_phandles[socket];
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
 +            if (socket == 1) {
 +                *irq_virtio_phandle = xplic_phandles[socket];
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
 +            if (socket == 2) {
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
          }
      }
-@@ -XXX,XX +XXX,XX @@ vext_ldst_index(void *vd, void *v0, target_ulong base,
-         k = 0;
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
          while (k < nf) {
              abi_ptr addr = get_index_addr(base, i, vs2) + (k << esz);
 -            ldst_elem(env, addr, i + k * max_elems, vd, ra);
 +            ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
              k++;
          }
      }
-@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
-         if (!vm && !vext_elem_mask(v0, i)) {
++    if (virt_use_kvm_aia(s)) {
-             continue;
++        kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
-         }
++                             VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
--        addr = base + i * (nf << esz);
++                             memmap[VIRT_APLIC_S].base,
-+        addr = adjust_addr(env, base + i * (nf << esz));
++                             memmap[VIRT_IMSIC_S].base,
-         if (i == 0) {
++                             s->aia_guests);
-             probe_pages(env, addr, nf << esz, ra, MMU_DATA_LOAD);
++    }
-         } else {
++
-@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
+     if (riscv_is_32bit(&s->soc[0])) {
-                     break;
+ #if HOST_LONG_BITS == 64
-                 }
+         /* limit RAM size in a 32-bit system */
                  remain -= offset;
 -                addr += offset;
 +                addr = adjust_addr(env, addr + offset);
              }
          }
      }
@@ -XXX,XX +XXX,XX @@ ProbeSuccess:
          }
          while (k < nf) {
              target_ulong addr = base + ((i * nf + k) << esz);
 -            ldst_elem(env, addr, i + k * max_elems, vd, ra);
 +            ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
              k++;
          }
      }
@@ -XXX,XX +XXX,XX @@ vext_ldst_whole(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
          /* load/store rest of elements of current segment pointed by vstart */
          for (pos = off; pos < max_elems; pos++, env->vstart++) {
              target_ulong addr = base + ((pos + k * max_elems) << esz);
 -            ldst_elem(env, addr, pos + k * max_elems, vd, ra);
 +            ldst_elem(env, adjust_addr(env, addr), pos + k * max_elems, vd, ra);
          }
          k++;
      }
@@ -XXX,XX +XXX,XX @@ vext_ldst_whole(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
      for (; k < nf; k++) {
          for (i = 0; i < max_elems; i++, env->vstart++) {
              target_ulong addr = base + ((i + k * max_elems) << esz);
 -            ldst_elem(env, addr, i + k * max_elems, vd, ra);
 +            ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
          }
      }
 --
-.31.1
+.41.0

-[PULL 44/61] target/riscv: Ignore the pc bits above XLEN
+[PULL v2 34/45] hw/riscv: virt: Fix riscv,pmu DT node path
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Conor Dooley <conor.dooley@microchip.com>
-The read from PC for translation is in cpu_get_tb_cpu_state, before translation.
+On a dtb dumped from the virt machine, dt-validate complains:
 soc: pmu: {'riscv,event-to-mhpmcounters': [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280], [65563, 65563, 524280], [65569, 65569, 524280]], 'compatible': ['riscv,pmu']} should not be valid under {'type': 'object'}
         from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
 That's pretty cryptic, but running the dtb back through dtc produces
 something a lot more reasonable:
 Warning (simple_bus_reg): /soc/pmu: missing or empty reg/ranges property
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+Moving the riscv,pmu node out of the soc bus solves the problem.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
-Message-id: 20220120122050.41546-7-zhiwei_liu@c-sky.com
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20230727-groom-decline-2c57ce42841c@spud>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 2 +-
+ hw/riscv/virt.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/hw/riscv/virt.c
-+++ b/target/riscv/cpu_helper.c
++++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_pmu(RISCVVirtState *s)
+     MachineState *ms = MACHINE(s);
-     uint32_t flags = 0;
+     RISCVCPU hart = s->soc[0].harts[0];
--    *pc = env->pc;
+-    pmu_name = g_strdup_printf("/soc/pmu");
-+    *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
++    pmu_name = g_strdup_printf("/pmu");
-     *cs_base = 0;
+     qemu_fdt_add_subnode(ms->fdt, pmu_name);
+     qemu_fdt_setprop_string(ms->fdt, pmu_name, "compatible", "riscv,pmu");
-     if (riscv_has_ext(env, RVV) || cpu->cfg.ext_zve32f || cpu->cfg.ext_zve64f) {
+     riscv_pmu_generate_fdt_node(ms->fdt, hart.cfg.pmu_num, pmu_name);
 --
-.31.1
+.41.0

-[PULL 43/61] target/riscv: Create xl field in env
+[PULL v2 35/45] target/riscv: Update CSR bits name for svadu extension
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Weiwei Li <liweiwei@iscas.ac.cn>
-Current xlen has been used in helper functions and many other places.
+The Svadu specification updated the name of the *envcfg bit from
-The computation of current xlen is not so trivial, so that we should
+HADE to ADUE.
 recompute it as little as possible.
-Fortunately, xlen only changes in very seldom cases, such as exception,
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-misa write, mstatus write, cpu reset, migration load. So that we can only
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-recompute xlen in this places and cache it into CPURISCVState.
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20230816141916.66898-1-liweiwei@iscas.ac.cn>
 Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20220120122050.41546-6-zhiwei_liu@c-sky.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        | 31 +++++++++++++++++++++++++++++++
+ target/riscv/cpu_bits.h   |  8 ++++----
- target/riscv/cpu.c        |  1 +
+ target/riscv/cpu.c        |  4 ++--
- target/riscv/cpu_helper.c | 34 ++--------------------------------
+ target/riscv/cpu_helper.c |  6 +++---
- target/riscv/csr.c        |  2 ++
+ target/riscv/csr.c        | 12 ++++++------
- target/riscv/machine.c    | 10 ++++++++++
+files changed, 15 insertions(+), 15 deletions(-)
 files changed, 46 insertions(+), 32 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/cpu_bits.h
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
-     uint32_t misa_mxl_max;  /* max mxl for this cpu */
+ #define MENVCFG_CBIE                       (3UL << 4)
-     uint32_t misa_ext;      /* current extensions */
+ #define MENVCFG_CBCFE                      BIT(6)
-     uint32_t misa_ext_mask; /* max ext for this cpu */
+ #define MENVCFG_CBZE                       BIT(7)
-+    uint32_t xl;            /* current xlen */
+-#define MENVCFG_HADE                       (1ULL << 61)
++#define MENVCFG_ADUE                       (1ULL << 61)
-     /* 128-bit helpers upper part return value */
+ #define MENVCFG_PBMTE                      (1ULL << 62)
-     target_ulong retxh;
+ #define MENVCFG_STCE                       (1ULL << 63)
-@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL riscv_cpu_mxl(CPURISCVState *env)
- }
+ /* For RV32 */
- #endif
+-#define MENVCFGH_HADE                      BIT(29)
++#define MENVCFGH_ADUE                      BIT(29)
-+#if defined(TARGET_RISCV32)
+ #define MENVCFGH_PBMTE                     BIT(30)
-+#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
+ #define MENVCFGH_STCE                      BIT(31)
-+#else
-+static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
-+{
+ #define HENVCFG_CBIE                       MENVCFG_CBIE
-+    RISCVMXL xl = env->misa_mxl;
+ #define HENVCFG_CBCFE                      MENVCFG_CBCFE
-+#if !defined(CONFIG_USER_ONLY)
+ #define HENVCFG_CBZE                       MENVCFG_CBZE
-+    /*
+-#define HENVCFG_HADE                       MENVCFG_HADE
-+     * When emulating a 32-bit-only cpu, use RV32.
++#define HENVCFG_ADUE                       MENVCFG_ADUE
-+     * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
+ #define HENVCFG_PBMTE                      MENVCFG_PBMTE
-+     * MSTATUSH doesn't have UXL/SXL, therefore XLEN cannot be widened
+ #define HENVCFG_STCE                       MENVCFG_STCE
-+     * back to RV64 for lower privs.
-+     */
+ /* For RV32 */
-+    if (xl != MXL_RV32) {
+-#define HENVCFGH_HADE                       MENVCFGH_HADE
-+        switch (env->priv) {
++#define HENVCFGH_ADUE                       MENVCFGH_ADUE
-+        case PRV_M:
+ #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
-+            break;
+ #define HENVCFGH_STCE                       MENVCFGH_STCE
-+        case PRV_U:
 +            xl = get_field(env->mstatus, MSTATUS64_UXL);
 +            break;
 +        default: /* PRV_S | PRV_H */
 +            xl = get_field(env->mstatus, MSTATUS64_SXL);
 +            break;
 +        }
 +    }
 +#endif
 +    return xl;
 +}
 +#endif
 +
  /*
   * Encode LMUL to lmul as follows:
   *     LMUL    vlmul    lmul
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
-     /* mmte is supposed to have pm.current hardwired to 1 */
+     env->two_stage_lookup = false;
-     env->mmte |= (PM_EXT_INITIAL | MMTE_M_PM_CURRENT);
- #endif
+     env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
-+    env->xl = riscv_cpu_mxl(env);
+-                   (cpu->cfg.ext_svadu ? MENVCFG_HADE : 0);
-     cs->exception_index = RISCV_EXCP_NONE;
++                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
-     env->load_res = -1;
+     env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
-     set_default_nan_mode(1, &env->fp_status);
+-                   (cpu->cfg.ext_svadu ? HENVCFG_HADE : 0);
 +                   (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
      /* Initialized default priorities of local interrupts. */
      for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
+@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
  #endif
  }
 -static RISCVMXL cpu_get_xl(CPURISCVState *env)
 -{
 -#if defined(TARGET_RISCV32)
 -    return MXL_RV32;
 -#elif defined(CONFIG_USER_ONLY)
 -    return MXL_RV64;
 -#else
 -    RISCVMXL xl = riscv_cpu_mxl(env);
 -
 -    /*
 -     * When emulating a 32-bit-only cpu, use RV32.
 -     * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
 -     * MSTATUSH doesn't have UXL/SXL, therefore XLEN cannot be widened
 -     * back to RV64 for lower privs.
 -     */
 -    if (xl != MXL_RV32) {
 -        switch (env->priv) {
 -        case PRV_M:
 -            break;
 -        case PRV_U:
 -            xl = get_field(env->mstatus, MSTATUS64_UXL);
 -            break;
 -        default: /* PRV_S | PRV_H */
 -            xl = get_field(env->mstatus, MSTATUS64_SXL);
 -            break;
 -        }
 -    }
 -    return xl;
 -#endif
 -}
 -
  void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
                            target_ulong *cs_base, uint32_t *pflags)
  {
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
      }
- #endif
+     bool pbmte = env->menvcfg & MENVCFG_PBMTE;
--    flags = FIELD_DP32(flags, TB_FLAGS, XL, cpu_get_xl(env));
+-    bool hade = env->menvcfg & MENVCFG_HADE;
-+    flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
++    bool adue = env->menvcfg & MENVCFG_ADUE;
-     *pflags = flags;
+     if (first_stage && two_stage && env->virt_enabled) {
- }
+         pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
+-        hade = hade && (env->henvcfg & HENVCFG_HADE);
 +        adue = adue && (env->henvcfg & HENVCFG_ADUE);
      }
-     /* tlb_flush is unnecessary as mode is contained in mmu_idx */
-     env->priv = newpriv;
+     int ptshift = (levels - 1) * ptidxbits;
-+    env->xl = cpu_recompute_xl(env);
+@@ -XXX,XX +XXX,XX @@ restart:
-     /*
+     /* Page table updates need to be atomic with MTTCG enabled */
-      * Clear the load reservation - otherwise a reservation placed in one
+     if (updated_pte != pte && !is_debug) {
 -        if (!hade) {
 +        if (!adue) {
              return TRANSLATE_FAIL;
          }
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
-         mstatus = set_field(mstatus, MSTATUS64_UXL, xl);
+     if (riscv_cpu_mxl(env) == MXL_RV64) {
          mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                  (cfg->ext_sstc ? MENVCFG_STCE : 0) |
 -                (cfg->ext_svadu ? MENVCFG_HADE : 0);
 +                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
      }
-     env->mstatus = mstatus;
+     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
-+    env->xl = cpu_recompute_xl(env);
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
      const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
      uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                      (cfg->ext_sstc ? MENVCFG_STCE : 0) |
 -                    (cfg->ext_svadu ? MENVCFG_HADE : 0);
 +                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
      uint64_t valh = (uint64_t)val << 32;
      env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
       * henvcfg.stce is read_only 0 when menvcfg.stce = 0
       * henvcfg.hade is read_only 0 when menvcfg.hade = 0
       */
 -    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
 +    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                             env->menvcfg);
      return RISCV_EXCP_NONE;
  }
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_misa(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
-     /* flush translation cache */
+     }
-     tb_flush(env_cpu(env));
-     env->misa_ext = val;
+     if (riscv_cpu_mxl(env) == MXL_RV64) {
-+    env->xl = riscv_cpu_mxl(env);
+-        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE);
 +        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
      }
      env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
          return ret;
      }
 -    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
 +    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                              env->menvcfg)) >> 32;
      return RISCV_EXCP_NONE;
  }
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
-diff --git a/target/riscv/machine.c b/target/riscv/machine.c
+                                      target_ulong val)
-index XXXXXXX..XXXXXXX 100644
+ {
---- a/target/riscv/machine.c
+     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
-+++ b/target/riscv/machine.c
+-                                    HENVCFG_HADE);
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_kvmtimer = {
++                                    HENVCFG_ADUE);
-     }
+     uint64_t valh = (uint64_t)val << 32;
- };
+     RISCVException ret;
 +static int riscv_cpu_post_load(void *opaque, int version_id)
 +{
 +    RISCVCPU *cpu = opaque;
 +    CPURISCVState *env = &cpu->env;
 +
 +    env->xl = cpu_recompute_xl(env);
 +    return 0;
 +}
 +
  const VMStateDescription vmstate_riscv_cpu = {
      .name = "cpu",
      .version_id = 3,
      .minimum_version_id = 3,
 +    .post_load = riscv_cpu_post_load,
      .fields = (VMStateField[]) {
          VMSTATE_UINTTL_ARRAY(env.gpr, RISCVCPU, 32),
          VMSTATE_UINT64_ARRAY(env.fpr, RISCVCPU, 32),
 --
-.31.1
+.41.0

-[PULL 59/61] target/riscv: Set default XLEN for hypervisor
+[PULL v2 36/45] target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-When swap regs for hypervisor, the value of vsstatus or mstatus_hs
+In the same emulated RISC-V host, the 'host' KVM CPU takes 4 times
-should have the right XLEN. Otherwise, it will propagate to mstatus.
+longer to boot than the 'rv64' KVM CPU.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+The reason is an unintended behavior of riscv_cpu_satp_mode_finalize()
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+when satp_mode.supported = 0, i.e. when cpu_init() does not set
-Message-id: 20220120122050.41546-22-zhiwei_liu@c-sky.com
+satp_mode_max_supported(). satp_mode_max_from_map(map) does:
 - __builtin_clz(map)
 This means that, if satp_mode.supported = 0, satp_mode_supported_max
 wil be '31 - 32'. But this is C, so satp_mode_supported_max will gladly
 set it to UINT_MAX (4294967295). After that, if the user didn't set a
 satp_mode, set_satp_mode_default_map(cpu) will make
 cfg.satp_mode.map = cfg.satp_mode.supported
 So satp_mode.map = 0. And then satp_mode_map_max will be set to
 satp_mode_max_from_map(cpu->cfg.satp_mode.map), i.e. also UINT_MAX. The
 guard "satp_mode_map_max > satp_mode_supported_max" doesn't protect us
 here since both are UINT_MAX.
 And finally we have 2 loops:
         for (int i = satp_mode_map_max - 1; i >= 0; --i) {
 Which are, in fact, 2 loops from UINT_MAX -1 to -1. This is where the
 extra delay when booting the 'host' CPU is coming from.
 Commit 43d1de32f8 already set a precedence for satp_mode.supported = 0
 in a different manner. We're doing the same here. If supported == 0,
 interpret as 'the CPU wants the OS to handle satp mode alone' and skip
 satp_mode_finalize().
 We'll also put a guard in satp_mode_max_from_map() to assert out if map
 is 0 since the function is not ready to deal with it.
 Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
 Fixes: 6f23aaeb9b ("riscv: Allow user to set the satp mode")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20230817152903.694926-1-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 10 ++++++++++
+ target/riscv/cpu.c | 23 ++++++++++++++++++++---
-file changed, 10 insertions(+)
+file changed, 20 insertions(+), 3 deletions(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ static uint8_t satp_mode_from_str(const char *satp_mode_str)
-          */
-         env->mstatus = set_field(env->mstatus, MSTATUS64_SXL, env->misa_mxl);
+ uint8_t satp_mode_max_from_map(uint32_t map)
-         env->mstatus = set_field(env->mstatus, MSTATUS64_UXL, env->misa_mxl);
+ {
-+        if (riscv_has_ext(env, RVH)) {
++    /*
-+            env->vsstatus = set_field(env->vsstatus,
++     * 'map = 0' will make us return (31 - 32), which C will
-+                                      MSTATUS64_SXL, env->misa_mxl);
++     * happily overflow to UINT_MAX. There's no good result to
-+            env->vsstatus = set_field(env->vsstatus,
++     * return if 'map = 0' (e.g. returning 0 will be ambiguous
-+                                      MSTATUS64_UXL, env->misa_mxl);
++     * with the result for 'map = 1').
-+            env->mstatus_hs = set_field(env->mstatus_hs,
++     *
-+                                        MSTATUS64_SXL, env->misa_mxl);
++     * Assert out if map = 0. Callers will have to deal with
-+            env->mstatus_hs = set_field(env->mstatus_hs,
++     * it outside of this function.
-+                                        MSTATUS64_UXL, env->misa_mxl);
++     */
-+        }
++    g_assert(map > 0);
-     }
++
-     env->mcause = 0;
+     /* map here has at least one bit set, so no problem with clz */
-     env->pc = env->resetvec;
+     return 31 - __builtin_clz(map);
  }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
  static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
  {
      bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
 -    uint8_t satp_mode_map_max;
 -    uint8_t satp_mode_supported_max =
 -                        satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
 +    uint8_t satp_mode_map_max, satp_mode_supported_max;
 +
 +    /* The CPU wants the OS to decide which satp mode to use */
 +    if (cpu->cfg.satp_mode.supported == 0) {
 +        return;
 +    }
 +
 +    satp_mode_supported_max =
 +                    satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
      if (cpu->cfg.satp_mode.map == 0) {
          if (cpu->cfg.satp_mode.init == 0) {
 --
-.31.1
+.41.0

-[PULL 45/61] target/riscv: Extend pc for runtime pc write
+[PULL v2 37/45] riscv: zicond: make non-experimental
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Vineet Gupta <vineetg@rivosinc.com>
-In some cases, we must restore the guest PC to the address of the start of
+zicond is now codegen supported in both llvm and gcc.
 the TB, such as when the instruction counter hits zero. So extend pc register
 according to current xlen for these cases.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+This change allows seamless enabling/testing of zicond in downstream
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+projects. e.g. currently riscv-gnu-toolchain parses elf attributes
 to create a cmdline for qemu but fails short of enabling it because of
 the "x-" prefix.
 Signed-off-by: Vineet Gupta <vineetg@rivosinc.com>
 Message-ID: <20230808181715.436395-1-vineetg@rivosinc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-8-zhiwei_liu@c-sky.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 22 +++++++++++++++++++---
+ target/riscv/cpu.c | 2 +-
-file changed, 19 insertions(+), 3 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
- {
+     DEFINE_PROP_BOOL("zcf", RISCVCPU, cfg.ext_zcf, false),
-     RISCVCPU *cpu = RISCV_CPU(cs);
+     DEFINE_PROP_BOOL("zcmp", RISCVCPU, cfg.ext_zcmp, false),
-     CPURISCVState *env = &cpu->env;
+     DEFINE_PROP_BOOL("zcmt", RISCVCPU, cfg.ext_zcmt, false),
--    env->pc = value;
++    DEFINE_PROP_BOOL("zicond", RISCVCPU, cfg.ext_zicond, false),
-+
-+    if (env->xl == MXL_RV32) {
+     /* Vendor-specific custom extensions */
-+        env->pc = (int32_t)value;
+     DEFINE_PROP_BOOL("xtheadba", RISCVCPU, cfg.ext_xtheadba, false),
-+    } else {
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-+        env->pc = value;
+     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
-+    }
- }
+     /* These are experimental so mark with 'x-' */
+-    DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
- static void riscv_cpu_synchronize_from_tb(CPUState *cs,
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
+     /* ePMP 0.9.3 */
- {
+     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
      RISCVCPU *cpu = RISCV_CPU(cs);
      CPURISCVState *env = &cpu->env;
 -    env->pc = tb->pc;
 +    RISCVMXL xl = FIELD_EX32(tb->flags, TB_FLAGS, XL);
 +
 +    if (xl == MXL_RV32) {
 +        env->pc = (int32_t)tb->pc;
 +    } else {
 +        env->pc = tb->pc;
 +    }
  }
  static bool riscv_cpu_has_work(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_has_work(CPUState *cs)
  void restore_state_to_opc(CPURISCVState *env, TranslationBlock *tb,
                            target_ulong *data)
  {
 -    env->pc = data[0];
 +    RISCVMXL xl = FIELD_EX32(tb->flags, TB_FLAGS, XL);
 +    if (xl == MXL_RV32) {
 +        env->pc = (int32_t)data[0];
 +    } else {
 +        env->pc = data[0];
 +    }
  }
  static void riscv_cpu_reset(DeviceState *dev)
 --
-.31.1
+.41.0

-[PULL 18/61] softmmu/device_tree: Remove redundant pointer assignment
+[PULL v2 38/45] hw/riscv/virt.c: fix non-KVM --enable-debug build
-From: Yanan Wang <wangyanan55@huawei.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The pointer assignment "const char *p = path;" in function
+A build with --enable-debug and without KVM will fail as follows:
-qemu_fdt_add_path is unnecessary. Let's remove it and just
-use the "path" passed in. No functional change.
+/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_riscv_virt.c.o: in function `virt_machine_init':
 ./qemu/build/../hw/riscv/virt.c:1465: undefined reference to `kvm_riscv_aia_create'
 This happens because the code block with "if virt_use_kvm_aia(s)" isn't
 being ignored by the debug build, resulting in an undefined reference to
 a KVM only function.
 Add a 'kvm_enabled()' conditional together with virt_use_kvm_aia() will
 make the compiler crop the kvm_riscv_aia_create() call entirely from a
 non-KVM build. Note that adding the 'kvm_enabled()' conditional inside
 virt_use_kvm_aia() won't fix the build because this function would need
 to be inlined multiple times to make the compiler zero out the entire
 block.
 While we're at it, use kvm_enabled() in all instances where
 virt_use_kvm_aia() is checked to allow the compiler to elide these other
 kvm-only instances as well.
 Suggested-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Yanan Wang <wangyanan55@huawei.com>
+Fixes: dbdb99948e ("target/riscv: select KVM AIA in riscv virt machine")
-Reviewed-by: Andrew Jones <drjones@redhat.com>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20220111032758.27804-1-wangyanan55@huawei.com
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230830133503.711138-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- softmmu/device_tree.c | 9 ++++-----
+ hw/riscv/virt.c | 6 +++---
-file changed, 4 insertions(+), 5 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/softmmu/device_tree.c b/softmmu/device_tree.c
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/softmmu/device_tree.c
+--- a/hw/riscv/virt.c
-+++ b/softmmu/device_tree.c
++++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ int qemu_fdt_add_subnode(void *fdt, const char *name)
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
  int qemu_fdt_add_path(void *fdt, const char *path)
  {
      const char *name;
 -    const char *p = path;
      int namelen, retval;
      int parent = 0;
@@ -XXX,XX +XXX,XX @@ int qemu_fdt_add_path(void *fdt, const char *path)
      }
-     do {
+     /* KVM AIA only has one APLIC instance */
--        name = p + 1;
+-    if (virt_use_kvm_aia(s)) {
--        p = strchr(name, '/');
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
--        namelen = p != NULL ? p - name : strlen(name);
+         create_fdt_socket_aplic(s, memmap, 0,
-+        name = path + 1;
+                                 msi_m_phandle, msi_s_phandle, phandle,
-+        path = strchr(name, '/');
+                                 &intc_phandles[0], xplic_phandles,
-+        namelen = path != NULL ? path - name : strlen(name);
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-         retval = fdt_subnode_offset_namelen(fdt, parent, name, namelen);
+     g_free(intc_phandles);
-         if (retval < 0 && retval != -FDT_ERR_NOTFOUND) {
-@@ -XXX,XX +XXX,XX @@ int qemu_fdt_add_path(void *fdt, const char *path)
+-    if (virt_use_kvm_aia(s)) {
 +    if (kvm_enabled() && virt_use_kvm_aia(s)) {
          *irq_mmio_phandle = xplic_phandles[0];
          *irq_virtio_phandle = xplic_phandles[0];
          *irq_pcie_phandle = xplic_phandles[0];
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
          }
+     }
-         parent = retval;
--    } while (p);
+-    if (virt_use_kvm_aia(s)) {
-+    } while (path);
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
+         kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
-     return retval;
+                              VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
- }
+                              memmap[VIRT_APLIC_S].base,
 --
-.31.1
+.41.0

-[PULL 14/61] target/riscv: Implement virtual time adjusting with vm state changing
+[PULL v2 39/45] hw/intc/riscv_aplic.c fix non-KVM --enable-debug build
-From: Yifei Jiang <jiangyifei@huawei.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We hope that virtual time adjusts with vm state changing. When a vm
+Commit 6df0b37e2ab breaks a --enable-debug build in a non-KVM
-is stopped, guest virtual time should stop counting and kvm_timer
+environment with the following error:
 should be stopped. When the vm is resumed, guest virtual time should
 continue to count and kvm_timer should be restored.
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
+/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_intc_riscv_aplic.c.o: in function `riscv_kvm_aplic_request':
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
+./qemu/build/../hw/intc/riscv_aplic.c:486: undefined reference to `kvm_set_irq'
-Reviewed-by: Anup Patel <anup.patel@wdc.com>
+collect2: error: ld returned 1 exit status
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220112081329.1835-12-jiangyifei@huawei.com
+This happens because the debug build will poke into the
 'if (is_kvm_aia(aplic->msimode))' block and fail to find a reference to
 the KVM only function riscv_kvm_aplic_request().
 There are multiple solutions to fix this. We'll go with the same
 solution from the previous patch, i.e. add a kvm_enabled() conditional
 to filter out the block. But there's a catch: riscv_kvm_aplic_request()
 is a local function that would end up being used if the compiler crops
 the block, and this won't work. Quoting Richard Henderson's explanation
 in [1]:
 "(...) the compiler won't eliminate entire unused functions with -O0"
 We'll solve it by moving riscv_kvm_aplic_request() to kvm.c and add its
 declaration in kvm_riscv.h, where all other KVM specific public
 functions are already declared. Other archs handles KVM specific code in
 this manner and we expect to do the same from now on.
 [1] https://lore.kernel.org/qemu-riscv/d2f1ad02-eb03-138f-9d08-db676deeed05@linaro.org/
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230830133503.711138-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/kvm.c | 15 +++++++++++++++
+ target/riscv/kvm_riscv.h | 1 +
-file changed, 15 insertions(+)
+ hw/intc/riscv_aplic.c    | 8 ++------
  target/riscv/kvm.c       | 5 +++++
 files changed, 8 insertions(+), 6 deletions(-)
+diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm_riscv.h
++++ b/target/riscv/kvm_riscv.h
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                           uint64_t aia_irq_num, uint64_t aia_msi_num,
+                           uint64_t aplic_base, uint64_t imsic_base,
+                           uint64_t guest_num);
++void riscv_kvm_aplic_request(void *opaque, int irq, int level);
+ #endif
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/riscv_aplic.c
++++ b/hw/intc/riscv_aplic.c
+@@ -XXX,XX +XXX,XX @@
+ #include "target/riscv/cpu.h"
+ #include "sysemu/sysemu.h"
+ #include "sysemu/kvm.h"
++#include "kvm_riscv.h"
+ #include "migration/vmstate.h"
+ #define APLIC_MAX_IDC                  (1UL << 14)
+@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
+     return topi;
+ }
+-static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
+-{
+-    kvm_set_irq(kvm_state, irq, !!level);
+-}
+-
+ static void riscv_aplic_request(void *opaque, int irq, int level)
+ {
+     bool update = false;
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
+      * have IRQ lines delegated by their parent APLIC.
+      */
+     if (!aplic->parent) {
+-        if (is_kvm_aia(aplic->msimode)) {
++        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
+             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
+         } else {
+             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm.c
 +++ b/target/riscv/kvm.c
 @@ -XXX,XX +XXX,XX @@
- #include "sbi_ecall_interface.h"
+ #include "sysemu/runstate.h"
- #include "chardev/char-fe.h"
+ #include "hw/riscv/numa.h"
- #include "migration/migration.h"
-+#include "sysemu/runstate.h"
++void riscv_kvm_aplic_request(void *opaque, int irq, int level)
++{
 +    kvm_set_irq(kvm_state, irq, !!level);
 +}
 +
  static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                   uint64_t idx)
-@@ -XXX,XX +XXX,XX @@ unsigned long kvm_arch_vcpu_id(CPUState *cpu)
-     return cpu->cpu_index;
- }
-+static void kvm_riscv_vm_state_change(void *opaque, bool running,
-+                                      RunState state)
-+{
-+    CPUState *cs = opaque;
-+
-+    if (running) {
-+        kvm_riscv_put_regs_timer(cs);
-+    } else {
-+        kvm_riscv_get_regs_timer(cs);
-+    }
-+}
-+
- void kvm_arch_init_irq_routing(KVMState *s)
  {
- }
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
-     CPURISCVState *env = &cpu->env;
-     uint64_t id;
-+    qemu_add_vm_change_state_handler(kvm_riscv_vm_state_change, cs);
-+
-     id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
-                           KVM_REG_RISCV_CONFIG_REG(isa));
-     ret = kvm_get_one_reg(cs, id, &isa);
 --
-.31.1
+.41.0

-[PULL 15/61] target/riscv: Support virtual time context synchronization
+Deleted patch
-From: Yifei Jiang <jiangyifei@huawei.com>
-Add virtual time context description to vmstate_kvmtimer. After cpu being
-loaded, virtual time context is updated to KVM.
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
-Reviewed-by: Anup Patel <anup.patel@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220112081329.1835-13-jiangyifei@huawei.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/machine.c | 30 ++++++++++++++++++++++++++++++
-file changed, 30 insertions(+)
-diff --git a/target/riscv/machine.c b/target/riscv/machine.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/machine.c
-+++ b/target/riscv/machine.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_rv128 = {
-     }
- };
-+static bool kvmtimer_needed(void *opaque)
-+{
-+    return kvm_enabled();
-+}
-+
-+static int cpu_post_load(void *opaque, int version_id)
-+{
-+    RISCVCPU *cpu = opaque;
-+    CPURISCVState *env = &cpu->env;
-+
-+    env->kvm_timer_dirty = true;
-+    return 0;
-+}
-+
-+static const VMStateDescription vmstate_kvmtimer = {
-+    .name = "cpu/kvmtimer",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .needed = kvmtimer_needed,
-+    .post_load = cpu_post_load,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT64(env.kvm_timer_time, RISCVCPU),
-+        VMSTATE_UINT64(env.kvm_timer_compare, RISCVCPU),
-+        VMSTATE_UINT64(env.kvm_timer_state, RISCVCPU),
-+
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
- const VMStateDescription vmstate_riscv_cpu = {
-     .name = "cpu",
-     .version_id = 3,
-@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
-         &vmstate_vector,
-         &vmstate_pointermasking,
-         &vmstate_rv128,
-+        &vmstate_kvmtimer,
-         NULL
-     }
- };
---
-.31.1

-[PULL 16/61] target/riscv: enable riscv kvm accel
+Deleted patch
-From: Yifei Jiang <jiangyifei@huawei.com>
-Add riscv kvm support in meson.build file.
-Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
-Signed-off-by: Mingwang Li <limingwang@huawei.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Anup Patel <anup@brainfault.org>
-Message-id: 20220112081329.1835-14-jiangyifei@huawei.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- meson.build | 2 ++
-file changed, 2 insertions(+)
-diff --git a/meson.build b/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/meson.build
-+++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ elif cpu in ['ppc', 'ppc64']
-   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
- elif cpu in ['mips', 'mips64']
-   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
-+elif cpu in ['riscv']
-+  kvm_targets = ['riscv32-softmmu', 'riscv64-softmmu']
- else
-   kvm_targets = []
- endif
---
-.31.1

-[PULL 22/61] target/riscv: rvv-1.0: Add Zve64f support for vmulh variant insns
+Deleted patch
-From: Frank Chang <frank.chang@sifive.com>
-All Zve* extensions support all vector integer instructions,
-except that the vmulh integer multiply variants that return the
-high word of the product (vmulh.vv, vmulh.vx, vmulhu.vv, vmulhu.vx,
-vmulhsu.vv, vmulhsu.vx) are not included for EEW=64 in Zve64*.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220118014522.13613-5-frank.chang@sifive.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_rvv.c.inc | 39 +++++++++++++++++++++----
-file changed, 33 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vmaxu_vx, opivx_check)
- GEN_OPIVX_TRANS(vmax_vx,  opivx_check)
- /* Vector Single-Width Integer Multiply Instructions */
-+
-+static bool vmulh_vv_check(DisasContext *s, arg_rmrr *a)
-+{
-+    /*
-+     * All Zve* extensions support all vector integer instructions,
-+     * except that the vmulh integer multiply variants
-+     * that return the high word of the product
-+     * (vmulh.vv, vmulh.vx, vmulhu.vv, vmulhu.vx, vmulhsu.vv, vmulhsu.vx)
-+     * are not included for EEW=64 in Zve64*. (Section 18.2)
-+     */
-+    return opivv_check(s, a) &&
-+           (!has_ext(s, RVV) && s->ext_zve64f ? s->sew != MO_64 : true);
-+}
-+
-+static bool vmulh_vx_check(DisasContext *s, arg_rmrr *a)
-+{
-+    /*
-+     * All Zve* extensions support all vector integer instructions,
-+     * except that the vmulh integer multiply variants
-+     * that return the high word of the product
-+     * (vmulh.vv, vmulh.vx, vmulhu.vv, vmulhu.vx, vmulhsu.vv, vmulhsu.vx)
-+     * are not included for EEW=64 in Zve64*. (Section 18.2)
-+     */
-+    return opivx_check(s, a) &&
-+           (!has_ext(s, RVV) && s->ext_zve64f ? s->sew != MO_64 : true);
-+}
-+
- GEN_OPIVV_GVEC_TRANS(vmul_vv,  mul)
--GEN_OPIVV_TRANS(vmulh_vv, opivv_check)
--GEN_OPIVV_TRANS(vmulhu_vv, opivv_check)
--GEN_OPIVV_TRANS(vmulhsu_vv, opivv_check)
-+GEN_OPIVV_TRANS(vmulh_vv, vmulh_vv_check)
-+GEN_OPIVV_TRANS(vmulhu_vv, vmulh_vv_check)
-+GEN_OPIVV_TRANS(vmulhsu_vv, vmulh_vv_check)
- GEN_OPIVX_GVEC_TRANS(vmul_vx,  muls)
--GEN_OPIVX_TRANS(vmulh_vx, opivx_check)
--GEN_OPIVX_TRANS(vmulhu_vx, opivx_check)
--GEN_OPIVX_TRANS(vmulhsu_vx, opivx_check)
-+GEN_OPIVX_TRANS(vmulh_vx, vmulh_vx_check)
-+GEN_OPIVX_TRANS(vmulhu_vx, vmulh_vx_check)
-+GEN_OPIVX_TRANS(vmulhsu_vx, vmulh_vx_check)
- /* Vector Integer Divide Instructions */
- GEN_OPIVV_TRANS(vdivu_vv, opivv_check)
---
-.31.1

-[PULL 23/61] target/riscv: rvv-1.0: Add Zve64f support for vsmul.vv and vsmul.vx insns
+Deleted patch
-From: Frank Chang <frank.chang@sifive.com>
-All Zve* extensions support all vector fixed-point arithmetic
-instructions, except that vsmul.vv and vsmul.vx are not supported
-for EEW=64 in Zve64*.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220118014522.13613-6-frank.chang@sifive.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_rvv.c.inc | 27 +++++++++++++++++++++++--
-file changed, 25 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vasub_vx,  opivx_check)
- GEN_OPIVX_TRANS(vasubu_vx,  opivx_check)
- /* Vector Single-Width Fractional Multiply with Rounding and Saturation */
--GEN_OPIVV_TRANS(vsmul_vv, opivv_check)
--GEN_OPIVX_TRANS(vsmul_vx,  opivx_check)
-+
-+static bool vsmul_vv_check(DisasContext *s, arg_rmrr *a)
-+{
-+    /*
-+     * All Zve* extensions support all vector fixed-point arithmetic
-+     * instructions, except that vsmul.vv and vsmul.vx are not supported
-+     * for EEW=64 in Zve64*. (Section 18.2)
-+     */
-+    return opivv_check(s, a) &&
-+           (!has_ext(s, RVV) && s->ext_zve64f ? s->sew != MO_64 : true);
-+}
-+
-+static bool vsmul_vx_check(DisasContext *s, arg_rmrr *a)
-+{
-+    /*
-+     * All Zve* extensions support all vector fixed-point arithmetic
-+     * instructions, except that vsmul.vv and vsmul.vx are not supported
-+     * for EEW=64 in Zve64*. (Section 18.2)
-+     */
-+    return opivx_check(s, a) &&
-+           (!has_ext(s, RVV) && s->ext_zve64f ? s->sew != MO_64 : true);
-+}
-+
-+GEN_OPIVV_TRANS(vsmul_vv, vsmul_vv_check)
-+GEN_OPIVX_TRANS(vsmul_vx,  vsmul_vx_check)
- /* Vector Single-Width Scaling Shift Instructions */
- GEN_OPIVV_TRANS(vssrl_vv, opivv_check)
---
-.31.1

-[PULL 24/61] target/riscv: rvv-1.0: Add Zve64f support for scalar fp insns
+Deleted patch
-From: Frank Chang <frank.chang@sifive.com>
-Zve64f extension requires the scalar processor to implement the F
-extension and implement all vector floating-point instructions for
-floating-point operands with EEW=32 (i.e., no widening floating-point
-operations).
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220118014522.13613-7-frank.chang@sifive.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_rvv.c.inc | 41 +++++++++++++++++++------
-file changed, 31 insertions(+), 10 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool require_scale_rvf(DisasContext *s)
-     }
- }
-+static bool require_zve64f(DisasContext *s)
-+{
-+    /* RVV + Zve64f = RVV. */
-+    if (has_ext(s, RVV)) {
-+        return true;
-+    }
-+
-+    /* Zve64f doesn't support FP64. (Section 18.2) */
-+    return s->ext_zve64f ? s->sew <= MO_32 : true;
-+}
-+
- /* Destination vector register group cannot overlap source mask register. */
- static bool require_vm(int vm, int vd)
- {
-@@ -XXX,XX +XXX,XX @@ static bool opfvv_check(DisasContext *s, arg_rmrr *a)
-     return require_rvv(s) &&
-            require_rvf(s) &&
-            vext_check_isa_ill(s) &&
--           vext_check_sss(s, a->rd, a->rs1, a->rs2, a->vm);
-+           vext_check_sss(s, a->rd, a->rs1, a->rs2, a->vm) &&
-+           require_zve64f(s);
- }
- /* OPFVV without GVEC IR */
-@@ -XXX,XX +XXX,XX @@ static bool opfvf_check(DisasContext *s, arg_rmrr *a)
-     return require_rvv(s) &&
-            require_rvf(s) &&
-            vext_check_isa_ill(s) &&
--           vext_check_ss(s, a->rd, a->rs2, a->vm);
-+           vext_check_ss(s, a->rd, a->rs2, a->vm) &&
-+           require_zve64f(s);
- }
- /* OPFVF without GVEC IR */
-@@ -XXX,XX +XXX,XX @@ static bool opfv_check(DisasContext *s, arg_rmr *a)
-            require_rvf(s) &&
-            vext_check_isa_ill(s) &&
-            /* OPFV instructions ignore vs1 check */
--           vext_check_ss(s, a->rd, a->rs2, a->vm);
-+           vext_check_ss(s, a->rd, a->rs2, a->vm) &&
-+           require_zve64f(s);
- }
- static bool do_opfv(DisasContext *s, arg_rmr *a,
-@@ -XXX,XX +XXX,XX @@ static bool opfvv_cmp_check(DisasContext *s, arg_rmrr *a)
-     return require_rvv(s) &&
-            require_rvf(s) &&
-            vext_check_isa_ill(s) &&
--           vext_check_mss(s, a->rd, a->rs1, a->rs2);
-+           vext_check_mss(s, a->rd, a->rs1, a->rs2) &&
-+           require_zve64f(s);
- }
- GEN_OPFVV_TRANS(vmfeq_vv, opfvv_cmp_check)
-@@ -XXX,XX +XXX,XX @@ static bool opfvf_cmp_check(DisasContext *s, arg_rmrr *a)
-     return require_rvv(s) &&
-            require_rvf(s) &&
-            vext_check_isa_ill(s) &&
--           vext_check_ms(s, a->rd, a->rs2);
-+           vext_check_ms(s, a->rd, a->rs2) &&
-+           require_zve64f(s);
- }
- GEN_OPFVF_TRANS(vmfeq_vf, opfvf_cmp_check)
-@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
-     if (require_rvv(s) &&
-         require_rvf(s) &&
-         vext_check_isa_ill(s) &&
--        require_align(a->rd, s->lmul)) {
-+        require_align(a->rd, s->lmul) &&
-+        require_zve64f(s)) {
-         gen_set_rm(s, RISCV_FRM_DYN);
-         TCGv_i64 t1;
-@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_f_s(DisasContext *s, arg_vfmv_f_s *a)
- {
-     if (require_rvv(s) &&
-         require_rvf(s) &&
--        vext_check_isa_ill(s)) {
-+        vext_check_isa_ill(s) &&
-+        require_zve64f(s)) {
-         gen_set_rm(s, RISCV_FRM_DYN);
-         unsigned int ofs = (8 << s->sew);
-@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
- {
-     if (require_rvv(s) &&
-         require_rvf(s) &&
--        vext_check_isa_ill(s)) {
-+        vext_check_isa_ill(s) &&
-+        require_zve64f(s)) {
-         gen_set_rm(s, RISCV_FRM_DYN);
-         /* The instructions ignore LMUL and vector register group. */
-@@ -XXX,XX +XXX,XX @@ GEN_OPIVI_TRANS(vslidedown_vi, IMM_ZX, vslidedown_vx, slidedown_check)
- static bool fslideup_check(DisasContext *s, arg_rmrr *a)
- {
-     return slideup_check(s, a) &&
--           require_rvf(s);
-+           require_rvf(s) &&
-+           require_zve64f(s);
- }
- static bool fslidedown_check(DisasContext *s, arg_rmrr *a)
- {
-     return slidedown_check(s, a) &&
--           require_rvf(s);
-+           require_rvf(s) &&
-+           require_zve64f(s);
- }
- GEN_OPFVF_TRANS(vfslide1up_vf, fslideup_check)
---
-.31.1

-[PULL 25/61] target/riscv: rvv-1.0: Add Zve64f support for single-width fp reduction insns
+Deleted patch
-From: Frank Chang <frank.chang@sifive.com>
-Vector single-width floating-point reduction operations for EEW=32 are
-supported for Zve64f extension.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220118014522.13613-8-frank.chang@sifive.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_rvv.c.inc | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ GEN_OPIVV_WIDEN_TRANS(vwredsumu_vs, reduction_widen_check)
- static bool freduction_check(DisasContext *s, arg_rmrr *a)
- {
-     return reduction_check(s, a) &&
--           require_rvf(s);
-+           require_rvf(s) &&
-+           require_zve64f(s);
- }
- GEN_OPFVV_TRANS(vfredsum_vs, freduction_check)
---
-.31.1

-[PULL 27/61] target/riscv: rvv-1.0: Add Zve64f support for narrowing type-convert insns
+Deleted patch
-From: Frank Chang <frank.chang@sifive.com>
-Vector narrowing conversion instructions are provided to and from all
-supported integer EEWs for Zve64f extension.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220118014522.13613-10-frank.chang@sifive.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_rvv.c.inc | 9 ++++++---
-file changed, 6 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool opfxv_narrow_check(DisasContext *s, arg_rmr *a)
- {
-     return opfv_narrow_check(s, a) &&
-            require_rvf(s) &&
--           (s->sew != MO_64);
-+           (s->sew != MO_64) &&
-+           require_zve64f(s);
- }
- static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
- {
-     return opfv_narrow_check(s, a) &&
-            require_scale_rvf(s) &&
--           (s->sew != MO_8);
-+           (s->sew != MO_8) &&
-+           require_scale_zve64f(s);
- }
- #define GEN_OPFV_NARROW_TRANS(NAME, CHECK, HELPER, FRM)            \
-@@ -XXX,XX +XXX,XX @@ static bool opxfv_narrow_check(DisasContext *s, arg_rmr *a)
-            require_scale_rvf(s) &&
-            vext_check_isa_ill(s) &&
-            /* OPFV narrowing instructions ignore vs1 check */
--           vext_check_sd(s, a->rd, a->rs2, a->vm);
-+           vext_check_sd(s, a->rd, a->rs2, a->vm) &&
-+           require_scale_zve64f(s);
- }
- #define GEN_OPXFV_NARROW_TRANS(NAME, HELPER, FRM)                  \
---
-.31.1

-[PULL 32/61] target/riscv: rvv-1.0: Add Zve32f support for single-width fp reduction insns
+Deleted patch
-From: Frank Chang <frank.chang@sifive.com>
-Vector single-width floating-point reduction operations for EEW=32 are
-supported for Zve32f extension.
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220118014522.13613-15-frank.chang@sifive.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn_trans/trans_rvv.c.inc | 1 +
-file changed, 1 insertion(+)
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool freduction_check(DisasContext *s, arg_rmrr *a)
- {
-     return reduction_check(s, a) &&
-            require_rvf(s) &&
-+           require_zve32f(s) &&
-            require_zve64f(s);
- }
---
-.31.1

-[PULL 55/61] target/riscv: Remove VILL field in VTYPE
+[PULL v2 40/45] linux-user/riscv: Add new extensions to hwprobe
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Robbin Ehn <rehn@rivosinc.com>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+This patch adds the new extensions in
 linux 6.5 to the hwprobe syscall.
 And fixes RVC check to OR with correct value.
 The previous variable contains 0 therefore it
 did work.
 Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
 Acked-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-18-zhiwei_liu@c-sky.com
+Message-ID: <bc82203b72d7efb30f1b4a8f9eb3d94699799dc8.camel@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h | 1 -
+ linux-user/syscall.c | 14 +++++++++++++-
-file changed, 1 deletion(-)
+file changed, 13 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/linux-user/syscall.c
-+++ b/target/riscv/cpu.h
++++ b/linux-user/syscall.c
-@@ -XXX,XX +XXX,XX @@ FIELD(VTYPE, VTA, 6, 1)
+@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
- FIELD(VTYPE, VMA, 7, 1)
+ #define RISCV_HWPROBE_KEY_IMA_EXT_0     4
- FIELD(VTYPE, VEDIV, 8, 2)
+ #define     RISCV_HWPROBE_IMA_FD       (1 << 0)
- FIELD(VTYPE, RESERVED, 10, sizeof(target_ulong) * 8 - 11)
+ #define     RISCV_HWPROBE_IMA_C        (1 << 1)
--FIELD(VTYPE, VILL, sizeof(target_ulong) * 8 - 1, 1)
++#define     RISCV_HWPROBE_IMA_V        (1 << 2)
++#define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
- struct CPURISCVState {
++#define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
-     target_ulong gpr[32];
++#define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
  #define RISCV_HWPROBE_KEY_CPUPERF_0     5
  #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
                      riscv_has_ext(env, RVD) ?
                      RISCV_HWPROBE_IMA_FD : 0;
              value |= riscv_has_ext(env, RVC) ?
 -                     RISCV_HWPROBE_IMA_C : pair->value;
 +                     RISCV_HWPROBE_IMA_C : 0;
 +            value |= riscv_has_ext(env, RVV) ?
 +                     RISCV_HWPROBE_IMA_V : 0;
 +            value |= cfg->ext_zba ?
 +                     RISCV_HWPROBE_EXT_ZBA : 0;
 +            value |= cfg->ext_zbb ?
 +                     RISCV_HWPROBE_EXT_ZBB : 0;
 +            value |= cfg->ext_zbs ?
 +                     RISCV_HWPROBE_EXT_ZBS : 0;
              __put_user(value, &pair->value);
              break;
          case RISCV_HWPROBE_KEY_CPUPERF_0:
 --
-.31.1
+.41.0

-[PULL 37/61] hw/riscv: Remove macros for ELF BIOS image names
+[PULL v2 41/45] target/riscv: Use accelerated helper for AES64KS1I
-From: Anup Patel <apatel@ventanamicro.com>
+From: Ard Biesheuvel <ardb@kernel.org>
-Now that RISC-V Spike machine can use BIN BIOS images, we remove
+Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
-the macros used for ELF BIOS image names.
+implement the first half of the key schedule derivation. This does not
 actually involve shifting rows, so clone the same value into all four
 columns of the AES vector to counter that operation.
-Signed-off-by: Anup Patel <apatel@ventanamicro.com>
+Cc: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
 Cc: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230831154118.138727-1-ardb@kernel.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/boot.h | 2 --
+ target/riscv/crypto_helper.c | 17 +++++------------
- hw/riscv/spike.c        | 4 ++--
+file changed, 5 insertions(+), 12 deletions(-)
 files changed, 2 insertions(+), 4 deletions(-)
-diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
+diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/boot.h
+--- a/target/riscv/crypto_helper.c
-+++ b/include/hw/riscv/boot.h
++++ b/target/riscv/crypto_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
- #include "hw/riscv/riscv_hart.h"
+     uint8_t enc_rnum = rnum;
- #define RISCV32_BIOS_BIN    "opensbi-riscv32-generic-fw_dynamic.bin"
+     uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
--#define RISCV32_BIOS_ELF    "opensbi-riscv32-generic-fw_dynamic.elf"
+-    uint8_t rcon_ = 0;
- #define RISCV64_BIOS_BIN    "opensbi-riscv64-generic-fw_dynamic.bin"
+-    target_ulong result;
--#define RISCV64_BIOS_ELF    "opensbi-riscv64-generic-fw_dynamic.elf"
++    AESState t, rc = {};
- bool riscv_is_32bit(RISCVHartArrayState *harts);
+     if (enc_rnum != 0xA) {
+         temp = ror32(temp, 8); /* Rotate right by 8 */
-diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
+-        rcon_ = round_consts[enc_rnum];
-index XXXXXXX..XXXXXXX 100644
++        rc.w[0] = rc.w[1] = round_consts[enc_rnum];
 --- a/hw/riscv/spike.c
 +++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
       */
      if (riscv_is_32bit(&s->soc[0])) {
          firmware_end_addr = riscv_find_and_load_firmware(machine,
 -                                    RISCV32_BIOS_ELF, memmap[SPIKE_DRAM].base,
 +                                    RISCV32_BIOS_BIN, memmap[SPIKE_DRAM].base,
                                      htif_symbol_callback);
      } else {
          firmware_end_addr = riscv_find_and_load_firmware(machine,
 -                                    RISCV64_BIOS_ELF, memmap[SPIKE_DRAM].base,
 +                                    RISCV64_BIOS_BIN, memmap[SPIKE_DRAM].base,
                                      htif_symbol_callback);
      }
+-    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
+-           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
+-           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
+-           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
++    t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
++    aesenc_SB_SR_AK(&t, &t, &rc, false);
+-    temp ^= rcon_;
+-
+-    result = ((uint64_t)temp << 32) | temp;
+-
+-    return result;
++    return t.d[0];
+ }
+ target_ulong HELPER(aes64im)(target_ulong rs1)
 --
-.31.1
+.41.0

-[PULL 38/61] roms/opensbi: Remove ELF images
+Deleted patch
-From: Anup Patel <apatel@ventanamicro.com>
-Now that all RISC-V machines can use OpenSBI BIN images, we remove
-OpenSBI ELF images and also exclude these images from BIOS build.
-Signed-off-by: Anup Patel <apatel@ventanamicro.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- .gitlab-ci.d/opensbi.yml                       |   2 --
- pc-bios/meson.build                            |   2 --
- pc-bios/opensbi-riscv32-generic-fw_dynamic.elf | Bin 838904 -> 0 bytes
- pc-bios/opensbi-riscv64-generic-fw_dynamic.elf | Bin 934696 -> 0 bytes
- roms/Makefile                                  |   2 --
-files changed, 6 deletions(-)
- delete mode 100644 pc-bios/opensbi-riscv32-generic-fw_dynamic.elf
- delete mode 100644 pc-bios/opensbi-riscv64-generic-fw_dynamic.elf
-diff --git a/.gitlab-ci.d/opensbi.yml b/.gitlab-ci.d/opensbi.yml
-index XXXXXXX..XXXXXXX 100644
---- a/.gitlab-ci.d/opensbi.yml
-+++ b/.gitlab-ci.d/opensbi.yml
-@@ -XXX,XX +XXX,XX @@ build-opensbi:
-  artifacts:
-    paths: # 'artifacts.zip' will contains the following files:
-    - pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
--   - pc-bios/opensbi-riscv32-generic-fw_dynamic.elf
-    - pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
--   - pc-bios/opensbi-riscv64-generic-fw_dynamic.elf
-    - opensbi32-generic-stdout.log
-    - opensbi32-generic-stderr.log
-    - opensbi64-generic-stdout.log
-diff --git a/pc-bios/meson.build b/pc-bios/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/pc-bios/meson.build
-+++ b/pc-bios/meson.build
-@@ -XXX,XX +XXX,XX @@ blobs = files(
-   'hppa-firmware.img',
-   'opensbi-riscv32-generic-fw_dynamic.bin',
-   'opensbi-riscv64-generic-fw_dynamic.bin',
--  'opensbi-riscv32-generic-fw_dynamic.elf',
--  'opensbi-riscv64-generic-fw_dynamic.elf',
-   'npcm7xx_bootrom.bin',
- )
-diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.elf b/pc-bios/opensbi-riscv32-generic-fw_dynamic.elf
-deleted file mode 100644
-index XXXXXXX..XXXXXXX
-Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.elf and /dev/null differ
-diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.elf b/pc-bios/opensbi-riscv64-generic-fw_dynamic.elf
-deleted file mode 100644
-index XXXXXXX..XXXXXXX
-Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.elf and /dev/null differ
-diff --git a/roms/Makefile b/roms/Makefile
-index XXXXXXX..XXXXXXX 100644
---- a/roms/Makefile
-+++ b/roms/Makefile
-@@ -XXX,XX +XXX,XX @@ opensbi32-generic:
-         CROSS_COMPILE=$(riscv32_cross_prefix) \
-         PLATFORM="generic"
-     cp opensbi/build/platform/generic/firmware/fw_dynamic.bin ../pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
--    cp opensbi/build/platform/generic/firmware/fw_dynamic.elf ../pc-bios/opensbi-riscv32-generic-fw_dynamic.elf
- opensbi64-generic:
-     $(MAKE) -C opensbi \
-         CROSS_COMPILE=$(riscv64_cross_prefix) \
-         PLATFORM="generic"
-     cp opensbi/build/platform/generic/firmware/fw_dynamic.bin ../pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
--    cp opensbi/build/platform/generic/firmware/fw_dynamic.elf ../pc-bios/opensbi-riscv64-generic-fw_dynamic.elf
- MESON = meson
- NINJA = ninja
---
-.31.1

-[PULL 42/61] target/riscv: Sign extend pc for different XLEN
+[PULL v2 42/45] target/riscv: Allocate itrigger timers only once
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
-When pc is written, it is sign-extended to fill the widest supported XLEN.
+riscv_trigger_init() had been called on reset events that can happen
 several times for a CPU and it allocated timers for itrigger. If old
 timers were present, they were simply overwritten by the new timers,
 resulting in a memory leak.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+Divide riscv_trigger_init() into two functions, namely
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+riscv_trigger_realize() and riscv_trigger_reset() and call them in
 appropriate timing. The timer allocation will happen only once for a
 CPU in riscv_trigger_realize().
 Fixes: 5a4ae64cac ("target/riscv: Add itrigger support when icount is enabled")
 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-5-zhiwei_liu@c-sky.com
+Message-ID: <20230818034059.9146-1-akihiko.odaki@daynix.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/translate.c                      | 25 ++++++++++++++++---
+ target/riscv/debug.h |  3 ++-
- .../riscv/insn_trans/trans_privileged.c.inc   |  2 +-
+ target/riscv/cpu.c   |  8 +++++++-
- target/riscv/insn_trans/trans_rvi.c.inc       |  5 ++--
+ target/riscv/debug.c | 15 ++++++++++++---
- target/riscv/insn_trans/trans_rvv.c.inc       |  4 +--
+files changed, 21 insertions(+), 5 deletions(-)
 files changed, 27 insertions(+), 9 deletions(-)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/target/riscv/debug.h b/target/riscv/debug.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/target/riscv/debug.h
-+++ b/target/riscv/translate.c
++++ b/target/riscv/debug.h
-@@ -XXX,XX +XXX,XX @@ static void gen_check_nanbox_s(TCGv_i64 out, TCGv_i64 in)
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs);
-     tcg_gen_movcond_i64(TCG_COND_GEU, out, in, t_max, in, t_nan);
+ bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
  bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
 -void riscv_trigger_init(CPURISCVState *env);
 +void riscv_trigger_realize(CPURISCVState *env);
 +void riscv_trigger_reset_hold(CPURISCVState *env);
  bool riscv_itrigger_enabled(CPURISCVState *env);
  void riscv_itrigger_update_priv(CPURISCVState *env);
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
  #ifndef CONFIG_USER_ONLY
      if (cpu->cfg.debug) {
 -        riscv_trigger_init(env);
 +        riscv_trigger_reset_hold(env);
      }
      if (kvm_enabled()) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
      riscv_cpu_register_gdb_regs_for_features(cs);
 +#ifndef CONFIG_USER_ONLY
 +    if (cpu->cfg.debug) {
 +        riscv_trigger_realize(&cpu->env);
 +    }
 +#endif
 +
      qemu_init_vcpu(cs);
      cpu_reset(cs);
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
      return false;
  }
-+static void gen_set_pc_imm(DisasContext *ctx, target_ulong dest)
+-void riscv_trigger_init(CPURISCVState *env)
 +void riscv_trigger_realize(CPURISCVState *env)
 +{
-+    if (get_xl(ctx) == MXL_RV32) {
++    int i;
 +        dest = (int32_t)dest;
 +    }
 +    tcg_gen_movi_tl(cpu_pc, dest);
 +}
 +
-+static void gen_set_pc(DisasContext *ctx, TCGv dest)
++    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
-+{
++        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-+    if (get_xl(ctx) == MXL_RV32) {
++                                              riscv_itrigger_timer_cb, env);
 +        tcg_gen_ext32s_tl(cpu_pc, dest);
 +    } else {
 +        tcg_gen_mov_tl(cpu_pc, dest);
 +    }
 +}
 +
- static void generate_exception(DisasContext *ctx, int excp)
++void riscv_trigger_reset_hold(CPURISCVState *env)
  {
--    tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
+     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
-+    gen_set_pc_imm(ctx, ctx->base.pc_next);
+     int i;
-     gen_helper_raise_exception(cpu_env, tcg_constant_i32(excp));
+@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
-     ctx->base.is_jmp = DISAS_NORETURN;
+         env->tdata3[i] = 0;
- }
+         env->cpu_breakpoint[i] = NULL;
+         env->cpu_watchpoint[i] = NULL;
- static void generate_exception_mtval(DisasContext *ctx, int excp)
+-        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
- {
+-                                              riscv_itrigger_timer_cb, env);
--    tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
++        timer_del(env->itrigger_timer[i]);
 +    gen_set_pc_imm(ctx, ctx->base.pc_next);
      tcg_gen_st_tl(cpu_pc, cpu_env, offsetof(CPURISCVState, badaddr));
      gen_helper_raise_exception(cpu_env, tcg_constant_i32(excp));
      ctx->base.is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
  {
      if (translator_use_goto_tb(&ctx->base, dest)) {
          tcg_gen_goto_tb(n);
 -        tcg_gen_movi_tl(cpu_pc, dest);
 +        gen_set_pc_imm(ctx, dest);
          tcg_gen_exit_tb(ctx->base.tb, n);
      } else {
 -        tcg_gen_movi_tl(cpu_pc, dest);
 +        gen_set_pc_imm(ctx, dest);
          tcg_gen_lookup_and_goto_ptr();
      }
  }
-diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_privileged.c.inc
-+++ b/target/riscv/insn_trans/trans_privileged.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
- static bool trans_wfi(DisasContext *ctx, arg_wfi *a)
- {
- #ifndef CONFIG_USER_ONLY
--    tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
-+    gen_set_pc_imm(ctx, ctx->pc_succ_insn);
-     gen_helper_wfi(cpu_env);
-     return true;
- #else
-diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvi.c.inc
-+++ b/target/riscv/insn_trans/trans_rvi.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
-     tcg_gen_addi_tl(cpu_pc, get_gpr(ctx, a->rs1, EXT_NONE), a->imm);
-     tcg_gen_andi_tl(cpu_pc, cpu_pc, (target_ulong)-2);
-+    gen_set_pc(ctx, cpu_pc);
-     if (!has_ext(ctx, RVC)) {
-         TCGv t0 = tcg_temp_new();
-@@ -XXX,XX +XXX,XX @@ static bool trans_fence_i(DisasContext *ctx, arg_fence_i *a)
-      * FENCE_I is a no-op in QEMU,
-      * however we need to end the translation block
-      */
--    tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
-+    gen_set_pc_imm(ctx, ctx->pc_succ_insn);
-     tcg_gen_exit_tb(NULL, 0);
-     ctx->base.is_jmp = DISAS_NORETURN;
-     return true;
-@@ -XXX,XX +XXX,XX @@ static bool trans_fence_i(DisasContext *ctx, arg_fence_i *a)
- static bool do_csr_post(DisasContext *ctx)
- {
-     /* We may have changed important cpu state -- exit to main loop. */
--    tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
-+    gen_set_pc_imm(ctx, ctx->pc_succ_insn);
-     tcg_gen_exit_tb(NULL, 0);
-     ctx->base.is_jmp = DISAS_NORETURN;
-     return true;
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
-     gen_set_gpr(s, rd, dst);
-     mark_vs_dirty(s);
--    tcg_gen_movi_tl(cpu_pc, s->pc_succ_insn);
-+    gen_set_pc_imm(s, s->pc_succ_insn);
-     tcg_gen_lookup_and_goto_ptr();
-     s->base.is_jmp = DISAS_NORETURN;
-@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
-     gen_helper_vsetvl(dst, cpu_env, s1, s2);
-     gen_set_gpr(s, rd, dst);
-     mark_vs_dirty(s);
--    tcg_gen_movi_tl(cpu_pc, s->pc_succ_insn);
-+    gen_set_pc_imm(s, s->pc_succ_insn);
-     tcg_gen_lookup_and_goto_ptr();
-     s->base.is_jmp = DISAS_NORETURN;
 --
-.31.1
+.41.0

-[PULL 39/61] target/riscv: Adjust pmpcfg access with mxl
+[PULL v2 43/45] target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Leon Schuermann <leons@opentitan.org>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+When the rule-lock bypass (RLB) bit is set in the mseccfg CSR, the PMP
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+configuration lock bits must not apply. While this behavior is
 implemented for the pmpcfgX CSRs, this bit is not respected for
 changes to the pmpaddrX CSRs. This patch ensures that pmpaddrX CSR
 writes work even on locked regions when the global rule-lock bypass is
 enabled.
 Signed-off-by: Leon Schuermann <leons@opentitan.org>
 Reviewed-by: Mayuresh Chitale <mchitale@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-2-zhiwei_liu@c-sky.com
+Message-ID: <20230829215046.1430463-1-leon@is.currently.online>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 19 +++++++++++++++++++
+ target/riscv/pmp.c | 4 ++++
- target/riscv/pmp.c | 12 ++++--------
+file changed, 4 insertions(+)
 files changed, 23 insertions(+), 8 deletions(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mseccfg(CPURISCVState *env, int csrno,
-     return RISCV_EXCP_NONE;
- }
-+static bool check_pmp_reg_index(CPURISCVState *env, uint32_t reg_index)
-+{
-+    /* TODO: RV128 restriction check */
-+    if ((reg_index & 1) && (riscv_cpu_mxl(env) == MXL_RV64)) {
-+        return false;
-+    }
-+    return true;
-+}
-+
- static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
- {
-+    uint32_t reg_index = csrno - CSR_PMPCFG0;
-+
-+    if (!check_pmp_reg_index(env, reg_index)) {
-+        return RISCV_EXCP_ILLEGAL_INST;
-+    }
-     *val = pmpcfg_csr_read(env, csrno - CSR_PMPCFG0);
-     return RISCV_EXCP_NONE;
- }
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
- static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val)
- {
-+    uint32_t reg_index = csrno - CSR_PMPCFG0;
-+
-+    if (!check_pmp_reg_index(env, reg_index)) {
-+        return RISCV_EXCP_ILLEGAL_INST;
-+    }
-     pmpcfg_csr_write(env, csrno - CSR_PMPCFG0, val);
-     return RISCV_EXCP_NONE;
- }
 diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.c
 +++ b/target/riscv/pmp.c
-@@ -XXX,XX +XXX,XX @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
+@@ -XXX,XX +XXX,XX @@ static inline uint8_t pmp_get_a_field(uint8_t cfg)
   */
  static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
  {
-     int i;
++    /* mseccfg.RLB is set */
-     uint8_t cfg_val;
++    if (MSECCFG_RLB_ISSET(env)) {
-+    int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
++        return 0;
++    }
-     trace_pmpcfg_csr_write(env->mhartid, reg_index, val);
+     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
--    if ((reg_index & 1) && (sizeof(target_ulong) == 8)) {
+         return 1;
 -        qemu_log_mask(LOG_GUEST_ERROR,
 -                      "ignoring pmpcfg write - incorrect address\n");
 -        return;
 -    }
 -
 -    for (i = 0; i < sizeof(target_ulong); i++) {
 +    for (i = 0; i < pmpcfg_nums; i++) {
          cfg_val = (val >> 8 * i)  & 0xff;
          pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
      }
@@ -XXX,XX +XXX,XX @@ target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
      int i;
      target_ulong cfg_val = 0;
      target_ulong val = 0;
 +    int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
 -    for (i = 0; i < sizeof(target_ulong); i++) {
 +    for (i = 0; i < pmpcfg_nums; i++) {
          val = pmp_read_cfg(env, (reg_index * 4) + i);
          cfg_val |= (val << (i * 8));
      }
 --
-.31.1
+.41.0

-[PULL 47/61] target/riscv: Relax debug check for pm write
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-10-zhiwei_liu@c-sky.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/csr.c | 3 +++
-file changed, 3 insertions(+)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static bool check_pm_current_disabled(CPURISCVState *env, int csrno)
-     int csr_priv = get_field(csrno, 0x300);
-     int pm_current;
-+    if (env->debugger) {
-+        return false;
-+    }
-     /*
-      * If priv lvls differ that means we're accessing csr from higher priv lvl,
-      * so allow the access
---
-.31.1

-[PULL 48/61] target/riscv: Adjust csr write mask with XLEN
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Write mask is representing the bits we care about.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-11-zhiwei_liu@c-sky.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/op_helper.c                |  3 ++-
- target/riscv/insn_trans/trans_rvi.c.inc | 12 ++++++++----
-files changed, 10 insertions(+), 5 deletions(-)
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
-+++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
- void helper_csrw(CPURISCVState *env, int csr, target_ulong src)
- {
--    RISCVException ret = riscv_csrrw(env, csr, NULL, src, -1);
-+    target_ulong mask = env->xl == MXL_RV32 ? UINT32_MAX : (target_ulong)-1;
-+    RISCVException ret = riscv_csrrw(env, csr, NULL, src, mask);
-     if (ret != RISCV_EXCP_NONE) {
-         riscv_raise_exception(env, ret, GETPC());
-diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvi.c.inc
-+++ b/target/riscv/insn_trans/trans_rvi.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool do_csrrw_i128(DisasContext *ctx, int rd, int rc,
- static bool trans_csrrw(DisasContext *ctx, arg_csrrw *a)
- {
--    if (get_xl(ctx) < MXL_RV128) {
-+    RISCVMXL xl = get_xl(ctx);
-+    if (xl < MXL_RV128) {
-         TCGv src = get_gpr(ctx, a->rs1, EXT_NONE);
-         /*
-@@ -XXX,XX +XXX,XX @@ static bool trans_csrrw(DisasContext *ctx, arg_csrrw *a)
-             return do_csrw(ctx, a->csr, src);
-         }
--        TCGv mask = tcg_constant_tl(-1);
-+        TCGv mask = tcg_constant_tl(xl == MXL_RV32 ? UINT32_MAX :
-+                                                     (target_ulong)-1);
-         return do_csrrw(ctx, a->rd, a->csr, src, mask);
-     } else {
-         TCGv srcl = get_gpr(ctx, a->rs1, EXT_NONE);
-@@ -XXX,XX +XXX,XX @@ static bool trans_csrrc(DisasContext *ctx, arg_csrrc *a)
- static bool trans_csrrwi(DisasContext *ctx, arg_csrrwi *a)
- {
--    if (get_xl(ctx) < MXL_RV128) {
-+    RISCVMXL xl = get_xl(ctx);
-+    if (xl < MXL_RV128) {
-         TCGv src = tcg_constant_tl(a->rs1);
-         /*
-@@ -XXX,XX +XXX,XX @@ static bool trans_csrrwi(DisasContext *ctx, arg_csrrwi *a)
-             return do_csrw(ctx, a->csr, src);
-         }
--        TCGv mask = tcg_constant_tl(-1);
-+        TCGv mask = tcg_constant_tl(xl == MXL_RV32 ? UINT32_MAX :
-+                                                     (target_ulong)-1);
-         return do_csrrw(ctx, a->rd, a->csr, src, mask);
-     } else {
-         TCGv src = tcg_constant_tl(a->rs1);
---
-.31.1

-[PULL 50/61] target/riscv: Alloc tcg global for cur_pm[mask|base]
+Deleted patch
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Replace the array of pm_mask/pm_base with scalar variables.
-Remove the cached array value in DisasContext.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-13-zhiwei_liu@c-sky.com
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/translate.c | 32 ++++++++------------------------
-file changed, 8 insertions(+), 24 deletions(-)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */
- static TCGv load_res;
- static TCGv load_val;
- /* globals for PM CSRs */
--static TCGv pm_mask[4];
--static TCGv pm_base[4];
-+static TCGv pm_mask;
-+static TCGv pm_base;
- #include "exec/gen-icount.h"
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
-     TCGv temp[4];
-     /* PointerMasking extension */
-     bool pm_enabled;
--    TCGv pm_mask;
--    TCGv pm_base;
- } DisasContext;
- static inline bool has_ext(DisasContext *ctx, uint32_t ext)
-@@ -XXX,XX +XXX,XX @@ static TCGv gen_pm_adjust_address(DisasContext *s, TCGv src)
-         return src;
-     } else {
-         temp = temp_new(s);
--        tcg_gen_andc_tl(temp, src, s->pm_mask);
--        tcg_gen_or_tl(temp, temp, s->pm_base);
-+        tcg_gen_andc_tl(temp, src, pm_mask);
-+        tcg_gen_or_tl(temp, temp, pm_base);
-         return temp;
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-     ctx->ntemp = 0;
-     memset(ctx->temp, 0, sizeof(ctx->temp));
-     ctx->pm_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_ENABLED);
--    int priv = tb_flags & TB_FLAGS_PRIV_MMU_MASK;
--    ctx->pm_mask = pm_mask[priv];
--    ctx->pm_base = pm_base[priv];
--
-     ctx->zero = tcg_constant_tl(0);
- }
-@@ -XXX,XX +XXX,XX @@ void riscv_translate_init(void)
-                              "load_res");
-     load_val = tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, load_val),
-                              "load_val");
--#ifndef CONFIG_USER_ONLY
-     /* Assign PM CSRs to tcg globals */
--    pm_mask[PRV_U] =
--      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, upmmask), "upmmask");
--    pm_base[PRV_U] =
--      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, upmbase), "upmbase");
--    pm_mask[PRV_S] =
--      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, spmmask), "spmmask");
--    pm_base[PRV_S] =
--      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, spmbase), "spmbase");
--    pm_mask[PRV_M] =
--      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, mpmmask), "mpmmask");
--    pm_base[PRV_M] =
--      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, mpmbase), "mpmbase");
--#endif
-+    pm_mask = tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, cur_pmmask),
-+                                 "pmmask");
-+    pm_base = tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, cur_pmbase),
-+                                 "pmbase");
- }
---
-.31.1

-[PULL 61/61] target/riscv: Relax UXL field for debugging
+[PULL v2 44/45] target/riscv: Align the AIA model to v1.0 ratified spec
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Tommy Wu <tommy.wu@sifive.com>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+According to the new spec, when vsiselect has a reserved value, attempts
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+from M-mode or HS-mode to access vsireg, or from VS-mode to access
-Message-id: 20220120122050.41546-24-zhiwei_liu@c-sky.com
+sireg, should preferably raise an illegal instruction exception.
 Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Message-ID: <20230816061647.600672-1-tommy.wu@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 8 ++++----
+ target/riscv/csr.c | 7 +++++--
-file changed, 4 insertions(+), 4 deletions(-)
+file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
-         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
+ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
-         MSTATUS_TW | MSTATUS_VS;
+                      target_ulong new_val, target_ulong wr_mask)
 -    if (xl != MXL_RV32) {
 +    if (xl != MXL_RV32 || env->debugger) {
          /*
           * RV32: MPV and GVA are not in mstatus. The current plan is to
           * add them to mstatush. For now, we just don't support it.
@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
  {
-     uint64_t mask = sstatus_v1_10_mask;
+-    bool virt;
-     uint64_t sstatus = env->mstatus & mask;
++    bool virt, isel_reserved;
--    if (env->xl != MXL_RV32) {
+     uint8_t *iprio;
-+    if (env->xl != MXL_RV32 || env->debugger) {
+     int ret = -EINVAL;
-         mask |= SSTATUS64_UXL;
+     target_ulong priv, isel, vgein;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
      /* Decode register details from CSR number */
      virt = false;
 +    isel_reserved = false;
      switch (csrno) {
      case CSR_MIREG:
          iprio = env->miprio;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                                                    riscv_cpu_mxl_bits(env)),
                                      val, new_val, wr_mask);
          }
 +    } else {
 +        isel_reserved = true;
      }
-@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus(CPURISCVState *env, int csrno,
+ done:
-                                    target_ulong *val)
+     if (ret) {
- {
+-        return (env->virt_enabled && virt) ?
-     target_ulong mask = (sstatus_v1_10_mask);
++        return (env->virt_enabled && virt && !isel_reserved) ?
--    if (env->xl != MXL_RV32) {
+                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
 +    if (env->xl != MXL_RV32 || env->debugger) {
          mask |= SSTATUS64_UXL;
      }
-     /* TODO: Use SXL not MXL. */
+     return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_sstatus(CPURISCVState *env, int csrno,
  {
      target_ulong mask = (sstatus_v1_10_mask);
 -    if (env->xl != MXL_RV32) {
 +    if (env->xl != MXL_RV32 || env->debugger) {
          if ((val & SSTATUS64_UXL) != 0) {
              mask |= SSTATUS64_UXL;
          }
 --
-.31.1
+.41.0

-[PULL 60/61] target/riscv: Enable uxl field write
+[PULL v2 45/45] target/riscv: don't read CSR in riscv_csrrw_do64
-From: LIU Zhiwei <zhiwei_liu@c-sky.com>
+From: Nikita Shubin <n.shubin@yadro.com>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
+As per ISA:
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 "For CSRRWI, if rd=x0, then the instruction shall not read the CSR and
 shall not cause any of the side effects that might occur on a CSR read."
 trans_csrrwi() and trans_csrrw() call do_csrw() if rd=x0, do_csrw() calls
 riscv_csrrw_do64(), via helper_csrw() passing NULL as *ret_value.
 Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220120122050.41546-23-zhiwei_liu@c-sky.com
+Message-ID: <20230808090914.17634-1-nikita.shubin@maquefel.me>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_bits.h |  3 +++
+ target/riscv/csr.c | 24 +++++++++++++++---------
- target/riscv/csr.c      | 28 ++++++++++++++++++++++------
+file changed, 15 insertions(+), 9 deletions(-)
 files changed, 25 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_bits.h
-+++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
- #define COUNTEREN_IR         (1 << 2)
- #define COUNTEREN_HPM3       (1 << 3)
-+/* vsstatus CSR bits */
-+#define VSSTATUS64_UXL       0x0000000300000000ULL
-+
- /* Privilege modes */
- #define PRV_U 0
- #define PRV_S 1
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
+@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
-       (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)));
+                                        target_ulong write_mask)
  static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
      SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
 -    SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS | (target_ulong)SSTATUS64_UXL;
 +    SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS;
  static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
  static const target_ulong hip_writable_mask = MIP_VSSIP;
  static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
  {
-     uint64_t mstatus = env->mstatus;
+     RISCVException ret;
-     uint64_t mask = 0;
+-    target_ulong old_value;
-+    RISCVMXL xl = riscv_cpu_mxl(env);
++    target_ulong old_value = 0;
-     /* flush tlb on mstatus fields that affect VM */
+     /* execute combined read/write operation if it exists */
-     if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPP | MSTATUS_MPV |
+     if (csr_ops[csrno].op) {
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
+         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
-         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
+     }
-         MSTATUS_TW | MSTATUS_VS;
+-    /* if no accessor exists then return failure */
--    if (riscv_cpu_mxl(env) != MXL_RV32) {
+-    if (!csr_ops[csrno].read) {
-+    if (xl != MXL_RV32) {
+-        return RISCV_EXCP_ILLEGAL_INST;
-         /*
+-    }
-          * RV32: MPV and GVA are not in mstatus. The current plan is to
+-    /* read old value */
-          * add them to mstatush. For now, we just don't support it.
+-    ret = csr_ops[csrno].read(env, csrno, &old_value);
-          */
+-    if (ret != RISCV_EXCP_NONE) {
-         mask |= MSTATUS_MPV | MSTATUS_GVA;
+-        return ret;
-+        if ((val & MSTATUS64_UXL) != 0) {
++    /*
-+            mask |= MSTATUS64_UXL;
++     * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
 +     * and we can't throw side effects caused by CSR reads.
 +     */
 +    if (ret_value) {
 +        /* if no accessor exists then return failure */
 +        if (!csr_ops[csrno].read) {
 +            return RISCV_EXCP_ILLEGAL_INST;
 +        }
 +        /* read old value */
 +        ret = csr_ops[csrno].read(env, csrno, &old_value);
 +        if (ret != RISCV_EXCP_NONE) {
 +            return ret;
 +        }
      }
-     mstatus = (mstatus & ~mask) | (val & mask);
+     /* write value if writable and write mask set, otherwise drop writes */
 -    RISCVMXL xl = riscv_cpu_mxl(env);
      if (xl > MXL_RV32) {
 -        /* SXL and UXL fields are for now read only */
 +        /* SXL field is for now read only */
          mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
 -        mstatus = set_field(mstatus, MSTATUS64_UXL, xl);
      }
      env->mstatus = mstatus;
      env->xl = cpu_recompute_xl(env);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
  {
      uint64_t mask = sstatus_v1_10_mask;
      uint64_t sstatus = env->mstatus & mask;
 +    if (env->xl != MXL_RV32) {
 +        mask |= SSTATUS64_UXL;
 +    }
      *val = int128_make128(sstatus, add_status_sd(MXL_RV128, sstatus));
      return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus(CPURISCVState *env, int csrno,
                                     target_ulong *val)
  {
      target_ulong mask = (sstatus_v1_10_mask);
 -
 +    if (env->xl != MXL_RV32) {
 +        mask |= SSTATUS64_UXL;
 +    }
      /* TODO: Use SXL not MXL. */
      *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus & mask);
      return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_sstatus(CPURISCVState *env, int csrno,
                                      target_ulong val)
  {
      target_ulong mask = (sstatus_v1_10_mask);
 +
 +    if (env->xl != MXL_RV32) {
 +        if ((val & SSTATUS64_UXL) != 0) {
 +            mask |= SSTATUS64_UXL;
 +        }
 +    }
      target_ulong newval = (env->mstatus & ~mask) | (val & mask);
      return write_mstatus(env, CSR_MSTATUS, newval);
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
                                       target_ulong val)
  {
      uint64_t mask = (target_ulong)-1;
 +    if ((val & VSSTATUS64_UXL) == 0) {
 +        mask &= ~VSSTATUS64_UXL;
 +    }
      env->vsstatus = (env->vsstatus & ~mask) | (uint64_t)val;
      return RISCV_EXCP_NONE;
  }
 --
-.31.1
+.41.0

From: Alistair Francis <alistair.francis@wdc.com>

The following changes since commit 2c89b5af5e72ab8c9d544c6e30399528b2238827:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20220120-1' into staging (2022-01-20 16:13:17 +0000)

are available in the Git repository at:

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20220121-1

for you to fetch changes up to f297245f6a780f496fb171af6fcd21ff3e6783c3:

target/riscv: Relax UXL field for debugging (2022-01-21 15:52:57 +1000)

----------------------------------------------------------------
Third RISC-V PR for QEMU 7.0

* Fixes for OpenTitan timer
 * Correction of OpenTitan PLIC stride length
 * RISC-V KVM support
 * Device tree code cleanup
 * Support for the Zve64f and Zve32f extensions
 * OpenSBI binary loading support for the Spike machine
 * Removal of OpenSBI ELFs
 * Support for the UXL field in xstatus

----------------------------------------------------------------
Anup Patel (3):
      hw/riscv: spike: Allow using binary firmware as bios
      hw/riscv: Remove macros for ELF BIOS image names
      roms/opensbi: Remove ELF images

Frank Chang (17):
      target/riscv: rvv-1.0: Add Zve64f extension into RISC-V
      target/riscv: rvv-1.0: Add Zve64f support for configuration insns
      target/riscv: rvv-1.0: Add Zve64f support for load and store insns
      target/riscv: rvv-1.0: Add Zve64f support for vmulh variant insns
      target/riscv: rvv-1.0: Add Zve64f support for vsmul.vv and vsmul.vx insns
      target/riscv: rvv-1.0: Add Zve64f support for scalar fp insns
      target/riscv: rvv-1.0: Add Zve64f support for single-width fp reduction insns
      target/riscv: rvv-1.0: Add Zve64f support for widening type-convert insns
      target/riscv: rvv-1.0: Add Zve64f support for narrowing type-convert insns
      target/riscv: rvv-1.0: Allow Zve64f extension to be turned on
      target/riscv: rvv-1.0: Add Zve32f extension into RISC-V
      target/riscv: rvv-1.0: Add Zve32f support for configuration insns
      target/riscv: rvv-1.0: Add Zve32f support for scalar fp insns
      target/riscv: rvv-1.0: Add Zve32f support for single-width fp reduction insns
      target/riscv: rvv-1.0: Add Zve32f support for widening type-convert insns
      target/riscv: rvv-1.0: Add Zve32f support for narrowing type-convert insns
      target/riscv: rvv-1.0: Allow Zve32f extension to be turned on

LIU Zhiwei (23):
      target/riscv: Adjust pmpcfg access with mxl
      target/riscv: Don't save pc when exception return
      target/riscv: Sign extend link reg for jal and jalr
      target/riscv: Sign extend pc for different XLEN
      target/riscv: Create xl field in env
      target/riscv: Ignore the pc bits above XLEN
      target/riscv: Extend pc for runtime pc write
      target/riscv: Use gdb xml according to max mxlen
      target/riscv: Relax debug check for pm write
      target/riscv: Adjust csr write mask with XLEN
      target/riscv: Create current pm fields in env
      target/riscv: Alloc tcg global for cur_pm[mask|base]
      target/riscv: Calculate address according to XLEN
      target/riscv: Split pm_enabled into mask and base
      target/riscv: Split out the vill from vtype
      target/riscv: Adjust vsetvl according to XLEN
      target/riscv: Remove VILL field in VTYPE
      target/riscv: Fix check range for first fault only
      target/riscv: Adjust vector address with mask
      target/riscv: Adjust scalar reg in vector with XLEN
      target/riscv: Set default XLEN for hypervisor
      target/riscv: Enable uxl field write
      target/riscv: Relax UXL field for debugging

Thomas Huth (1):
      softmmu/device_tree: Silence compiler warning with --enable-sanitizers

Wilfred Mallawa (3):
      hw: timer: ibex_timer: Fixup reading w/o register
      riscv: opentitan: fixup plic stride len
      hw: timer: ibex_timer: update/add reg address

Yanan Wang (1):
      softmmu/device_tree: Remove redundant pointer assignment

Yifei Jiang (13):
      update-linux-headers: Add asm-riscv/kvm.h
      target/riscv: Add target/riscv/kvm.c to place the public kvm interface
      target/riscv: Implement function kvm_arch_init_vcpu
      target/riscv: Implement kvm_arch_get_registers
      target/riscv: Implement kvm_arch_put_registers
      target/riscv: Support start kernel directly by KVM
      target/riscv: Support setting external interrupt by KVM
      target/riscv: Handle KVM_EXIT_RISCV_SBI exit
      target/riscv: Add host cpu type
      target/riscv: Add kvm_riscv_get/put_regs_timer
      target/riscv: Implement virtual time adjusting with vm state changing
      target/riscv: Support virtual time context synchronization
      target/riscv: enable riscv kvm accel

meson.build                                    |   2 +
 include/hw/char/riscv_htif.h                   |   5 +-
 include/hw/riscv/boot.h                        |   3 +-
 include/hw/riscv/spike.h                       |   1 +
 include/hw/timer/ibex_timer.h                  |   1 -
 linux-headers/asm-riscv/kvm.h                  | 128 ++++++
 target/riscv/cpu.h                             |  58 ++-
 target/riscv/cpu_bits.h                        |   3 +
 target/riscv/helper.h                          |   4 +-
 target/riscv/kvm_riscv.h                       |  25 ++
 target/riscv/sbi_ecall_interface.h             |  72 ++++
 hw/char/riscv_htif.c                           |  33 +-
 hw/intc/sifive_plic.c                          |  20 +-
 hw/riscv/boot.c                                |  16 +-
 hw/riscv/opentitan.c                           |   2 +-
 hw/riscv/spike.c                               |  45 ++-
 hw/riscv/virt.c                                |  83 ++--
 hw/timer/ibex_timer.c                          |  25 +-
 softmmu/device_tree.c                          |  11 +-
 target/riscv/cpu.c                             |  77 +++-
 target/riscv/cpu_helper.c                      |  99 ++---
 target/riscv/csr.c                             |  90 ++++-
 target/riscv/gdbstub.c                         |  71 +++-
 target/riscv/kvm-stub.c                        |  30 ++
 target/riscv/kvm.c                             | 535 +++++++++++++++++++++++++
 target/riscv/machine.c                         |  46 ++-
 target/riscv/op_helper.c                       |   7 +-
 target/riscv/pmp.c                             |  12 +-
 target/riscv/translate.c                       |  94 +++--
 target/riscv/vector_helper.c                   |  39 +-
 target/riscv/insn_trans/trans_privileged.c.inc |   9 +-
 target/riscv/insn_trans/trans_rva.c.inc        |   9 +-
 target/riscv/insn_trans/trans_rvd.c.inc        |  19 +-
 target/riscv/insn_trans/trans_rvf.c.inc        |  19 +-
 target/riscv/insn_trans/trans_rvi.c.inc        |  39 +-
 target/riscv/insn_trans/trans_rvv.c.inc        | 225 +++++++++--
 .gitlab-ci.d/opensbi.yml                       |   2 -
 pc-bios/meson.build                            |   2 -
 pc-bios/opensbi-riscv32-generic-fw_dynamic.elf | Bin 838904 -> 0 bytes
 pc-bios/opensbi-riscv64-generic-fw_dynamic.elf | Bin 934696 -> 0 bytes
 roms/Makefile                                  |   2 -
 target/riscv/meson.build                       |   1 +
 42 files changed, 1608 insertions(+), 356 deletions(-)
 create mode 100644 linux-headers/asm-riscv/kvm.h
 create mode 100644 target/riscv/kvm_riscv.h
 create mode 100644 target/riscv/sbi_ecall_interface.h
 create mode 100644 target/riscv/kvm-stub.c
 create mode 100644 target/riscv/kvm.c
 delete mode 100644 pc-bios/opensbi-riscv32-generic-fw_dynamic.elf
 delete mode 100644 pc-bios/opensbi-riscv64-generic-fw_dynamic.elf

From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

This change fixes a bug where a write only register is read.
As per https://docs.opentitan.org/hw/ip/rv_timer/doc/#register-table
the 'INTR_TEST0' register is write only.

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220110051606.4031241-1-alistair.francis@opensource.wdc.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/timer/ibex_timer.h |  1 -
 hw/timer/ibex_timer.c         | 14 +++++---------
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/include/hw/timer/ibex_timer.h b/include/hw/timer/ibex_timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/ibex_timer.h
+++ b/include/hw/timer/ibex_timer.h
@@ -XXX,XX +XXX,XX @@ struct IbexTimerState {
     uint32_t timer_compare_upper0;
     uint32_t timer_intr_enable;
     uint32_t timer_intr_state;
-    uint32_t timer_intr_test;
 
     uint32_t timebase_freq;
 
diff --git a/hw/timer/ibex_timer.c b/hw/timer/ibex_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/ibex_timer.c
+++ b/hw/timer/ibex_timer.c
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_reset(DeviceState *dev)
     s->timer_compare_upper0 = 0xFFFFFFFF;
     s->timer_intr_enable = 0x00000000;
     s->timer_intr_state = 0x00000000;
-    s->timer_intr_test = 0x00000000;
 
     ibex_timer_update_irqs(s);
 }
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_timer_read(void *opaque, hwaddr addr,
         retvalue = s->timer_intr_state;
         break;
     case R_INTR_TEST:
-        retvalue = s->timer_intr_test;
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Attempted to read INTR_TEST, a write only register");
         break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_write(void *opaque, hwaddr addr,
         s->timer_intr_state &= ~val;
         break;
     case R_INTR_TEST:
-        s->timer_intr_test = val;
-        if (s->timer_intr_enable &
-            s->timer_intr_test &
-            R_INTR_ENABLE_IE_0_MASK) {
+        if (s->timer_intr_enable & val & R_INTR_ENABLE_IE_0_MASK) {
             s->timer_intr_state |= R_INTR_STATE_IS_0_MASK;
             qemu_set_irq(s->irq, true);
         }
@@ -XXX,XX +XXX,XX @@ static int ibex_timer_post_load(void *opaque, int version_id)
 
 static const VMStateDescription vmstate_ibex_timer = {
     .name = TYPE_IBEX_TIMER,
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .post_load = ibex_timer_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(timer_ctrl, IbexTimerState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_ibex_timer = {
         VMSTATE_UINT32(timer_compare_upper0, IbexTimerState),
         VMSTATE_UINT32(timer_intr_enable, IbexTimerState),
         VMSTATE_UINT32(timer_intr_state, IbexTimerState),
-        VMSTATE_UINT32(timer_intr_test, IbexTimerState),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.31.1

From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

The following change was made to rectify incorrectly set stride length
on the PLIC [1]. Where it should be 32bit and not 24bit (0x18). This was
discovered whilst attempting to fix a bug where a timer_interrupt was
not serviced on TockOS-OpenTitan.

[1] https://docs.opentitan.org/hw/top_earlgrey/ip_autogen/rv_plic/doc/

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Tested-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 20220111071025.4169189-1-alistair.francis@opensource.wdc.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/opentitan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
     qdev_prop_set_uint32(DEVICE(&s->plic), "priority-base", 0x00);
     qdev_prop_set_uint32(DEVICE(&s->plic), "pending-base", 0x1000);
     qdev_prop_set_uint32(DEVICE(&s->plic), "enable-base", 0x2000);
-    qdev_prop_set_uint32(DEVICE(&s->plic), "enable-stride", 0x18);
+    qdev_prop_set_uint32(DEVICE(&s->plic), "enable-stride", 32);
     qdev_prop_set_uint32(DEVICE(&s->plic), "context-base", 0x200000);
     qdev_prop_set_uint32(DEVICE(&s->plic), "context-stride", 8);
     qdev_prop_set_uint32(DEVICE(&s->plic), "aperture-size", memmap[IBEX_DEV_PLIC].size);
-- 
2.31.1

From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

The following changes:
1. Fixes the incorrectly set CTRL register address. As
per [1] https://docs.opentitan.org/hw/ip/rv_timer/doc/#register-table

The CTRL register is @ 0x04.

This was found when attempting to fixup a bug where a timer_interrupt
was not serviced on TockOS-OpenTitan.

2. Adds ALERT_TEST register as documented on [1], adding repective
   switch cases to error handle and later implement functionality.

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Tested-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-id: 20220111071025.4169189-2-alistair.francis@opensource.wdc.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/timer/ibex_timer.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/hw/timer/ibex_timer.c b/hw/timer/ibex_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/ibex_timer.c
+++ b/hw/timer/ibex_timer.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "migration/vmstate.h"
 
-REG32(CTRL, 0x00)
+REG32(ALERT_TEST, 0x00)
+    FIELD(ALERT_TEST, FATAL_FAULT, 0, 1)
+REG32(CTRL, 0x04)
     FIELD(CTRL, ACTIVE, 0, 1)
 REG32(CFG0, 0x100)
     FIELD(CFG0, PRESCALE, 0, 12)
@@ -XXX,XX +XXX,XX @@ static uint64_t ibex_timer_read(void *opaque, hwaddr addr,
     uint64_t retvalue = 0;
 
     switch (addr >> 2) {
+    case R_ALERT_TEST:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                        "Attempted to read ALERT_TEST, a write only register");
+        break;
     case R_CTRL:
         retvalue = s->timer_ctrl;
         break;
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_write(void *opaque, hwaddr addr,
     uint32_t val = val64;
 
     switch (addr >> 2) {
+    case R_ALERT_TEST:
+        qemu_log_mask(LOG_UNIMP, "Alert triggering not supported");
+        break;
     case R_CTRL:
         s->timer_ctrl = val;
         break;
-- 
2.31.1

From: Yifei Jiang <jiangyifei@huawei.com>

Add asm-riscv/kvm.h for RISC-V KVM.

Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
Signed-off-by: Mingwang Li <limingwang@huawei.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Anup Patel <anup.patel@wdc.com>
Message-id: 20220112081329.1835-2-jiangyifei@huawei.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-headers/asm-riscv/kvm.h | 128 ++++++++++++++++++++++++++++++++++
 1 file changed, 128 insertions(+)
 create mode 100644 linux-headers/asm-riscv/kvm.h

diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/linux-headers/asm-riscv/kvm.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (C) 2019 Western Digital Corporation or its affiliates.
+ *
+ * Authors:
+ *     Anup Patel <anup.patel@wdc.com>
+ */
+
+#ifndef __LINUX_KVM_RISCV_H
+#define __LINUX_KVM_RISCV_H
+
+#ifndef __ASSEMBLY__
+
+#include <linux/types.h>
+#include <asm/ptrace.h>
+
+#define __KVM_HAVE_READONLY_MEM
+
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+
+#define KVM_INTERRUPT_SET	-1U
+#define KVM_INTERRUPT_UNSET	-2U
+
+/* for KVM_GET_REGS and KVM_SET_REGS */
+struct kvm_regs {
+};
+
+/* for KVM_GET_FPU and KVM_SET_FPU */
+struct kvm_fpu {
+};
+
+/* KVM Debug exit structure */
+struct kvm_debug_exit_arch {
+};
+
+/* for KVM_SET_GUEST_DEBUG */
+struct kvm_guest_debug_arch {
+};
+
+/* definition of registers in kvm_run */
+struct kvm_sync_regs {
+};
+
+/* for KVM_GET_SREGS and KVM_SET_SREGS */
+struct kvm_sregs {
+};
+
+/* CONFIG registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
+struct kvm_riscv_config {
+	unsigned long isa;
+};
+
+/* CORE registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
+struct kvm_riscv_core {
+	struct user_regs_struct regs;
+	unsigned long mode;
+};
+
+/* Possible privilege modes for kvm_riscv_core */
+#define KVM_RISCV_MODE_S	1
+#define KVM_RISCV_MODE_U	0
+
+/* CSR registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
+struct kvm_riscv_csr {
+	unsigned long sstatus;
+	unsigned long sie;
+	unsigned long stvec;
+	unsigned long sscratch;
+	unsigned long sepc;
+	unsigned long scause;
+	unsigned long stval;
+	unsigned long sip;
+	unsigned long satp;
+	unsigned long scounteren;
+};
+
+/* TIMER registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
+struct kvm_riscv_timer {
+	__u64 frequency;
+	__u64 time;
+	__u64 compare;
+	__u64 state;
+};
+
+/* Possible states for kvm_riscv_timer */
+#define KVM_RISCV_TIMER_STATE_OFF	0
+#define KVM_RISCV_TIMER_STATE_ON	1
+
+#define KVM_REG_SIZE(id)		\
+	(1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
+
+/* If you need to interpret the index values, here is the key: */
+#define KVM_REG_RISCV_TYPE_MASK		0x00000000FF000000
+#define KVM_REG_RISCV_TYPE_SHIFT	24
+
+/* Config registers are mapped as type 1 */
+#define KVM_REG_RISCV_CONFIG		(0x01 << KVM_REG_RISCV_TYPE_SHIFT)
+#define KVM_REG_RISCV_CONFIG_REG(name)	\
+	(offsetof(struct kvm_riscv_config, name) / sizeof(unsigned long))
+
+/* Core registers are mapped as type 2 */
+#define KVM_REG_RISCV_CORE		(0x02 << KVM_REG_RISCV_TYPE_SHIFT)
+#define KVM_REG_RISCV_CORE_REG(name)	\
+		(offsetof(struct kvm_riscv_core, name) / sizeof(unsigned long))
+
+/* Control and status registers are mapped as type 3 */
+#define KVM_REG_RISCV_CSR		(0x03 << KVM_REG_RISCV_TYPE_SHIFT)
+#define KVM_REG_RISCV_CSR_REG(name)	\
+		(offsetof(struct kvm_riscv_csr, name) / sizeof(unsigned long))
+
+/* Timer registers are mapped as type 4 */
+#define KVM_REG_RISCV_TIMER		(0x04 << KVM_REG_RISCV_TYPE_SHIFT)
+#define KVM_REG_RISCV_TIMER_REG(name)	\
+		(offsetof(struct kvm_riscv_timer, name) / sizeof(__u64))
+
+/* F extension registers are mapped as type 5 */
+#define KVM_REG_RISCV_FP_F		(0x05 << KVM_REG_RISCV_TYPE_SHIFT)
+#define KVM_REG_RISCV_FP_F_REG(name)	\
+		(offsetof(struct __riscv_f_ext_state, name) / sizeof(__u32))
+
+/* D extension registers are mapped as type 6 */
+#define KVM_REG_RISCV_FP_D		(0x06 << KVM_REG_RISCV_TYPE_SHIFT)
+#define KVM_REG_RISCV_FP_D_REG(name)	\
+		(offsetof(struct __riscv_d_ext_state, name) / sizeof(__u64))
+
+#endif
+
+#endif /* __LINUX_KVM_RISCV_H */
-- 
2.31.1

From: Yifei Jiang <jiangyifei@huawei.com>

Add target/riscv/kvm.c to place kvm_arch_* function needed by
kvm/kvm-all.c.

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V implementation of KVM hooks
+ *
+ * Copyright (c) 2020 Huawei Technologies Co., Ltd
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include <sys/ioctl.h>
+
+#include <linux/kvm.h>
+
+#include "qemu-common.h"
+#include "qemu/timer.h"
+#include "qemu/error-report.h"
+#include "qemu/main-loop.h"
+#include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
+#include "sysemu/kvm_int.h"
+#include "cpu.h"
+#include "trace.h"
+#include "hw/pci/pci.h"
+#include "exec/memattrs.h"
+#include "exec/address-spaces.h"
+#include "hw/boards.h"
+#include "hw/irq.h"
+#include "qemu/log.h"
+#include "hw/loader.h"
+
+const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
+    KVM_CAP_LAST_INFO
+};
+
+int kvm_arch_get_registers(CPUState *cs)
+{
+    return 0;
+}
+
+int kvm_arch_put_registers(CPUState *cs, int level)
+{
+    return 0;
+}
+
+int kvm_arch_release_virq_post(int virq)
+{
+    return 0;
+}
+
+int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
+                             uint64_t address, uint32_t data, PCIDevice *dev)
+{
+    return 0;
+}
+
+int kvm_arch_destroy_vcpu(CPUState *cs)
+{
+    return 0;
+}
+
+unsigned long kvm_arch_vcpu_id(CPUState *cpu)
+{
+    return cpu->cpu_index;
+}
+
+void kvm_arch_init_irq_routing(KVMState *s)
+{
+}
+
+int kvm_arch_init_vcpu(CPUState *cs)
+{
+    return 0;
+}
+
+int kvm_arch_msi_data_to_gsi(uint32_t data)
+{
+    abort();
+}
+
+int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
+                                int vector, PCIDevice *dev)
+{
+    return 0;
+}
+
+int kvm_arch_init(MachineState *ms, KVMState *s)
+{
+    return 0;
+}
+
+int kvm_arch_irqchip_create(KVMState *s)
+{
+    return 0;
+}
+
+int kvm_arch_process_async_events(CPUState *cs)
+{
+    return 0;
+}
+
+void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
+{
+}
+
+MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
+{
+    return MEMTXATTRS_UNSPECIFIED;
+}
+
+bool kvm_arch_stop_on_emulation_error(CPUState *cs)
+{
+    return true;
+}
+
+int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
+{
+    return 0;
+}
+
+bool kvm_arch_cpu_check_are_resettable(void)
+{
+    return true;
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
   'translate.c',
   'm128_helper.c'
 ))
+riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'))
 
 riscv_softmmu_ss = ss.source_set()
 riscv_softmmu_ss.add(files(
-- 
2.31.1

From: Yifei Jiang <jiangyifei@huawei.com>

Get isa info from kvm while kvm init.

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "hw/loader.h"
 
+static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
+                                 uint64_t idx)
+{
+    uint64_t id = KVM_REG_RISCV | type | idx;
+
+    switch (riscv_cpu_mxl(env)) {
+    case MXL_RV32:
+        id |= KVM_REG_SIZE_U32;
+        break;
+    case MXL_RV64:
+        id |= KVM_REG_SIZE_U64;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return id;
+}
+
 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
     KVM_CAP_LAST_INFO
 };
@@ -XXX,XX +XXX,XX @@ void kvm_arch_init_irq_routing(KVMState *s)
 
 int kvm_arch_init_vcpu(CPUState *cs)
 {
-    return 0;
+    int ret = 0;
+    target_ulong isa;
+    RISCVCPU *cpu = RISCV_CPU(cs);
+    CPURISCVState *env = &cpu->env;
+    uint64_t id;
+
+    id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
+                          KVM_REG_RISCV_CONFIG_REG(isa));
+    ret = kvm_get_one_reg(cs, id, &isa);
+    if (ret) {
+        return ret;
+    }
+    env->misa_ext = isa;
+
+    return ret;
 }
 
 int kvm_arch_msi_data_to_gsi(uint32_t data)
-- 
2.31.1

From: Yifei Jiang <jiangyifei@huawei.com>

Get GPR CSR and FP registers from kvm by KVM_GET_ONE_REG ioctl.

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
     return id;
 }
 
+#define RISCV_CORE_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, \
+                 KVM_REG_RISCV_CORE_REG(name))
+
+#define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
+                 KVM_REG_RISCV_CSR_REG(name))
+
+#define RISCV_FP_F_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_F, idx)
+
+#define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
+
+#define KVM_RISCV_GET_CSR(cs, env, csr, reg) \
+    do { \
+        int ret = kvm_get_one_reg(cs, RISCV_CSR_REG(env, csr), &reg); \
+        if (ret) { \
+            return ret; \
+        } \
+    } while (0)
+
+static int kvm_riscv_get_regs_core(CPUState *cs)
+{
+    int ret = 0;
+    int i;
+    target_ulong reg;
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+
+    ret = kvm_get_one_reg(cs, RISCV_CORE_REG(env, regs.pc), &reg);
+    if (ret) {
+        return ret;
+    }
+    env->pc = reg;
+
+    for (i = 1; i < 32; i++) {
+        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
+        ret = kvm_get_one_reg(cs, id, &reg);
+        if (ret) {
+            return ret;
+        }
+        env->gpr[i] = reg;
+    }
+
+    return ret;
+}
+
+static int kvm_riscv_get_regs_csr(CPUState *cs)
+{
+    int ret = 0;
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+
+    KVM_RISCV_GET_CSR(cs, env, sstatus, env->mstatus);
+    KVM_RISCV_GET_CSR(cs, env, sie, env->mie);
+    KVM_RISCV_GET_CSR(cs, env, stvec, env->stvec);
+    KVM_RISCV_GET_CSR(cs, env, sscratch, env->sscratch);
+    KVM_RISCV_GET_CSR(cs, env, sepc, env->sepc);
+    KVM_RISCV_GET_CSR(cs, env, scause, env->scause);
+    KVM_RISCV_GET_CSR(cs, env, stval, env->stval);
+    KVM_RISCV_GET_CSR(cs, env, sip, env->mip);
+    KVM_RISCV_GET_CSR(cs, env, satp, env->satp);
+    return ret;
+}
+
+static int kvm_riscv_get_regs_fp(CPUState *cs)
+{
+    int ret = 0;
+    int i;
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+
+    if (riscv_has_ext(env, RVD)) {
+        uint64_t reg;
+        for (i = 0; i < 32; i++) {
+            ret = kvm_get_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
+            if (ret) {
+                return ret;
+            }
+            env->fpr[i] = reg;
+        }
+        return ret;
+    }
+
+    if (riscv_has_ext(env, RVF)) {
+        uint32_t reg;
+        for (i = 0; i < 32; i++) {
+            ret = kvm_get_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
+            if (ret) {
+                return ret;
+            }
+            env->fpr[i] = reg;
+        }
+        return ret;
+    }
+
+    return ret;
+}
+
 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
     KVM_CAP_LAST_INFO
 };
 
 int kvm_arch_get_registers(CPUState *cs)
 {
-    return 0;
+    int ret = 0;
+
+    ret = kvm_riscv_get_regs_core(cs);
+    if (ret) {
+        return ret;
+    }
+
+    ret = kvm_riscv_get_regs_csr(cs);
+    if (ret) {
+        return ret;
+    }
+
+    ret = kvm_riscv_get_regs_fp(cs);
+    if (ret) {
+        return ret;
+    }
+
+    return ret;
 }
 
 int kvm_arch_put_registers(CPUState *cs, int level)
-- 
2.31.1

From: Yifei Jiang <jiangyifei@huawei.com>

Put GPR CSR and FP registers to kvm by KVM_SET_ONE_REG ioctl

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
         } \
     } while (0)
 
+#define KVM_RISCV_SET_CSR(cs, env, csr, reg) \
+    do { \
+        int ret = kvm_set_one_reg(cs, RISCV_CSR_REG(env, csr), &reg); \
+        if (ret) { \
+            return ret; \
+        } \
+    } while (0)
+
 static int kvm_riscv_get_regs_core(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_core(CPUState *cs)
     return ret;
 }
 
+static int kvm_riscv_put_regs_core(CPUState *cs)
+{
+    int ret = 0;
+    int i;
+    target_ulong reg;
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+
+    reg = env->pc;
+    ret = kvm_set_one_reg(cs, RISCV_CORE_REG(env, regs.pc), &reg);
+    if (ret) {
+        return ret;
+    }
+
+    for (i = 1; i < 32; i++) {
+        uint64_t id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CORE, i);
+        reg = env->gpr[i];
+        ret = kvm_set_one_reg(cs, id, &reg);
+        if (ret) {
+            return ret;
+        }
+    }
+
+    return ret;
+}
+
 static int kvm_riscv_get_regs_csr(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_csr(CPUState *cs)
     return ret;
 }
 
+static int kvm_riscv_put_regs_csr(CPUState *cs)
+{
+    int ret = 0;
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+
+    KVM_RISCV_SET_CSR(cs, env, sstatus, env->mstatus);
+    KVM_RISCV_SET_CSR(cs, env, sie, env->mie);
+    KVM_RISCV_SET_CSR(cs, env, stvec, env->stvec);
+    KVM_RISCV_SET_CSR(cs, env, sscratch, env->sscratch);
+    KVM_RISCV_SET_CSR(cs, env, sepc, env->sepc);
+    KVM_RISCV_SET_CSR(cs, env, scause, env->scause);
+    KVM_RISCV_SET_CSR(cs, env, stval, env->stval);
+    KVM_RISCV_SET_CSR(cs, env, sip, env->mip);
+    KVM_RISCV_SET_CSR(cs, env, satp, env->satp);
+
+    return ret;
+}
+
 static int kvm_riscv_get_regs_fp(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_fp(CPUState *cs)
     return ret;
 }
 
+static int kvm_riscv_put_regs_fp(CPUState *cs)
+{
+    int ret = 0;
+    int i;
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+
+    if (riscv_has_ext(env, RVD)) {
+        uint64_t reg;
+        for (i = 0; i < 32; i++) {
+            reg = env->fpr[i];
+            ret = kvm_set_one_reg(cs, RISCV_FP_D_REG(env, i), &reg);
+            if (ret) {
+                return ret;
+            }
+        }
+        return ret;
+    }
+
+    if (riscv_has_ext(env, RVF)) {
+        uint32_t reg;
+        for (i = 0; i < 32; i++) {
+            reg = env->fpr[i];
+            ret = kvm_set_one_reg(cs, RISCV_FP_F_REG(env, i), &reg);
+            if (ret) {
+                return ret;
+            }
+        }
+        return ret;
+    }
+
+    return ret;
+}
+
+
 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
     KVM_CAP_LAST_INFO
 };
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
 
 int kvm_arch_put_registers(CPUState *cs, int level)
 {
-    return 0;
+    int ret = 0;
+
+    ret = kvm_riscv_put_regs_core(cs);
+    if (ret) {
+        return ret;
+    }
+
+    ret = kvm_riscv_put_regs_csr(cs);
+    if (ret) {
+        return ret;
+    }
+
+    ret = kvm_riscv_put_regs_fp(cs);
+    if (ret) {
+        return ret;
+    }
+
+    return ret;
 }
 
 int kvm_arch_release_virq_post(int virq)
-- 
2.31.1

From: Yifei Jiang <jiangyifei@huawei.com>

Get kernel and fdt start address in virt.c, and pass them to KVM
when cpu reset. Add kvm_riscv.h to place riscv specific interface.

In addition, PLIC is created without M-mode PLIC contexts when KVM
is enabled.

Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
Signed-off-by: Mingwang Li <limingwang@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Message-id: 20220112081329.1835-7-jiangyifei@huawei.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/boot.h  |  1 +
 target/riscv/cpu.h       |  3 ++
 target/riscv/kvm_riscv.h | 24 ++++++++++++
 hw/intc/sifive_plic.c    | 20 +++++++---
 hw/riscv/boot.c          | 16 +++++++-
 hw/riscv/virt.c          | 83 ++++++++++++++++++++++++++++------------
 target/riscv/cpu.c       |  8 ++++
 target/riscv/kvm-stub.c  | 25 ++++++++++++
 target/riscv/kvm.c       | 14 +++++++
 target/riscv/meson.build |  2 +-
 10 files changed, 164 insertions(+), 32 deletions(-)
 create mode 100644 target/riscv/kvm_riscv.h
 create mode 100644 target/riscv/kvm-stub.c

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -XXX,XX +XXX,XX @@ void riscv_rom_copy_firmware_info(MachineState *machine, hwaddr rom_base,
                                   hwaddr rom_size,
                                   uint32_t reset_vec_size,
                                   uint64_t kernel_entry);
+void riscv_setup_direct_kernel(hwaddr kernel_addr, hwaddr fdt_addr);
 
 #endif /* RISCV_BOOT_H */
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
 
     /* Fields from here on are preserved across CPU reset. */
     QEMUTimer *timer; /* Internal timer */
+
+    hwaddr kernel_addr;
+    hwaddr fdt_addr;
 };
 
 OBJECT_DECLARE_TYPE(RISCVCPU, RISCVCPUClass,
diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU KVM support -- RISC-V specific functions.
+ *
+ * Copyright (c) 2020 Huawei Technologies Co., Ltd
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef QEMU_KVM_RISCV_H
+#define QEMU_KVM_RISCV_H
+
+void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
+
+#endif
diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/sifive_plic.c
+++ b/hw/intc/sifive_plic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "migration/vmstate.h"
 #include "hw/irq.h"
+#include "sysemu/kvm.h"
 
 static bool addr_between(uint32_t addr, uint32_t base, uint32_t num)
 {
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
     uint32_t context_stride, uint32_t aperture_size)
 {
     DeviceState *dev = qdev_new(TYPE_SIFIVE_PLIC);
-    int i;
+    int i, j = 0;
+    SiFivePLICState *plic;
 
     assert(enable_stride == (enable_stride & -enable_stride));
     assert(context_stride == (context_stride & -context_stride));
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 
+    plic = SIFIVE_PLIC(dev);
     for (i = 0; i < num_harts; i++) {
         CPUState *cpu = qemu_get_cpu(hartid_base + i);
 
-        qdev_connect_gpio_out(dev, i,
-                              qdev_get_gpio_in(DEVICE(cpu), IRQ_S_EXT));
-        qdev_connect_gpio_out(dev, num_harts + i,
-                              qdev_get_gpio_in(DEVICE(cpu), IRQ_M_EXT));
+        if (plic->addr_config[j].mode == PLICMode_M) {
+            j++;
+            qdev_connect_gpio_out(dev, num_harts + i,
+                                  qdev_get_gpio_in(DEVICE(cpu), IRQ_M_EXT));
+        }
+
+        if (plic->addr_config[j].mode == PLICMode_S) {
+            j++;
+            qdev_connect_gpio_out(dev, i,
+                                  qdev_get_gpio_in(DEVICE(cpu), IRQ_S_EXT));
+        }
     }
 
     return dev;
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "elf.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/qtest.h"
+#include "sysemu/kvm.h"
 
 #include <libfdt.h>
 
@@ -XXX,XX +XXX,XX @@ char *riscv_plic_hart_config_string(int hart_count)
         CPUState *cs = qemu_get_cpu(i);
         CPURISCVState *env = &RISCV_CPU(cs)->env;
 
-        if (riscv_has_ext(env, RVS)) {
+        if (kvm_enabled()) {
+            vals[i] = "S";
+        } else if (riscv_has_ext(env, RVS)) {
             vals[i] = "MS";
         } else {
             vals[i] = "M";
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts
 
     return;
 }
+
+void riscv_setup_direct_kernel(hwaddr kernel_addr, hwaddr fdt_addr)
+{
+    CPUState *cs;
+
+    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
+        RISCVCPU *riscv_cpu = RISCV_CPU(cs);
+        riscv_cpu->env.kernel_addr = kernel_addr;
+        riscv_cpu->env.fdt_addr = fdt_addr;
+    }
+}
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "hw/pci/pci.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/display/ramfb.h"
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
         "sifive,plic-1.0.0", "riscv,plic0"
     };
 
-    plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
+    if (kvm_enabled()) {
+        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+    } else {
+        plic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 4);
+    }
 
     for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
-        plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
-        plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
-        plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
+        if (kvm_enabled()) {
+            plic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+            plic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
+        } else {
+            plic_cells[cpu * 4 + 0] = cpu_to_be32(intc_phandles[cpu]);
+            plic_cells[cpu * 4 + 1] = cpu_to_be32(IRQ_M_EXT);
+            plic_cells[cpu * 4 + 2] = cpu_to_be32(intc_phandles[cpu]);
+            plic_cells[cpu * 4 + 3] = cpu_to_be32(IRQ_S_EXT);
+        }
     }
 
     plic_phandles[socket] = (*phandle)++;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
         create_fdt_socket_memory(s, memmap, socket);
 
-        if (s->have_aclint) {
-            create_fdt_socket_aclint(s, memmap, socket, intc_phandles);
-        } else {
-            create_fdt_socket_clint(s, memmap, socket, intc_phandles);
+        if (!kvm_enabled()) {
+            if (s->have_aclint) {
+                create_fdt_socket_aclint(s, memmap, socket, intc_phandles);
+            } else {
+                create_fdt_socket_clint(s, memmap, socket, intc_phandles);
+            }
         }
 
         create_fdt_socket_plic(s, memmap, socket, phandle,
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                                 hart_count, &error_abort);
         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_abort);
 
-        /* Per-socket CLINT */
-        riscv_aclint_swi_create(
-            memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
-            base_hartid, hart_count, false);
-        riscv_aclint_mtimer_create(
-            memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size +
-                RISCV_ACLINT_SWI_SIZE,
-            RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
-            RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
-            RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
-
-        /* Per-socket ACLINT SSWI */
-        if (s->have_aclint) {
+        if (!kvm_enabled()) {
+            /* Per-socket CLINT */
             riscv_aclint_swi_create(
-                memmap[VIRT_ACLINT_SSWI].base +
-                    i * memmap[VIRT_ACLINT_SSWI].size,
-                base_hartid, hart_count, true);
+                memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
+                base_hartid, hart_count, false);
+            riscv_aclint_mtimer_create(
+                memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size +
+                    RISCV_ACLINT_SWI_SIZE,
+                RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
+                RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
+                RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
+
+            /* Per-socket ACLINT SSWI */
+            if (s->have_aclint) {
+                riscv_aclint_swi_create(
+                    memmap[VIRT_ACLINT_SSWI].base +
+                        i * memmap[VIRT_ACLINT_SSWI].size,
+                    base_hartid, hart_count, true);
+            }
         }
 
         /* Per-socket PLIC hart topology configuration string */
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
     memory_region_add_subregion(system_memory, memmap[VIRT_MROM].base,
                                 mask_rom);
 
+    /*
+     * Only direct boot kernel is currently supported for KVM VM,
+     * so the "-bios" parameter is ignored and treated like "-bios none"
+     * when KVM is enabled.
+     */
+    if (kvm_enabled()) {
+        g_free(machine->firmware);
+        machine->firmware = g_strdup("none");
+    }
+
     if (riscv_is_32bit(&s->soc[0])) {
         firmware_end_addr = riscv_find_and_load_firmware(machine,
                                     RISCV32_BIOS_BIN, start_addr, NULL);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                               virt_memmap[VIRT_MROM].size, kernel_entry,
                               fdt_load_addr, machine->fdt);
 
+    /*
+     * Only direct boot kernel is currently supported for KVM VM,
+     * So here setup kernel start address and fdt address.
+     * TODO:Support firmware loading and integrate to TCG start
+     */
+    if (kvm_enabled()) {
+        riscv_setup_direct_kernel(kernel_entry, fdt_load_addr);
+    }
+
     /* SiFive Test MMIO device */
     sifive_test_create(memmap[VIRT_TEST].base);
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
 #include "fpu/softfloat-helpers.h"
+#include "sysemu/kvm.h"
+#include "kvm_riscv.h"
 
 /* RISC-V CPU definitions */
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
     cs->exception_index = RISCV_EXCP_NONE;
     env->load_res = -1;
     set_default_nan_mode(1, &env->fp_status);
+
+#ifndef CONFIG_USER_ONLY
+    if (kvm_enabled()) {
+        kvm_riscv_reset_vcpu(cpu);
+    }
+#endif
 }
 
 static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
diff --git a/target/riscv/kvm-stub.c b/target/riscv/kvm-stub.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/kvm-stub.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU KVM RISC-V specific function stubs
+ *
+ * Copyright (c) 2020 Huawei Technologies Co., Ltd
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "kvm_riscv.h"
+
+void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
+{
+    abort();
+}
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "qemu/log.h"
 #include "hw/loader.h"
+#include "kvm_riscv.h"
 
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
     return 0;
 }
 
+void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
+{
+    CPURISCVState *env = &cpu->env;
+
+    if (!kvm_enabled()) {
+        return;
+    }
+    env->pc = cpu->env.kernel_addr;
+    env->gpr[10] = kvm_arch_vcpu_id(CPU(cpu)); /* a0 */
+    env->gpr[11] = cpu->env.fdt_addr;          /* a1 */
+    env->satp = 0;
+}
+
 bool kvm_arch_cpu_check_are_resettable(void)
 {
     return true;
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
   'translate.c',
   'm128_helper.c'
 ))
-riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'))
+riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
 
 riscv_softmmu_ss = ss.source_set()
 riscv_softmmu_ss.add(files(
-- 
2.31.1

From: Yifei Jiang <jiangyifei@huawei.com>

When KVM is enabled, set the S-mode external interrupt through
kvm_riscv_set_irq function.

From: Yifei Jiang <jiangyifei@huawei.com>

Use char-fe to handle console sbi call, which implement early
console io while apply 'earlycon=sbi' into kernel parameters.

Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
Signed-off-by: Mingwang Li <limingwang@huawei.com>
Reviewed-by: Anup Patel <anup.patel@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220112081329.1835-9-jiangyifei@huawei.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/sbi_ecall_interface.h | 72 ++++++++++++++++++++++++++++++
 target/riscv/kvm.c                 | 42 ++++++++++++++++-
 2 files changed, 113 insertions(+), 1 deletion(-)
 create mode 100644 target/riscv/sbi_ecall_interface.h

diff --git a/target/riscv/sbi_ecall_interface.h b/target/riscv/sbi_ecall_interface.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/sbi_ecall_interface.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2019 Western Digital Corporation or its affiliates.
+ *
+ * Authors:
+ *   Anup Patel <anup.patel@wdc.com>
+ */
+
+#ifndef __SBI_ECALL_INTERFACE_H__
+#define __SBI_ECALL_INTERFACE_H__
+
+/* clang-format off */
+
+/* SBI Extension IDs */
+#define SBI_EXT_0_1_SET_TIMER           0x0
+#define SBI_EXT_0_1_CONSOLE_PUTCHAR     0x1
+#define SBI_EXT_0_1_CONSOLE_GETCHAR     0x2
+#define SBI_EXT_0_1_CLEAR_IPI           0x3
+#define SBI_EXT_0_1_SEND_IPI            0x4
+#define SBI_EXT_0_1_REMOTE_FENCE_I      0x5
+#define SBI_EXT_0_1_REMOTE_SFENCE_VMA   0x6
+#define SBI_EXT_0_1_REMOTE_SFENCE_VMA_ASID 0x7
+#define SBI_EXT_0_1_SHUTDOWN            0x8
+#define SBI_EXT_BASE                    0x10
+#define SBI_EXT_TIME                    0x54494D45
+#define SBI_EXT_IPI                     0x735049
+#define SBI_EXT_RFENCE                  0x52464E43
+#define SBI_EXT_HSM                     0x48534D
+
+/* SBI function IDs for BASE extension*/
+#define SBI_EXT_BASE_GET_SPEC_VERSION   0x0
+#define SBI_EXT_BASE_GET_IMP_ID         0x1
+#define SBI_EXT_BASE_GET_IMP_VERSION    0x2
+#define SBI_EXT_BASE_PROBE_EXT          0x3
+#define SBI_EXT_BASE_GET_MVENDORID      0x4
+#define SBI_EXT_BASE_GET_MARCHID        0x5
+#define SBI_EXT_BASE_GET_MIMPID         0x6
+
+/* SBI function IDs for TIME extension*/
+#define SBI_EXT_TIME_SET_TIMER          0x0
+
+/* SBI function IDs for IPI extension*/
+#define SBI_EXT_IPI_SEND_IPI            0x0
+
+/* SBI function IDs for RFENCE extension*/
+#define SBI_EXT_RFENCE_REMOTE_FENCE_I       0x0
+#define SBI_EXT_RFENCE_REMOTE_SFENCE_VMA    0x1
+#define SBI_EXT_RFENCE_REMOTE_SFENCE_VMA_ASID  0x2
+#define SBI_EXT_RFENCE_REMOTE_HFENCE_GVMA   0x3
+#define SBI_EXT_RFENCE_REMOTE_HFENCE_GVMA_VMID 0x4
+#define SBI_EXT_RFENCE_REMOTE_HFENCE_VVMA   0x5
+#define SBI_EXT_RFENCE_REMOTE_HFENCE_VVMA_ASID 0x6
+
+/* SBI function IDs for HSM extension */
+#define SBI_EXT_HSM_HART_START          0x0
+#define SBI_EXT_HSM_HART_STOP           0x1
+#define SBI_EXT_HSM_HART_GET_STATUS     0x2
+
+#define SBI_HSM_HART_STATUS_STARTED     0x0
+#define SBI_HSM_HART_STATUS_STOPPED     0x1
+#define SBI_HSM_HART_STATUS_START_PENDING   0x2
+#define SBI_HSM_HART_STATUS_STOP_PENDING    0x3
+
+#define SBI_SPEC_VERSION_MAJOR_OFFSET   24
+#define SBI_SPEC_VERSION_MAJOR_MASK     0x7f
+#define SBI_SPEC_VERSION_MINOR_MASK     0xffffff
+#define SBI_EXT_VENDOR_START            0x09000000
+#define SBI_EXT_VENDOR_END              0x09FFFFFF
+/* clang-format on */
+
+#endif
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "hw/loader.h"
 #include "kvm_riscv.h"
+#include "sbi_ecall_interface.h"
+#include "chardev/char-fe.h"
 
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
     return true;
 }
 
+static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
+{
+    int ret = 0;
+    unsigned char ch;
+    switch (run->riscv_sbi.extension_id) {
+    case SBI_EXT_0_1_CONSOLE_PUTCHAR:
+        ch = run->riscv_sbi.args[0];
+        qemu_chr_fe_write(serial_hd(0)->be, &ch, sizeof(ch));
+        break;
+    case SBI_EXT_0_1_CONSOLE_GETCHAR:
+        ret = qemu_chr_fe_read_all(serial_hd(0)->be, &ch, sizeof(ch));
+        if (ret == sizeof(ch)) {
+            run->riscv_sbi.args[0] = ch;
+        } else {
+            run->riscv_sbi.args[0] = -1;
+        }
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: un-handled SBI EXIT, specific reasons is %lu\n",
+                      __func__, run->riscv_sbi.extension_id);
+        ret = -1;
+        break;
+    }
+    return ret;
+}
+
 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
 {
-    return 0;
+    int ret = 0;
+    switch (run->exit_reason) {
+    case KVM_EXIT_RISCV_SBI:
+        ret = kvm_riscv_handle_sbi(cs, run);
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",
+                      __func__, run->exit_reason);
+        ret = -1;
+        break;
+    }
+    return ret;
 }
 
 void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
-- 
2.31.1

From: Yifei Jiang <jiangyifei@huawei.com>

'host' type cpu is set isa to RV32 or RV64 simply, more isa info
will obtain from KVM in kvm_arch_init_vcpu()

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_SIFIVE_E51       RISCV_CPU_TYPE_NAME("sifive-e51")
 #define TYPE_RISCV_CPU_SIFIVE_U34       RISCV_CPU_TYPE_NAME("sifive-u34")
 #define TYPE_RISCV_CPU_SIFIVE_U54       RISCV_CPU_TYPE_NAME("sifive-u54")
+#define TYPE_RISCV_CPU_HOST             RISCV_CPU_TYPE_NAME("host")
 
 #if defined(TARGET_RISCV32)
 # define TYPE_RISCV_CPU_BASE            TYPE_RISCV_CPU_BASE32
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv32_imafcu_nommu_cpu_init(Object *obj)
 }
 #endif
 
+#if defined(CONFIG_KVM)
+static void riscv_host_cpu_init(Object *obj)
+{
+    CPURISCVState *env = &RISCV_CPU(obj)->env;
+#if defined(TARGET_RISCV32)
+    set_misa(env, MXL_RV32, 0);
+#elif defined(TARGET_RISCV64)
+    set_misa(env, MXL_RV64, 0);
+#endif
+}
+#endif
+
 static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
 {
     ObjectClass *oc;
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .class_init = riscv_cpu_class_init,
     },
     DEFINE_CPU(TYPE_RISCV_CPU_ANY,              riscv_any_cpu_init),
+#if defined(CONFIG_KVM)
+    DEFINE_CPU(TYPE_RISCV_CPU_HOST,             riscv_host_cpu_init),
+#endif
 #if defined(TARGET_RISCV32)
     DEFINE_CPU(TYPE_RISCV_CPU_BASE32,           rv32_base_cpu_init),
     DEFINE_CPU(TYPE_RISCV_CPU_IBEX,             rv32_ibex_cpu_init),
-- 
2.31.1

From: Yifei Jiang <jiangyifei@huawei.com>

Add kvm_riscv_get/put_regs_timer to synchronize virtual time context
from KVM.

To set register of RISCV_TIMER_REG(state) will occur a error from KVM
on kvm_timer_state == 0. It's better to adapt in KVM, but it doesn't matter
that adaping in QEMU.

Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
Signed-off-by: Mingwang Li <limingwang@huawei.com>
Reviewed-by: Anup Patel <anup.patel@wdc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220112081329.1835-11-jiangyifei@huawei.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  7 +++++
 target/riscv/kvm.c | 72 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 79 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
 
     hwaddr kernel_addr;
     hwaddr fdt_addr;
+
+    /* kvm timer */
+    bool kvm_timer_dirty;
+    uint64_t kvm_timer_time;
+    uint64_t kvm_timer_compare;
+    uint64_t kvm_timer_state;
+    uint64_t kvm_timer_frequency;
 };
 
 OBJECT_DECLARE_TYPE(RISCVCPU, RISCVCPUClass,
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "kvm_riscv.h"
 #include "sbi_ecall_interface.h"
 #include "chardev/char-fe.h"
+#include "migration/migration.h"
 
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
 #define RISCV_CSR_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_CSR, \
                  KVM_REG_RISCV_CSR_REG(name))
 
+#define RISCV_TIMER_REG(env, name)  kvm_riscv_reg_id(env, KVM_REG_RISCV_TIMER, \
+                 KVM_REG_RISCV_TIMER_REG(name))
+
 #define RISCV_FP_F_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_F, idx)
 
 #define RISCV_FP_D_REG(env, idx)  kvm_riscv_reg_id(env, KVM_REG_RISCV_FP_D, idx)
@@ -XXX,XX +XXX,XX @@ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
         } \
     } while (0)
 
+#define KVM_RISCV_GET_TIMER(cs, env, name, reg) \
+    do { \
+        int ret = kvm_get_one_reg(cs, RISCV_TIMER_REG(env, name), &reg); \
+        if (ret) { \
+            abort(); \
+        } \
+    } while (0)
+
+#define KVM_RISCV_SET_TIMER(cs, env, name, reg) \
+    do { \
+        int ret = kvm_set_one_reg(cs, RISCV_TIMER_REG(env, time), &reg); \
+        if (ret) { \
+            abort(); \
+        } \
+    } while (0)
+
 static int kvm_riscv_get_regs_core(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_fp(CPUState *cs)
     return ret;
 }
 
+static void kvm_riscv_get_regs_timer(CPUState *cs)
+{
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+
+    if (env->kvm_timer_dirty) {
+        return;
+    }
+
+    KVM_RISCV_GET_TIMER(cs, env, time, env->kvm_timer_time);
+    KVM_RISCV_GET_TIMER(cs, env, compare, env->kvm_timer_compare);
+    KVM_RISCV_GET_TIMER(cs, env, state, env->kvm_timer_state);
+    KVM_RISCV_GET_TIMER(cs, env, frequency, env->kvm_timer_frequency);
+
+    env->kvm_timer_dirty = true;
+}
+
+static void kvm_riscv_put_regs_timer(CPUState *cs)
+{
+    uint64_t reg;
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+
+    if (!env->kvm_timer_dirty) {
+        return;
+    }
+
+    KVM_RISCV_SET_TIMER(cs, env, time, env->kvm_timer_time);
+    KVM_RISCV_SET_TIMER(cs, env, compare, env->kvm_timer_compare);
+
+    /*
+     * To set register of RISCV_TIMER_REG(state) will occur a error from KVM
+     * on env->kvm_timer_state == 0, It's better to adapt in KVM, but it
+     * doesn't matter that adaping in QEMU now.
+     * TODO If KVM changes, adapt here.
+     */
+    if (env->kvm_timer_state) {
+        KVM_RISCV_SET_TIMER(cs, env, state, env->kvm_timer_state);
+    }
+
+    /*
+     * For now, migration will not work between Hosts with different timer
+     * frequency. Therefore, we should check whether they are the same here
+     * during the migration.
+     */
+    if (migration_is_running(migrate_get_current()->state)) {
+        KVM_RISCV_GET_TIMER(cs, env, frequency, reg);
+        if (reg != env->kvm_timer_frequency) {
+            error_report("Dst Hosts timer frequency != Src Hosts");
+        }
+    }
+
+    env->kvm_timer_dirty = false;
+}
 
 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
     KVM_CAP_LAST_INFO
-- 
2.31.1

From: Yifei Jiang <jiangyifei@huawei.com>

We hope that virtual time adjusts with vm state changing. When a vm
is stopped, guest virtual time should stop counting and kvm_timer
should be stopped. When the vm is resumed, guest virtual time should
continue to count and kvm_timer should be restored.

Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
Signed-off-by: Mingwang Li <limingwang@huawei.com>
Reviewed-by: Anup Patel <anup.patel@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220112081329.1835-12-jiangyifei@huawei.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "sbi_ecall_interface.h"
 #include "chardev/char-fe.h"
 #include "migration/migration.h"
+#include "sysemu/runstate.h"
 
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
@@ -XXX,XX +XXX,XX @@ unsigned long kvm_arch_vcpu_id(CPUState *cpu)
     return cpu->cpu_index;
 }
 
+static void kvm_riscv_vm_state_change(void *opaque, bool running,
+                                      RunState state)
+{
+    CPUState *cs = opaque;
+
+    if (running) {
+        kvm_riscv_put_regs_timer(cs);
+    } else {
+        kvm_riscv_get_regs_timer(cs);
+    }
+}
+
 void kvm_arch_init_irq_routing(KVMState *s)
 {
 }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
     CPURISCVState *env = &cpu->env;
     uint64_t id;
 
+    qemu_add_vm_change_state_handler(kvm_riscv_vm_state_change, cs);
+
     id = kvm_riscv_reg_id(env, KVM_REG_RISCV_CONFIG,
                           KVM_REG_RISCV_CONFIG_REG(isa));
     ret = kvm_get_one_reg(cs, id, &isa);
-- 
2.31.1

From: Yifei Jiang <jiangyifei@huawei.com>

Add virtual time context description to vmstate_kvmtimer. After cpu being
loaded, virtual time context is updated to KVM.

Signed-off-by: Yifei Jiang <jiangyifei@huawei.com>
Signed-off-by: Mingwang Li <limingwang@huawei.com>
Reviewed-by: Anup Patel <anup.patel@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220112081329.1835-13-jiangyifei@huawei.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/machine.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_rv128 = {
     }
 };
 
+static bool kvmtimer_needed(void *opaque)
+{
+    return kvm_enabled();
+}
+
+static int cpu_post_load(void *opaque, int version_id)
+{
+    RISCVCPU *cpu = opaque;
+    CPURISCVState *env = &cpu->env;
+
+    env->kvm_timer_dirty = true;
+    return 0;
+}
+
+static const VMStateDescription vmstate_kvmtimer = {
+    .name = "cpu/kvmtimer",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = kvmtimer_needed,
+    .post_load = cpu_post_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT64(env.kvm_timer_time, RISCVCPU),
+        VMSTATE_UINT64(env.kvm_timer_compare, RISCVCPU),
+        VMSTATE_UINT64(env.kvm_timer_state, RISCVCPU),
+
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 const VMStateDescription vmstate_riscv_cpu = {
     .name = "cpu",
     .version_id = 3,
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
         &vmstate_vector,
         &vmstate_pointermasking,
         &vmstate_rv128,
+        &vmstate_kvmtimer,
         NULL
     }
 };
-- 
2.31.1

From: Thomas Huth <thuth@redhat.com>

If I configure my build with --enable-sanitizers, my GCC (v8.5.0)
complains:

.../softmmu/device_tree.c: In function ‘qemu_fdt_add_path’:
.../softmmu/device_tree.c:560:18: error: ‘retval’ may be used uninitialized
 in this function [-Werror=maybe-uninitialized]
     int namelen, retval;
                  ^~~~~~

It's a false warning since the while loop is always executed at least
once (p has to be non-NULL, otherwise the derefence in the if-statement
earlier will crash). Thus let's switch to a do-while loop here instead
to make the compiler happy in all cases.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
Message-id: 20220107133844.145039-1-thuth@redhat.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 softmmu/device_tree.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/softmmu/device_tree.c b/softmmu/device_tree.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/device_tree.c
+++ b/softmmu/device_tree.c
@@ -XXX,XX +XXX,XX @@ int qemu_fdt_add_path(void *fdt, const char *path)
         return -1;
     }
 
-    while (p) {
+    do {
         name = p + 1;
         p = strchr(name, '/');
         namelen = p != NULL ? p - name : strlen(name);
@@ -XXX,XX +XXX,XX @@ int qemu_fdt_add_path(void *fdt, const char *path)
         }
 
         parent = retval;
-    }
+    } while (p);
 
     return retval;
 }
-- 
2.31.1

From: Yanan Wang <wangyanan55@huawei.com>

The pointer assignment "const char *p = path;" in function
qemu_fdt_add_path is unnecessary. Let's remove it and just
use the "path" passed in. No functional change.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Yanan Wang <wangyanan55@huawei.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20220111032758.27804-1-wangyanan55@huawei.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 softmmu/device_tree.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/softmmu/device_tree.c b/softmmu/device_tree.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/device_tree.c
+++ b/softmmu/device_tree.c
@@ -XXX,XX +XXX,XX @@ int qemu_fdt_add_subnode(void *fdt, const char *name)
 int qemu_fdt_add_path(void *fdt, const char *path)
 {
     const char *name;
-    const char *p = path;
     int namelen, retval;
     int parent = 0;
 
@@ -XXX,XX +XXX,XX @@ int qemu_fdt_add_path(void *fdt, const char *path)
     }
 
     do {
-        name = p + 1;
-        p = strchr(name, '/');
-        namelen = p != NULL ? p - name : strlen(name);
+        name = path + 1;
+        path = strchr(name, '/');
+        namelen = path != NULL ? path - name : strlen(name);
 
         retval = fdt_subnode_offset_namelen(fdt, parent, name, namelen);
         if (retval < 0 && retval != -FDT_ERR_NOTFOUND) {
@@ -XXX,XX +XXX,XX @@ int qemu_fdt_add_path(void *fdt, const char *path)
         }
 
         parent = retval;
-    } while (p);
+    } while (path);
 
     return retval;
 }
-- 
2.31.1

From: Frank Chang <frank.chang@sifive.com>

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-2-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        | 1 +
 target/riscv/cpu.c        | 4 ++++
 target/riscv/cpu_helper.c | 5 ++++-
 target/riscv/csr.c        | 6 +++++-
 target/riscv/translate.c  | 2 ++
 5 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPU {
         bool ext_icsr;
         bool ext_zfh;
         bool ext_zfhmin;
+        bool ext_zve64f;
 
         char *priv_spec;
         char *user_spec;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
             }
             set_vext_version(env, vext_version);
         }
+        if (cpu->cfg.ext_zve64f && !cpu->cfg.ext_f) {
+            error_setg(errp, "Zve64f extension depends upon RVF.");
+            return;
+        }
         if (cpu->cfg.ext_j) {
             ext |= RVJ;
         }
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static RISCVMXL cpu_get_xl(CPURISCVState *env)
 void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
                           target_ulong *cs_base, uint32_t *pflags)
 {
+    CPUState *cs = env_cpu(env);
+    RISCVCPU *cpu = RISCV_CPU(cs);
+
     uint32_t flags = 0;
 
     *pc = env->pc;
     *cs_base = 0;
 
-    if (riscv_has_ext(env, RVV)) {
+    if (riscv_has_ext(env, RVV) || cpu->cfg.ext_zve64f) {
         /*
          * If env->vl equals to VLMAX, we can use generic vector operation
          * expanders (GVEC) to accerlate the vector operations.
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException fs(CPURISCVState *env, int csrno)
 
 static RISCVException vs(CPURISCVState *env, int csrno)
 {
-    if (env->misa_ext & RVV) {
+    CPUState *cs = env_cpu(env);
+    RISCVCPU *cpu = RISCV_CPU(cs);
+
+    if (env->misa_ext & RVV ||
+        cpu->cfg.ext_zve64f) {
 #if !defined(CONFIG_USER_ONLY)
         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
             return RISCV_EXCP_ILLEGAL_INST;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool ext_ifencei;
     bool ext_zfh;
     bool ext_zfhmin;
+    bool ext_zve64f;
     bool hlsx;
     /* vector extension */
     bool vill;
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->ext_ifencei = cpu->cfg.ext_ifencei;
     ctx->ext_zfh = cpu->cfg.ext_zfh;
     ctx->ext_zfhmin = cpu->cfg.ext_zfhmin;
+    ctx->ext_zve64f = cpu->cfg.ext_zve64f;
     ctx->vlen = cpu->cfg.vlen;
     ctx->elen = cpu->cfg.elen;
     ctx->mstatus_hs_fs = FIELD_EX32(tb_flags, TB_FLAGS, MSTATUS_HS_FS);
-- 
2.31.1

From: Frank Chang <frank.chang@sifive.com>

All Zve* extensions support the vector configuration instructions.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-3-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

From: Frank Chang <frank.chang@sifive.com>

All Zve* extensions support all vector load and store instructions,
except Zve64* extensions do not support EEW=64 for index values when
XLEN=32.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-4-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

From: Frank Chang <frank.chang@sifive.com>

All Zve* extensions support all vector integer instructions,
except that the vmulh integer multiply variants that return the
high word of the product (vmulh.vv, vmulh.vx, vmulhu.vv, vmulhu.vx,
vmulhsu.vv, vmulhsu.vx) are not included for EEW=64 in Zve64*.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-5-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 39 +++++++++++++++++++++----
 1 file changed, 33 insertions(+), 6 deletions(-)

From: Frank Chang <frank.chang@sifive.com>

All Zve* extensions support all vector fixed-point arithmetic
instructions, except that vsmul.vv and vsmul.vx are not supported
for EEW=64 in Zve64*.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-6-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 27 +++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

From: Frank Chang <frank.chang@sifive.com>

Zve64f extension requires the scalar processor to implement the F
extension and implement all vector floating-point instructions for
floating-point operands with EEW=32 (i.e., no widening floating-point
operations).

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-7-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 41 +++++++++++++++++++------
 1 file changed, 31 insertions(+), 10 deletions(-)

From: Frank Chang <frank.chang@sifive.com>

Vector single-width floating-point reduction operations for EEW=32 are
supported for Zve64f extension.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-8-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

From: Frank Chang <frank.chang@sifive.com>

Vector widening conversion instructions are provided to and from all
supported integer EEWs for Zve64f extension.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-9-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 32 +++++++++++++++++++------
 1 file changed, 25 insertions(+), 7 deletions(-)

From: Frank Chang <frank.chang@sifive.com>

Vector narrowing conversion instructions are provided to and from all
supported integer EEWs for Zve64f extension.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-10-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

From: Frank Chang <frank.chang@sifive.com>

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-12-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        | 1 +
 target/riscv/cpu.c        | 4 ++--
 target/riscv/cpu_helper.c | 2 +-
 target/riscv/csr.c        | 2 +-
 target/riscv/translate.c  | 2 ++
 5 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPU {
         bool ext_icsr;
         bool ext_zfh;
         bool ext_zfhmin;
+        bool ext_zve32f;
         bool ext_zve64f;
 
         char *priv_spec;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
             }
             set_vext_version(env, vext_version);
         }
-        if (cpu->cfg.ext_zve64f && !cpu->cfg.ext_f) {
-            error_setg(errp, "Zve64f extension depends upon RVF.");
+        if ((cpu->cfg.ext_zve32f || cpu->cfg.ext_zve64f) && !cpu->cfg.ext_f) {
+            error_setg(errp, "Zve32f/Zve64f extension depends upon RVF.");
             return;
         }
         if (cpu->cfg.ext_j) {
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
     *pc = env->pc;
     *cs_base = 0;
 
-    if (riscv_has_ext(env, RVV) || cpu->cfg.ext_zve64f) {
+    if (riscv_has_ext(env, RVV) || cpu->cfg.ext_zve32f || cpu->cfg.ext_zve64f) {
         /*
          * If env->vl equals to VLMAX, we can use generic vector operation
          * expanders (GVEC) to accerlate the vector operations.
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException vs(CPURISCVState *env, int csrno)
     RISCVCPU *cpu = RISCV_CPU(cs);
 
     if (env->misa_ext & RVV ||
-        cpu->cfg.ext_zve64f) {
+        cpu->cfg.ext_zve32f || cpu->cfg.ext_zve64f) {
 #if !defined(CONFIG_USER_ONLY)
         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
             return RISCV_EXCP_ILLEGAL_INST;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool ext_ifencei;
     bool ext_zfh;
     bool ext_zfhmin;
+    bool ext_zve32f;
     bool ext_zve64f;
     bool hlsx;
     /* vector extension */
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->ext_ifencei = cpu->cfg.ext_ifencei;
     ctx->ext_zfh = cpu->cfg.ext_zfh;
     ctx->ext_zfhmin = cpu->cfg.ext_zfhmin;
+    ctx->ext_zve32f = cpu->cfg.ext_zve32f;
     ctx->ext_zve64f = cpu->cfg.ext_zve64f;
     ctx->vlen = cpu->cfg.vlen;
     ctx->elen = cpu->cfg.elen;
-- 
2.31.1

From: Frank Chang <frank.chang@sifive.com>

All Zve* extensions support the vector configuration instructions.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-13-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

From: Frank Chang <frank.chang@sifive.com>

Zve32f extension requires the scalar processor to implement the F
extension and implement all vector floating-point instructions for
floating-point operands with EEW=32 (i.e., no widening floating-point
operations).

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-14-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

From: Frank Chang <frank.chang@sifive.com>

Vector widening conversion instructions are provided to and from all
supported integer EEWs for Zve32f extension.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-16-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

From: Frank Chang <frank.chang@sifive.com>

Vector narrowing conversion instructions are provided to and from all
supported integer EEWs for Zve32f extension.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220118014522.13613-17-frank.chang@sifive.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 3 +++
 1 file changed, 3 insertions(+)

From: Anup Patel <apatel@ventanamicro.com>

Currently, we have to use OpenSBI firmware ELF as bios for the spike
machine because the HTIF console requires ELF for parsing "fromhost"
and "tohost" symbols.

The latest OpenSBI can now optionally pick-up HTIF register address
from HTIF DT node so using this feature spike machine can now use
OpenSBI firmware BIN as bios.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/char/riscv_htif.h |  5 ++++-
 include/hw/riscv/spike.h     |  1 +
 hw/char/riscv_htif.c         | 33 +++++++++++++++++++----------
 hw/riscv/spike.c             | 41 ++++++++++++++++++++++--------------
 4 files changed, 52 insertions(+), 28 deletions(-)

diff --git a/include/hw/char/riscv_htif.h b/include/hw/char/riscv_htif.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/riscv_htif.h
+++ b/include/hw/char/riscv_htif.h
@@ -XXX,XX +XXX,XX @@ extern const MemoryRegionOps htif_io_ops;
 void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
     uint64_t st_size);
 
+/* Check if HTIF uses ELF symbols */
+bool htif_uses_elf_symbols(void);
+
 /* legacy pre qom */
 HTIFState *htif_mm_init(MemoryRegion *address_space, MemoryRegion *main_mem,
-    CPURISCVState *env, Chardev *chr);
+    CPURISCVState *env, Chardev *chr, uint64_t nonelf_base);
 
 #endif
diff --git a/include/hw/riscv/spike.h b/include/hw/riscv/spike.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/spike.h
+++ b/include/hw/riscv/spike.h
@@ -XXX,XX +XXX,XX @@ struct SpikeState {
 
 enum {
     SPIKE_MROM,
+    SPIKE_HTIF,
     SPIKE_CLINT,
     SPIKE_DRAM
 };
diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps htif_mm_ops = {
     .write = htif_mm_write,
 };
 
+bool htif_uses_elf_symbols(void)
+{
+    return (address_symbol_set == 3) ? true : false;
+}
+
 HTIFState *htif_mm_init(MemoryRegion *address_space, MemoryRegion *main_mem,
-    CPURISCVState *env, Chardev *chr)
+    CPURISCVState *env, Chardev *chr, uint64_t nonelf_base)
 {
-    uint64_t base = MIN(tohost_addr, fromhost_addr);
-    uint64_t size = MAX(tohost_addr + 8, fromhost_addr + 8) - base;
-    uint64_t tohost_offset = tohost_addr - base;
-    uint64_t fromhost_offset = fromhost_addr - base;
+    uint64_t base, size, tohost_offset, fromhost_offset;
+
+    if (!htif_uses_elf_symbols()) {
+        fromhost_addr = nonelf_base;
+        tohost_addr = nonelf_base + 8;
+    }
+
+    base = MIN(tohost_addr, fromhost_addr);
+    size = MAX(tohost_addr + 8, fromhost_addr + 8) - base;
+    tohost_offset = tohost_addr - base;
+    fromhost_offset = fromhost_addr - base;
 
     HTIFState *s = g_malloc0(sizeof(HTIFState));
     s->address_space = address_space;
@@ -XXX,XX +XXX,XX @@ HTIFState *htif_mm_init(MemoryRegion *address_space, MemoryRegion *main_mem,
     qemu_chr_fe_init(&s->chr, chr, &error_abort);
     qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event,
         htif_be_change, s, NULL, true);
-    if (address_symbol_set == 3) {
-        memory_region_init_io(&s->mmio, NULL, &htif_mm_ops, s,
-                              TYPE_HTIF_UART, size);
-        memory_region_add_subregion_overlap(address_space, base,
-                                            &s->mmio, 1);
-    }
+
+    memory_region_init_io(&s->mmio, NULL, &htif_mm_ops, s,
+                          TYPE_HTIF_UART, size);
+    memory_region_add_subregion_overlap(address_space, base,
+                                        &s->mmio, 1);
 
     return s;
 }
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@
 
 static const MemMapEntry spike_memmap[] = {
     [SPIKE_MROM] =     {     0x1000,     0xf000 },
+    [SPIKE_HTIF] =     {  0x1000000,     0x1000 },
     [SPIKE_CLINT] =    {  0x2000000,    0x10000 },
     [SPIKE_DRAM] =     { 0x80000000,        0x0 },
 };
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
 
     qemu_fdt_add_subnode(fdt, "/htif");
     qemu_fdt_setprop_string(fdt, "/htif", "compatible", "ucb,htif0");
+    if (!htif_uses_elf_symbols()) {
+        qemu_fdt_setprop_cells(fdt, "/htif", "reg",
+            0x0, memmap[SPIKE_HTIF].base, 0x0, memmap[SPIKE_HTIF].size);
+    }
 
     qemu_fdt_add_subnode(fdt, "/soc");
     qemu_fdt_setprop(fdt, "/soc", "ranges", NULL, 0);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
     if (cmdline) {
         qemu_fdt_add_subnode(fdt, "/chosen");
         qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", cmdline);
+        qemu_fdt_setprop_string(fdt, "/chosen", "stdout-path", "/htif");
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
     memory_region_add_subregion(system_memory, memmap[SPIKE_DRAM].base,
         machine->ram);
 
-    /* create device tree */
-    create_fdt(s, memmap, machine->ram_size, machine->kernel_cmdline,
-               riscv_is_32bit(&s->soc[0]));
-
     /* boot rom */
     memory_region_init_rom(mask_rom, NULL, "riscv.spike.mrom",
                            memmap[SPIKE_MROM].size, &error_fatal);
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
                                     htif_symbol_callback);
     }
 
+    /* Load kernel */
     if (machine->kernel_filename) {
         kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc[0],
                                                          firmware_end_addr);
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
         kernel_entry = riscv_load_kernel(machine->kernel_filename,
                                          kernel_start_addr,
                                          htif_symbol_callback);
-
-        if (machine->initrd_filename) {
-            hwaddr start;
-            hwaddr end = riscv_load_initrd(machine->initrd_filename,
-                                           machine->ram_size, kernel_entry,
-                                           &start);
-            qemu_fdt_setprop_cell(s->fdt, "/chosen",
-                                  "linux,initrd-start", start);
-            qemu_fdt_setprop_cell(s->fdt, "/chosen", "linux,initrd-end",
-                                  end);
-        }
     } else {
        /*
         * If dynamic firmware is used, it doesn't know where is the next mode
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
         kernel_entry = 0;
     }
 
+    /* Create device tree */
+    create_fdt(s, memmap, machine->ram_size, machine->kernel_cmdline,
+               riscv_is_32bit(&s->soc[0]));
+
+    /* Load initrd */
+    if (machine->kernel_filename && machine->initrd_filename) {
+        hwaddr start;
+        hwaddr end = riscv_load_initrd(machine->initrd_filename,
+                                       machine->ram_size, kernel_entry,
+                                       &start);
+        qemu_fdt_setprop_cell(s->fdt, "/chosen",
+                              "linux,initrd-start", start);
+        qemu_fdt_setprop_cell(s->fdt, "/chosen", "linux,initrd-end",
+                              end);
+    }
+
     /* Compute the fdt load address in dram */
     fdt_load_addr = riscv_load_fdt(memmap[SPIKE_DRAM].base,
                                    machine->ram_size, s->fdt);
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
 
     /* initialize HTIF using symbols found in load_kernel */
     htif_mm_init(system_memory, mask_rom,
-                 &s->soc[0].harts[0].env, serial_hd(0));
+                 &s->soc[0].harts[0].env, serial_hd(0),
+                 memmap[SPIKE_HTIF].base);
 }
 
 static void spike_machine_instance_init(Object *obj)
-- 
2.31.1

From: Anup Patel <apatel@ventanamicro.com>

Now that RISC-V Spike machine can use BIN BIOS images, we remove
the macros used for ELF BIOS image names.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/boot.h | 2 --
 hw/riscv/spike.c        | 4 ++--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/riscv_hart.h"
 
 #define RISCV32_BIOS_BIN    "opensbi-riscv32-generic-fw_dynamic.bin"
-#define RISCV32_BIOS_ELF    "opensbi-riscv32-generic-fw_dynamic.elf"
 #define RISCV64_BIOS_BIN    "opensbi-riscv64-generic-fw_dynamic.bin"
-#define RISCV64_BIOS_ELF    "opensbi-riscv64-generic-fw_dynamic.elf"
 
 bool riscv_is_32bit(RISCVHartArrayState *harts);
 
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
      */
     if (riscv_is_32bit(&s->soc[0])) {
         firmware_end_addr = riscv_find_and_load_firmware(machine,
-                                    RISCV32_BIOS_ELF, memmap[SPIKE_DRAM].base,
+                                    RISCV32_BIOS_BIN, memmap[SPIKE_DRAM].base,
                                     htif_symbol_callback);
     } else {
         firmware_end_addr = riscv_find_and_load_firmware(machine,
-                                    RISCV64_BIOS_ELF, memmap[SPIKE_DRAM].base,
+                                    RISCV64_BIOS_BIN, memmap[SPIKE_DRAM].base,
                                     htif_symbol_callback);
     }
 
-- 
2.31.1

From: Anup Patel <apatel@ventanamicro.com>

Now that all RISC-V machines can use OpenSBI BIN images, we remove
OpenSBI ELF images and also exclude these images from BIOS build.

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 .gitlab-ci.d/opensbi.yml                       |   2 --
 pc-bios/meson.build                            |   2 --
 pc-bios/opensbi-riscv32-generic-fw_dynamic.elf | Bin 838904 -> 0 bytes
 pc-bios/opensbi-riscv64-generic-fw_dynamic.elf | Bin 934696 -> 0 bytes
 roms/Makefile                                  |   2 --
 5 files changed, 6 deletions(-)
 delete mode 100644 pc-bios/opensbi-riscv32-generic-fw_dynamic.elf
 delete mode 100644 pc-bios/opensbi-riscv64-generic-fw_dynamic.elf

diff --git a/.gitlab-ci.d/opensbi.yml b/.gitlab-ci.d/opensbi.yml
index XXXXXXX..XXXXXXX 100644
--- a/.gitlab-ci.d/opensbi.yml
+++ b/.gitlab-ci.d/opensbi.yml
@@ -XXX,XX +XXX,XX @@ build-opensbi:
  artifacts:
    paths: # 'artifacts.zip' will contains the following files:
    - pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
-   - pc-bios/opensbi-riscv32-generic-fw_dynamic.elf
    - pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
-   - pc-bios/opensbi-riscv64-generic-fw_dynamic.elf
    - opensbi32-generic-stdout.log
    - opensbi32-generic-stderr.log
    - opensbi64-generic-stdout.log
diff --git a/pc-bios/meson.build b/pc-bios/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/pc-bios/meson.build
+++ b/pc-bios/meson.build
@@ -XXX,XX +XXX,XX @@ blobs = files(
   'hppa-firmware.img',
   'opensbi-riscv32-generic-fw_dynamic.bin',
   'opensbi-riscv64-generic-fw_dynamic.bin',
-  'opensbi-riscv32-generic-fw_dynamic.elf',
-  'opensbi-riscv64-generic-fw_dynamic.elf',
   'npcm7xx_bootrom.bin',
 )
 
diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.elf b/pc-bios/opensbi-riscv32-generic-fw_dynamic.elf
deleted file mode 100644
index XXXXXXX..XXXXXXX
Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.elf and /dev/null differ
diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.elf b/pc-bios/opensbi-riscv64-generic-fw_dynamic.elf
deleted file mode 100644
index XXXXXXX..XXXXXXX
Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.elf and /dev/null differ
diff --git a/roms/Makefile b/roms/Makefile
index XXXXXXX..XXXXXXX 100644
--- a/roms/Makefile
+++ b/roms/Makefile
@@ -XXX,XX +XXX,XX @@ opensbi32-generic:
 		CROSS_COMPILE=$(riscv32_cross_prefix) \
 		PLATFORM="generic"
 	cp opensbi/build/platform/generic/firmware/fw_dynamic.bin ../pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
-	cp opensbi/build/platform/generic/firmware/fw_dynamic.elf ../pc-bios/opensbi-riscv32-generic-fw_dynamic.elf
 
 opensbi64-generic:
 	$(MAKE) -C opensbi \
 		CROSS_COMPILE=$(riscv64_cross_prefix) \
 		PLATFORM="generic"
 	cp opensbi/build/platform/generic/firmware/fw_dynamic.bin ../pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
-	cp opensbi/build/platform/generic/firmware/fw_dynamic.elf ../pc-bios/opensbi-riscv64-generic-fw_dynamic.elf
 
 MESON = meson
 NINJA = ninja
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mseccfg(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+static bool check_pmp_reg_index(CPURISCVState *env, uint32_t reg_index)
+{
+    /* TODO: RV128 restriction check */
+    if ((reg_index & 1) && (riscv_cpu_mxl(env) == MXL_RV64)) {
+        return false;
+    }
+    return true;
+}
+
 static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
                                   target_ulong *val)
 {
+    uint32_t reg_index = csrno - CSR_PMPCFG0;
+
+    if (!check_pmp_reg_index(env, reg_index)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
     *val = pmpcfg_csr_read(env, csrno - CSR_PMPCFG0);
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
 static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
                                    target_ulong val)
 {
+    uint32_t reg_index = csrno - CSR_PMPCFG0;
+
+    if (!check_pmp_reg_index(env, reg_index)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
     pmpcfg_csr_write(env, csrno - CSR_PMPCFG0, val);
     return RISCV_EXCP_NONE;
 }
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
 {
     int i;
     uint8_t cfg_val;
+    int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
 
     trace_pmpcfg_csr_write(env->mhartid, reg_index, val);
 
-    if ((reg_index & 1) && (sizeof(target_ulong) == 8)) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "ignoring pmpcfg write - incorrect address\n");
-        return;
-    }
-
-    for (i = 0; i < sizeof(target_ulong); i++) {
+    for (i = 0; i < pmpcfg_nums; i++) {
         cfg_val = (val >> 8 * i)  & 0xff;
         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
     }
@@ -XXX,XX +XXX,XX @@ target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
     int i;
     target_ulong cfg_val = 0;
     target_ulong val = 0;
+    int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
 
-    for (i = 0; i < sizeof(target_ulong); i++) {
+    for (i = 0; i < pmpcfg_nums; i++) {
         val = pmp_read_cfg(env, (reg_index * 4) + i);
         cfg_val |= (val << (i * 8));
     }
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

As pc will be written by the xepc in exception return, just ignore
pc in translation.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-3-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                          | 4 ++--
 target/riscv/op_helper.c                       | 4 ++--
 target/riscv/insn_trans/trans_privileged.c.inc | 7 ++-----
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(csrr_i128, tl, env, int)
 DEF_HELPER_4(csrw_i128, void, env, int, tl, tl)
 DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
 #ifndef CONFIG_USER_ONLY
-DEF_HELPER_2(sret, tl, env, tl)
-DEF_HELPER_2(mret, tl, env, tl)
+DEF_HELPER_1(sret, tl, env)
+DEF_HELPER_1(mret, tl, env)
 DEF_HELPER_1(wfi, void, env)
 DEF_HELPER_1(tlb_flush, void, env)
 #endif
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrrw_i128(CPURISCVState *env, int csr,
 
 #ifndef CONFIG_USER_ONLY
 
-target_ulong helper_sret(CPURISCVState *env, target_ulong cpu_pc_deb)
+target_ulong helper_sret(CPURISCVState *env)
 {
     uint64_t mstatus;
     target_ulong prev_priv, prev_virt;
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env, target_ulong cpu_pc_deb)
     return retpc;
 }
 
-target_ulong helper_mret(CPURISCVState *env, target_ulong cpu_pc_deb)
+target_ulong helper_mret(CPURISCVState *env)
 {
     if (!(env->priv >= PRV_M)) {
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_uret(DisasContext *ctx, arg_uret *a)
 static bool trans_sret(DisasContext *ctx, arg_sret *a)
 {
 #ifndef CONFIG_USER_ONLY
-    tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
-
     if (has_ext(ctx, RVS)) {
-        gen_helper_sret(cpu_pc, cpu_env, cpu_pc);
+        gen_helper_sret(cpu_pc, cpu_env);
         tcg_gen_exit_tb(NULL, 0); /* no chaining */
         ctx->base.is_jmp = DISAS_NORETURN;
     } else {
@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
 static bool trans_mret(DisasContext *ctx, arg_mret *a)
 {
 #ifndef CONFIG_USER_ONLY
-    tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
-    gen_helper_mret(cpu_pc, cpu_env, cpu_pc);
+    gen_helper_mret(cpu_pc, cpu_env);
     tcg_gen_exit_tb(NULL, 0); /* no chaining */
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-4-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c                | 4 +---
 target/riscv/insn_trans/trans_rvi.c.inc | 4 +---
 2 files changed, 2 insertions(+), 6 deletions(-)

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

When pc is written, it is sign-extended to fill the widest supported XLEN.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-5-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c                      | 25 ++++++++++++++++---
 .../riscv/insn_trans/trans_privileged.c.inc   |  2 +-
 target/riscv/insn_trans/trans_rvi.c.inc       |  5 ++--
 target/riscv/insn_trans/trans_rvv.c.inc       |  4 +--
 4 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_check_nanbox_s(TCGv_i64 out, TCGv_i64 in)
     tcg_gen_movcond_i64(TCG_COND_GEU, out, in, t_max, in, t_nan);
 }
 
+static void gen_set_pc_imm(DisasContext *ctx, target_ulong dest)
+{
+    if (get_xl(ctx) == MXL_RV32) {
+        dest = (int32_t)dest;
+    }
+    tcg_gen_movi_tl(cpu_pc, dest);
+}
+
+static void gen_set_pc(DisasContext *ctx, TCGv dest)
+{
+    if (get_xl(ctx) == MXL_RV32) {
+        tcg_gen_ext32s_tl(cpu_pc, dest);
+    } else {
+        tcg_gen_mov_tl(cpu_pc, dest);
+    }
+}
+
 static void generate_exception(DisasContext *ctx, int excp)
 {
-    tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
+    gen_set_pc_imm(ctx, ctx->base.pc_next);
     gen_helper_raise_exception(cpu_env, tcg_constant_i32(excp));
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
 static void generate_exception_mtval(DisasContext *ctx, int excp)
 {
-    tcg_gen_movi_tl(cpu_pc, ctx->base.pc_next);
+    gen_set_pc_imm(ctx, ctx->base.pc_next);
     tcg_gen_st_tl(cpu_pc, cpu_env, offsetof(CPURISCVState, badaddr));
     gen_helper_raise_exception(cpu_env, tcg_constant_i32(excp));
     ctx->base.is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
 {
     if (translator_use_goto_tb(&ctx->base, dest)) {
         tcg_gen_goto_tb(n);
-        tcg_gen_movi_tl(cpu_pc, dest);
+        gen_set_pc_imm(ctx, dest);
         tcg_gen_exit_tb(ctx->base.tb, n);
     } else {
-        tcg_gen_movi_tl(cpu_pc, dest);
+        gen_set_pc_imm(ctx, dest);
         tcg_gen_lookup_and_goto_ptr();
     }
 }
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
 static bool trans_wfi(DisasContext *ctx, arg_wfi *a)
 {
 #ifndef CONFIG_USER_ONLY
-    tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
+    gen_set_pc_imm(ctx, ctx->pc_succ_insn);
     gen_helper_wfi(cpu_env);
     return true;
 #else
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
     tcg_gen_addi_tl(cpu_pc, get_gpr(ctx, a->rs1, EXT_NONE), a->imm);
     tcg_gen_andi_tl(cpu_pc, cpu_pc, (target_ulong)-2);
 
+    gen_set_pc(ctx, cpu_pc);
     if (!has_ext(ctx, RVC)) {
         TCGv t0 = tcg_temp_new();
 
@@ -XXX,XX +XXX,XX @@ static bool trans_fence_i(DisasContext *ctx, arg_fence_i *a)
      * FENCE_I is a no-op in QEMU,
      * however we need to end the translation block
      */
-    tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
+    gen_set_pc_imm(ctx, ctx->pc_succ_insn);
     tcg_gen_exit_tb(NULL, 0);
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fence_i(DisasContext *ctx, arg_fence_i *a)
 static bool do_csr_post(DisasContext *ctx)
 {
     /* We may have changed important cpu state -- exit to main loop. */
-    tcg_gen_movi_tl(cpu_pc, ctx->pc_succ_insn);
+    gen_set_pc_imm(ctx, ctx->pc_succ_insn);
     tcg_gen_exit_tb(NULL, 0);
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
     gen_set_gpr(s, rd, dst);
     mark_vs_dirty(s);
 
-    tcg_gen_movi_tl(cpu_pc, s->pc_succ_insn);
+    gen_set_pc_imm(s, s->pc_succ_insn);
     tcg_gen_lookup_and_goto_ptr();
     s->base.is_jmp = DISAS_NORETURN;
 
@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
     gen_helper_vsetvl(dst, cpu_env, s1, s2);
     gen_set_gpr(s, rd, dst);
     mark_vs_dirty(s);
-    tcg_gen_movi_tl(cpu_pc, s->pc_succ_insn);
+    gen_set_pc_imm(s, s->pc_succ_insn);
     tcg_gen_lookup_and_goto_ptr();
     s->base.is_jmp = DISAS_NORETURN;
 
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Current xlen has been used in helper functions and many other places.
The computation of current xlen is not so trivial, so that we should
recompute it as little as possible.

Fortunately, xlen only changes in very seldom cases, such as exception,
misa write, mstatus write, cpu reset, migration load. So that we can only
recompute xlen in this places and cache it into CPURISCVState.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-6-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        | 31 +++++++++++++++++++++++++++++++
 target/riscv/cpu.c        |  1 +
 target/riscv/cpu_helper.c | 34 ++--------------------------------
 target/riscv/csr.c        |  2 ++
 target/riscv/machine.c    | 10 ++++++++++
 5 files changed, 46 insertions(+), 32 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
     uint32_t misa_mxl_max;  /* max mxl for this cpu */
     uint32_t misa_ext;      /* current extensions */
     uint32_t misa_ext_mask; /* max ext for this cpu */
+    uint32_t xl;            /* current xlen */
 
     /* 128-bit helpers upper part return value */
     target_ulong retxh;
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL riscv_cpu_mxl(CPURISCVState *env)
 }
 #endif
 
+#if defined(TARGET_RISCV32)
+#define cpu_recompute_xl(env)  ((void)(env), MXL_RV32)
+#else
+static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
+{
+    RISCVMXL xl = env->misa_mxl;
+#if !defined(CONFIG_USER_ONLY)
+    /*
+     * When emulating a 32-bit-only cpu, use RV32.
+     * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
+     * MSTATUSH doesn't have UXL/SXL, therefore XLEN cannot be widened
+     * back to RV64 for lower privs.
+     */
+    if (xl != MXL_RV32) {
+        switch (env->priv) {
+        case PRV_M:
+            break;
+        case PRV_U:
+            xl = get_field(env->mstatus, MSTATUS64_UXL);
+            break;
+        default: /* PRV_S | PRV_H */
+            xl = get_field(env->mstatus, MSTATUS64_SXL);
+            break;
+        }
+    }
+#endif
+    return xl;
+}
+#endif
+
 /*
  * Encode LMUL to lmul as follows:
  *     LMUL    vlmul    lmul
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
     /* mmte is supposed to have pm.current hardwired to 1 */
     env->mmte |= (PM_EXT_INITIAL | MMTE_M_PM_CURRENT);
 #endif
+    env->xl = riscv_cpu_mxl(env);
     cs->exception_index = RISCV_EXCP_NONE;
     env->load_res = -1;
     set_default_nan_mode(1, &env->fp_status);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 #endif
 }
 
-static RISCVMXL cpu_get_xl(CPURISCVState *env)
-{
-#if defined(TARGET_RISCV32)
-    return MXL_RV32;
-#elif defined(CONFIG_USER_ONLY)
-    return MXL_RV64;
-#else
-    RISCVMXL xl = riscv_cpu_mxl(env);
-
-    /*
-     * When emulating a 32-bit-only cpu, use RV32.
-     * When emulating a 64-bit cpu, and MXL has been reduced to RV32,
-     * MSTATUSH doesn't have UXL/SXL, therefore XLEN cannot be widened
-     * back to RV64 for lower privs.
-     */
-    if (xl != MXL_RV32) {
-        switch (env->priv) {
-        case PRV_M:
-            break;
-        case PRV_U:
-            xl = get_field(env->mstatus, MSTATUS64_UXL);
-            break;
-        default: /* PRV_S | PRV_H */
-            xl = get_field(env->mstatus, MSTATUS64_SXL);
-            break;
-        }
-    }
-    return xl;
-#endif
-}
-
 void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
                           target_ulong *cs_base, uint32_t *pflags)
 {
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
     }
 #endif
 
-    flags = FIELD_DP32(flags, TB_FLAGS, XL, cpu_get_xl(env));
+    flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
 
     *pflags = flags;
 }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
     }
     /* tlb_flush is unnecessary as mode is contained in mmu_idx */
     env->priv = newpriv;
+    env->xl = cpu_recompute_xl(env);
 
     /*
      * Clear the load reservation - otherwise a reservation placed in one
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
         mstatus = set_field(mstatus, MSTATUS64_UXL, xl);
     }
     env->mstatus = mstatus;
+    env->xl = cpu_recompute_xl(env);
 
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_misa(CPURISCVState *env, int csrno,
     /* flush translation cache */
     tb_flush(env_cpu(env));
     env->misa_ext = val;
+    env->xl = riscv_cpu_mxl(env);
     return RISCV_EXCP_NONE;
 }
 
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_kvmtimer = {
     }
 };
 
+static int riscv_cpu_post_load(void *opaque, int version_id)
+{
+    RISCVCPU *cpu = opaque;
+    CPURISCVState *env = &cpu->env;
+
+    env->xl = cpu_recompute_xl(env);
+    return 0;
+}
+
 const VMStateDescription vmstate_riscv_cpu = {
     .name = "cpu",
     .version_id = 3,
     .minimum_version_id = 3,
+    .post_load = riscv_cpu_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINTTL_ARRAY(env.gpr, RISCVCPU, 32),
         VMSTATE_UINT64_ARRAY(env.fpr, RISCVCPU, 32),
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

In some cases, we must restore the guest PC to the address of the start of
the TB, such as when the instruction counter hits zero. So extend pc register
according to current xlen for these cases.

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
-    env->pc = value;
+
+    if (env->xl == MXL_RV32) {
+        env->pc = (int32_t)value;
+    } else {
+        env->pc = value;
+    }
 }
 
 static void riscv_cpu_synchronize_from_tb(CPUState *cs,
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_synchronize_from_tb(CPUState *cs,
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
-    env->pc = tb->pc;
+    RISCVMXL xl = FIELD_EX32(tb->flags, TB_FLAGS, XL);
+
+    if (xl == MXL_RV32) {
+        env->pc = (int32_t)tb->pc;
+    } else {
+        env->pc = tb->pc;
+    }
 }
 
 static bool riscv_cpu_has_work(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_has_work(CPUState *cs)
 void restore_state_to_opc(CPURISCVState *env, TranslationBlock *tb,
                           target_ulong *data)
 {
-    env->pc = data[0];
+    RISCVMXL xl = FIELD_EX32(tb->flags, TB_FLAGS, XL);
+    if (xl == MXL_RV32) {
+        env->pc = (int32_t)data[0];
+    } else {
+        env->pc = data[0];
+    }
 }
 
 static void riscv_cpu_reset(DeviceState *dev)
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
     RISCVCPU *cpu = RISCV_CPU(dev);
     CPURISCVState *env = &cpu->env;
     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
+    CPUClass *cc = CPU_CLASS(mcc);
     int priv_version = 0;
     Error *local_err = NULL;
 
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
     switch (env->misa_mxl_max) {
 #ifdef TARGET_RISCV64
     case MXL_RV64:
+        cc->gdb_core_xml_file = "riscv-64bit-cpu.xml";
         break;
     case MXL_RV128:
         break;
 #endif
     case MXL_RV32:
+        cc->gdb_core_xml_file = "riscv-32bit-cpu.xml";
         break;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     cc->gdb_read_register = riscv_cpu_gdb_read_register;
     cc->gdb_write_register = riscv_cpu_gdb_write_register;
     cc->gdb_num_core_regs = 33;
-#if defined(TARGET_RISCV32)
-    cc->gdb_core_xml_file = "riscv-32bit-cpu.xml";
-#elif defined(TARGET_RISCV64)
-    cc->gdb_core_xml_file = "riscv-64bit-cpu.xml";
-#endif
     cc->gdb_stop_before_watchpoint = true;
     cc->disas_set_info = riscv_cpu_disas_set_info;
 #ifndef CONFIG_USER_ONLY
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
+    target_ulong tmp;
 
     if (n < 32) {
-        return gdb_get_regl(mem_buf, env->gpr[n]);
+        tmp = env->gpr[n];
     } else if (n == 32) {
-        return gdb_get_regl(mem_buf, env->pc);
+        tmp = env->pc;
+    } else {
+        return 0;
+    }
+
+    switch (env->misa_mxl_max) {
+    case MXL_RV32:
+        return gdb_get_reg32(mem_buf, tmp);
+    case MXL_RV64:
+        return gdb_get_reg64(mem_buf, tmp);
+    default:
+        g_assert_not_reached();
     }
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ int riscv_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
-
-    if (n == 0) {
-        /* discard writes to x0 */
-        return sizeof(target_ulong);
-    } else if (n < 32) {
-        env->gpr[n] = ldtul_p(mem_buf);
-        return sizeof(target_ulong);
+    int length = 0;
+    target_ulong tmp;
+
+    switch (env->misa_mxl_max) {
+    case MXL_RV32:
+        tmp = (int32_t)ldl_p(mem_buf);
+        length = 4;
+        break;
+    case MXL_RV64:
+        if (env->xl < MXL_RV64) {
+            tmp = (int32_t)ldq_p(mem_buf);
+        } else {
+            tmp = ldq_p(mem_buf);
+        }
+        length = 8;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    if (n > 0 && n < 32) {
+        env->gpr[n] = tmp;
     } else if (n == 32) {
-        env->pc = ldtul_p(mem_buf);
-        return sizeof(target_ulong);
+        env->pc = tmp;
     }
-    return 0;
+
+    return length;
 }
 
 static int riscv_gdb_get_fpu(CPURISCVState *env, GByteArray *buf, int n)
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
                                                               cs->gdb_num_regs),
                                  "riscv-vector.xml", 0);
     }
-#if defined(TARGET_RISCV32)
-    gdb_register_coprocessor(cs, riscv_gdb_get_virtual, riscv_gdb_set_virtual,
-                             1, "riscv-32bit-virtual.xml", 0);
-#elif defined(TARGET_RISCV64)
-    gdb_register_coprocessor(cs, riscv_gdb_get_virtual, riscv_gdb_set_virtual,
-                             1, "riscv-64bit-virtual.xml", 0);
-#endif
+    switch (env->misa_mxl_max) {
+    case MXL_RV32:
+        gdb_register_coprocessor(cs, riscv_gdb_get_virtual,
+                                 riscv_gdb_set_virtual,
+                                 1, "riscv-32bit-virtual.xml", 0);
+        break;
+    case MXL_RV64:
+        gdb_register_coprocessor(cs, riscv_gdb_get_virtual,
+                                 riscv_gdb_set_virtual,
+                                 1, "riscv-64bit-virtual.xml", 0);
+        break;
+    default:
+        g_assert_not_reached();
+    }
 
     gdb_register_coprocessor(cs, riscv_gdb_get_csr, riscv_gdb_set_csr,
                              riscv_gen_dynamic_csr_xml(cs, cs->gdb_num_regs),
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Write mask is representing the bits we care about.

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
 
 void helper_csrw(CPURISCVState *env, int csr, target_ulong src)
 {
-    RISCVException ret = riscv_csrrw(env, csr, NULL, src, -1);
+    target_ulong mask = env->xl == MXL_RV32 ? UINT32_MAX : (target_ulong)-1;
+    RISCVException ret = riscv_csrrw(env, csr, NULL, src, mask);
 
     if (ret != RISCV_EXCP_NONE) {
         riscv_raise_exception(env, ret, GETPC());
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool do_csrrw_i128(DisasContext *ctx, int rd, int rc,
 
 static bool trans_csrrw(DisasContext *ctx, arg_csrrw *a)
 {
-    if (get_xl(ctx) < MXL_RV128) {
+    RISCVMXL xl = get_xl(ctx);
+    if (xl < MXL_RV128) {
         TCGv src = get_gpr(ctx, a->rs1, EXT_NONE);
 
         /*
@@ -XXX,XX +XXX,XX @@ static bool trans_csrrw(DisasContext *ctx, arg_csrrw *a)
             return do_csrw(ctx, a->csr, src);
         }
 
-        TCGv mask = tcg_constant_tl(-1);
+        TCGv mask = tcg_constant_tl(xl == MXL_RV32 ? UINT32_MAX :
+                                                     (target_ulong)-1);
         return do_csrrw(ctx, a->rd, a->csr, src, mask);
     } else {
         TCGv srcl = get_gpr(ctx, a->rs1, EXT_NONE);
@@ -XXX,XX +XXX,XX @@ static bool trans_csrrc(DisasContext *ctx, arg_csrrc *a)
 
 static bool trans_csrrwi(DisasContext *ctx, arg_csrrwi *a)
 {
-    if (get_xl(ctx) < MXL_RV128) {
+    RISCVMXL xl = get_xl(ctx);
+    if (xl < MXL_RV128) {
         TCGv src = tcg_constant_tl(a->rs1);
 
         /*
@@ -XXX,XX +XXX,XX @@ static bool trans_csrrwi(DisasContext *ctx, arg_csrrwi *a)
             return do_csrw(ctx, a->csr, src);
         }
 
-        TCGv mask = tcg_constant_tl(-1);
+        TCGv mask = tcg_constant_tl(xl == MXL_RV32 ? UINT32_MAX :
+                                                     (target_ulong)-1);
         return do_csrrw(ctx, a->rd, a->csr, src, mask);
     } else {
         TCGv src = tcg_constant_tl(a->rs1);
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220120122050.41546-12-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  4 ++++
 target/riscv/cpu.c        |  1 +
 target/riscv/cpu_helper.c | 43 +++++++++++++++++++++++++++++++++++++++
 target/riscv/csr.c        | 19 +++++++++++++++++
 target/riscv/machine.c    |  1 +
 5 files changed, 68 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
     target_ulong upmmask;
     target_ulong upmbase;
 #endif
+    target_ulong cur_pmmask;
+    target_ulong cur_pmbase;
 
     float_status fp_status;
 
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_get_vlmax(RISCVCPU *cpu, target_ulong vtype)
 void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
                           target_ulong *cs_base, uint32_t *pflags);
 
+void riscv_cpu_update_mask(CPURISCVState *env);
+
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                            target_ulong *ret_value,
                            target_ulong new_value, target_ulong write_mask);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
     env->mmte |= (PM_EXT_INITIAL | MMTE_M_PM_CURRENT);
 #endif
     env->xl = riscv_cpu_mxl(env);
+    riscv_cpu_update_mask(env);
     cs->exception_index = RISCV_EXCP_NONE;
     env->load_res = -1;
     set_default_nan_mode(1, &env->fp_status);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
     *pflags = flags;
 }
 
+void riscv_cpu_update_mask(CPURISCVState *env)
+{
+    target_ulong mask = -1, base = 0;
+    /*
+     * TODO: Current RVJ spec does not specify
+     * how the extension interacts with XLEN.
+     */
+#ifndef CONFIG_USER_ONLY
+    if (riscv_has_ext(env, RVJ)) {
+        switch (env->priv) {
+        case PRV_M:
+            if (env->mmte & M_PM_ENABLE) {
+                mask = env->mpmmask;
+                base = env->mpmbase;
+            }
+            break;
+        case PRV_S:
+            if (env->mmte & S_PM_ENABLE) {
+                mask = env->spmmask;
+                base = env->spmbase;
+            }
+            break;
+        case PRV_U:
+            if (env->mmte & U_PM_ENABLE) {
+                mask = env->upmmask;
+                base = env->upmbase;
+            }
+            break;
+        default:
+            g_assert_not_reached();
+        }
+    }
+#endif
+    if (env->xl == MXL_RV32) {
+        env->cur_pmmask = mask & UINT32_MAX;
+        env->cur_pmbase = base & UINT32_MAX;
+    } else {
+        env->cur_pmmask = mask;
+        env->cur_pmbase = base;
+    }
+}
+
 #ifndef CONFIG_USER_ONLY
 static int riscv_cpu_local_irq_pending(CPURISCVState *env)
 {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
     /* tlb_flush is unnecessary as mode is contained in mmu_idx */
     env->priv = newpriv;
     env->xl = cpu_recompute_xl(env);
+    riscv_cpu_update_mask(env);
 
     /*
      * Clear the load reservation - otherwise a reservation placed in one
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mmte(CPURISCVState *env, int csrno,
     /* hardwiring pm.instruction bit to 0, since it's not supported yet */
     wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
     env->mmte = wpri_val | PM_EXT_DIRTY;
+    riscv_cpu_update_mask(env);
 
     /* Set XS and SD bits, since PM CSRs are dirty */
     mstatus = env->mstatus | MSTATUS_XS;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
     uint64_t mstatus;
 
     env->mpmmask = val;
+    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
+        env->cur_pmmask = val;
+    }
     env->mmte |= PM_EXT_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmmask(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->spmmask = val;
+    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+        env->cur_pmmask = val;
+    }
     env->mmte |= PM_EXT_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmmask(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->upmmask = val;
+    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+        env->cur_pmmask = val;
+    }
     env->mmte |= PM_EXT_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
     uint64_t mstatus;
 
     env->mpmbase = val;
+    if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
+        env->cur_pmbase = val;
+    }
     env->mmte |= PM_EXT_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
@@ -XXX,XX +XXX,XX @@ static RISCVException write_spmbase(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->spmbase = val;
+    if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
+        env->cur_pmbase = val;
+    }
     env->mmte |= PM_EXT_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
     env->upmbase = val;
+    if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
+        env->cur_pmbase = val;
+    }
     env->mmte |= PM_EXT_DIRTY;
 
     /* Set XS and SD bits, since PM CSRs are dirty */
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_post_load(void *opaque, int version_id)
     CPURISCVState *env = &cpu->env;
 
     env->xl = cpu_recompute_xl(env);
+    riscv_cpu_update_mask(env);
     return 0;
 }
 
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Replace the array of pm_mask/pm_base with scalar variables.
Remove the cached array value in DisasContext.

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */
 static TCGv load_res;
 static TCGv load_val;
 /* globals for PM CSRs */
-static TCGv pm_mask[4];
-static TCGv pm_base[4];
+static TCGv pm_mask;
+static TCGv pm_base;
 
 #include "exec/gen-icount.h"
 
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     TCGv temp[4];
     /* PointerMasking extension */
     bool pm_enabled;
-    TCGv pm_mask;
-    TCGv pm_base;
 } DisasContext;
 
 static inline bool has_ext(DisasContext *ctx, uint32_t ext)
@@ -XXX,XX +XXX,XX @@ static TCGv gen_pm_adjust_address(DisasContext *s, TCGv src)
         return src;
     } else {
         temp = temp_new(s);
-        tcg_gen_andc_tl(temp, src, s->pm_mask);
-        tcg_gen_or_tl(temp, temp, s->pm_base);
+        tcg_gen_andc_tl(temp, src, pm_mask);
+        tcg_gen_or_tl(temp, temp, pm_base);
         return temp;
     }
 }
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->ntemp = 0;
     memset(ctx->temp, 0, sizeof(ctx->temp));
     ctx->pm_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_ENABLED);
-    int priv = tb_flags & TB_FLAGS_PRIV_MMU_MASK;
-    ctx->pm_mask = pm_mask[priv];
-    ctx->pm_base = pm_base[priv];
-
     ctx->zero = tcg_constant_tl(0);
 }
 
@@ -XXX,XX +XXX,XX @@ void riscv_translate_init(void)
                              "load_res");
     load_val = tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, load_val),
                              "load_val");
-#ifndef CONFIG_USER_ONLY
     /* Assign PM CSRs to tcg globals */
-    pm_mask[PRV_U] =
-      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, upmmask), "upmmask");
-    pm_base[PRV_U] =
-      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, upmbase), "upmbase");
-    pm_mask[PRV_S] =
-      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, spmmask), "spmmask");
-    pm_base[PRV_S] =
-      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, spmbase), "spmbase");
-    pm_mask[PRV_M] =
-      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, mpmmask), "mpmmask");
-    pm_base[PRV_M] =
-      tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, mpmbase), "mpmbase");
-#endif
+    pm_mask = tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, cur_pmmask),
+                                 "pmmask");
+    pm_base = tcg_global_mem_new(cpu_env, offsetof(CPURISCVState, cur_pmbase),
+                                 "pmbase");
 }
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Define one common function to compute a canonical address from a register
plus offset. Merge gen_pm_adjust_address into this function.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-14-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c                | 25 ++++++++++++-------------
 target/riscv/insn_trans/trans_rva.c.inc |  9 +++------
 target/riscv/insn_trans/trans_rvd.c.inc | 19 ++-----------------
 target/riscv/insn_trans/trans_rvf.c.inc | 19 ++-----------------
 target/riscv/insn_trans/trans_rvi.c.inc | 18 ++----------------
 5 files changed, 21 insertions(+), 69 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
-/*
- * Generates address adjustment for PointerMasking
- */
-static TCGv gen_pm_adjust_address(DisasContext *s, TCGv src)
+/* Compute a canonical address from a register plus offset. */
+static TCGv get_address(DisasContext *ctx, int rs1, int imm)
 {
-    TCGv temp;
-    if (!s->pm_enabled) {
-        /* Load unmodified address */
-        return src;
-    } else {
-        temp = temp_new(s);
-        tcg_gen_andc_tl(temp, src, pm_mask);
-        tcg_gen_or_tl(temp, temp, pm_base);
-        return temp;
+    TCGv addr = temp_new(ctx);
+    TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
+
+    tcg_gen_addi_tl(addr, src1, imm);
+    if (ctx->pm_enabled) {
+        tcg_gen_and_tl(addr, addr, pm_mask);
+        tcg_gen_or_tl(addr, addr, pm_base);
+    } else if (get_xl(ctx) == MXL_RV32) {
+        tcg_gen_ext32u_tl(addr, addr);
     }
+    return addr;
 }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/riscv/insn_trans/trans_rva.c.inc b/target/riscv/insn_trans/trans_rva.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rva.c.inc
+++ b/target/riscv/insn_trans/trans_rva.c.inc
@@ -XXX,XX +XXX,XX @@
 
 static bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop)
 {
-    TCGv src1 = get_gpr(ctx, a->rs1, EXT_ZERO);
+    TCGv src1 = get_address(ctx, a->rs1, 0);
 
     if (a->rl) {
         tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
     }
-    src1 = gen_pm_adjust_address(ctx, src1);
     tcg_gen_qemu_ld_tl(load_val, src1, ctx->mem_idx, mop);
     if (a->aq) {
         tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
@@ -XXX,XX +XXX,XX @@ static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
     TCGLabel *l1 = gen_new_label();
     TCGLabel *l2 = gen_new_label();
 
-    src1 = get_gpr(ctx, a->rs1, EXT_ZERO);
-    src1 = gen_pm_adjust_address(ctx, src1);
+    src1 = get_address(ctx, a->rs1, 0);
     tcg_gen_brcond_tl(TCG_COND_NE, load_res, src1, l1);
 
     /*
@@ -XXX,XX +XXX,XX @@ static bool gen_amo(DisasContext *ctx, arg_atomic *a,
                     MemOp mop)
 {
     TCGv dest = dest_gpr(ctx, a->rd);
-    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
+    TCGv src1 = get_address(ctx, a->rs1, 0);
     TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
 
-    src1 = gen_pm_adjust_address(ctx, src1);
     func(dest, src1, src2, ctx->mem_idx, mop);
 
     gen_set_gpr(ctx, a->rd, dest);
diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvd.c.inc
+++ b/target/riscv/insn_trans/trans_rvd.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_fld(DisasContext *ctx, arg_fld *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
 
-    addr = get_gpr(ctx, a->rs1, EXT_NONE);
-    if (a->imm) {
-        TCGv temp = temp_new(ctx);
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
-    addr = gen_pm_adjust_address(ctx, addr);
-
+    addr = get_address(ctx, a->rs1, a->imm);
     tcg_gen_qemu_ld_i64(cpu_fpr[a->rd], addr, ctx->mem_idx, MO_TEUQ);
 
     mark_fs_dirty(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
 
-    addr = get_gpr(ctx, a->rs1, EXT_NONE);
-    if (a->imm) {
-        TCGv temp = temp_new(ctx);
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
-    addr = gen_pm_adjust_address(ctx, addr);
-
+    addr = get_address(ctx, a->rs1, a->imm);
     tcg_gen_qemu_st_i64(cpu_fpr[a->rs2], addr, ctx->mem_idx, MO_TEUQ);
-
     return true;
 }
 
diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvf.c.inc
+++ b/target/riscv/insn_trans/trans_rvf.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_flw(DisasContext *ctx, arg_flw *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
 
-    addr = get_gpr(ctx, a->rs1, EXT_NONE);
-    if (a->imm) {
-        TCGv temp = temp_new(ctx);
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
-    addr = gen_pm_adjust_address(ctx, addr);
-
+    addr = get_address(ctx, a->rs1, a->imm);
     dest = cpu_fpr[a->rd];
     tcg_gen_qemu_ld_i64(dest, addr, ctx->mem_idx, MO_TEUL);
     gen_nanbox_s(dest, dest);
@@ -XXX,XX +XXX,XX @@ static bool trans_fsw(DisasContext *ctx, arg_fsw *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
 
-    addr = get_gpr(ctx, a->rs1, EXT_NONE);
-    if (a->imm) {
-        TCGv temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
-    addr = gen_pm_adjust_address(ctx, addr);
-
+    addr = get_address(ctx, a->rs1, a->imm);
     tcg_gen_qemu_st_i64(cpu_fpr[a->rs2], addr, ctx->mem_idx, MO_TEUL);
-
     return true;
 }
 
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_bgeu(DisasContext *ctx, arg_bgeu *a)
 static bool gen_load_tl(DisasContext *ctx, arg_lb *a, MemOp memop)
 {
     TCGv dest = dest_gpr(ctx, a->rd);
-    TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
-
-    if (a->imm) {
-        TCGv temp = temp_new(ctx);
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
-    addr = gen_pm_adjust_address(ctx, addr);
+    TCGv addr = get_address(ctx, a->rs1, a->imm);
 
     tcg_gen_qemu_ld_tl(dest, addr, ctx->mem_idx, memop);
     gen_set_gpr(ctx, a->rd, dest);
@@ -XXX,XX +XXX,XX @@ static bool trans_ldu(DisasContext *ctx, arg_ldu *a)
 
 static bool gen_store_tl(DisasContext *ctx, arg_sb *a, MemOp memop)
 {
-    TCGv addr = get_gpr(ctx, a->rs1, EXT_NONE);
+    TCGv addr = get_address(ctx, a->rs1, a->imm);
     TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
 
-    if (a->imm) {
-        TCGv temp = temp_new(ctx);
-        tcg_gen_addi_tl(temp, addr, a->imm);
-        addr = temp;
-    }
-    addr = gen_pm_adjust_address(ctx, addr);
-
     tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, memop);
     return true;
 }
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Use cached cur_pmmask and cur_pmbase to infer the
current PM mode.

This may decrease the TCG IR by one when pm_enabled
is true and pm_base_enabled is false.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-15-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  3 ++-
 target/riscv/cpu_helper.c | 24 ++++++------------------
 target/riscv/translate.c  | 12 ++++++++----
 3 files changed, 16 insertions(+), 23 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, MSTATUS_HS_VS, 18, 2)
 /* The combination of MXL/SXL/UXL that applies to the current cpu mode. */
 FIELD(TB_FLAGS, XL, 20, 2)
 /* If PointerMasking should be applied */
-FIELD(TB_FLAGS, PM_ENABLED, 22, 1)
+FIELD(TB_FLAGS, PM_MASK_ENABLED, 22, 1)
+FIELD(TB_FLAGS, PM_BASE_ENABLED, 23, 1)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
         flags = FIELD_DP32(flags, TB_FLAGS, MSTATUS_HS_VS,
                            get_field(env->mstatus_hs, MSTATUS_VS));
     }
-    if (riscv_has_ext(env, RVJ)) {
-        int priv = flags & TB_FLAGS_PRIV_MMU_MASK;
-        bool pm_enabled = false;
-        switch (priv) {
-        case PRV_U:
-            pm_enabled = env->mmte & U_PM_ENABLE;
-            break;
-        case PRV_S:
-            pm_enabled = env->mmte & S_PM_ENABLE;
-            break;
-        case PRV_M:
-            pm_enabled = env->mmte & M_PM_ENABLE;
-            break;
-        default:
-            g_assert_not_reached();
-        }
-        flags = FIELD_DP32(flags, TB_FLAGS, PM_ENABLED, pm_enabled);
-    }
 #endif
 
     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
+    if (env->cur_pmmask < (env->xl == MXL_RV32 ? UINT32_MAX : UINT64_MAX)) {
+        flags = FIELD_DP32(flags, TB_FLAGS, PM_MASK_ENABLED, 1);
+    }
+    if (env->cur_pmbase != 0) {
+        flags = FIELD_DP32(flags, TB_FLAGS, PM_BASE_ENABLED, 1);
+    }
 
     *pflags = flags;
 }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     /* Space for 3 operands plus 1 extra for address computation. */
     TCGv temp[4];
     /* PointerMasking extension */
-    bool pm_enabled;
+    bool pm_mask_enabled;
+    bool pm_base_enabled;
 } DisasContext;
 
 static inline bool has_ext(DisasContext *ctx, uint32_t ext)
@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
     TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
 
     tcg_gen_addi_tl(addr, src1, imm);
-    if (ctx->pm_enabled) {
+    if (ctx->pm_mask_enabled) {
         tcg_gen_and_tl(addr, addr, pm_mask);
-        tcg_gen_or_tl(addr, addr, pm_base);
     } else if (get_xl(ctx) == MXL_RV32) {
         tcg_gen_ext32u_tl(addr, addr);
     }
+    if (ctx->pm_base_enabled) {
+        tcg_gen_or_tl(addr, addr, pm_base);
+    }
     return addr;
 }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->cs = cs;
     ctx->ntemp = 0;
     memset(ctx->temp, 0, sizeof(ctx->temp));
-    ctx->pm_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_ENABLED);
+    ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
+    ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
     ctx->zero = tcg_constant_tl(0);
 }
 
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

We need not specially process vtype when XLEN changes.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-16-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h           |  1 +
 target/riscv/cpu_helper.c    |  3 +--
 target/riscv/csr.c           | 13 ++++++++++++-
 target/riscv/machine.c       |  5 +++--
 target/riscv/vector_helper.c |  3 ++-
 5 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPURISCVState {
     target_ulong vl;
     target_ulong vstart;
     target_ulong vtype;
+    bool vill;
 
     target_ulong pc;
     target_ulong load_res;
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
         uint32_t maxsz = vlmax << sew;
         bool vl_eq_vlmax = (env->vstart == 0) && (vlmax == env->vl) &&
                            (maxsz >= 8);
-        flags = FIELD_DP32(flags, TB_FLAGS, VILL,
-                    FIELD_EX64(env->vtype, VTYPE, VILL));
+        flags = FIELD_DP32(flags, TB_FLAGS, VILL, env->vill);
         flags = FIELD_DP32(flags, TB_FLAGS, SEW, sew);
         flags = FIELD_DP32(flags, TB_FLAGS, LMUL,
                     FIELD_EX64(env->vtype, VTYPE, VLMUL));
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_fcsr(CPURISCVState *env, int csrno,
 static RISCVException read_vtype(CPURISCVState *env, int csrno,
                                  target_ulong *val)
 {
-    *val = env->vtype;
+    uint64_t vill;
+    switch (env->xl) {
+    case MXL_RV32:
+        vill = (uint32_t)env->vill << 31;
+        break;
+    case MXL_RV64:
+        vill = (uint64_t)env->vill << 63;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    *val = (target_ulong)vill | env->vtype;
     return RISCV_EXCP_NONE;
 }
 
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static bool vector_needed(void *opaque)
 
 static const VMStateDescription vmstate_vector = {
     .name = "cpu/vector",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .needed = vector_needed,
     .fields = (VMStateField[]) {
             VMSTATE_UINT64_ARRAY(env.vreg, RISCVCPU, 32 * RV_VLEN_MAX / 64),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_vector = {
             VMSTATE_UINTTL(env.vl, RISCVCPU),
             VMSTATE_UINTTL(env.vstart, RISCVCPU),
             VMSTATE_UINTTL(env.vtype, RISCVCPU),
+            VMSTATE_BOOL(env.vill, RISCVCPU),
             VMSTATE_END_OF_LIST()
         }
 };
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
         || (ediv != 0)
         || (reserved != 0)) {
         /* only set vill bit. */
-        env->vtype = FIELD_DP64(0, VTYPE, VILL, 1);
+        env->vill = 1;
+        env->vtype = 0;
         env->vl = 0;
         env->vstart = 0;
         return 0;
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL cpu_recompute_xl(CPURISCVState *env)
 }
 #endif
 
+static inline int riscv_cpu_xlen(CPURISCVState *env)
+{
+    return 16 << env->xl;
+}
+
 /*
  * Encode LMUL to lmul as follows:
  *     LMUL    vlmul    lmul
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
     uint64_t lmul = FIELD_EX64(s2, VTYPE, VLMUL);
     uint16_t sew = 8 << FIELD_EX64(s2, VTYPE, VSEW);
     uint8_t ediv = FIELD_EX64(s2, VTYPE, VEDIV);
-    bool vill = FIELD_EX64(s2, VTYPE, VILL);
-    target_ulong reserved = FIELD_EX64(s2, VTYPE, RESERVED);
+    int xlen = riscv_cpu_xlen(env);
+    bool vill = (s2 >> (xlen - 1)) & 0x1;
+    target_ulong reserved = s2 &
+                            MAKE_64BIT_MASK(R_VTYPE_RESERVED_SHIFT,
+                                            xlen - 1 - R_VTYPE_RESERVED_SHIFT);
 
     if (lmul & 4) {
         /* Fractional LMUL. */
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Only check the range that has passed the address translation.

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
                                          cpu_mmu_index(env, false));
                 if (host) {
 #ifdef CONFIG_USER_ONLY
-                    if (page_check_range(addr, nf << esz, PAGE_READ) < 0) {
+                    if (page_check_range(addr, offset, PAGE_READ) < 0) {
                         vl = i;
                         goto ProbeSuccess;
                     }
 #else
-                    probe_pages(env, addr, nf << esz, ra, MMU_DATA_LOAD);
+                    probe_pages(env, addr, offset, ra, MMU_DATA_LOAD);
 #endif
                 } else {
                     vl = i;
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

The mask comes from the pointer masking extension, or the max value
corresponding to XLEN bits.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220120122050.41546-20-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t esz)
     return scale < 0 ? vlenb >> -scale : vlenb << scale;
 }
 
+static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
+{
+    return (addr & env->cur_pmmask) | env->cur_pmbase;
+}
+
 /*
  * This function checks watchpoint before real load operation.
  *
@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
     target_ulong pagelen = -(addr | TARGET_PAGE_MASK);
     target_ulong curlen = MIN(pagelen, len);
 
-    probe_access(env, addr, curlen, access_type,
+    probe_access(env, adjust_addr(env, addr), curlen, access_type,
                  cpu_mmu_index(env, false), ra);
     if (len > curlen) {
         addr += curlen;
         curlen = len - curlen;
-        probe_access(env, addr, curlen, access_type,
+        probe_access(env, adjust_addr(env, addr), curlen, access_type,
                      cpu_mmu_index(env, false), ra);
     }
 }
@@ -XXX,XX +XXX,XX @@ vext_ldst_stride(void *vd, void *v0, target_ulong base,
         k = 0;
         while (k < nf) {
             target_ulong addr = base + stride * i + (k << esz);
-            ldst_elem(env, addr, i + k * max_elems, vd, ra);
+            ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
             k++;
         }
     }
@@ -XXX,XX +XXX,XX @@ vext_ldst_us(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
         k = 0;
         while (k < nf) {
             target_ulong addr = base + ((i * nf + k) << esz);
-            ldst_elem(env, addr, i + k * max_elems, vd, ra);
+            ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
             k++;
         }
     }
@@ -XXX,XX +XXX,XX @@ vext_ldst_index(void *vd, void *v0, target_ulong base,
         k = 0;
         while (k < nf) {
             abi_ptr addr = get_index_addr(base, i, vs2) + (k << esz);
-            ldst_elem(env, addr, i + k * max_elems, vd, ra);
+            ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
             k++;
         }
     }
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
         if (!vm && !vext_elem_mask(v0, i)) {
             continue;
         }
-        addr = base + i * (nf << esz);
+        addr = adjust_addr(env, base + i * (nf << esz));
         if (i == 0) {
             probe_pages(env, addr, nf << esz, ra, MMU_DATA_LOAD);
         } else {
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
                     break;
                 }
                 remain -= offset;
-                addr += offset;
+                addr = adjust_addr(env, addr + offset);
             }
         }
     }
@@ -XXX,XX +XXX,XX @@ ProbeSuccess:
         }
         while (k < nf) {
             target_ulong addr = base + ((i * nf + k) << esz);
-            ldst_elem(env, addr, i + k * max_elems, vd, ra);
+            ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
             k++;
         }
     }
@@ -XXX,XX +XXX,XX @@ vext_ldst_whole(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
         /* load/store rest of elements of current segment pointed by vstart */
         for (pos = off; pos < max_elems; pos++, env->vstart++) {
             target_ulong addr = base + ((pos + k * max_elems) << esz);
-            ldst_elem(env, addr, pos + k * max_elems, vd, ra);
+            ldst_elem(env, adjust_addr(env, addr), pos + k * max_elems, vd, ra);
         }
         k++;
     }
@@ -XXX,XX +XXX,XX @@ vext_ldst_whole(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
     for (; k < nf; k++) {
         for (i = 0; i < max_elems; i++, env->vstart++) {
             target_ulong addr = base + ((i + k * max_elems) << esz);
-            ldst_elem(env, addr, i + k * max_elems, vd, ra);
+            ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
         }
     }
 
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

When sew <= 32bits, not need to extend scalar reg.
When sew > 32bits, if xlen is less that sew, we should sign extend
the scalar register, except explicitly specified by the spec.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-21-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

When swap regs for hypervisor, the value of vsstatus or mstatus_hs
should have the right XLEN. Otherwise, it will propagate to mstatus.

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-22-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset(DeviceState *dev)
          */
         env->mstatus = set_field(env->mstatus, MSTATUS64_SXL, env->misa_mxl);
         env->mstatus = set_field(env->mstatus, MSTATUS64_UXL, env->misa_mxl);
+        if (riscv_has_ext(env, RVH)) {
+            env->vsstatus = set_field(env->vsstatus,
+                                      MSTATUS64_SXL, env->misa_mxl);
+            env->vsstatus = set_field(env->vsstatus,
+                                      MSTATUS64_UXL, env->misa_mxl);
+            env->mstatus_hs = set_field(env->mstatus_hs,
+                                        MSTATUS64_SXL, env->misa_mxl);
+            env->mstatus_hs = set_field(env->mstatus_hs,
+                                        MSTATUS64_UXL, env->misa_mxl);
+        }
     }
     env->mcause = 0;
     env->pc = env->resetvec;
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 #define COUNTEREN_IR         (1 << 2)
 #define COUNTEREN_HPM3       (1 << 3)
 
+/* vsstatus CSR bits */
+#define VSSTATUS64_UXL       0x0000000300000000ULL
+
 /* Privilege modes */
 #define PRV_U 0
 #define PRV_S 1
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
       (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)));
 static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
-    SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS | (target_ulong)SSTATUS64_UXL;
+    SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS;
 static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
 static const target_ulong hip_writable_mask = MIP_VSSIP;
 static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
 {
     uint64_t mstatus = env->mstatus;
     uint64_t mask = 0;
+    RISCVMXL xl = riscv_cpu_mxl(env);
 
     /* flush tlb on mstatus fields that affect VM */
     if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPP | MSTATUS_MPV |
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
         MSTATUS_TW | MSTATUS_VS;
 
-    if (riscv_cpu_mxl(env) != MXL_RV32) {
+    if (xl != MXL_RV32) {
         /*
          * RV32: MPV and GVA are not in mstatus. The current plan is to
          * add them to mstatush. For now, we just don't support it.
          */
         mask |= MSTATUS_MPV | MSTATUS_GVA;
+        if ((val & MSTATUS64_UXL) != 0) {
+            mask |= MSTATUS64_UXL;
+        }
     }
 
     mstatus = (mstatus & ~mask) | (val & mask);
 
-    RISCVMXL xl = riscv_cpu_mxl(env);
     if (xl > MXL_RV32) {
-        /* SXL and UXL fields are for now read only */
+        /* SXL field is for now read only */
         mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
-        mstatus = set_field(mstatus, MSTATUS64_UXL, xl);
     }
     env->mstatus = mstatus;
     env->xl = cpu_recompute_xl(env);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
 {
     uint64_t mask = sstatus_v1_10_mask;
     uint64_t sstatus = env->mstatus & mask;
+    if (env->xl != MXL_RV32) {
+        mask |= SSTATUS64_UXL;
+    }
 
     *val = int128_make128(sstatus, add_status_sd(MXL_RV128, sstatus));
     return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus(CPURISCVState *env, int csrno,
                                    target_ulong *val)
 {
     target_ulong mask = (sstatus_v1_10_mask);
-
+    if (env->xl != MXL_RV32) {
+        mask |= SSTATUS64_UXL;
+    }
     /* TODO: Use SXL not MXL. */
     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus & mask);
     return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_sstatus(CPURISCVState *env, int csrno,
                                     target_ulong val)
 {
     target_ulong mask = (sstatus_v1_10_mask);
+
+    if (env->xl != MXL_RV32) {
+        if ((val & SSTATUS64_UXL) != 0) {
+            mask |= SSTATUS64_UXL;
+        }
+    }
     target_ulong newval = (env->mstatus & ~mask) | (val & mask);
     return write_mstatus(env, CSR_MSTATUS, newval);
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
     uint64_t mask = (target_ulong)-1;
+    if ((val & VSSTATUS64_UXL) == 0) {
+        mask &= ~VSSTATUS64_UXL;
+    }
     env->vsstatus = (env->vsstatus & ~mask) | (uint64_t)val;
     return RISCV_EXCP_NONE;
 }
-- 
2.31.1

From: LIU Zhiwei <zhiwei_liu@c-sky.com>

Signed-off-by: LIU Zhiwei <zhiwei_liu@c-sky.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220120122050.41546-24-zhiwei_liu@c-sky.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
         MSTATUS_TW | MSTATUS_VS;
 
-    if (xl != MXL_RV32) {
+    if (xl != MXL_RV32 || env->debugger) {
         /*
          * RV32: MPV and GVA are not in mstatus. The current plan is to
          * add them to mstatush. For now, we just don't support it.
@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
 {
     uint64_t mask = sstatus_v1_10_mask;
     uint64_t sstatus = env->mstatus & mask;
-    if (env->xl != MXL_RV32) {
+    if (env->xl != MXL_RV32 || env->debugger) {
         mask |= SSTATUS64_UXL;
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException read_sstatus(CPURISCVState *env, int csrno,
                                    target_ulong *val)
 {
     target_ulong mask = (sstatus_v1_10_mask);
-    if (env->xl != MXL_RV32) {
+    if (env->xl != MXL_RV32 || env->debugger) {
         mask |= SSTATUS64_UXL;
     }
     /* TODO: Use SXL not MXL. */
@@ -XXX,XX +XXX,XX @@ static RISCVException write_sstatus(CPURISCVState *env, int csrno,
 {
     target_ulong mask = (sstatus_v1_10_mask);
 
-    if (env->xl != MXL_RV32) {
+    if (env->xl != MXL_RV32 || env->debugger) {
         if ((val & SSTATUS64_UXL) != 0) {
             mask |= SSTATUS64_UXL;
         }
-- 
2.31.1

The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:

Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230911

for you to fetch changes up to e7a03409f29e2da59297d55afbaec98c96e43e3a:

target/riscv: don't read CSR in riscv_csrrw_do64 (2023-09-11 11:45:55 +1000)

----------------------------------------------------------------
First RISC-V PR for 8.2

* Remove 'host' CPU from TCG
 * riscv_htif Fixup printing on big endian hosts
 * Add zmmul isa string
 * Add smepmp isa string
 * Fix page_check_range use in fault-only-first
 * Use existing lookup tables for MixColumns
 * Add RISC-V vector cryptographic instruction set support
 * Implement WARL behaviour for mcountinhibit/mcounteren
 * Add Zihintntl extension ISA string to DTS
 * Fix zfa fleq.d and fltq.d
 * Fix upper/lower mtime write calculation
 * Make rtc variable names consistent
 * Use abi type for linux-user target_ucontext
 * Add RISC-V KVM AIA Support
 * Fix riscv,pmu DT node path in the virt machine
 * Update CSR bits name for svadu extension
 * Mark zicond non-experimental
 * Fix satp_mode_finalize() when satp_mode.supported = 0
 * Fix non-KVM --enable-debug build
 * Add new extensions to hwprobe
 * Use accelerated helper for AES64KS1I
 * Allocate itrigger timers only once
 * Respect mseccfg.RLB for pmpaddrX changes
 * Align the AIA model to v1.0 ratified spec
 * Don't read the CSR in riscv_csrrw_do64

----------------------------------------------------------------
Akihiko Odaki (1):
      target/riscv: Allocate itrigger timers only once

Ard Biesheuvel (2):
      target/riscv: Use existing lookup tables for MixColumns
      target/riscv: Use accelerated helper for AES64KS1I

Conor Dooley (1):
      hw/riscv: virt: Fix riscv,pmu DT node path

Daniel Henrique Barboza (6):
      target/riscv/cpu.c: do not run 'host' CPU with TCG
      target/riscv/cpu.c: add zmmul isa string
      target/riscv/cpu.c: add smepmp isa string
      target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
      hw/riscv/virt.c: fix non-KVM --enable-debug build
      hw/intc/riscv_aplic.c fix non-KVM --enable-debug build

Dickon Hood (2):
      target/riscv: Refactor translation of vector-widening instruction
      target/riscv: Add Zvbb ISA extension support

Jason Chien (3):
      target/riscv: Add Zihintntl extension ISA string to DTS
      hw/intc: Fix upper/lower mtime write calculation
      hw/intc: Make rtc variable names consistent

Kiran Ostrolenk (4):
      target/riscv: Refactor some of the generic vector functionality
      target/riscv: Refactor vector-vector translation macro
      target/riscv: Refactor some of the generic vector functionality
      target/riscv: Add Zvknh ISA extension support

LIU Zhiwei (3):
      target/riscv: Fix page_check_range use in fault-only-first
      target/riscv: Fix zfa fleq.d and fltq.d
      linux-user/riscv: Use abi type for target_ucontext

Lawrence Hunter (2):
      target/riscv: Add Zvbc ISA extension support
      target/riscv: Add Zvksh ISA extension support

Leon Schuermann (1):
      target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes

Max Chou (3):
      crypto: Create sm4_subword
      crypto: Add SM4 constant parameter CK
      target/riscv: Add Zvksed ISA extension support

Nazar Kazakov (4):
      target/riscv: Remove redundant "cpu_vl == 0" checks
      target/riscv: Move vector translation checks
      target/riscv: Add Zvkned ISA extension support
      target/riscv: Add Zvkg ISA extension support

Nikita Shubin (1):
      target/riscv: don't read CSR in riscv_csrrw_do64

Rob Bradford (1):
      target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren

Robbin Ehn (1):
      linux-user/riscv: Add new extensions to hwprobe

Thomas Huth (2):
      hw/char/riscv_htif: Fix printing of console characters on big endian hosts
      hw/char/riscv_htif: Fix the console syscall on big endian hosts

Tommy Wu (1):
      target/riscv: Align the AIA model to v1.0 ratified spec

Vineet Gupta (1):
      riscv: zicond: make non-experimental

Weiwei Li (1):
      target/riscv: Update CSR bits name for svadu extension

Yong-Xuan Wang (5):
      target/riscv: support the AIA device emulation with KVM enabled
      target/riscv: check the in-kernel irqchip support
      target/riscv: Create an KVM AIA irqchip
      target/riscv: update APLIC and IMSIC to support KVM AIA
      target/riscv: select KVM AIA in riscv virt machine

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The 'host' CPU is available in a CONFIG_KVM build and it's currently
available for all accels, but is a KVM only CPU. This means that in a
RISC-V KVM capable host we can do things like this:

$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
qemu-system-riscv64: H extension requires priv spec 1.12.0

This CPU does not have a priv spec because we don't filter its extensions
via priv spec. We shouldn't be reaching riscv_cpu_realize_tcg() at all
with the 'host' CPU.

We don't have a way to filter the 'host' CPU out of the available CPU
options (-cpu help) if the build includes both KVM and TCG. What we can
do is to error out during riscv_cpu_realize_tcg() if the user chooses
the 'host' CPU with accel=tcg:

$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
qemu-system-riscv64: 'host' CPU is not compatible with TCG acceleration

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230721133411.474105-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
     CPURISCVState *env = &cpu->env;
     Error *local_err = NULL;
 
+    if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_CPU_HOST)) {
+        error_setg(errp, "'host' CPU is not compatible with TCG acceleration");
+        return;
+    }
+
     riscv_cpu_validate_misa_mxl(cpu, &local_err);
     if (local_err != NULL) {
         error_propagate(errp, local_err);
-- 
2.41.0

From: Thomas Huth <thuth@redhat.com>

The character that should be printed is stored in the 64 bit "payload"
variable. The code currently tries to print it by taking the address
of the variable and passing this pointer to qemu_chr_fe_write(). However,
this only works on little endian hosts where the least significant bits
are stored on the lowest address. To do this in a portable way, we have
to store the value in an uint8_t variable instead.

Fixes: 5033606780 ("RISC-V HTIF Console")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230721094720.902454-2-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             s->tohost = 0; /* clear to indicate we read */
             return;
         } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
-            qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1);
+            uint8_t ch = (uint8_t)payload;
+            qemu_chr_fe_write(&s->chr, &ch, 1);
             resp = 0x100 | (uint8_t)payload;
         } else {
             qemu_log("HTIF device %d: unknown command\n", device);
-- 
2.41.0

From: Thomas Huth <thuth@redhat.com>

Values that have been read via cpu_physical_memory_read() from the
guest's memory have to be swapped in case the host endianess differs
from the guest.

Fixes: a6e13e31d5 ("riscv_htif: Support console output via proxy syscall")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230721094720.902454-3-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
 #include "exec/address-spaces.h"
+#include "exec/tswap.h"
 #include "sysemu/dma.h"
 
 #define RISCV_DEBUG_HTIF 0
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             } else {
                 uint64_t syscall[8];
                 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
-                if (syscall[0] == PK_SYS_WRITE &&
-                    syscall[1] == HTIF_DEV_CONSOLE &&
-                    syscall[3] == HTIF_CONSOLE_CMD_PUTC) {
+                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
+                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
+                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
                     uint8_t ch;
-                    cpu_physical_memory_read(syscall[2], &ch, 1);
+                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
                     qemu_chr_fe_write(&s->chr, &ch, 1);
                     resp = 0x100 | (uint8_t)payload;
                 } else {
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

zmmul was promoted from experimental to ratified in commit 6d00ffad4e95.
Add a riscv,isa string for it.

Fixes: 6d00ffad4e95 ("target/riscv: move zmmul out of the experimental properties")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230720132424.371132-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
+    ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The cpu->cfg.epmp extension is still experimental, but it already has a
'smepmp' riscv,isa string. Add it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230720132424.371132-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
+    ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, epmp),
     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
-- 
2.41.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Commit bef6f008b98(accel/tcg: Return bool from page_check_range) converts
integer return value to bool type. However, it wrongly converted the use
of the API in riscv fault-only-first, where page_check_range < = 0, should
be converted to !page_check_range.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230729031618.821-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
                                          cpu_mmu_index(env, false));
                 if (host) {
 #ifdef CONFIG_USER_ONLY
-                    if (page_check_range(addr, offset, PAGE_READ)) {
+                    if (!page_check_range(addr, offset, PAGE_READ)) {
                         vl = i;
                         goto ProbeSuccess;
                     }
-- 
2.41.0

From: Ard Biesheuvel <ardb@kernel.org>

The AES MixColumns and InvMixColumns operations are relatively
expensive 4x4 matrix multiplications in GF(2^8), which is why C
implementations usually rely on precomputed lookup tables rather than
performing the calculations on demand.

Given that we already carry those tables in QEMU, we can just grab the
right value in the implementation of the RISC-V AES32 instructions. Note
that the tables in question are permuted according to the respective
Sbox, so we can omit the Sbox lookup as well in this case.

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Zewen Ye <lustrew@foxmail.com>
Cc: Weiwei Li <liweiwei@iscas.ac.cn>
Cc: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230731084043.1791984-1-ardb@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/aes.h         |  7 +++++++
 crypto/aes.c                 |  4 ++--
 target/riscv/crypto_helper.c | 34 ++++------------------------------
 3 files changed, 13 insertions(+), 32 deletions(-)

diff --git a/include/crypto/aes.h b/include/crypto/aes.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/aes.h
+++ b/include/crypto/aes.h
@@ -XXX,XX +XXX,XX @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
 extern const uint8_t AES_sbox[256];
 extern const uint8_t AES_isbox[256];
 
+/*
+AES_Te0[x] = S [x].[02, 01, 01, 03];
+AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
+*/
+
+extern const uint32_t AES_Te0[256], AES_Td0[256];
+
 #endif
diff --git a/crypto/aes.c b/crypto/aes.c
index XXXXXXX..XXXXXXX 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -XXX,XX +XXX,XX @@ AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
 AES_Td4[x] = Si[x].[01, 01, 01, 01];
 */
 
-static const uint32_t AES_Te0[256] = {
+const uint32_t AES_Te0[256] = {
     0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
     0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
     0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
@@ -XXX,XX +XXX,XX @@ static const uint32_t AES_Te4[256] = {
     0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
 };
 
-static const uint32_t AES_Td0[256] = {
+const uint32_t AES_Td0[256] = {
     0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
     0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
     0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "crypto/aes-round.h"
 #include "crypto/sm4.h"
 
-#define AES_XTIME(a) \
-    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
-
-#define AES_GFMUL(a, b) (( \
-    (((b) & 0x1) ? (a) : 0) ^ \
-    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
-    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
-    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
-
-static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
-{
-    uint32_t u;
-
-    if (fwd) {
-        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
-            (AES_GFMUL(x, 2) << 0);
-    } else {
-        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
-            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
-    }
-    return u;
-}
-
 #define sext32_xlen(x) (target_ulong)(int32_t)(x)
 
 static inline target_ulong aes32_operation(target_ulong shamt,
@@ -XXX,XX +XXX,XX @@ static inline target_ulong aes32_operation(target_ulong shamt,
                                            bool enc, bool mix)
 {
     uint8_t si = rs2 >> shamt;
-    uint8_t so;
     uint32_t mixed;
     target_ulong res;
 
     if (enc) {
-        so = AES_sbox[si];
         if (mix) {
-            mixed = aes_mixcolumn_byte(so, true);
+            mixed = be32_to_cpu(AES_Te0[si]);
         } else {
-            mixed = so;
+            mixed = AES_sbox[si];
         }
     } else {
-        so = AES_isbox[si];
         if (mix) {
-            mixed = aes_mixcolumn_byte(so, false);
+            mixed = be32_to_cpu(AES_Td0[si]);
         } else {
-            mixed = so;
+            mixed = AES_isbox[si];
         }
     }
     mixed = rol32(mixed, shamt);
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Take some functions/macros out of `vector_helper` and put them in a new
module called `vector_internals`. This ensures they can be used by both
vector and vector-crypto helpers (latter implemented in proceeding
commits).

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230711165917.2629866-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 182 +++++++++++++++++++++++++++++
 target/riscv/vector_helper.c    | 201 +-------------------------------
 target/riscv/vector_internals.c |  81 +++++++++++++
 target/riscv/meson.build        |   1 +
 4 files changed, 265 insertions(+), 200 deletions(-)
 create mode 100644 target/riscv/vector_internals.h
 create mode 100644 target/riscv/vector_internals.c

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Vector Extension Internals
+ *
+ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef TARGET_RISCV_VECTOR_INTERNALS_H
+#define TARGET_RISCV_VECTOR_INTERNALS_H
+
+#include "qemu/osdep.h"
+#include "qemu/bitops.h"
+#include "cpu.h"
+#include "tcg/tcg-gvec-desc.h"
+#include "internals.h"
+
+static inline uint32_t vext_nf(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, NF);
+}
+
+/*
+ * Note that vector data is stored in host-endian 64-bit chunks,
+ * so addressing units smaller than that needs a host-endian fixup.
+ */
+#if HOST_BIG_ENDIAN
+#define H1(x)   ((x) ^ 7)
+#define H1_2(x) ((x) ^ 6)
+#define H1_4(x) ((x) ^ 4)
+#define H2(x)   ((x) ^ 3)
+#define H4(x)   ((x) ^ 1)
+#define H8(x)   ((x))
+#else
+#define H1(x)   (x)
+#define H1_2(x) (x)
+#define H1_4(x) (x)
+#define H2(x)   (x)
+#define H4(x)   (x)
+#define H8(x)   (x)
+#endif
+
+/*
+ * Encode LMUL to lmul as following:
+ *     LMUL    vlmul    lmul
+ *      1       000       0
+ *      2       001       1
+ *      4       010       2
+ *      8       011       3
+ *      -       100       -
+ *     1/8      101      -3
+ *     1/4      110      -2
+ *     1/2      111      -1
+ */
+static inline int32_t vext_lmul(uint32_t desc)
+{
+    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
+}
+
+static inline uint32_t vext_vm(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VM);
+}
+
+static inline uint32_t vext_vma(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VMA);
+}
+
+static inline uint32_t vext_vta(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VTA);
+}
+
+static inline uint32_t vext_vta_all_1s(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
+}
+
+/*
+ * Earlier designs (pre-0.9) had a varying number of bits
+ * per mask value (MLEN). In the 0.9 design, MLEN=1.
+ * (Section 4.5)
+ */
+static inline int vext_elem_mask(void *v0, int index)
+{
+    int idx = index / 64;
+    int pos = index  % 64;
+    return (((uint64_t *)v0)[idx] >> pos) & 1;
+}
+
+/*
+ * Get number of total elements, including prestart, body and tail elements.
+ * Note that when LMUL < 1, the tail includes the elements past VLMAX that
+ * are held in the same vector register.
+ */
+static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
+                                            uint32_t esz)
+{
+    uint32_t vlenb = simd_maxsz(desc);
+    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
+    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
+                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
+    return (vlenb << emul) / esz;
+}
+
+/* set agnostic elements to 1s */
+void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+                       uint32_t tot);
+
+/* expand macro args before macro */
+#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
+
+/* (TD, T1, T2, TX1, TX2) */
+#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
+#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
+#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
+#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
+
+/* operation of two vector elements */
+typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
+
+#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
+static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
+{                                                               \
+    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
+    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
+}
+
+void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivv2_fn *fn, uint32_t esz);
+
+/* generate the helpers for OPIVV */
+#define GEN_VEXT_VV(NAME, ESZ)                            \
+void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
+{                                                         \
+    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
+               do_##NAME, ESZ);                           \
+}
+
+typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
+
+/*
+ * (T1)s1 gives the real operator type.
+ * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
+ */
+#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
+static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
+{                                                                   \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
+    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
+}
+
+void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivx2_fn fn, uint32_t esz);
+
+/* generate the helpers for OPIVX */
+#define GEN_VEXT_VX(NAME, ESZ)                            \
+void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
+{                                                         \
+    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
+               do_##NAME, ESZ);                           \
+}
+
+#endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "fpu/softfloat.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "internals.h"
+#include "vector_internals.h"
 #include <math.h>
 
 target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
     return vl;
 }
 
-/*
- * Note that vector data is stored in host-endian 64-bit chunks,
- * so addressing units smaller than that needs a host-endian fixup.
- */
-#if HOST_BIG_ENDIAN
-#define H1(x)   ((x) ^ 7)
-#define H1_2(x) ((x) ^ 6)
-#define H1_4(x) ((x) ^ 4)
-#define H2(x)   ((x) ^ 3)
-#define H4(x)   ((x) ^ 1)
-#define H8(x)   ((x))
-#else
-#define H1(x)   (x)
-#define H1_2(x) (x)
-#define H1_4(x) (x)
-#define H2(x)   (x)
-#define H4(x)   (x)
-#define H8(x)   (x)
-#endif
-
-static inline uint32_t vext_nf(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, NF);
-}
-
-static inline uint32_t vext_vm(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VM);
-}
-
-/*
- * Encode LMUL to lmul as following:
- *     LMUL    vlmul    lmul
- *      1       000       0
- *      2       001       1
- *      4       010       2
- *      8       011       3
- *      -       100       -
- *     1/8      101      -3
- *     1/4      110      -2
- *     1/2      111      -1
- */
-static inline int32_t vext_lmul(uint32_t desc)
-{
-    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
-}
-
-static inline uint32_t vext_vta(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VTA);
-}
-
-static inline uint32_t vext_vma(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VMA);
-}
-
-static inline uint32_t vext_vta_all_1s(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
-}
-
 /*
  * Get the maximum number of elements can be operated.
  *
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
     return scale < 0 ? vlenb >> -scale : vlenb << scale;
 }
 
-/*
- * Get number of total elements, including prestart, body and tail elements.
- * Note that when LMUL < 1, the tail includes the elements past VLMAX that
- * are held in the same vector register.
- */
-static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
-                                            uint32_t esz)
-{
-    uint32_t vlenb = simd_maxsz(desc);
-    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
-    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
-                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
-    return (vlenb << emul) / esz;
-}
-
 static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
 {
     return (addr & ~env->cur_pmmask) | env->cur_pmbase;
@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
     }
 }
 
-/* set agnostic elements to 1s */
-static void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
-                              uint32_t tot)
-{
-    if (is_agnostic == 0) {
-        /* policy undisturbed */
-        return;
-    }
-    if (tot - cnt == 0) {
-        return;
-    }
-    memset(base + cnt, -1, tot - cnt);
-}
-
 static inline void vext_set_elem_mask(void *v0, int index,
                                       uint8_t value)
 {
@@ -XXX,XX +XXX,XX @@ static inline void vext_set_elem_mask(void *v0, int index,
     ((uint64_t *)v0)[idx] = deposit64(old, pos, 1, value);
 }
 
-/*
- * Earlier designs (pre-0.9) had a varying number of bits
- * per mask value (MLEN). In the 0.9 design, MLEN=1.
- * (Section 4.5)
- */
-static inline int vext_elem_mask(void *v0, int index)
-{
-    int idx = index / 64;
-    int pos = index  % 64;
-    return (((uint64_t *)v0)[idx] >> pos) & 1;
-}
-
 /* elements operations for load and store */
 typedef void vext_ldst_elem_fn(CPURISCVState *env, abi_ptr addr,
                                uint32_t idx, void *vd, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
  * Vector Integer Arithmetic Instructions
  */
 
-/* expand macro args before macro */
-#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
-
 /* (TD, T1, T2, TX1, TX2) */
 #define OP_SSS_B int8_t, int8_t, int8_t, int8_t, int8_t
 #define OP_SSS_H int16_t, int16_t, int16_t, int16_t, int16_t
 #define OP_SSS_W int32_t, int32_t, int32_t, int32_t, int32_t
 #define OP_SSS_D int64_t, int64_t, int64_t, int64_t, int64_t
-#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
-#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
-#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
-#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 #define OP_SUS_B int8_t, uint8_t, int8_t, uint8_t, int8_t
 #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
 #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
 #define NOP_UUU_H uint16_t, uint16_t, uint32_t, uint16_t, uint32_t
 #define NOP_UUU_W uint32_t, uint32_t, uint64_t, uint32_t, uint64_t
 
-/* operation of two vector elements */
-typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
-
-#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
-static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
-{                                                               \
-    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
-    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
-}
 #define DO_SUB(N, M) (N - M)
 #define DO_RSUB(N, M) (M - N)
 
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vsub_vv_h, OP_SSS_H, H2, H2, H2, DO_SUB)
 RVVCALL(OPIVV2, vsub_vv_w, OP_SSS_W, H4, H4, H4, DO_SUB)
 RVVCALL(OPIVV2, vsub_vv_d, OP_SSS_D, H8, H8, H8, DO_SUB)
 
-static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
-                       CPURISCVState *env, uint32_t desc,
-                       opivv2_fn *fn, uint32_t esz)
-{
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-    uint32_t vta = vext_vta(desc);
-    uint32_t vma = vext_vma(desc);
-    uint32_t i;
-
-    for (i = env->vstart; i < vl; i++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            /* set masked-off elements to 1s */
-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-            continue;
-        }
-        fn(vd, vs1, vs2, i);
-    }
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-}
-
-/* generate the helpers for OPIVV */
-#define GEN_VEXT_VV(NAME, ESZ)                            \
-void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
-                  void *vs2, CPURISCVState *env,          \
-                  uint32_t desc)                          \
-{                                                         \
-    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
-               do_##NAME, ESZ);                           \
-}
-
 GEN_VEXT_VV(vadd_vv_b, 1)
 GEN_VEXT_VV(vadd_vv_h, 2)
 GEN_VEXT_VV(vadd_vv_w, 4)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV(vsub_vv_h, 2)
 GEN_VEXT_VV(vsub_vv_w, 4)
 GEN_VEXT_VV(vsub_vv_d, 8)
 
-typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
-
-/*
- * (T1)s1 gives the real operator type.
- * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
- */
-#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
-static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
-{                                                                   \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
-    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
-}
 
 RVVCALL(OPIVX2, vadd_vx_b, OP_SSS_B, H1, H1, DO_ADD)
 RVVCALL(OPIVX2, vadd_vx_h, OP_SSS_H, H2, H2, DO_ADD)
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vrsub_vx_h, OP_SSS_H, H2, H2, DO_RSUB)
 RVVCALL(OPIVX2, vrsub_vx_w, OP_SSS_W, H4, H4, DO_RSUB)
 RVVCALL(OPIVX2, vrsub_vx_d, OP_SSS_D, H8, H8, DO_RSUB)
 
-static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
-                       CPURISCVState *env, uint32_t desc,
-                       opivx2_fn fn, uint32_t esz)
-{
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-    uint32_t vta = vext_vta(desc);
-    uint32_t vma = vext_vma(desc);
-    uint32_t i;
-
-    for (i = env->vstart; i < vl; i++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            /* set masked-off elements to 1s */
-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-            continue;
-        }
-        fn(vd, s1, vs2, i);
-    }
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-}
-
-/* generate the helpers for OPIVX */
-#define GEN_VEXT_VX(NAME, ESZ)                            \
-void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
-                  void *vs2, CPURISCVState *env,          \
-                  uint32_t desc)                          \
-{                                                         \
-    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
-               do_##NAME, ESZ);                           \
-}
-
 GEN_VEXT_VX(vadd_vx_b, 1)
 GEN_VEXT_VX(vadd_vx_h, 2)
 GEN_VEXT_VX(vadd_vx_w, 4)
diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Vector Extension Internals
+ *
+ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "vector_internals.h"
+
+/* set agnostic elements to 1s */
+void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+                       uint32_t tot)
+{
+    if (is_agnostic == 0) {
+        /* policy undisturbed */
+        return;
+    }
+    if (tot - cnt == 0) {
+        return ;
+    }
+    memset(base + cnt, -1, tot - cnt);
+}
+
+void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivv2_fn *fn, uint32_t esz)
+{
+    uint32_t vm = vext_vm(desc);
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+    uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
+    uint32_t i;
+
+    for (i = env->vstart; i < vl; i++) {
+        if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+            continue;
+        }
+        fn(vd, vs1, vs2, i);
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+}
+
+void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivx2_fn fn, uint32_t esz)
+{
+    uint32_t vm = vext_vm(desc);
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+    uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
+    uint32_t i;
+
+    for (i = env->vstart; i < vl; i++) {
+        if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+            continue;
+        }
+        fn(vd, s1, vs2, i);
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
   'gdbstub.c',
   'op_helper.c',
   'vector_helper.c',
+  'vector_internals.c',
   'bitmanip_helper.c',
   'translate.c',
   'm128_helper.c',
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Refactor the non SEW-specific stuff out of `GEN_OPIVV_TRANS` into
function `opivv_trans` (similar to `opivi_trans`). `opivv_trans` will be
used in proceeding vector-crypto commits.

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 62 +++++++++++++------------
 1 file changed, 32 insertions(+), 30 deletions(-)

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

Remove the redundant "vl == 0" check which is already included within the  vstart >= vl check, when vl == 0.

Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230711165917.2629866-4-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 31 +------------------------
 1 file changed, 1 insertion(+), 30 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
         return false;
     }
 
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
     uint32_t data = 0;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
     uint32_t data = 0;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
     if (checkfn(s, a)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
     if (opiwv_widen_check(s, a)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
 {
     uint32_t data = 0;
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     data = FIELD_DP32(data, VDATA, VM, vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
             gen_helper_##NAME##_w,                                 \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
                 gen_helper_vmv_v_v_w, gen_helper_vmv_v_v_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
         vext_check_ss(s, a->rd, 0, 1)) {
         TCGv s1;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         s1 = get_gpr(s, a->rs1, EXT_SIGN);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
                 gen_helper_vmv_v_x_w, gen_helper_vmv_v_x_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             s1 = tcg_constant_i64(simm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     TCGv_i64 t1;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
         };                                                       \
         TCGLabel *over = gen_new_label();                        \
         gen_set_rm(s, RISCV_FRM_DYN);                            \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);        \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);\
                                                                  \
         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
         gen_set_rm_chkfrm(s, rm);
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
                 gen_helper_vmv_v_x_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
         uint32_t data = 0;                                         \
         gen_helper_gvec_4_ptr *fn = gen_helper_##NAME;             \
         TCGLabel *over = gen_new_label();                          \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
         require_vm(a->vm, a->rd)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_s_x(DisasContext *s, arg_vmv_s_x *a)
         TCGv s1;
         TCGLabel *over = gen_new_label();
 
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
         TCGv_i64 t1;
         TCGLabel *over = gen_new_label();
 
-        /* if vl == 0 or vstart >= vl, skip vector register write back */
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        /* if vstart >= vl, skip vector register write back */
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         /* NaN-box f[rs1] */
@@ -XXX,XX +XXX,XX @@ static bool int_ext_op(DisasContext *s, arg_rmr *a, uint8_t seq)
     uint32_t data = 0;
     gen_helper_gvec_3_ptr *fn;
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     static gen_helper_gvec_3_ptr * const fns[6][4] = {
-- 
2.41.0

From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>

This commit adds support for the Zvbc vector-crypto extension, which
consists of the following instructions:

* vclmulh.[vx,vv]
* vclmul.[vx,vv]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: Max Chou <max.chou@sifive.com>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
[max.chou@sifive.com: Exposed x-zvbc property]
Message-ID: <20230711165917.2629866-5-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |  1 +
 target/riscv/helper.h                    |  6 +++
 target/riscv/insn32.decode               |  6 +++
 target/riscv/cpu.c                       |  9 ++++
 target/riscv/translate.c                 |  1 +
 target/riscv/vcrypto_helper.c            | 59 ++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 62 ++++++++++++++++++++++++
 target/riscv/meson.build                 |  3 +-
 8 files changed, 146 insertions(+), 1 deletion(-)
 create mode 100644 target/riscv/vcrypto_helper.c
 create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

Move the checks out of `do_opiv{v,x,i}_gvec{,_shift}` functions
and into the corresponding macros. This enables the functions to be
reused in proceeding commits without check duplication.

Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-6-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 28 +++++++++++--------------
 1 file changed, 12 insertions(+), 16 deletions(-)

From: Dickon Hood <dickon.hood@codethink.co.uk>

Zvbb (implemented in later commit) has a widening instruction, which
requires an extra check on the enabled extensions.  Refactor
GEN_OPIVX_WIDEN_TRANS() to take a check function to avoid reimplementing
it.

Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-7-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 52 +++++++++++--------------
 1 file changed, 23 insertions(+), 29 deletions(-)

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Move some macros out of `vector_helper` and into `vector_internals`.
This ensures they can be used by both vector and vector-crypto helpers
(latter implemented in proceeding commits).

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-8-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 46 +++++++++++++++++++++++++++++++++
 target/riscv/vector_helper.c    | 42 ------------------------------
 2 files changed, 46 insertions(+), 42 deletions(-)

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_internals.h
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 /* expand macro args before macro */
 #define RVVCALL(macro, ...)  macro(__VA_ARGS__)
 
+/* (TD, T2, TX2) */
+#define OP_UU_B uint8_t, uint8_t, uint8_t
+#define OP_UU_H uint16_t, uint16_t, uint16_t
+#define OP_UU_W uint32_t, uint32_t, uint32_t
+#define OP_UU_D uint64_t, uint64_t, uint64_t
+
 /* (TD, T1, T2, TX1, TX2) */
 #define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
 #define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
 #define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
 #define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 
+#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
+static void do_##NAME(void *vd, void *vs2, int i)      \
+{                                                      \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
+    *((TD *)vd + HD(i)) = OP(s2);                      \
+}
+
+#define GEN_VEXT_V(NAME, ESZ)                          \
+void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
+                  CPURISCVState *env, uint32_t desc)   \
+{                                                      \
+    uint32_t vm = vext_vm(desc);                       \
+    uint32_t vl = env->vl;                             \
+    uint32_t total_elems =                             \
+        vext_get_total_elems(env, desc, ESZ);          \
+    uint32_t vta = vext_vta(desc);                     \
+    uint32_t vma = vext_vma(desc);                     \
+    uint32_t i;                                        \
+                                                       \
+    for (i = env->vstart; i < vl; i++) {               \
+        if (!vm && !vext_elem_mask(v0, i)) {           \
+            /* set masked-off elements to 1s */        \
+            vext_set_elems_1s(vd, vma, i * ESZ,        \
+                              (i + 1) * ESZ);          \
+            continue;                                  \
+        }                                              \
+        do_##NAME(vd, vs2, i);                         \
+    }                                                  \
+    env->vstart = 0;                                   \
+    /* set tail elements to 1s */                      \
+    vext_set_elems_1s(vd, vta, vl * ESZ,               \
+                      total_elems * ESZ);              \
+}
+
 /* operation of two vector elements */
 typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
 
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
                do_##NAME, ESZ);                           \
 }
 
+/* Three of the widening shortening macros: */
+/* (TD, T1, T2, TX1, TX2) */
+#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
+#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
+#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
+
 #endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
 #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
 #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
 #define OP_SUS_D int64_t, uint64_t, int64_t, uint64_t, int64_t
-#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
-#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
-#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
 #define WOP_SSS_B int16_t, int8_t, int8_t, int16_t, int16_t
 #define WOP_SSS_H int32_t, int16_t, int16_t, int32_t, int32_t
 #define WOP_SSS_W int64_t, int32_t, int32_t, int64_t, int64_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_h, 4)
 GEN_VEXT_VF(vfwnmsac_vf_w, 8)
 
 /* Vector Floating-Point Square-Root Instruction */
-/* (TD, T2, TX2) */
-#define OP_UU_H uint16_t, uint16_t, uint16_t
-#define OP_UU_W uint32_t, uint32_t, uint32_t
-#define OP_UU_D uint64_t, uint64_t, uint64_t
-
 #define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 static void do_##NAME(void *vd, void *vs2, int i,      \
                       CPURISCVState *env)              \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
 GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
 
 /* Vector Floating-Point Classify Instruction */
-#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
-static void do_##NAME(void *vd, void *vs2, int i)      \
-{                                                      \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
-    *((TD *)vd + HD(i)) = OP(s2);                      \
-}
-
-#define GEN_VEXT_V(NAME, ESZ)                          \
-void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-                  CPURISCVState *env, uint32_t desc)   \
-{                                                      \
-    uint32_t vm = vext_vm(desc);                       \
-    uint32_t vl = env->vl;                             \
-    uint32_t total_elems =                             \
-        vext_get_total_elems(env, desc, ESZ);          \
-    uint32_t vta = vext_vta(desc);                     \
-    uint32_t vma = vext_vma(desc);                     \
-    uint32_t i;                                        \
-                                                       \
-    for (i = env->vstart; i < vl; i++) {               \
-        if (!vm && !vext_elem_mask(v0, i)) {           \
-            /* set masked-off elements to 1s */        \
-            vext_set_elems_1s(vd, vma, i * ESZ,        \
-                              (i + 1) * ESZ);          \
-            continue;                                  \
-        }                                              \
-        do_##NAME(vd, vs2, i);                         \
-    }                                                  \
-    env->vstart = 0;                                   \
-    /* set tail elements to 1s */                      \
-    vext_set_elems_1s(vd, vta, vl * ESZ,               \
-                      total_elems * ESZ);              \
-}
-
 target_ulong fclass_h(uint64_t frs1)
 {
     float16 f = frs1;
-- 
2.41.0

From: Dickon Hood <dickon.hood@codethink.co.uk>

This commit adds support for the Zvbb vector-crypto extension, which
consists of the following instructions:

* vrol.[vv,vx]
* vror.[vv,vx,vi]
* vbrev8.v
* vrev8.v
* vandn.[vv,vx]
* vbrev.v
* vclz.v
* vctz.v
* vcpop.v
* vwsll.[vv,vx,vi]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
[max.chou@sifive.com: Fix imm mode of vror.vi]
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvbb property]
Message-ID: <20230711165917.2629866-9-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |  62 +++++++++
 target/riscv/insn32.decode               |  20 +++
 target/riscv/cpu.c                       |  12 ++
 target/riscv/vcrypto_helper.c            | 138 +++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 164 +++++++++++++++++++++++
 6 files changed, 397 insertions(+)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve32f;
     bool ext_zve64f;
     bool ext_zve64d;
+    bool ext_zvbb;
     bool ext_zvbc;
     bool ext_zmmul;
     bool ext_zvfbfmin;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vror_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vror_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vrol_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vrol_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_5(vrev8_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_d, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_5(vclz_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_d, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vwsll_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vandn_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 %imm_u    12:s20                 !function=ex_shift_12
 %imm_bs   30:2                   !function=ex_shift_3
 %imm_rnum 20:4
+%imm_z6   26:1 15:5
 
 # Argument sets:
 &empty
@@ -XXX,XX +XXX,XX @@
 @r_vm    ...... vm:1 ..... ..... ... ..... ....... &rmrr %rs2 %rs1 %rd
 @r_vm_1  ...... . ..... ..... ... ..... .......    &rmrr vm=1 %rs2 %rs1 %rd
 @r_vm_0  ...... . ..... ..... ... ..... .......    &rmrr vm=0 %rs2 %rs1 %rd
+@r2_zimm6  ..... . vm:1 ..... ..... ... ..... .......  &rmrr %rs2 rs1=%imm_z6 %rd
 @r2_zimm11 . zimm:11  ..... ... ..... ....... %rs1 %rd
 @r2_zimm10 .. zimm:10  ..... ... ..... ....... %rs1 %rd
 @r2_s    .......   ..... ..... ... ..... ....... %rs2 %rs1
@@ -XXX,XX +XXX,XX @@ vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
 vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
 vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
 vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
+
+# *** Zvbb vector crypto extension ***
+vrol_vv     010101 . ..... ..... 000 ..... 1010111 @r_vm
+vrol_vx     010101 . ..... ..... 100 ..... 1010111 @r_vm
+vror_vv     010100 . ..... ..... 000 ..... 1010111 @r_vm
+vror_vx     010100 . ..... ..... 100 ..... 1010111 @r_vm
+vror_vi     01010. . ..... ..... 011 ..... 1010111 @r2_zimm6
+vbrev8_v    010010 . ..... 01000 010 ..... 1010111 @r2_vm
+vrev8_v     010010 . ..... 01001 010 ..... 1010111 @r2_vm
+vandn_vv    000001 . ..... ..... 000 ..... 1010111 @r_vm
+vandn_vx    000001 . ..... ..... 100 ..... 1010111 @r_vm
+vbrev_v     010010 . ..... 01010 010 ..... 1010111 @r2_vm
+vclz_v      010010 . ..... 01100 010 ..... 1010111 @r2_vm
+vctz_v      010010 . ..... 01101 010 ..... 1010111 @r2_vm
+vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
+vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
+vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
+vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
     ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
     ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
+    ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    /*
+     * In principle Zve*x would also suffice here, were they supported
+     * in qemu
+     */
+    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
+        error_setg(errp,
+                   "Vector crypto extensions require V or Zve* extensions");
+        return;
+    }
+
     if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
         error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
         return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
 
     /* Vector cryptography extensions */
+    DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 
     DEFINE_PROP_END_OF_LIST(),
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
 #include "qemu/bitops.h"
+#include "qemu/bswap.h"
 #include "cpu.h"
 #include "exec/memop.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
 GEN_VEXT_VV(vclmulh_vv, 8)
 RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
 GEN_VEXT_VX(vclmulh_vx, 8)
+
+RVVCALL(OPIVV2, vror_vv_b, OP_UUU_B, H1, H1, H1, ror8)
+RVVCALL(OPIVV2, vror_vv_h, OP_UUU_H, H2, H2, H2, ror16)
+RVVCALL(OPIVV2, vror_vv_w, OP_UUU_W, H4, H4, H4, ror32)
+RVVCALL(OPIVV2, vror_vv_d, OP_UUU_D, H8, H8, H8, ror64)
+GEN_VEXT_VV(vror_vv_b, 1)
+GEN_VEXT_VV(vror_vv_h, 2)
+GEN_VEXT_VV(vror_vv_w, 4)
+GEN_VEXT_VV(vror_vv_d, 8)
+
+RVVCALL(OPIVX2, vror_vx_b, OP_UUU_B, H1, H1, ror8)
+RVVCALL(OPIVX2, vror_vx_h, OP_UUU_H, H2, H2, ror16)
+RVVCALL(OPIVX2, vror_vx_w, OP_UUU_W, H4, H4, ror32)
+RVVCALL(OPIVX2, vror_vx_d, OP_UUU_D, H8, H8, ror64)
+GEN_VEXT_VX(vror_vx_b, 1)
+GEN_VEXT_VX(vror_vx_h, 2)
+GEN_VEXT_VX(vror_vx_w, 4)
+GEN_VEXT_VX(vror_vx_d, 8)
+
+RVVCALL(OPIVV2, vrol_vv_b, OP_UUU_B, H1, H1, H1, rol8)
+RVVCALL(OPIVV2, vrol_vv_h, OP_UUU_H, H2, H2, H2, rol16)
+RVVCALL(OPIVV2, vrol_vv_w, OP_UUU_W, H4, H4, H4, rol32)
+RVVCALL(OPIVV2, vrol_vv_d, OP_UUU_D, H8, H8, H8, rol64)
+GEN_VEXT_VV(vrol_vv_b, 1)
+GEN_VEXT_VV(vrol_vv_h, 2)
+GEN_VEXT_VV(vrol_vv_w, 4)
+GEN_VEXT_VV(vrol_vv_d, 8)
+
+RVVCALL(OPIVX2, vrol_vx_b, OP_UUU_B, H1, H1, rol8)
+RVVCALL(OPIVX2, vrol_vx_h, OP_UUU_H, H2, H2, rol16)
+RVVCALL(OPIVX2, vrol_vx_w, OP_UUU_W, H4, H4, rol32)
+RVVCALL(OPIVX2, vrol_vx_d, OP_UUU_D, H8, H8, rol64)
+GEN_VEXT_VX(vrol_vx_b, 1)
+GEN_VEXT_VX(vrol_vx_h, 2)
+GEN_VEXT_VX(vrol_vx_w, 4)
+GEN_VEXT_VX(vrol_vx_d, 8)
+
+static uint64_t brev8(uint64_t val)
+{
+    val = ((val & 0x5555555555555555ull) << 1) |
+          ((val & 0xAAAAAAAAAAAAAAAAull) >> 1);
+    val = ((val & 0x3333333333333333ull) << 2) |
+          ((val & 0xCCCCCCCCCCCCCCCCull) >> 2);
+    val = ((val & 0x0F0F0F0F0F0F0F0Full) << 4) |
+          ((val & 0xF0F0F0F0F0F0F0F0ull) >> 4);
+
+    return val;
+}
+
+RVVCALL(OPIVV1, vbrev8_v_b, OP_UU_B, H1, H1, brev8)
+RVVCALL(OPIVV1, vbrev8_v_h, OP_UU_H, H2, H2, brev8)
+RVVCALL(OPIVV1, vbrev8_v_w, OP_UU_W, H4, H4, brev8)
+RVVCALL(OPIVV1, vbrev8_v_d, OP_UU_D, H8, H8, brev8)
+GEN_VEXT_V(vbrev8_v_b, 1)
+GEN_VEXT_V(vbrev8_v_h, 2)
+GEN_VEXT_V(vbrev8_v_w, 4)
+GEN_VEXT_V(vbrev8_v_d, 8)
+
+#define DO_IDENTITY(a) (a)
+RVVCALL(OPIVV1, vrev8_v_b, OP_UU_B, H1, H1, DO_IDENTITY)
+RVVCALL(OPIVV1, vrev8_v_h, OP_UU_H, H2, H2, bswap16)
+RVVCALL(OPIVV1, vrev8_v_w, OP_UU_W, H4, H4, bswap32)
+RVVCALL(OPIVV1, vrev8_v_d, OP_UU_D, H8, H8, bswap64)
+GEN_VEXT_V(vrev8_v_b, 1)
+GEN_VEXT_V(vrev8_v_h, 2)
+GEN_VEXT_V(vrev8_v_w, 4)
+GEN_VEXT_V(vrev8_v_d, 8)
+
+#define DO_ANDN(a, b) ((a) & ~(b))
+RVVCALL(OPIVV2, vandn_vv_b, OP_UUU_B, H1, H1, H1, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_h, OP_UUU_H, H2, H2, H2, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_w, OP_UUU_W, H4, H4, H4, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_d, OP_UUU_D, H8, H8, H8, DO_ANDN)
+GEN_VEXT_VV(vandn_vv_b, 1)
+GEN_VEXT_VV(vandn_vv_h, 2)
+GEN_VEXT_VV(vandn_vv_w, 4)
+GEN_VEXT_VV(vandn_vv_d, 8)
+
+RVVCALL(OPIVX2, vandn_vx_b, OP_UUU_B, H1, H1, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_h, OP_UUU_H, H2, H2, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_w, OP_UUU_W, H4, H4, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_d, OP_UUU_D, H8, H8, DO_ANDN)
+GEN_VEXT_VX(vandn_vx_b, 1)
+GEN_VEXT_VX(vandn_vx_h, 2)
+GEN_VEXT_VX(vandn_vx_w, 4)
+GEN_VEXT_VX(vandn_vx_d, 8)
+
+RVVCALL(OPIVV1, vbrev_v_b, OP_UU_B, H1, H1, revbit8)
+RVVCALL(OPIVV1, vbrev_v_h, OP_UU_H, H2, H2, revbit16)
+RVVCALL(OPIVV1, vbrev_v_w, OP_UU_W, H4, H4, revbit32)
+RVVCALL(OPIVV1, vbrev_v_d, OP_UU_D, H8, H8, revbit64)
+GEN_VEXT_V(vbrev_v_b, 1)
+GEN_VEXT_V(vbrev_v_h, 2)
+GEN_VEXT_V(vbrev_v_w, 4)
+GEN_VEXT_V(vbrev_v_d, 8)
+
+RVVCALL(OPIVV1, vclz_v_b, OP_UU_B, H1, H1, clz8)
+RVVCALL(OPIVV1, vclz_v_h, OP_UU_H, H2, H2, clz16)
+RVVCALL(OPIVV1, vclz_v_w, OP_UU_W, H4, H4, clz32)
+RVVCALL(OPIVV1, vclz_v_d, OP_UU_D, H8, H8, clz64)
+GEN_VEXT_V(vclz_v_b, 1)
+GEN_VEXT_V(vclz_v_h, 2)
+GEN_VEXT_V(vclz_v_w, 4)
+GEN_VEXT_V(vclz_v_d, 8)
+
+RVVCALL(OPIVV1, vctz_v_b, OP_UU_B, H1, H1, ctz8)
+RVVCALL(OPIVV1, vctz_v_h, OP_UU_H, H2, H2, ctz16)
+RVVCALL(OPIVV1, vctz_v_w, OP_UU_W, H4, H4, ctz32)
+RVVCALL(OPIVV1, vctz_v_d, OP_UU_D, H8, H8, ctz64)
+GEN_VEXT_V(vctz_v_b, 1)
+GEN_VEXT_V(vctz_v_h, 2)
+GEN_VEXT_V(vctz_v_w, 4)
+GEN_VEXT_V(vctz_v_d, 8)
+
+RVVCALL(OPIVV1, vcpop_v_b, OP_UU_B, H1, H1, ctpop8)
+RVVCALL(OPIVV1, vcpop_v_h, OP_UU_H, H2, H2, ctpop16)
+RVVCALL(OPIVV1, vcpop_v_w, OP_UU_W, H4, H4, ctpop32)
+RVVCALL(OPIVV1, vcpop_v_d, OP_UU_D, H8, H8, ctpop64)
+GEN_VEXT_V(vcpop_v_b, 1)
+GEN_VEXT_V(vcpop_v_h, 2)
+GEN_VEXT_V(vcpop_v_w, 4)
+GEN_VEXT_V(vcpop_v_d, 8)
+
+#define DO_SLL(N, M) (N << (M & (sizeof(N) * 8 - 1)))
+RVVCALL(OPIVV2, vwsll_vv_b, WOP_UUU_B, H2, H1, H1, DO_SLL)
+RVVCALL(OPIVV2, vwsll_vv_h, WOP_UUU_H, H4, H2, H2, DO_SLL)
+RVVCALL(OPIVV2, vwsll_vv_w, WOP_UUU_W, H8, H4, H4, DO_SLL)
+GEN_VEXT_VV(vwsll_vv_b, 2)
+GEN_VEXT_VV(vwsll_vv_h, 4)
+GEN_VEXT_VV(vwsll_vv_w, 8)
+
+RVVCALL(OPIVX2, vwsll_vx_b, WOP_UUU_B, H2, H1, DO_SLL)
+RVVCALL(OPIVX2, vwsll_vx_h, WOP_UUU_H, H4, H2, DO_SLL)
+RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
+GEN_VEXT_VX(vwsll_vx_b, 2)
+GEN_VEXT_VX(vwsll_vx_h, 4)
+GEN_VEXT_VX(vwsll_vx_w, 8)
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
 
 GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
 GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
+
+/*
+ * Zvbb
+ */
+
+#define GEN_OPIVI_GVEC_TRANS_CHECK(NAME, IMM_MODE, OPIVX, SUF, CHECK)   \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)              \
+    {                                                                   \
+        if (CHECK(s, a)) {                                              \
+            static gen_helper_opivx *const fns[4] = {                   \
+                gen_helper_##OPIVX##_b,                                 \
+                gen_helper_##OPIVX##_h,                                 \
+                gen_helper_##OPIVX##_w,                                 \
+                gen_helper_##OPIVX##_d,                                 \
+            };                                                          \
+            return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew], \
+                                 IMM_MODE);                             \
+        }                                                               \
+        return false;                                                   \
+    }
+
+#define GEN_OPIVV_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
+    {                                                                    \
+        if (CHECK(s, a)) {                                               \
+            static gen_helper_gvec_4_ptr *const fns[4] = {               \
+                gen_helper_##NAME##_b,                                   \
+                gen_helper_##NAME##_h,                                   \
+                gen_helper_##NAME##_w,                                   \
+                gen_helper_##NAME##_d,                                   \
+            };                                                           \
+            return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
+        }                                                                \
+        return false;                                                    \
+    }
+
+#define GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(NAME, SUF, CHECK)       \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
+    {                                                            \
+        if (CHECK(s, a)) {                                       \
+            static gen_helper_opivx *const fns[4] = {            \
+                gen_helper_##NAME##_b,                           \
+                gen_helper_##NAME##_h,                           \
+                gen_helper_##NAME##_w,                           \
+                gen_helper_##NAME##_d,                           \
+            };                                                   \
+            return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, \
+                                       fns[s->sew]);             \
+        }                                                        \
+        return false;                                            \
+    }
+
+static bool zvbb_vv_check(DisasContext *s, arg_rmrr *a)
+{
+    return opivv_check(s, a) && s->cfg_ptr->ext_zvbb == true;
+}
+
+static bool zvbb_vx_check(DisasContext *s, arg_rmrr *a)
+{
+    return opivx_check(s, a) && s->cfg_ptr->ext_zvbb == true;
+}
+
+/* vrol.v[vx] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vrol_vv, rotlv, zvbb_vv_check)
+GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vrol_vx, rotls, zvbb_vx_check)
+
+/* vror.v[vxi] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vror_vv, rotrv, zvbb_vv_check)
+GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vror_vx, rotrs, zvbb_vx_check)
+GEN_OPIVI_GVEC_TRANS_CHECK(vror_vi, IMM_TRUNC_SEW, vror_vx, rotri, zvbb_vx_check)
+
+#define GEN_OPIVX_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
+    {                                                                    \
+        if (CHECK(s, a)) {                                               \
+            static gen_helper_opivx *const fns[4] = {                    \
+                gen_helper_##NAME##_b,                                   \
+                gen_helper_##NAME##_h,                                   \
+                gen_helper_##NAME##_w,                                   \
+                gen_helper_##NAME##_d,                                   \
+            };                                                           \
+            return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
+        }                                                                \
+        return false;                                                    \
+    }
+
+/* vandn.v[vx] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vandn_vv, andc, zvbb_vv_check)
+GEN_OPIVX_GVEC_TRANS_CHECK(vandn_vx, andcs, zvbb_vx_check)
+
+#define GEN_OPIV_TRANS(NAME, CHECK)                                        \
+    static bool trans_##NAME(DisasContext *s, arg_rmr *a)                  \
+    {                                                                      \
+        if (CHECK(s, a)) {                                                 \
+            uint32_t data = 0;                                             \
+            static gen_helper_gvec_3_ptr *const fns[4] = {                 \
+                gen_helper_##NAME##_b,                                     \
+                gen_helper_##NAME##_h,                                     \
+                gen_helper_##NAME##_w,                                     \
+                gen_helper_##NAME##_d,                                     \
+            };                                                             \
+            TCGLabel *over = gen_new_label();                              \
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);     \
+                                                                           \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                     \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                 \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                   \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s); \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                   \
+            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),         \
+                               vreg_ofs(s, a->rs2), cpu_env,               \
+                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, \
+                               data, fns[s->sew]);                         \
+            mark_vs_dirty(s);                                              \
+            gen_set_label(over);                                           \
+            return true;                                                   \
+        }                                                                  \
+        return false;                                                      \
+    }
+
+static bool zvbb_opiv_check(DisasContext *s, arg_rmr *a)
+{
+    return s->cfg_ptr->ext_zvbb == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           vext_check_ss(s, a->rd, a->rs2, a->vm);
+}
+
+GEN_OPIV_TRANS(vbrev8_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vrev8_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vbrev_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vclz_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vctz_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vcpop_v, zvbb_opiv_check)
+
+static bool vwsll_vv_check(DisasContext *s, arg_rmrr *a)
+{
+    return s->cfg_ptr->ext_zvbb && opivv_widen_check(s, a);
+}
+
+static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
+{
+    return s->cfg_ptr->ext_zvbb && opivx_widen_check(s, a);
+}
+
+/* OPIVI without GVEC IR */
+#define GEN_OPIVI_WIDEN_TRANS(NAME, IMM_MODE, OPIVX, CHECK)                  \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
+    {                                                                        \
+        if (CHECK(s, a)) {                                                   \
+            static gen_helper_opivx *const fns[3] = {                        \
+                gen_helper_##OPIVX##_b,                                      \
+                gen_helper_##OPIVX##_h,                                      \
+                gen_helper_##OPIVX##_w,                                      \
+            };                                                               \
+            return opivi_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s, \
+                               IMM_MODE);                                    \
+        }                                                                    \
+        return false;                                                        \
+    }
+
+GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
+GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
+GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
-- 
2.41.0

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

This commit adds support for the Zvkned vector-crypto extension, which
consists of the following instructions:

* vaesef.[vv,vs]
* vaesdf.[vv,vs]
* vaesdm.[vv,vs]
* vaesz.vs
* vaesem.[vv,vs]
* vaeskf1.vi
* vaeskf2.vi

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Imported aes-round.h and exposed x-zvkned
property]
[max.chou@sifive.com: Fixed endian issues and replaced the vstart & vl
egs checking by helper function]
[max.chou@sifive.com: Replaced bswap32 calls in aes key expanding]
Message-ID: <20230711165917.2629866-10-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |  14 ++
 target/riscv/insn32.decode               |  14 ++
 target/riscv/cpu.c                       |   4 +-
 target/riscv/vcrypto_helper.c            | 202 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 147 +++++++++++++++++
 6 files changed, 381 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve64d;
     bool ext_zvbb;
     bool ext_zvbc;
+    bool ext_zvkned;
     bool ext_zmmul;
     bool ext_zvfbfmin;
     bool ext_zvfbfwma;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_2(egs_check, void, i32, env)
+
+DEF_HELPER_4(vaesef_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesef_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdf_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdf_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesem_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesem_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdm_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
+DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
 @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
 @r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
+@r2_vm_1 ...... . ..... ..... ... ..... ....... &rmr vm=1 %rs2 %rd
 @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
 @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
 @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
@@ -XXX,XX +XXX,XX @@ vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
 vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
 vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
 vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
+
+# *** Zvkned vector crypto extension ***
+vaesef_vv   101000 1 ..... 00011 010 ..... 1110111 @r2_vm_1
+vaesef_vs   101001 1 ..... 00011 010 ..... 1110111 @r2_vm_1
+vaesdf_vv   101000 1 ..... 00001 010 ..... 1110111 @r2_vm_1
+vaesdf_vs   101001 1 ..... 00001 010 ..... 1110111 @r2_vm_1
+vaesem_vv   101000 1 ..... 00010 010 ..... 1110111 @r2_vm_1
+vaesem_vs   101001 1 ..... 00010 010 ..... 1110111 @r2_vm_1
+vaesdm_vv   101000 1 ..... 00000 010 ..... 1110111 @r2_vm_1
+vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
+vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
+vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
+    ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      * In principle Zve*x would also suffice here, were they supported
      * in qemu
      */
-    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
+    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     /* Vector cryptography extensions */
     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
+    DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
 
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "qemu/bswap.h"
 #include "cpu.h"
+#include "crypto/aes.h"
+#include "crypto/aes-round.h"
 #include "exec/memop.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
 GEN_VEXT_VX(vwsll_vx_b, 2)
 GEN_VEXT_VX(vwsll_vx_h, 4)
 GEN_VEXT_VX(vwsll_vx_w, 8)
+
+void HELPER(egs_check)(uint32_t egs, CPURISCVState *env)
+{
+    uint32_t vl = env->vl;
+    uint32_t vstart = env->vstart;
+
+    if (vl % egs != 0 || vstart % egs != 0) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+    }
+}
+
+static inline void xor_round_key(AESState *round_state, AESState *round_key)
+{
+    round_state->v = round_state->v ^ round_key->v;
+}
+
+#define GEN_ZVKNED_HELPER_VV(NAME, ...)                                   \
+    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
+                      uint32_t desc)                                      \
+    {                                                                     \
+        uint32_t vl = env->vl;                                            \
+        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
+        uint32_t vta = vext_vta(desc);                                    \
+                                                                          \
+        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
+            AESState round_key;                                           \
+            round_key.d[0] = *((uint64_t *)vs2 + H8(i * 2 + 0));          \
+            round_key.d[1] = *((uint64_t *)vs2 + H8(i * 2 + 1));          \
+            AESState round_state;                                         \
+            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
+            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
+            __VA_ARGS__;                                                  \
+            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
+            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
+        }                                                                 \
+        env->vstart = 0;                                                  \
+        /* set tail elements to 1s */                                     \
+        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
+    }
+
+#define GEN_ZVKNED_HELPER_VS(NAME, ...)                                   \
+    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
+                      uint32_t desc)                                      \
+    {                                                                     \
+        uint32_t vl = env->vl;                                            \
+        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
+        uint32_t vta = vext_vta(desc);                                    \
+                                                                          \
+        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
+            AESState round_key;                                           \
+            round_key.d[0] = *((uint64_t *)vs2 + H8(0));                  \
+            round_key.d[1] = *((uint64_t *)vs2 + H8(1));                  \
+            AESState round_state;                                         \
+            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
+            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
+            __VA_ARGS__;                                                  \
+            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
+            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
+        }                                                                 \
+        env->vstart = 0;                                                  \
+        /* set tail elements to 1s */                                     \
+        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
+    }
+
+GEN_ZVKNED_HELPER_VV(vaesef_vv, aesenc_SB_SR_AK(&round_state,
+                                                &round_state,
+                                                &round_key,
+                                                false);)
+GEN_ZVKNED_HELPER_VS(vaesef_vs, aesenc_SB_SR_AK(&round_state,
+                                                &round_state,
+                                                &round_key,
+                                                false);)
+GEN_ZVKNED_HELPER_VV(vaesdf_vv, aesdec_ISB_ISR_AK(&round_state,
+                                                  &round_state,
+                                                  &round_key,
+                                                  false);)
+GEN_ZVKNED_HELPER_VS(vaesdf_vs, aesdec_ISB_ISR_AK(&round_state,
+                                                  &round_state,
+                                                  &round_key,
+                                                  false);)
+GEN_ZVKNED_HELPER_VV(vaesem_vv, aesenc_SB_SR_MC_AK(&round_state,
+                                                   &round_state,
+                                                   &round_key,
+                                                   false);)
+GEN_ZVKNED_HELPER_VS(vaesem_vs, aesenc_SB_SR_MC_AK(&round_state,
+                                                   &round_state,
+                                                   &round_key,
+                                                   false);)
+GEN_ZVKNED_HELPER_VV(vaesdm_vv, aesdec_ISB_ISR_AK_IMC(&round_state,
+                                                      &round_state,
+                                                      &round_key,
+                                                      false);)
+GEN_ZVKNED_HELPER_VS(vaesdm_vs, aesdec_ISB_ISR_AK_IMC(&round_state,
+                                                      &round_state,
+                                                      &round_key,
+                                                      false);)
+GEN_ZVKNED_HELPER_VS(vaesz_vs, xor_round_key(&round_state, &round_key);)
+
+void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
+                        CPURISCVState *env, uint32_t desc)
+{
+    uint32_t *vd = vd_vptr;
+    uint32_t *vs2 = vs2_vptr;
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
+    uint32_t vta = vext_vta(desc);
+
+    uimm &= 0b1111;
+    if (uimm > 10 || uimm == 0) {
+        uimm ^= 0b1000;
+    }
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        uint32_t rk[8], tmp;
+        static const uint32_t rcon[] = {
+            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
+            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
+        };
+
+        rk[0] = vs2[i * 4 + H4(0)];
+        rk[1] = vs2[i * 4 + H4(1)];
+        rk[2] = vs2[i * 4 + H4(2)];
+        rk[3] = vs2[i * 4 + H4(3)];
+        tmp = ror32(rk[3], 8);
+
+        rk[4] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
+                         ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
+                         ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
+                         ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
+                      ^ rcon[uimm - 1];
+        rk[5] = rk[1] ^ rk[4];
+        rk[6] = rk[2] ^ rk[5];
+        rk[7] = rk[3] ^ rk[6];
+
+        vd[i * 4 + H4(0)] = rk[4];
+        vd[i * 4 + H4(1)] = rk[5];
+        vd[i * 4 + H4(2)] = rk[6];
+        vd[i * 4 + H4(3)] = rk[7];
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
+}
+
+void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
+                        CPURISCVState *env, uint32_t desc)
+{
+    uint32_t *vd = vd_vptr;
+    uint32_t *vs2 = vs2_vptr;
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
+    uint32_t vta = vext_vta(desc);
+
+    uimm &= 0b1111;
+    if (uimm > 14 || uimm < 2) {
+        uimm ^= 0b1000;
+    }
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        uint32_t rk[12], tmp;
+        static const uint32_t rcon[] = {
+            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
+            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
+        };
+
+        rk[0] = vd[i * 4 + H4(0)];
+        rk[1] = vd[i * 4 + H4(1)];
+        rk[2] = vd[i * 4 + H4(2)];
+        rk[3] = vd[i * 4 + H4(3)];
+        rk[4] = vs2[i * 4 + H4(0)];
+        rk[5] = vs2[i * 4 + H4(1)];
+        rk[6] = vs2[i * 4 + H4(2)];
+        rk[7] = vs2[i * 4 + H4(3)];
+
+        if (uimm % 2 == 0) {
+            tmp = ror32(rk[7], 8);
+            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
+                             ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
+                             ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
+                             ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
+                          ^ rcon[(uimm - 1) / 2];
+        } else {
+            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(rk[7] >> 24) & 0xff] << 24) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 16) & 0xff] << 16) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 8) & 0xff] << 8) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 0) & 0xff] << 0));
+        }
+        rk[9] = rk[1] ^ rk[8];
+        rk[10] = rk[2] ^ rk[9];
+        rk[11] = rk[3] ^ rk[10];
+
+        vd[i * 4 + H4(0)] = rk[8];
+        vd[i * 4 + H4(1)] = rk[9];
+        vd[i * 4 + H4(2)] = rk[10];
+        vd[i * 4 + H4(3)] = rk[11];
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
+}
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
 GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
 GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
 GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
+
+/*
+ * Zvkned
+ */
+
+#define ZVKNED_EGS 4
+
+#define GEN_V_UNMASKED_TRANS(NAME, CHECK, EGS)                                \
+    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            TCGv_ptr rd_v, rs2_v;                                             \
+            TCGv_i32 desc, egs;                                               \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+            rd_v = tcg_temp_new_ptr();                                        \
+            rs2_v = tcg_temp_new_ptr();                                       \
+            desc = tcg_constant_i32(                                          \
+                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
+            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
+            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
+            gen_helper_##NAME(rd_v, rs2_v, cpu_env, desc);                    \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vaes_check_vv(DisasContext *s, arg_rmr *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul) &&
+           s->sew == MO_32;
+}
+
+static bool vaes_check_overlap(DisasContext *s, int vd, int vs2)
+{
+    int8_t op_size = s->lmul <= 0 ? 1 : 1 << s->lmul;
+    return !is_overlapped(vd, op_size, vs2, 1);
+}
+
+static bool vaes_check_vs(DisasContext *s, arg_rmr *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return vaes_check_overlap(s, a->rd, a->rs2) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           require_align(a->rd, s->lmul) &&
+           s->sew == MO_32;
+}
+
+GEN_V_UNMASKED_TRANS(vaesef_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesef_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdf_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdf_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdm_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdm_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesz_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesem_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesem_vs, vaes_check_vs, ZVKNED_EGS)
+
+#define GEN_VI_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
+    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            TCGv_ptr rd_v, rs2_v;                                             \
+            TCGv_i32 uimm_v, desc, egs;                                       \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+                                                                              \
+            rd_v = tcg_temp_new_ptr();                                        \
+            rs2_v = tcg_temp_new_ptr();                                       \
+            uimm_v = tcg_constant_i32(a->rs1);                                \
+            desc = tcg_constant_i32(                                          \
+                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
+            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
+            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
+            gen_helper_##NAME(rd_v, rs2_v, uimm_v, cpu_env, desc);            \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vaeskf1_check(DisasContext *s, arg_vaeskf1_vi *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->sew == MO_32 &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul);
+}
+
+static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->sew == MO_32 &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul);
+}
+
+GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
+GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

This commit adds support for the Zvknh vector-crypto extension, which
consists of the following instructions:

* vsha2ms.vv
* vsha2c[hl].vv

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvknha & x-zvknhb properties]
[max.chou@sifive.com: Replaced SEW selection to happened during
translation]
Message-ID: <20230711165917.2629866-11-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   2 +
 target/riscv/helper.h                    |   6 +
 target/riscv/insn32.decode               |   5 +
 target/riscv/cpu.c                       |  13 +-
 target/riscv/vcrypto_helper.c            | 238 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 129 ++++++++++++
 6 files changed, 390 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zvbb;
     bool ext_zvbc;
     bool ext_zvkned;
+    bool ext_zvknha;
+    bool ext_zvknhb;
     bool ext_zmmul;
     bool ext_zvfbfmin;
     bool ext_zvfbfwma;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
 DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
 DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
 DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
+
+DEF_HELPER_5(vsha2ms_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
 vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
 vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+
+# *** Zvknh vector crypto extension ***
+vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
+    ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
+    ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      * In principle Zve*x would also suffice here, were they supported
      * in qemu
      */
-    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
+    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
+        !cpu->cfg.ext_zve32f) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
     }
 
-    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
-        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
+    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
+        error_setg(
+            errp,
+            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
     DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
+    DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
+    DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
     /* set tail elements to 1s */
     vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 }
+
+static inline uint32_t sig0_sha256(uint32_t x)
+{
+    return ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3);
+}
+
+static inline uint32_t sig1_sha256(uint32_t x)
+{
+    return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
+}
+
+static inline uint64_t sig0_sha512(uint64_t x)
+{
+    return ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7);
+}
+
+static inline uint64_t sig1_sha512(uint64_t x)
+{
+    return ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6);
+}
+
+static inline void vsha2ms_e32(uint32_t *vd, uint32_t *vs1, uint32_t *vs2)
+{
+    uint32_t res[4];
+    res[0] = sig1_sha256(vs1[H4(2)]) + vs2[H4(1)] + sig0_sha256(vd[H4(1)]) +
+             vd[H4(0)];
+    res[1] = sig1_sha256(vs1[H4(3)]) + vs2[H4(2)] + sig0_sha256(vd[H4(2)]) +
+             vd[H4(1)];
+    res[2] =
+        sig1_sha256(res[0]) + vs2[H4(3)] + sig0_sha256(vd[H4(3)]) + vd[H4(2)];
+    res[3] =
+        sig1_sha256(res[1]) + vs1[H4(0)] + sig0_sha256(vs2[H4(0)]) + vd[H4(3)];
+    vd[H4(3)] = res[3];
+    vd[H4(2)] = res[2];
+    vd[H4(1)] = res[1];
+    vd[H4(0)] = res[0];
+}
+
+static inline void vsha2ms_e64(uint64_t *vd, uint64_t *vs1, uint64_t *vs2)
+{
+    uint64_t res[4];
+    res[0] = sig1_sha512(vs1[2]) + vs2[1] + sig0_sha512(vd[1]) + vd[0];
+    res[1] = sig1_sha512(vs1[3]) + vs2[2] + sig0_sha512(vd[2]) + vd[1];
+    res[2] = sig1_sha512(res[0]) + vs2[3] + sig0_sha512(vd[3]) + vd[2];
+    res[3] = sig1_sha512(res[1]) + vs1[0] + sig0_sha512(vs2[0]) + vd[3];
+    vd[3] = res[3];
+    vd[2] = res[2];
+    vd[1] = res[1];
+    vd[0] = res[0];
+}
+
+void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                        uint32_t desc)
+{
+    uint32_t sew = FIELD_EX64(env->vtype, VTYPE, VSEW);
+    uint32_t esz = sew == MO_32 ? 4 : 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        if (sew == MO_32) {
+            vsha2ms_e32(((uint32_t *)vd) + i * 4, ((uint32_t *)vs1) + i * 4,
+                        ((uint32_t *)vs2) + i * 4);
+        } else {
+            /* If not 32 then SEW should be 64 */
+            vsha2ms_e64(((uint64_t *)vd) + i * 4, ((uint64_t *)vs1) + i * 4,
+                        ((uint64_t *)vs2) + i * 4);
+        }
+    }
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+static inline uint64_t sum0_64(uint64_t x)
+{
+    return ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39);
+}
+
+static inline uint32_t sum0_32(uint32_t x)
+{
+    return ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22);
+}
+
+static inline uint64_t sum1_64(uint64_t x)
+{
+    return ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41);
+}
+
+static inline uint32_t sum1_32(uint32_t x)
+{
+    return ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25);
+}
+
+#define ch(x, y, z) ((x & y) ^ ((~x) & z))
+
+#define maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
+
+static void vsha2c_64(uint64_t *vs2, uint64_t *vd, uint64_t *vs1)
+{
+    uint64_t a = vs2[3], b = vs2[2], e = vs2[1], f = vs2[0];
+    uint64_t c = vd[3], d = vd[2], g = vd[1], h = vd[0];
+    uint64_t W0 = vs1[0], W1 = vs1[1];
+    uint64_t T1 = h + sum1_64(e) + ch(e, f, g) + W0;
+    uint64_t T2 = sum0_64(a) + maj(a, b, c);
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    T1 = h + sum1_64(e) + ch(e, f, g) + W1;
+    T2 = sum0_64(a) + maj(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    vd[0] = f;
+    vd[1] = e;
+    vd[2] = b;
+    vd[3] = a;
+}
+
+static void vsha2c_32(uint32_t *vs2, uint32_t *vd, uint32_t *vs1)
+{
+    uint32_t a = vs2[H4(3)], b = vs2[H4(2)], e = vs2[H4(1)], f = vs2[H4(0)];
+    uint32_t c = vd[H4(3)], d = vd[H4(2)], g = vd[H4(1)], h = vd[H4(0)];
+    uint32_t W0 = vs1[H4(0)], W1 = vs1[H4(1)];
+    uint32_t T1 = h + sum1_32(e) + ch(e, f, g) + W0;
+    uint32_t T2 = sum0_32(a) + maj(a, b, c);
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    T1 = h + sum1_32(e) + ch(e, f, g) + W1;
+    T2 = sum0_32(a) + maj(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    vd[H4(0)] = f;
+    vd[H4(1)] = e;
+    vd[H4(2)] = b;
+    vd[H4(3)] = a;
+}
+
+void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 4;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
+                  ((uint32_t *)vs1) + 4 * i + 2);
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
+                  ((uint64_t *)vs1) + 4 * i + 2);
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 4;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
+                  (((uint32_t *)vs1) + 4 * i));
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    uint32_t esz = 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
+                  (((uint64_t *)vs1) + 4 * i));
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
 
 GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
 GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
+
+/*
+ * Zvknh
+ */
+
+#define ZVKNH_EGS 4
+
+#define GEN_VV_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+            TCGv_i32 egs;                                                     \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+                                                                              \
+            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),       \
+                               vreg_ofs(s, a->rs2), cpu_env,                  \
+                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8,    \
+                               data, gen_helper_##NAME);                      \
+                                                                              \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vsha_check_sew(DisasContext *s)
+{
+    return (s->cfg_ptr->ext_zvknha == true && s->sew == MO_32) ||
+           (s->cfg_ptr->ext_zvknhb == true &&
+            (s->sew == MO_32 || s->sew == MO_64));
+}
+
+static bool vsha_check(DisasContext *s, arg_rmrr *a)
+{
+    int egw_bytes = ZVKNH_EGS << s->sew;
+    int mult = 1 << MAX(s->lmul, 0);
+    return opivv_check(s, a) &&
+           vsha_check_sew(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           !is_overlapped(a->rd, mult, a->rs1, mult) &&
+           !is_overlapped(a->rd, mult, a->rs2, mult) &&
+           s->lmul >= 0;
+}
+
+GEN_VV_UNMASKED_TRANS(vsha2ms_vv, vsha_check, ZVKNH_EGS)
+
+static bool trans_vsha2cl_vv(DisasContext *s, arg_rmrr *a)
+{
+    if (vsha_check(s, a)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+        TCGv_i32 egs;
+
+        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
+            /* save opcode for unwinding in case we throw an exception */
+            decode_save_opc(s);
+            egs = tcg_constant_i32(ZVKNH_EGS);
+            gen_helper_egs_check(egs, cpu_env);
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+        }
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
+
+        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
+            s->cfg_ptr->vlen / 8, data,
+            s->sew == MO_32 ?
+                gen_helper_vsha2cl32_vv : gen_helper_vsha2cl64_vv);
+
+        mark_vs_dirty(s);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
+{
+    if (vsha_check(s, a)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+        TCGv_i32 egs;
+
+        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
+            /* save opcode for unwinding in case we throw an exception */
+            decode_save_opc(s);
+            egs = tcg_constant_i32(ZVKNH_EGS);
+            gen_helper_egs_check(egs, cpu_env);
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+        }
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
+
+        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
+            s->cfg_ptr->vlen / 8, data,
+            s->sew == MO_32 ?
+                gen_helper_vsha2ch32_vv : gen_helper_vsha2ch64_vv);
+
+        mark_vs_dirty(s);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
-- 
2.41.0

From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>

This commit adds support for the Zvksh vector-crypto extension, which
consists of the following instructions:

* vsm3me.vv
* vsm3c.vi

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvksh property]
Message-ID: <20230711165917.2629866-12-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |   3 +
 target/riscv/insn32.decode               |   4 +
 target/riscv/cpu.c                       |   6 +-
 target/riscv/vcrypto_helper.c            | 134 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc |  31 ++++++
 6 files changed, 177 insertions(+), 2 deletions(-)

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

This commit adds support for the Zvkg vector-crypto extension, which
consists of the following instructions:

* vgmul.vv
* vghsh.vv

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvkg property]
[max.chou@sifive.com: Replaced uint by int for cross win32 build]
Message-ID: <20230711165917.2629866-13-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |  1 +
 target/riscv/helper.h                    |  3 +
 target/riscv/insn32.decode               |  4 ++
 target/riscv/cpu.c                       |  6 +-
 target/riscv/vcrypto_helper.c            | 72 ++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 30 ++++++++++
 6 files changed, 114 insertions(+), 2 deletions(-)

From: Max Chou <max.chou@sifive.com>

Allows sharing of sm4_subword between different targets.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-14-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/sm4.h           |  8 ++++++++
 target/arm/tcg/crypto_helper.c | 10 ++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/sm4.h
+++ b/include/crypto/sm4.h
@@ -XXX,XX +XXX,XX @@
 
 extern const uint8_t sm4_sbox[256];
 
+static inline uint32_t sm4_subword(uint32_t word)
+{
+    return sm4_sbox[word & 0xff] |
+           sm4_sbox[(word >> 8) & 0xff] << 8 |
+           sm4_sbox[(word >> 16) & 0xff] << 16 |
+           sm4_sbox[(word >> 24) & 0xff] << 24;
+}
+
 #endif
diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
             CR_ST_WORD(d, (i + 3) % 4) ^
             CR_ST_WORD(n, i);
 
-        t = sm4_sbox[t & 0xff] |
-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-            sm4_sbox[(t >> 24) & 0xff] << 24;
+        t = sm4_subword(t);
 
         CR_ST_WORD(d, i) ^= t ^ rol32(t, 2) ^ rol32(t, 10) ^ rol32(t, 18) ^
                             rol32(t, 24);
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4ekey(uint64_t *rd, uint64_t *rn, uint64_t *rm)
             CR_ST_WORD(d, (i + 3) % 4) ^
             CR_ST_WORD(m, i);
 
-        t = sm4_sbox[t & 0xff] |
-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-            sm4_sbox[(t >> 24) & 0xff] << 24;
+        t = sm4_subword(t);
 
         CR_ST_WORD(d, i) ^= t ^ rol32(t, 13) ^ rol32(t, 23);
     }
-- 
2.41.0

From: Max Chou <max.chou@sifive.com>

Adds sm4_ck constant for use in sm4 cryptography across different targets.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-15-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/sm4.h |  1 +
 crypto/sm4.c         | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/sm4.h
+++ b/include/crypto/sm4.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_SM4_H
 
 extern const uint8_t sm4_sbox[256];
+extern const uint32_t sm4_ck[32];
 
 static inline uint32_t sm4_subword(uint32_t word)
 {
diff --git a/crypto/sm4.c b/crypto/sm4.c
index XXXXXXX..XXXXXXX 100644
--- a/crypto/sm4.c
+++ b/crypto/sm4.c
@@ -XXX,XX +XXX,XX @@ uint8_t const sm4_sbox[] = {
     0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
 };
 
+uint32_t const sm4_ck[] = {
+    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
+    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
+    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
+    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
+    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
+    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
+    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
+    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
+};
-- 
2.41.0

From: Max Chou <max.chou@sifive.com>

This commit adds support for the Zvksed vector-crypto extension, which
consists of the following instructions:

* vsm4k.vi
* vsm4r.[vv,vs]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
[lawrence.hunter@codethink.co.uk: Moved SM4 functions from
crypto_helper.c to vcrypto_helper.c]
[nazar.kazakov@codethink.co.uk: Added alignment checks, refactored code to
use macros, and minor style changes]
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-16-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |   4 +
 target/riscv/insn32.decode               |   5 +
 target/riscv/cpu.c                       |   5 +-
 target/riscv/vcrypto_helper.c            | 127 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc |  43 ++++++++
 6 files changed, 184 insertions(+), 1 deletion(-)

From: Rob Bradford <rbradford@rivosinc.com>

These are WARL fields - zero out the bits for unavailable counters and
special case the TM bit in mcountinhibit which is hardwired to zero.
This patch achieves this by modifying the value written so that any use
of the field will see the correctly masked bits.

Tested by modifying OpenSBI to write max value to these CSRs and upon
subsequent read the appropriate number of bits for number of PMUs is
enabled and the TM bit is zero in mcountinhibit.

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20230802124906.24197-1-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
 {
     int cidx;
     PMUCTRState *counter;
+    RISCVCPU *cpu = env_archcpu(env);
 
-    env->mcountinhibit = val;
+    /* WARL register - disable unavailable counters; TM bit is always 0 */
+    env->mcountinhibit =
+        val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR);
 
     /* Check if any other counter is also monitoring cycles/instructions */
     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
                                        target_ulong val)
 {
-    env->mcounteren = val;
+    RISCVCPU *cpu = env_archcpu(env);
+
+    /* WARL register - disable unavailable counters */
+    env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
+                             COUNTEREN_IR);
     return RISCV_EXCP_NONE;
 }
 
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

RVA23 Profiles states:
The RVA23 profiles are intended to be used for 64-bit application
processors that will run rich OS stacks from standard binary OS
distributions and with a substantial number of third-party binary user
applications that will be supported over a considerable length of time
in the field.

The chapter 4 of the unprivileged spec introduces the Zihintntl extension
and Zihintntl is a mandatory extension presented in RVA23 Profiles, whose
purpose is to enable application and operating system portability across
different implementations. Thus the DTS should contain the Zihintntl ISA
string in order to pass to software.

The unprivileged spec states:
Like any HINTs, these instructions may be freely ignored. Hence, although
they are described in terms of cache-based memory hierarchies, they do not
mandate the provision of caches.

These instructions are encoded with non-used opcode, e.g. ADD x0, x0, x2,
which QEMU already supports, and QEMU does not emulate cache. Therefore
these instructions can be considered as a no-op, and we only need to add
a new property for the Zihintntl extension.

Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Jason Chien <jason.chien@sifive.com>
Message-ID: <20230726074049.19505-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h | 1 +
 target/riscv/cpu.c     | 2 ++
 2 files changed, 3 insertions(+)

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Commit a47842d ("riscv: Add support for the Zfa extension") implemented the zfa extension.
However, it has some typos for fleq.d and fltq.d. Both of them misused the fltq.s
helper function.

Fixes: a47842d ("riscv: Add support for the Zfa extension")
Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-ID: <20230728003906.768-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzfa.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzfa.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
@@ -XXX,XX +XXX,XX @@ bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_helper_fleq_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_helper_fltq_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

When writing the upper mtime, we should keep the original lower mtime
whose value is given by cpu_riscv_read_rtc() instead of
cpu_riscv_read_rtc_raw(). The same logic applies to writes to lower mtime.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230728082502.26439-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         return;
     } else if (addr == mtimer->time_base || addr == mtimer->time_base + 4) {
         uint64_t rtc_r = cpu_riscv_read_rtc_raw(mtimer->timebase_freq);
+        uint64_t rtc = cpu_riscv_read_rtc(mtimer);
 
         if (addr == mtimer->time_base) {
             if (size == 4) {
                 /* time_lo for RV32/RV64 */
-                mtimer->time_delta = ((rtc_r & ~0xFFFFFFFFULL) | value) - rtc_r;
+                mtimer->time_delta = ((rtc & ~0xFFFFFFFFULL) | value) - rtc_r;
             } else {
                 /* time for RV64 */
                 mtimer->time_delta = value - rtc_r;
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         } else {
             if (size == 4) {
                 /* time_hi for RV32/RV64 */
-                mtimer->time_delta = (value << 32 | (rtc_r & 0xFFFFFFFF)) - rtc_r;
+                mtimer->time_delta = (value << 32 | (rtc & 0xFFFFFFFF)) - rtc_r;
             } else {
                 qemu_log_mask(LOG_GUEST_ERROR,
                               "aclint-mtimer: invalid time_hi write: %08x",
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

The variables whose values are given by cpu_riscv_read_rtc() should be named
"rtc". The variables whose value are given by cpu_riscv_read_rtc_raw()
should be named "rtc_r".

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230728082502.26439-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
     uint64_t next;
     uint64_t diff;
 
-    uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
+    uint64_t rtc = cpu_riscv_read_rtc(mtimer);
 
     /* Compute the relative hartid w.r.t the socket */
     hartid = hartid - mtimer->hartid_base;
 
     mtimer->timecmp[hartid] = value;
-    if (mtimer->timecmp[hartid] <= rtc_r) {
+    if (mtimer->timecmp[hartid] <= rtc) {
         /*
          * If we're setting an MTIMECMP value in the "past",
          * immediately raise the timer interrupt
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
 
     /* otherwise, set up the future timer interrupt */
     qemu_irq_lower(mtimer->timer_irqs[hartid]);
-    diff = mtimer->timecmp[hartid] - rtc_r;
+    diff = mtimer->timecmp[hartid] - rtc;
     /* back to ns (note args switched in muldiv64) */
     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
 
-- 
2.41.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

We should not use types dependend on host arch for target_ucontext.
This bug is found when run rv32 applications.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230811055438.1945-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/riscv/signal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/riscv/signal.c
+++ b/linux-user/riscv/signal.c
@@ -XXX,XX +XXX,XX @@ struct target_sigcontext {
 }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
 
 struct target_ucontext {
-    unsigned long uc_flags;
-    struct target_ucontext *uc_link;
+    abi_ulong uc_flags;
+    abi_ptr uc_link;
     target_stack_t uc_stack;
     target_sigset_t uc_sigmask;
     uint8_t   __unused[1024 / 8 - sizeof(target_sigset_t)];
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

In this patch, we create the APLIC and IMSIC FDT helper functions and
remove M mode AIA devices when using KVM acceleration.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-2-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 290 +++++++++++++++++++++++-------------------------
 1 file changed, 137 insertions(+), 153 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static uint32_t imsic_num_bits(uint32_t count)
     return ret;
 }
 
-static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
-                             uint32_t *phandle, uint32_t *intc_phandles,
-                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
+static void create_fdt_one_imsic(RISCVVirtState *s, hwaddr base_addr,
+                                 uint32_t *intc_phandles, uint32_t msi_phandle,
+                                 bool m_mode, uint32_t imsic_guest_bits)
 {
     int cpu, socket;
     char *imsic_name;
     MachineState *ms = MACHINE(s);
     int socket_count = riscv_socket_count(ms);
-    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
+    uint32_t imsic_max_hart_per_socket;
     uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
 
-    *msi_m_phandle = (*phandle)++;
-    *msi_s_phandle = (*phandle)++;
     imsic_cells = g_new0(uint32_t, ms->smp.cpus * 2);
     imsic_regs = g_new0(uint32_t, socket_count * 4);
 
-    /* M-level IMSIC node */
     for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
         imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+        imsic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
-    imsic_max_hart_per_socket = 0;
-    for (socket = 0; socket < socket_count; socket++) {
-        imsic_addr = memmap[VIRT_IMSIC_M].base +
-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
-        imsic_regs[socket * 4 + 0] = 0;
-        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
-        imsic_regs[socket * 4 + 2] = 0;
-        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
-        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
-            imsic_max_hart_per_socket = s->soc[socket].num_harts;
-        }
-    }
-    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-        (unsigned long)memmap[VIRT_IMSIC_M].base);
-    qemu_fdt_add_subnode(ms->fdt, imsic_name);
-    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
-        "riscv,imsics");
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
-        FDT_IMSIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
-        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
-        socket_count * sizeof(uint32_t) * 4);
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
-        VIRT_IRQCHIP_NUM_MSIS);
-    if (socket_count > 1) {
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
-            imsic_num_bits(imsic_max_hart_per_socket));
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
-            imsic_num_bits(socket_count));
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
-            IMSIC_MMIO_GROUP_MIN_SHIFT);
-    }
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_m_phandle);
-
-    g_free(imsic_name);
 
-    /* S-level IMSIC node */
-    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
-        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
-    }
-    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
     imsic_max_hart_per_socket = 0;
     for (socket = 0; socket < socket_count; socket++) {
-        imsic_addr = memmap[VIRT_IMSIC_S].base +
-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+        imsic_addr = base_addr + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
         imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
                      s->soc[socket].num_harts;
         imsic_regs[socket * 4 + 0] = 0;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
             imsic_max_hart_per_socket = s->soc[socket].num_harts;
         }
     }
-    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-        (unsigned long)memmap[VIRT_IMSIC_S].base);
+
+    imsic_name = g_strdup_printf("/soc/imsics@%lx", (unsigned long)base_addr);
     qemu_fdt_add_subnode(ms->fdt, imsic_name);
-    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
-        "riscv,imsics");
+    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible", "riscv,imsics");
     qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
-        FDT_IMSIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
-        NULL, 0);
+                          FDT_IMSIC_INT_CELLS);
+    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller", NULL, 0);
     qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
-        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
+                     imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
     qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
-        socket_count * sizeof(uint32_t) * 4);
+                     socket_count * sizeof(uint32_t) * 4);
     qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
-        VIRT_IRQCHIP_NUM_MSIS);
+                     VIRT_IRQCHIP_NUM_MSIS);
+
     if (imsic_guest_bits) {
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,guest-index-bits",
-            imsic_guest_bits);
+                              imsic_guest_bits);
     }
+
     if (socket_count > 1) {
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
-            imsic_num_bits(imsic_max_hart_per_socket));
+                              imsic_num_bits(imsic_max_hart_per_socket));
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
-            imsic_num_bits(socket_count));
+                              imsic_num_bits(socket_count));
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
-            IMSIC_MMIO_GROUP_MIN_SHIFT);
+                              IMSIC_MMIO_GROUP_MIN_SHIFT);
     }
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_s_phandle);
-    g_free(imsic_name);
+    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", msi_phandle);
 
+    g_free(imsic_name);
     g_free(imsic_regs);
     g_free(imsic_cells);
 }
 
-static void create_fdt_socket_aplic(RISCVVirtState *s,
-                                    const MemMapEntry *memmap, int socket,
-                                    uint32_t msi_m_phandle,
-                                    uint32_t msi_s_phandle,
-                                    uint32_t *phandle,
-                                    uint32_t *intc_phandles,
-                                    uint32_t *aplic_phandles)
+static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
+                             uint32_t *phandle, uint32_t *intc_phandles,
+                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
+{
+    *msi_m_phandle = (*phandle)++;
+    *msi_s_phandle = (*phandle)++;
+
+    if (!kvm_enabled()) {
+        /* M-level IMSIC node */
+        create_fdt_one_imsic(s, memmap[VIRT_IMSIC_M].base, intc_phandles,
+                             *msi_m_phandle, true, 0);
+    }
+
+    /* S-level IMSIC node */
+    create_fdt_one_imsic(s, memmap[VIRT_IMSIC_S].base, intc_phandles,
+                         *msi_s_phandle, false,
+                         imsic_num_bits(s->aia_guests + 1));
+
+}
+
+static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
+                                 unsigned long aplic_addr, uint32_t aplic_size,
+                                 uint32_t msi_phandle,
+                                 uint32_t *intc_phandles,
+                                 uint32_t aplic_phandle,
+                                 uint32_t aplic_child_phandle,
+                                 bool m_mode)
 {
     int cpu;
     char *aplic_name;
     uint32_t *aplic_cells;
-    unsigned long aplic_addr;
     MachineState *ms = MACHINE(s);
-    uint32_t aplic_m_phandle, aplic_s_phandle;
 
-    aplic_m_phandle = (*phandle)++;
-    aplic_s_phandle = (*phandle)++;
     aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 
-    /* M-level APLIC node */
     for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+        aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
-    aplic_addr = memmap[VIRT_APLIC_M].base +
-                 (memmap[VIRT_APLIC_M].size * socket);
+
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
     qemu_fdt_add_subnode(ms->fdt, aplic_name);
     qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
     qemu_fdt_setprop_cell(ms->fdt, aplic_name,
-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
+                          "#interrupt-cells", FDT_APLIC_INT_CELLS);
     qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
+
     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+                         aplic_cells,
+                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
     } else {
-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
-            msi_m_phandle);
+        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
     }
+
     qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
+                           0x0, aplic_addr, 0x0, aplic_size);
     qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
-        VIRT_IRQCHIP_NUM_SOURCES);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
-        aplic_s_phandle);
-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
-        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
+                          VIRT_IRQCHIP_NUM_SOURCES);
+
+    if (aplic_child_phandle) {
+        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
+                              aplic_child_phandle);
+        qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
+                               aplic_child_phandle, 0x1,
+                               VIRT_IRQCHIP_NUM_SOURCES);
+    }
+
     riscv_socket_fdt_write_id(ms, aplic_name, socket);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_m_phandle);
+    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_phandle);
+
     g_free(aplic_name);
+    g_free(aplic_cells);
+}
 
-    /* S-level APLIC node */
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
-        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
+static void create_fdt_socket_aplic(RISCVVirtState *s,
+                                    const MemMapEntry *memmap, int socket,
+                                    uint32_t msi_m_phandle,
+                                    uint32_t msi_s_phandle,
+                                    uint32_t *phandle,
+                                    uint32_t *intc_phandles,
+                                    uint32_t *aplic_phandles)
+{
+    char *aplic_name;
+    unsigned long aplic_addr;
+    MachineState *ms = MACHINE(s);
+    uint32_t aplic_m_phandle, aplic_s_phandle;
+
+    aplic_m_phandle = (*phandle)++;
+    aplic_s_phandle = (*phandle)++;
+
+    if (!kvm_enabled()) {
+        /* M-level APLIC node */
+        aplic_addr = memmap[VIRT_APLIC_M].base +
+                     (memmap[VIRT_APLIC_M].size * socket);
+        create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
+                             msi_m_phandle, intc_phandles,
+                             aplic_m_phandle, aplic_s_phandle,
+                             true);
     }
+
+    /* S-level APLIC node */
     aplic_addr = memmap[VIRT_APLIC_S].base +
                  (memmap[VIRT_APLIC_S].size * socket);
+    create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
+                         msi_s_phandle, intc_phandles,
+                         aplic_s_phandle, 0,
+                         false);
+
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
-    qemu_fdt_add_subnode(ms->fdt, aplic_name);
-    qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name,
-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
-    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
-        qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
-    } else {
-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
-            msi_s_phandle);
-    }
-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
-        VIRT_IRQCHIP_NUM_SOURCES);
-    riscv_socket_fdt_write_id(ms, aplic_name, socket);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_s_phandle);
 
     if (!socket) {
         platform_bus_add_all_fdt_nodes(ms->fdt, aplic_name,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
 
     g_free(aplic_name);
 
-    g_free(aplic_cells);
     aplic_phandles[socket] = aplic_s_phandle;
 }
 
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
     int i;
     hwaddr addr;
     uint32_t guest_bits;
-    DeviceState *aplic_m;
-    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
+    DeviceState *aplic_s = NULL;
+    DeviceState *aplic_m = NULL;
+    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 
     if (msimode) {
-        /* Per-socket M-level IMSICs */
-        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-        for (i = 0; i < hart_count; i++) {
-            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
-                               base_hartid + i, true, 1,
-                               VIRT_IRQCHIP_NUM_MSIS);
+        if (!kvm_enabled()) {
+            /* Per-socket M-level IMSICs */
+            addr = memmap[VIRT_IMSIC_M].base +
+                   socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+            for (i = 0; i < hart_count; i++) {
+                riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
+                                   base_hartid + i, true, 1,
+                                   VIRT_IRQCHIP_NUM_MSIS);
+            }
         }
 
         /* Per-socket S-level IMSICs */
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
         }
     }
 
-    /* Per-socket M-level APLIC */
-    aplic_m = riscv_aplic_create(
-        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
-        memmap[VIRT_APLIC_M].size,
-        (msimode) ? 0 : base_hartid,
-        (msimode) ? 0 : hart_count,
-        VIRT_IRQCHIP_NUM_SOURCES,
-        VIRT_IRQCHIP_NUM_PRIO_BITS,
-        msimode, true, NULL);
-
-    if (aplic_m) {
-        /* Per-socket S-level APLIC */
-        riscv_aplic_create(
-            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
-            memmap[VIRT_APLIC_S].size,
-            (msimode) ? 0 : base_hartid,
-            (msimode) ? 0 : hart_count,
-            VIRT_IRQCHIP_NUM_SOURCES,
-            VIRT_IRQCHIP_NUM_PRIO_BITS,
-            msimode, false, aplic_m);
+    if (!kvm_enabled()) {
+        /* Per-socket M-level APLIC */
+        aplic_m = riscv_aplic_create(memmap[VIRT_APLIC_M].base +
+                                     socket * memmap[VIRT_APLIC_M].size,
+                                     memmap[VIRT_APLIC_M].size,
+                                     (msimode) ? 0 : base_hartid,
+                                     (msimode) ? 0 : hart_count,
+                                     VIRT_IRQCHIP_NUM_SOURCES,
+                                     VIRT_IRQCHIP_NUM_PRIO_BITS,
+                                     msimode, true, NULL);
     }
 
-    return aplic_m;
+    /* Per-socket S-level APLIC */
+    aplic_s = riscv_aplic_create(memmap[VIRT_APLIC_S].base +
+                                 socket * memmap[VIRT_APLIC_S].size,
+                                 memmap[VIRT_APLIC_S].size,
+                                 (msimode) ? 0 : base_hartid,
+                                 (msimode) ? 0 : hart_count,
+                                 VIRT_IRQCHIP_NUM_SOURCES,
+                                 VIRT_IRQCHIP_NUM_PRIO_BITS,
+                                 msimode, false, aplic_m);
+
+    return kvm_enabled() ? aplic_s : aplic_m;
 }
 
 static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

We check the in-kernel irqchip support when using KVM acceleration.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-3-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
 
 int kvm_arch_irqchip_create(KVMState *s)
 {
-    return 0;
+    if (kvm_kernel_irqchip_split()) {
+        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
+        exit(1);
+    }
+
+    /*
+     * We can create the VAIA using the newer device control API.
+     */
+    return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
 }
 
 int kvm_arch_process_async_events(CPUState *cs)
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

We create a vAIA chip by using the KVM_DEV_TYPE_RISCV_AIA and then set up
the chip with the KVM_DEV_RISCV_AIA_GRP_* APIs.
We also extend KVM accelerator to specify the KVM AIA mode. The "riscv-aia"
parameter is passed along with --accel in QEMU command-line.
1) "riscv-aia=emul": IMSIC is emulated by hypervisor
2) "riscv-aia=hwaccel": use hardware guest IMSIC
3) "riscv-aia=auto": use the hardware guest IMSICs whenever available
                     otherwise we fallback to software emulation.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-4-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h |   4 +
 target/riscv/kvm.c       | 186 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 190 insertions(+)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@
 void kvm_riscv_init_user_properties(Object *cpu_obj);
 void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
 void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
+void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                          uint64_t aia_irq_num, uint64_t aia_msi_num,
+                          uint64_t aplic_base, uint64_t imsic_base,
+                          uint64_t guest_num);
 
 #endif
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/irq.h"
+#include "hw/intc/riscv_imsic.h"
 #include "qemu/log.h"
 #include "hw/loader.h"
 #include "kvm_riscv.h"
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "migration/migration.h"
 #include "sysemu/runstate.h"
+#include "hw/riscv/numa.h"
 
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_cpu_check_are_resettable(void)
     return true;
 }
 
+static int aia_mode;
+
+static const char *kvm_aia_mode_str(uint64_t mode)
+{
+    switch (mode) {
+    case KVM_DEV_RISCV_AIA_MODE_EMUL:
+        return "emul";
+    case KVM_DEV_RISCV_AIA_MODE_HWACCEL:
+        return "hwaccel";
+    case KVM_DEV_RISCV_AIA_MODE_AUTO:
+    default:
+        return "auto";
+    };
+}
+
+static char *riscv_get_kvm_aia(Object *obj, Error **errp)
+{
+    return g_strdup(kvm_aia_mode_str(aia_mode));
+}
+
+static void riscv_set_kvm_aia(Object *obj, const char *val, Error **errp)
+{
+    if (!strcmp(val, "emul")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_EMUL;
+    } else if (!strcmp(val, "hwaccel")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_HWACCEL;
+    } else if (!strcmp(val, "auto")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_AUTO;
+    } else {
+        error_setg(errp, "Invalid KVM AIA mode");
+        error_append_hint(errp, "Valid values are emul, hwaccel, and auto.\n");
+    }
+}
+
 void kvm_arch_accel_class_init(ObjectClass *oc)
 {
+    object_class_property_add_str(oc, "riscv-aia", riscv_get_kvm_aia,
+                                  riscv_set_kvm_aia);
+    object_class_property_set_description(oc, "riscv-aia",
+                                          "Set KVM AIA mode. Valid values are "
+                                          "emul, hwaccel, and auto. Default "
+                                          "is auto.");
+    object_property_set_default_str(object_class_property_find(oc, "riscv-aia"),
+                                    "auto");
+}
+
+void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                          uint64_t aia_irq_num, uint64_t aia_msi_num,
+                          uint64_t aplic_base, uint64_t imsic_base,
+                          uint64_t guest_num)
+{
+    int ret, i;
+    int aia_fd = -1;
+    uint64_t default_aia_mode;
+    uint64_t socket_count = riscv_socket_count(machine);
+    uint64_t max_hart_per_socket = 0;
+    uint64_t socket, base_hart, hart_count, socket_imsic_base, imsic_addr;
+    uint64_t socket_bits, hart_bits, guest_bits;
+
+    aia_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_RISCV_AIA, false);
+
+    if (aia_fd < 0) {
+        error_report("Unable to create in-kernel irqchip");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_MODE,
+                            &default_aia_mode, false, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to get current KVM AIA mode");
+        exit(1);
+    }
+    qemu_log("KVM AIA: default mode is %s\n",
+             kvm_aia_mode_str(default_aia_mode));
+
+    if (default_aia_mode != aia_mode) {
+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                                KVM_DEV_RISCV_AIA_CONFIG_MODE,
+                                &aia_mode, true, NULL);
+        if (ret < 0)
+            warn_report("KVM AIA: failed to set KVM AIA mode");
+        else
+            qemu_log("KVM AIA: set current mode to %s\n",
+                     kvm_aia_mode_str(aia_mode));
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
+                            &aia_irq_num, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set number of input irq lines");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_IDS,
+                            &aia_msi_num, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set number of msi");
+        exit(1);
+    }
+
+    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
+                            &socket_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set group_bits");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
+                            &group_shift, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set group_shift");
+        exit(1);
+    }
+
+    guest_bits = guest_num == 0 ? 0 :
+                 find_last_bit(&guest_num, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GUEST_BITS,
+                            &guest_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set guest_bits");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
+                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
+                            &aplic_base, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set the base address of APLIC");
+        exit(1);
+    }
+
+    for (socket = 0; socket < socket_count; socket++) {
+        socket_imsic_base = imsic_base + socket * (1U << group_shift);
+        hart_count = riscv_socket_hart_count(machine, socket);
+        base_hart = riscv_socket_first_hartid(machine, socket);
+
+        if (max_hart_per_socket < hart_count) {
+            max_hart_per_socket = hart_count;
+        }
+
+        for (i = 0; i < hart_count; i++) {
+            imsic_addr = socket_imsic_base + i * IMSIC_HART_SIZE(guest_bits);
+            ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
+                                    KVM_DEV_RISCV_AIA_ADDR_IMSIC(i + base_hart),
+                                    &imsic_addr, true, NULL);
+            if (ret < 0) {
+                error_report("KVM AIA: failed to set the IMSIC address for hart %d", i);
+                exit(1);
+            }
+        }
+    }
+
+    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
+                            &hart_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set hart_bits");
+        exit(1);
+    }
+
+    if (kvm_has_gsi_routing()) {
+        for (uint64_t idx = 0; idx < aia_irq_num + 1; ++idx) {
+            /* KVM AIA only has one APLIC instance */
+            kvm_irqchip_add_irq_route(kvm_state, idx, 0, idx);
+        }
+        kvm_gsi_routing_allowed = true;
+        kvm_irqchip_commit_routes(kvm_state);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CTRL,
+                            KVM_DEV_RISCV_AIA_CTRL_INIT,
+                            NULL, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: initialized fail");
+        exit(1);
+    }
+
+    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
 }
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

KVM AIA can't emulate APLIC only. When "aia=aplic" parameter is passed,
APLIC devices is emulated by QEMU. For "aia=aplic-imsic", remove the
mmio operations of APLIC when using KVM AIA and send wired interrupt
signal via KVM_IRQ_LINE API.
After KVM AIA enabled, MSI messages are delivered by KVM_SIGNAL_MSI API
when the IMSICs receive mmio write requests.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-5-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 56 ++++++++++++++++++++++++++++++-------------
 hw/intc/riscv_imsic.c | 25 +++++++++++++++----
 2 files changed, 61 insertions(+), 20 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "migration/vmstate.h"
 
 #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@
 
 #define APLIC_IDC_CLAIMI               0x1c
 
+/*
+ * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
+ * APLIC Wired.
+ */
+static bool is_kvm_aia(bool msimode)
+{
+    return kvm_irqchip_in_kernel() && msimode;
+}
+
 static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
                                             uint32_t word)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
     return topi;
 }
 
+static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
+{
+    kvm_set_irq(kvm_state, irq, !!level);
+}
+
 static void riscv_aplic_request(void *opaque, int irq, int level)
 {
     bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
     uint32_t i;
     RISCVAPLICState *aplic = RISCV_APLIC(dev);
 
-    aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
-    aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
-    aplic->state = g_new0(uint32_t, aplic->num_irqs);
-    aplic->target = g_new0(uint32_t, aplic->num_irqs);
-    if (!aplic->msimode) {
-        for (i = 0; i < aplic->num_irqs; i++) {
-            aplic->target[i] = 1;
+    if (!is_kvm_aia(aplic->msimode)) {
+        aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
+        aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
+        aplic->state = g_new0(uint32_t, aplic->num_irqs);
+        aplic->target = g_new0(uint32_t, aplic->num_irqs);
+        if (!aplic->msimode) {
+            for (i = 0; i < aplic->num_irqs; i++) {
+                aplic->target[i] = 1;
+            }
         }
-    }
-    aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
-    aplic->iforce = g_new0(uint32_t, aplic->num_harts);
-    aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
+        aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
+        aplic->iforce = g_new0(uint32_t, aplic->num_harts);
+        aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 
-    memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops, aplic,
-                          TYPE_RISCV_APLIC, aplic->aperture_size);
-    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
+        memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
+                              aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
+        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
+    }
 
     /*
      * Only root APLICs have hardware IRQ lines. All non-root APLICs
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
+        if (is_kvm_aia(aplic->msimode)) {
+            qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
+        } else {
+            qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
+        }
     }
 
     /* Create output IRQ lines for non-MSI mode */
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
     qdev_prop_set_bit(dev, "mmode", mmode);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+
+    if (!is_kvm_aia(msimode)) {
+        sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+    }
 
     if (parent) {
         riscv_aplic_add_child(parent, dev);
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "target/riscv/cpu_bits.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "migration/vmstate.h"
 
 #define IMSIC_MMIO_PAGE_LE             0x00
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
         goto err;
     }
 
+#if defined(CONFIG_KVM)
+    if (kvm_irqchip_in_kernel()) {
+        struct kvm_msi msi;
+
+        msi.address_lo = extract64(imsic->mmio.addr + addr, 0, 32);
+        msi.address_hi = extract64(imsic->mmio.addr + addr, 32, 32);
+        msi.data = le32_to_cpu(value);
+
+        kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
+
+        return;
+    }
+#endif
+
     /* Writes only supported for MSI little-endian registers */
     page = addr >> IMSIC_MMIO_PAGE_SHIFT;
     if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
     CPUState *cpu = cpu_by_arch_id(imsic->hartid);
     CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 
-    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
-    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
-    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
-    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
+    if (!kvm_irqchip_in_kernel()) {
+        imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
+        imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
+        imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
+        imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
+    }
 
     memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
                           imsic, TYPE_RISCV_IMSIC,
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

Select KVM AIA when the host kernel has in-kernel AIA chip support.
Since KVM AIA only has one APLIC instance, we map the QEMU APLIC
devices to KVM APLIC.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-6-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 94 +++++++++++++++++++++++++++++++++----------------
 1 file changed, 63 insertions(+), 31 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
+#include "kvm_riscv.h"
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/riscv_aplic.h"
 #include "hw/intc/riscv_imsic.h"
@@ -XXX,XX +XXX,XX @@
 #error "Can't accommodate all IMSIC groups in address space"
 #endif
 
+/* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
+static bool virt_use_kvm_aia(RISCVVirtState *s)
+{
+    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
+}
+
 static const MemMapEntry virt_memmap[] = {
     [VIRT_DEBUG] =        {        0x0,         0x100 },
     [VIRT_MROM] =         {     0x1000,        0xf000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
                                  uint32_t *intc_phandles,
                                  uint32_t aplic_phandle,
                                  uint32_t aplic_child_phandle,
-                                 bool m_mode)
+                                 bool m_mode, int num_harts)
 {
     int cpu;
     char *aplic_name;
     uint32_t *aplic_cells;
     MachineState *ms = MACHINE(s);
 
-    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+    aplic_cells = g_new0(uint32_t, num_harts * 2);
 
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+    for (cpu = 0; cpu < num_harts; cpu++) {
         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
         aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
 
     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-                         aplic_cells,
-                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+                         aplic_cells, num_harts * sizeof(uint32_t) * 2);
     } else {
         qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
     }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
                                     uint32_t msi_s_phandle,
                                     uint32_t *phandle,
                                     uint32_t *intc_phandles,
-                                    uint32_t *aplic_phandles)
+                                    uint32_t *aplic_phandles,
+                                    int num_harts)
 {
     char *aplic_name;
     unsigned long aplic_addr;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
         create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
                              msi_m_phandle, intc_phandles,
                              aplic_m_phandle, aplic_s_phandle,
-                             true);
+                             true, num_harts);
     }
 
     /* S-level APLIC node */
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
     create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
                          msi_s_phandle, intc_phandles,
                          aplic_s_phandle, 0,
-                         false);
+                         false, num_harts);
 
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
         *msi_pcie_phandle = msi_s_phandle;
     }
 
-    phandle_pos = ms->smp.cpus;
-    for (socket = (socket_count - 1); socket >= 0; socket--) {
-        phandle_pos -= s->soc[socket].num_harts;
-
-        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
-            create_fdt_socket_plic(s, memmap, socket, phandle,
-                &intc_phandles[phandle_pos], xplic_phandles);
-        } else {
-            create_fdt_socket_aplic(s, memmap, socket,
-                msi_m_phandle, msi_s_phandle, phandle,
-                &intc_phandles[phandle_pos], xplic_phandles);
+    /* KVM AIA only has one APLIC instance */
+    if (virt_use_kvm_aia(s)) {
+        create_fdt_socket_aplic(s, memmap, 0,
+                                msi_m_phandle, msi_s_phandle, phandle,
+                                &intc_phandles[0], xplic_phandles,
+                                ms->smp.cpus);
+    } else {
+        phandle_pos = ms->smp.cpus;
+        for (socket = (socket_count - 1); socket >= 0; socket--) {
+            phandle_pos -= s->soc[socket].num_harts;
+
+            if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+                create_fdt_socket_plic(s, memmap, socket, phandle,
+                                       &intc_phandles[phandle_pos],
+                                       xplic_phandles);
+            } else {
+                create_fdt_socket_aplic(s, memmap, socket,
+                                        msi_m_phandle, msi_s_phandle, phandle,
+                                        &intc_phandles[phandle_pos],
+                                        xplic_phandles,
+                                        s->soc[socket].num_harts);
+            }
         }
     }
 
     g_free(intc_phandles);
 
-    for (socket = 0; socket < socket_count; socket++) {
-        if (socket == 0) {
-            *irq_mmio_phandle = xplic_phandles[socket];
-            *irq_virtio_phandle = xplic_phandles[socket];
-            *irq_pcie_phandle = xplic_phandles[socket];
-        }
-        if (socket == 1) {
-            *irq_virtio_phandle = xplic_phandles[socket];
-            *irq_pcie_phandle = xplic_phandles[socket];
-        }
-        if (socket == 2) {
-            *irq_pcie_phandle = xplic_phandles[socket];
+    if (virt_use_kvm_aia(s)) {
+        *irq_mmio_phandle = xplic_phandles[0];
+        *irq_virtio_phandle = xplic_phandles[0];
+        *irq_pcie_phandle = xplic_phandles[0];
+    } else {
+        for (socket = 0; socket < socket_count; socket++) {
+            if (socket == 0) {
+                *irq_mmio_phandle = xplic_phandles[socket];
+                *irq_virtio_phandle = xplic_phandles[socket];
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
+            if (socket == 1) {
+                *irq_virtio_phandle = xplic_phandles[socket];
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
+            if (socket == 2) {
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         }
     }
 
+    if (virt_use_kvm_aia(s)) {
+        kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
+                             VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
+                             memmap[VIRT_APLIC_S].base,
+                             memmap[VIRT_IMSIC_S].base,
+                             s->aia_guests);
+    }
+
     if (riscv_is_32bit(&s->soc[0])) {
 #if HOST_LONG_BITS == 64
         /* limit RAM size in a 32-bit system */
-- 
2.41.0

From: Conor Dooley <conor.dooley@microchip.com>

On a dtb dumped from the virt machine, dt-validate complains:
soc: pmu: {'riscv,event-to-mhpmcounters': [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280], [65563, 65563, 524280], [65569, 65569, 524280]], 'compatible': ['riscv,pmu']} should not be valid under {'type': 'object'}
        from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
That's pretty cryptic, but running the dtb back through dtc produces
something a lot more reasonable:
Warning (simple_bus_reg): /soc/pmu: missing or empty reg/ranges property

Moving the riscv,pmu node out of the soc bus solves the problem.

Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20230727-groom-decline-2c57ce42841c@spud>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_pmu(RISCVVirtState *s)
     MachineState *ms = MACHINE(s);
     RISCVCPU hart = s->soc[0].harts[0];
 
-    pmu_name = g_strdup_printf("/soc/pmu");
+    pmu_name = g_strdup_printf("/pmu");
     qemu_fdt_add_subnode(ms->fdt, pmu_name);
     qemu_fdt_setprop_string(ms->fdt, pmu_name, "compatible", "riscv,pmu");
     riscv_pmu_generate_fdt_node(ms->fdt, hart.cfg.pmu_num, pmu_name);
-- 
2.41.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

The Svadu specification updated the name of the *envcfg bit from
HADE to ADUE.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20230816141916.66898-1-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h   |  8 ++++----
 target/riscv/cpu.c        |  4 ++--
 target/riscv/cpu_helper.c |  6 +++---
 target/riscv/csr.c        | 12 ++++++------
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MENVCFG_CBIE                       (3UL << 4)
 #define MENVCFG_CBCFE                      BIT(6)
 #define MENVCFG_CBZE                       BIT(7)
-#define MENVCFG_HADE                       (1ULL << 61)
+#define MENVCFG_ADUE                       (1ULL << 61)
 #define MENVCFG_PBMTE                      (1ULL << 62)
 #define MENVCFG_STCE                       (1ULL << 63)
 
 /* For RV32 */
-#define MENVCFGH_HADE                      BIT(29)
+#define MENVCFGH_ADUE                      BIT(29)
 #define MENVCFGH_PBMTE                     BIT(30)
 #define MENVCFGH_STCE                      BIT(31)
 
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define HENVCFG_CBIE                       MENVCFG_CBIE
 #define HENVCFG_CBCFE                      MENVCFG_CBCFE
 #define HENVCFG_CBZE                       MENVCFG_CBZE
-#define HENVCFG_HADE                       MENVCFG_HADE
+#define HENVCFG_ADUE                       MENVCFG_ADUE
 #define HENVCFG_PBMTE                      MENVCFG_PBMTE
 #define HENVCFG_STCE                       MENVCFG_STCE
 
 /* For RV32 */
-#define HENVCFGH_HADE                       MENVCFGH_HADE
+#define HENVCFGH_ADUE                       MENVCFGH_ADUE
 #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
 #define HENVCFGH_STCE                       MENVCFGH_STCE
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
     env->two_stage_lookup = false;
 
     env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
-                   (cpu->cfg.ext_svadu ? MENVCFG_HADE : 0);
+                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
     env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
-                   (cpu->cfg.ext_svadu ? HENVCFG_HADE : 0);
+                   (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
 
     /* Initialized default priorities of local interrupts. */
     for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     bool pbmte = env->menvcfg & MENVCFG_PBMTE;
-    bool hade = env->menvcfg & MENVCFG_HADE;
+    bool adue = env->menvcfg & MENVCFG_ADUE;
 
     if (first_stage && two_stage && env->virt_enabled) {
         pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
-        hade = hade && (env->henvcfg & HENVCFG_HADE);
+        adue = adue && (env->henvcfg & HENVCFG_ADUE);
     }
 
     int ptshift = (levels - 1) * ptidxbits;
@@ -XXX,XX +XXX,XX @@ restart:
 
     /* Page table updates need to be atomic with MTTCG enabled */
     if (updated_pte != pte && !is_debug) {
-        if (!hade) {
+        if (!adue) {
             return TRANSLATE_FAIL;
         }
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
     if (riscv_cpu_mxl(env) == MXL_RV64) {
         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                (cfg->ext_svadu ? MENVCFG_HADE : 0);
+                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
     }
     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                    (cfg->ext_svadu ? MENVCFG_HADE : 0);
+                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
     uint64_t valh = (uint64_t)val << 32;
 
     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
      * henvcfg.hade is read_only 0 when menvcfg.hade = 0
      */
-    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
+    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                            env->menvcfg);
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
     }
 
     if (riscv_cpu_mxl(env) == MXL_RV64) {
-        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE);
+        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
     }
 
     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
         return ret;
     }
 
-    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
+    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                             env->menvcfg)) >> 32;
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
-                                    HENVCFG_HADE);
+                                    HENVCFG_ADUE);
     uint64_t valh = (uint64_t)val << 32;
     RISCVException ret;
 
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

In the same emulated RISC-V host, the 'host' KVM CPU takes 4 times
longer to boot than the 'rv64' KVM CPU.

The reason is an unintended behavior of riscv_cpu_satp_mode_finalize()
when satp_mode.supported = 0, i.e. when cpu_init() does not set
satp_mode_max_supported(). satp_mode_max_from_map(map) does:

31 - __builtin_clz(map)

This means that, if satp_mode.supported = 0, satp_mode_supported_max
wil be '31 - 32'. But this is C, so satp_mode_supported_max will gladly
set it to UINT_MAX (4294967295). After that, if the user didn't set a
satp_mode, set_satp_mode_default_map(cpu) will make

cfg.satp_mode.map = cfg.satp_mode.supported

So satp_mode.map = 0. And then satp_mode_map_max will be set to
satp_mode_max_from_map(cpu->cfg.satp_mode.map), i.e. also UINT_MAX. The
guard "satp_mode_map_max > satp_mode_supported_max" doesn't protect us
here since both are UINT_MAX.

And finally we have 2 loops:

for (int i = satp_mode_map_max - 1; i >= 0; --i) {

Which are, in fact, 2 loops from UINT_MAX -1 to -1. This is where the
extra delay when booting the 'host' CPU is coming from.

Commit 43d1de32f8 already set a precedence for satp_mode.supported = 0
in a different manner. We're doing the same here. If supported == 0,
interpret as 'the CPU wants the OS to handle satp mode alone' and skip
satp_mode_finalize().

We'll also put a guard in satp_mode_max_from_map() to assert out if map
is 0 since the function is not ready to deal with it.

Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
Fixes: 6f23aaeb9b ("riscv: Allow user to set the satp mode")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230817152903.694926-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static uint8_t satp_mode_from_str(const char *satp_mode_str)
 
 uint8_t satp_mode_max_from_map(uint32_t map)
 {
+    /*
+     * 'map = 0' will make us return (31 - 32), which C will
+     * happily overflow to UINT_MAX. There's no good result to
+     * return if 'map = 0' (e.g. returning 0 will be ambiguous
+     * with the result for 'map = 1').
+     *
+     * Assert out if map = 0. Callers will have to deal with
+     * it outside of this function.
+     */
+    g_assert(map > 0);
+
     /* map here has at least one bit set, so no problem with clz */
     return 31 - __builtin_clz(map);
 }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
 static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
 {
     bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
-    uint8_t satp_mode_map_max;
-    uint8_t satp_mode_supported_max =
-                        satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
+    uint8_t satp_mode_map_max, satp_mode_supported_max;
+
+    /* The CPU wants the OS to decide which satp mode to use */
+    if (cpu->cfg.satp_mode.supported == 0) {
+        return;
+    }
+
+    satp_mode_supported_max =
+                    satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
 
     if (cpu->cfg.satp_mode.map == 0) {
         if (cpu->cfg.satp_mode.init == 0) {
-- 
2.41.0

From: Vineet Gupta <vineetg@rivosinc.com>

zicond is now codegen supported in both llvm and gcc.

This change allows seamless enabling/testing of zicond in downstream
projects. e.g. currently riscv-gnu-toolchain parses elf attributes
to create a cmdline for qemu but fails short of enabling it because of
the "x-" prefix.

Signed-off-by: Vineet Gupta <vineetg@rivosinc.com>
Message-ID: <20230808181715.436395-1-vineetg@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("zcf", RISCVCPU, cfg.ext_zcf, false),
     DEFINE_PROP_BOOL("zcmp", RISCVCPU, cfg.ext_zcmp, false),
     DEFINE_PROP_BOOL("zcmt", RISCVCPU, cfg.ext_zcmt, false),
+    DEFINE_PROP_BOOL("zicond", RISCVCPU, cfg.ext_zicond, false),
 
     /* Vendor-specific custom extensions */
     DEFINE_PROP_BOOL("xtheadba", RISCVCPU, cfg.ext_xtheadba, false),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
 
     /* These are experimental so mark with 'x-' */
-    DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
 
     /* ePMP 0.9.3 */
     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

A build with --enable-debug and without KVM will fail as follows:

/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_riscv_virt.c.o: in function `virt_machine_init':
./qemu/build/../hw/riscv/virt.c:1465: undefined reference to `kvm_riscv_aia_create'

This happens because the code block with "if virt_use_kvm_aia(s)" isn't
being ignored by the debug build, resulting in an undefined reference to
a KVM only function.

Add a 'kvm_enabled()' conditional together with virt_use_kvm_aia() will
make the compiler crop the kvm_riscv_aia_create() call entirely from a
non-KVM build. Note that adding the 'kvm_enabled()' conditional inside
virt_use_kvm_aia() won't fix the build because this function would need
to be inlined multiple times to make the compiler zero out the entire
block.

While we're at it, use kvm_enabled() in all instances where
virt_use_kvm_aia() is checked to allow the compiler to elide these other
kvm-only instances as well.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Fixes: dbdb99948e ("target/riscv: select KVM AIA in riscv virt machine")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230830133503.711138-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
     }
 
     /* KVM AIA only has one APLIC instance */
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         create_fdt_socket_aplic(s, memmap, 0,
                                 msi_m_phandle, msi_s_phandle, phandle,
                                 &intc_phandles[0], xplic_phandles,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
     g_free(intc_phandles);
 
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         *irq_mmio_phandle = xplic_phandles[0];
         *irq_virtio_phandle = xplic_phandles[0];
         *irq_pcie_phandle = xplic_phandles[0];
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         }
     }
 
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
                              VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
                              memmap[VIRT_APLIC_S].base,
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 6df0b37e2ab breaks a --enable-debug build in a non-KVM
environment with the following error:

/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_intc_riscv_aplic.c.o: in function `riscv_kvm_aplic_request':
./qemu/build/../hw/intc/riscv_aplic.c:486: undefined reference to `kvm_set_irq'
collect2: error: ld returned 1 exit status

This happens because the debug build will poke into the
'if (is_kvm_aia(aplic->msimode))' block and fail to find a reference to
the KVM only function riscv_kvm_aplic_request().

There are multiple solutions to fix this. We'll go with the same
solution from the previous patch, i.e. add a kvm_enabled() conditional
to filter out the block. But there's a catch: riscv_kvm_aplic_request()
is a local function that would end up being used if the compiler crops
the block, and this won't work. Quoting Richard Henderson's explanation
in [1]:

"(...) the compiler won't eliminate entire unused functions with -O0"

We'll solve it by moving riscv_kvm_aplic_request() to kvm.c and add its
declaration in kvm_riscv.h, where all other KVM specific public
functions are already declared. Other archs handles KVM specific code in
this manner and we expect to do the same from now on.

[1] https://lore.kernel.org/qemu-riscv/d2f1ad02-eb03-138f-9d08-db676deeed05@linaro.org/

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230830133503.711138-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h | 1 +
 hw/intc/riscv_aplic.c    | 8 ++------
 target/riscv/kvm.c       | 5 +++++
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
                           uint64_t aia_irq_num, uint64_t aia_msi_num,
                           uint64_t aplic_base, uint64_t imsic_base,
                           uint64_t guest_num);
+void riscv_kvm_aplic_request(void *opaque, int irq, int level);
 
 #endif
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
+#include "kvm_riscv.h"
 #include "migration/vmstate.h"
 
 #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
     return topi;
 }
 
-static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
-{
-    kvm_set_irq(kvm_state, irq, !!level);
-}
-
 static void riscv_aplic_request(void *opaque, int irq, int level)
 {
     bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        if (is_kvm_aia(aplic->msimode)) {
+        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
         } else {
             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/runstate.h"
 #include "hw/riscv/numa.h"
 
+void riscv_kvm_aplic_request(void *opaque, int irq, int level)
+{
+    kvm_set_irq(kvm_state, irq, !!level);
+}
+
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
 {
-- 
2.41.0

From: Robbin Ehn <rehn@rivosinc.com>

This patch adds the new extensions in
linux 6.5 to the hwprobe syscall.

And fixes RVC check to OR with correct value.
The previous variable contains 0 therefore it
did work.

Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <bc82203b72d7efb30f1b4a8f9eb3d94699799dc8.camel@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/syscall.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
 #define RISCV_HWPROBE_KEY_IMA_EXT_0     4
 #define     RISCV_HWPROBE_IMA_FD       (1 << 0)
 #define     RISCV_HWPROBE_IMA_C        (1 << 1)
+#define     RISCV_HWPROBE_IMA_V        (1 << 2)
+#define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
+#define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
+#define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
 
 #define RISCV_HWPROBE_KEY_CPUPERF_0     5
 #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
                     riscv_has_ext(env, RVD) ?
                     RISCV_HWPROBE_IMA_FD : 0;
             value |= riscv_has_ext(env, RVC) ?
-                     RISCV_HWPROBE_IMA_C : pair->value;
+                     RISCV_HWPROBE_IMA_C : 0;
+            value |= riscv_has_ext(env, RVV) ?
+                     RISCV_HWPROBE_IMA_V : 0;
+            value |= cfg->ext_zba ?
+                     RISCV_HWPROBE_EXT_ZBA : 0;
+            value |= cfg->ext_zbb ?
+                     RISCV_HWPROBE_EXT_ZBB : 0;
+            value |= cfg->ext_zbs ?
+                     RISCV_HWPROBE_EXT_ZBS : 0;
             __put_user(value, &pair->value);
             break;
         case RISCV_HWPROBE_KEY_CPUPERF_0:
-- 
2.41.0

From: Ard Biesheuvel <ardb@kernel.org>

Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
implement the first half of the key schedule derivation. This does not
actually involve shifting rows, so clone the same value into all four
columns of the AES vector to counter that operation.

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230831154118.138727-1-ardb@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/crypto_helper.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
 
     uint8_t enc_rnum = rnum;
     uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
-    uint8_t rcon_ = 0;
-    target_ulong result;
+    AESState t, rc = {};
 
     if (enc_rnum != 0xA) {
         temp = ror32(temp, 8); /* Rotate right by 8 */
-        rcon_ = round_consts[enc_rnum];
+        rc.w[0] = rc.w[1] = round_consts[enc_rnum];
     }
 
-    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
-           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
-           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
-           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
+    t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
+    aesenc_SB_SR_AK(&t, &t, &rc, false);
 
-    temp ^= rcon_;
-
-    result = ((uint64_t)temp << 32) | temp;
-
-    return result;
+    return t.d[0];
 }
 
 target_ulong HELPER(aes64im)(target_ulong rs1)
-- 
2.41.0

From: Akihiko Odaki <akihiko.odaki@daynix.com>

riscv_trigger_init() had been called on reset events that can happen
several times for a CPU and it allocated timers for itrigger. If old
timers were present, they were simply overwritten by the new timers,
resulting in a memory leak.

Divide riscv_trigger_init() into two functions, namely
riscv_trigger_realize() and riscv_trigger_reset() and call them in
appropriate timing. The timer allocation will happen only once for a
CPU in riscv_trigger_realize().

Fixes: 5a4ae64cac ("target/riscv: Add itrigger support when icount is enabled")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230818034059.9146-1-akihiko.odaki@daynix.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.h |  3 ++-
 target/riscv/cpu.c   |  8 +++++++-
 target/riscv/debug.c | 15 ++++++++++++---
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs);
 bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
 
-void riscv_trigger_init(CPURISCVState *env);
+void riscv_trigger_realize(CPURISCVState *env);
+void riscv_trigger_reset_hold(CPURISCVState *env);
 
 bool riscv_itrigger_enabled(CPURISCVState *env);
 void riscv_itrigger_update_priv(CPURISCVState *env);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
 
 #ifndef CONFIG_USER_ONLY
     if (cpu->cfg.debug) {
-        riscv_trigger_init(env);
+        riscv_trigger_reset_hold(env);
     }
 
     if (kvm_enabled()) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 
     riscv_cpu_register_gdb_regs_for_features(cs);
 
+#ifndef CONFIG_USER_ONLY
+    if (cpu->cfg.debug) {
+        riscv_trigger_realize(&cpu->env);
+    }
+#endif
+
     qemu_init_vcpu(cs);
     cpu_reset(cs);
 
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
     return false;
 }
 
-void riscv_trigger_init(CPURISCVState *env)
+void riscv_trigger_realize(CPURISCVState *env)
+{
+    int i;
+
+    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
+        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                              riscv_itrigger_timer_cb, env);
+    }
+}
+
+void riscv_trigger_reset_hold(CPURISCVState *env)
 {
     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
     int i;
@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
         env->tdata3[i] = 0;
         env->cpu_breakpoint[i] = NULL;
         env->cpu_watchpoint[i] = NULL;
-        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                              riscv_itrigger_timer_cb, env);
+        timer_del(env->itrigger_timer[i]);
     }
 }
-- 
2.41.0

From: Leon Schuermann <leons@opentitan.org>

When the rule-lock bypass (RLB) bit is set in the mseccfg CSR, the PMP
configuration lock bits must not apply. While this behavior is
implemented for the pmpcfgX CSRs, this bit is not respected for
changes to the pmpaddrX CSRs. This patch ensures that pmpaddrX CSR
writes work even on locked regions when the global rule-lock bypass is
enabled.

Signed-off-by: Leon Schuermann <leons@opentitan.org>
Reviewed-by: Mayuresh Chitale <mchitale@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230829215046.1430463-1-leon@is.currently.online>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t pmp_get_a_field(uint8_t cfg)
  */
 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
 {
+    /* mseccfg.RLB is set */
+    if (MSECCFG_RLB_ISSET(env)) {
+        return 0;
+    }
 
     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
         return 1;
-- 
2.41.0

From: Tommy Wu <tommy.wu@sifive.com>

According to the new spec, when vsiselect has a reserved value, attempts
from M-mode or HS-mode to access vsireg, or from VS-mode to access
sireg, should preferably raise an illegal instruction exception.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-ID: <20230816061647.600672-1-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
 static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                      target_ulong new_val, target_ulong wr_mask)
 {
-    bool virt;
+    bool virt, isel_reserved;
     uint8_t *iprio;
     int ret = -EINVAL;
     target_ulong priv, isel, vgein;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
 
     /* Decode register details from CSR number */
     virt = false;
+    isel_reserved = false;
     switch (csrno) {
     case CSR_MIREG:
         iprio = env->miprio;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                                                   riscv_cpu_mxl_bits(env)),
                                     val, new_val, wr_mask);
         }
+    } else {
+        isel_reserved = true;
     }
 
 done:
     if (ret) {
-        return (env->virt_enabled && virt) ?
+        return (env->virt_enabled && virt && !isel_reserved) ?
                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
     }
     return RISCV_EXCP_NONE;
-- 
2.41.0

From: Nikita Shubin <n.shubin@yadro.com>

As per ISA:

"For CSRRWI, if rd=x0, then the instruction shall not read the CSR and
shall not cause any of the side effects that might occur on a CSR read."

trans_csrrwi() and trans_csrrw() call do_csrw() if rd=x0, do_csrw() calls
riscv_csrrw_do64(), via helper_csrw() passing NULL as *ret_value.

Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230808090914.17634-1-nikita.shubin@maquefel.me>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
                                        target_ulong write_mask)
 {
     RISCVException ret;
-    target_ulong old_value;
+    target_ulong old_value = 0;
 
     /* execute combined read/write operation if it exists */
     if (csr_ops[csrno].op) {
         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
     }
 
-    /* if no accessor exists then return failure */
-    if (!csr_ops[csrno].read) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-    /* read old value */
-    ret = csr_ops[csrno].read(env, csrno, &old_value);
-    if (ret != RISCV_EXCP_NONE) {
-        return ret;
+    /*
+     * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
+     * and we can't throw side effects caused by CSR reads.
+     */
+    if (ret_value) {
+        /* if no accessor exists then return failure */
+        if (!csr_ops[csrno].read) {
+            return RISCV_EXCP_ILLEGAL_INST;
+        }
+        /* read old value */
+        ret = csr_ops[csrno].read(env, csrno, &old_value);
+        if (ret != RISCV_EXCP_NONE) {
+            return ret;
+        }
     }
 
     /* write value if writable and write mask set, otherwise drop writes */
-- 
2.41.0