Series comparison

-[PULL 00/13] riscv-to-apply queue
+[PULL 00/59] riscv-to-apply queue
-From: Alistair Francis <alistair.francis@wdc.com>
+The following changes since commit 661c2e1ab29cd9c4d268ae3f44712e8d421c0e56:
-The following changes since commit 64ada298b98a51eb2512607f6e6180cb330c47b1:
+  scripts/checkpatch: Fix a typo (2025-03-04 09:30:26 +0800)
   Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220302' into staging (2022-03-02 12:38:46 +0000)
 are available in the Git repository at:
-  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20220303
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20250305-1
-for you to fetch changes up to 6b1accefd4876ea5475d55454c7d5b52c02cb73c:
+for you to fetch changes up to 4db19d5b21e058e6eb3474b6be470d1184afaa9e:
-  target/riscv: expose zfinx, zdinx, zhinx{min} properties (2022-03-03 13:14:50 +1000)
+  target/riscv/kvm: add missing KVM CSRs (2025-03-04 15:42:54 +1000)
 ----------------------------------------------------------------
-Fifth RISC-V PR for QEMU 7.0
+Third RISC-V PR for 10.0
- * Fixup checks for ext_zb[abcs]
+* CSR coverity fixes
- * Add AIA support for virt machine
+* Fix unexpected behavior of vector reduction instructions when vl is 0
- * Increase maximum number of CPUs in virt machine
+* Fix incorrect vlen comparison in prop_vlen_set
- * Fixup OpenTitan SPI address
+* Throw debug exception before page fault
- * Add support for zfinx, zdinx and zhinx{min} extensions
+* Remove redundant "hart_idx" masking from APLIC
 * Add support for Control Transfer Records Ext
 * Remove redundant struct members from the IOMMU
 * Remove duplicate definitions from the IOMMU
 * Fix tick_offset migration for Goldfish RTC
 * Add serial alias in virt machine DTB
 * Remove Bin Meng from RISC-V maintainers
 * Add support for Control Transfer Records Ext
 * Log guest errors when reserved bits are set in PTEs
 * Add missing Sdtrig disas CSRs
 * Correct the hpmevent sscofpmf mask
 * Mask upper sscofpmf bits during validation
 * Remove warnings about Smdbltrp/Smrnmi being disabled
 * Respect mseccfg.RLB bit for TOR mode PMP entry
 * Update KVM support to Linux 6.14-rc3
 * IOMMU HPM support
 * Support Sscofpmf/Svade/Svadu/Smnpm/Ssnpm extensions in KVM
 * Add --ignore-family option to binfmt
 * Refinement for AIA with KVM acceleration
 * Reset time changes for KVM
 ----------------------------------------------------------------
-Anup Patel (5):
+Alistair Francis (1):
-      hw/riscv: virt: Add optional AIA APLIC support to virt machine
+      MAINTAINERS: Remove Bin Meng from RISC-V maintainers
       hw/intc: Add RISC-V AIA IMSIC device emulation
       hw/riscv: virt: Add optional AIA IMSIC support to virt machine
       docs/system: riscv: Document AIA options for virt machine
       hw/riscv: virt: Increase maximum number of allowed CPUs
-Philipp Tomsich (1):
+Andrea Bolognani (3):
-      target/riscv: fix inverted checks for ext_zb[abcs]
+      binfmt: Shuffle things around
       binfmt: Normalize host CPU architecture
       binfmt: Add --ignore-family option
-Weiwei Li (6):
+Atish Patra (2):
-      target/riscv: add cfg properties for zfinx, zdinx and zhinx{min}
+      target/riscv: Fix the hpmevent mask
-      target/riscv: hardwire mstatus.FS to zero when enable zfinx
+      target/riscv: Mask out upper sscofpmf bits during validation
       target/riscv: add support for zfinx
       target/riscv: add support for zdinx
       target/riscv: add support for zhinx/zhinxmin
       target/riscv: expose zfinx, zdinx, zhinx{min} properties
-Wilfred Mallawa (1):
+Clément Léger (1):
-      hw: riscv: opentitan: fixup SPI addresses
+      target/riscv: remove warnings about Smdbltrp/Smrnmi being disabled
- docs/system/riscv/virt.rst                |  16 +
+Daniel Henrique Barboza (22):
- include/hw/intc/riscv_imsic.h             |  68 +++
+      target/riscv/csr.c: fix deadcode in rmw_xireg()
- include/hw/riscv/opentitan.h              |   4 +-
+      target/riscv/csr.c: fix 'ret' deadcode in rmw_xireg()
- include/hw/riscv/virt.h                   |  41 +-
+      target/riscv/csr.c: fix deadcode in rmw_xiregi()
- target/riscv/cpu.h                        |   4 +
+      target/riscv/csr.c: fix deadcode in aia_smode32()
- target/riscv/helper.h                     |   4 +-
+      target/riscv/cpu_helper.c: fix bad_shift in riscv_cpu_interrupt()
- target/riscv/internals.h                  |  32 +-
+      target/riscv/debug.c: use wp size = 4 for 32-bit CPUs
- hw/intc/riscv_imsic.c                     | 448 +++++++++++++++++++
+      target/riscv: throw debug exception before page fault
- hw/riscv/opentitan.c                      |  12 +-
+      target/riscv: add ssu64xl
- hw/riscv/virt.c                           | 698 +++++++++++++++++++++++++-----
+      target/riscv: use RVB in RVA22U64
- target/riscv/cpu.c                        |  17 +
+      target/riscv: add profile u_parent and s_parent
- target/riscv/cpu_helper.c                 |   6 +-
+      target/riscv: change priv_ver check in validate_profile()
- target/riscv/csr.c                        |  25 +-
+      target/riscv: add RVA23U64 profile
- target/riscv/fpu_helper.c                 | 178 ++++----
+      target/riscv: add RVA23S64 profile
- target/riscv/translate.c                  | 149 ++++++-
+      linux-headers: Update to Linux v6.14-rc3
- target/riscv/insn_trans/trans_rvb.c.inc   |   8 +-
+      target/riscv/cpu.c: create flag for ziccrse
- target/riscv/insn_trans/trans_rvd.c.inc   | 285 ++++++++----
+      target/riscv/kvm: add extensions after 6.14-rc3 update
- target/riscv/insn_trans/trans_rvf.c.inc   | 314 ++++++++++----
+      hw/riscv/riscv-iommu.h: add missing headers
- target/riscv/insn_trans/trans_rvzfh.c.inc | 332 ++++++++++----
+      hw/riscv: add IOMMU HPM trace events
- hw/intc/Kconfig                           |   3 +
+      docs/specs/riscv-iommu.rst: add HPM support info
- hw/intc/meson.build                       |   1 +
+      target/riscv/cpu: remove unneeded !kvm_enabled() check
- hw/riscv/Kconfig                          |   2 +
+      target/riscv/kvm: add kvm_riscv_reset_regs_csr()
-files changed, 2146 insertions(+), 501 deletions(-)
+      target/riscv/kvm: add missing KVM CSRs
- create mode 100644 include/hw/intc/riscv_imsic.h
- create mode 100644 hw/intc/riscv_imsic.c
+Huang Borong (1):
       hw/intc/riscv_aplic: Remove redundant "hart_idx" masking
 Jason Chien (2):
       hw/riscv/riscv-iommu: Remove redundant struct members
       hw/riscv/riscv-iommu-bits: Remove duplicate definitions
 Max Chou (2):
       target/riscv: rvv: Fix unexpected behavior of vector reduction instructions when vl is 0
       target/riscv: rvv: Fix incorrect vlen comparison in prop_vlen_set
 Quan Zhou (1):
       target/riscv/kvm: Add some exts support
 Rajnesh Kanwal (7):
       target/riscv: Remove obsolete sfence.vm instruction
       target/riscv: Add Control Transfer Records CSR definitions.
       target/riscv: Add support for Control Transfer Records extension CSRs.
       target/riscv: Add support to record CTR entries.
       target/riscv: Add CTR sctrclr instruction.
       target/riscv: machine: Add Control Transfer Record state description
       target/riscv: Add support to access ctrsource, ctrtarget, ctrdata regs.
 Rob Bradford (3):
       disas/riscv: Fix minor whitespace issues
       disas/riscv: Add missing Sdtrig CSRs
       target/riscv: Respect mseccfg.RLB bit for TOR mode PMP entry
 Rodrigo Dias Correa (1):
       goldfish_rtc: Fix tick_offset migration
 Tomasz Jeznach (8):
       hw/riscv/riscv-iommu-bits.h: HPM bits
       hw/riscv/riscv-iommu: add riscv-iommu-hpm file
       hw/riscv/riscv-iommu: add riscv_iommu_hpm_incr_ctr()
       hw/riscv/riscv-iommu: instantiate hpm_timer
       hw/riscv/riscv-iommu: add IOCOUNTINH mmio writes
       hw/riscv/riscv-iommu: add IOHPMCYCLES mmio write
       hw/riscv/riscv-iommu: add hpm events mmio write
       hw/riscv/riscv-iommu.c: add RISCV_IOMMU_CAP_HPM cap
 Vasilis Liaskovitis (1):
       hw/riscv/virt: Add serial alias in DTB
 Yong-Xuan Wang (3):
       hw/intc/imsic: refine the IMSIC realize
       hw/intc/aplic: refine the APLIC realize
       hw/intc/aplic: refine kvm_msicfgaddr
 julia (1):
       target/riscv: log guest errors when reserved bits are set in PTEs
  MAINTAINERS                                        |   5 +-
  docs/specs/riscv-iommu.rst                         |   2 +
  hw/riscv/riscv-iommu-bits.h                        |  69 +++-
  hw/riscv/riscv-iommu-hpm.h                         |  33 ++
  hw/riscv/riscv-iommu.h                             |  32 +-
  include/standard-headers/linux/ethtool.h           |   4 +
  include/standard-headers/linux/fuse.h              |  76 +++-
  include/standard-headers/linux/input-event-codes.h |   1 +
  include/standard-headers/linux/pci_regs.h          |  16 +-
  include/standard-headers/linux/virtio_pci.h        |  14 +
  linux-headers/asm-arm64/kvm.h                      |   3 -
  linux-headers/asm-loongarch/kvm_para.h             |   1 +
  linux-headers/asm-riscv/kvm.h                      |   7 +-
  linux-headers/asm-x86/kvm.h                        |   1 +
  linux-headers/linux/iommufd.h                      |  35 +-
  linux-headers/linux/kvm.h                          |   8 +-
  linux-headers/linux/stddef.h                       |  13 +-
  linux-headers/linux/vduse.h                        |   2 +-
  target/riscv/cpu-qom.h                             |   2 +
  target/riscv/cpu.h                                 |  16 +-
  target/riscv/cpu_bits.h                            | 150 +++++++-
  target/riscv/cpu_cfg.h                             |   5 +
  target/riscv/helper.h                              |   2 +
  target/riscv/insn32.decode                         |   2 +-
  disas/riscv.c                                      |  16 +-
  hw/intc/riscv_aplic.c                              |  74 ++--
  hw/intc/riscv_imsic.c                              |  47 +--
  hw/riscv/riscv-iommu-hpm.c                         | 381 +++++++++++++++++++++
  hw/riscv/riscv-iommu.c                             | 131 ++++++-
  hw/riscv/virt.c                                    |   3 +
  hw/rtc/goldfish_rtc.c                              |  43 +--
  target/riscv/cpu.c                                 | 115 ++++++-
  target/riscv/cpu_helper.c                          | 315 ++++++++++++++++-
  target/riscv/csr.c                                 | 318 +++++++++++++++--
  target/riscv/debug.c                               |   6 +-
  target/riscv/kvm/kvm-cpu.c                         |  40 ++-
  target/riscv/machine.c                             |  25 ++
  target/riscv/op_helper.c                           |  48 +++
  target/riscv/pmp.c                                 |   2 +-
  target/riscv/pmu.c                                 |   2 +-
  target/riscv/tcg/tcg-cpu.c                         |  58 +++-
  target/riscv/translate.c                           |  46 +++
  target/riscv/vector_helper.c                       |   8 +-
  target/riscv/insn_trans/trans_privileged.c.inc     |  18 +-
  target/riscv/insn_trans/trans_rvi.c.inc            |  75 ++++
  target/riscv/insn_trans/trans_rvzce.c.inc          |  21 ++
  hw/riscv/meson.build                               |   3 +-
  hw/riscv/trace-events                              |   5 +
  scripts/qemu-binfmt-conf.sh                        |  78 +++--
  tests/data/acpi/riscv64/virt/RHCT                  | Bin 390 -> 400 bytes
 files changed, 2106 insertions(+), 271 deletions(-)
  create mode 100644 hw/riscv/riscv-iommu-hpm.h
  create mode 100644 hw/riscv/riscv-iommu-hpm.c

-New patch
+[PULL 01/59] target/riscv/csr.c: fix deadcode in rmw_xireg()
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Coverity found a DEADCODE issue in rmw_xireg() claiming that we can't
+reach 'RISCV_EXCP_VIRT_INSTRUCTION_FAULT' at the 'done' label:
+done:
+    if (ret) {
+        return (env->virt_enabled && virt) ?
+               RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
+    }
+    return RISCV_EXCP_NONE;
+This happens because the 'virt' flag, which is only used by 'done', is
+set to 'false' and it will always remain 'false' in any condition where
+we'll jump to 'done':
+    switch (csrno) {
+    (...)
+    case CSR_VSIREG:
+        isel = env->vsiselect;
+        virt = true;
+        break;
+    default:
+        goto done;
+    };
+'virt = true' will never reach 'done' because we have a if/else-if/else
+block right before the label that will always return:
+    if (xiselect_aia_range(isel)) {
+        return ...
+    } else if (...) {
+        return ...
+    } else {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+All this means that we can preserve the current logic by reducing the
+'done' label to:
+done:
+    if (ret) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+    return RISCV_EXCP_NONE;
+The flag 'virt' is now unused. Remove it.
+Fix the 'goto done' identation while we're at it.
+Resolves: Coverity CID 1590359
+Fixes: dc0280723d ("target/riscv: Decouple AIA processing from xiselect and xireg")
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250121184847.2109128-2-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/csr.c | 7 ++-----
+file changed, 2 insertions(+), 5 deletions(-)
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/csr.c
++++ b/target/riscv/csr.c
+@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
+                                 target_ulong *val, target_ulong new_val,
+                                 target_ulong wr_mask)
+ {
+-    bool virt = false;
+     int ret = -EINVAL;
+     target_ulong isel;
+@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
+         break;
+     case CSR_VSIREG:
+         isel = env->vsiselect;
+-        virt = true;
+         break;
+     default:
+-         goto done;
++        goto done;
+     };
+     /*
+@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
+ done:
+     if (ret) {
+-        return (env->virt_enabled && virt) ?
+-               RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
++        return RISCV_EXCP_ILLEGAL_INST;
+     }
+     return RISCV_EXCP_NONE;
+ }
+--
+.48.1

-New patch
+[PULL 02/59] target/riscv/csr.c: fix 'ret' deadcode in rmw_xireg()
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Coverity found a second DEADCODE issue in rmw_xireg() claiming that we can't
+reach 'RISCV_EXCP_NONE' at the 'done' label:
+ > 2706     done:
+ > 2707         if (ret) {
+ > 2708             return (env->virt_enabled && virt) ?
+ > 2709                    RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
+ > 2710         }
+ >>>>      CID 1590356:  Control flow issues  (DEADCODE)
+ >>>>      Execution cannot reach this statement: "return RISCV_EXCP_NONE;".
+ > 2711         return RISCV_EXCP_NONE;
+Our label is now reduced after fixing another deadcode in the previous
+patch but the problem reported here still remains:
+ done:
+    if (ret) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+    return RISCV_EXCP_NONE;
+This happens because 'ret' changes only once at the start of the
+function:
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_SVSLCT);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+So it's a guarantee that ret will be RISCV_EXCP_NONE (-1) if we ever
+reach the label, i.e. "if (ret)" will always be true, and  the label can
+be even further reduced to:
+done:
+    return RISCV_EXCP_ILLEGAL_INST;
+To make a better use of the label, remove the 'else' from the
+xiselect_aia_range() chain and let it fall-through to the 'done' label
+since they are now both returning RISCV_EXCP_ILLEGAL_INST.
+Resolves: Coverity CID 1590356
+Fixes: dc0280723d ("target/riscv: Decouple AIA processing from xiselect and xireg")
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250121184847.2109128-3-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/csr.c | 7 +------
+file changed, 1 insertion(+), 6 deletions(-)
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/csr.c
++++ b/target/riscv/csr.c
+@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
+     } else if (riscv_cpu_cfg(env)->ext_smcsrind ||
+                riscv_cpu_cfg(env)->ext_sscsrind) {
+         return rmw_xireg_csrind(env, csrno, isel, val, new_val, wr_mask);
+-    } else {
+-        return RISCV_EXCP_ILLEGAL_INST;
+     }
+ done:
+-    if (ret) {
+-        return RISCV_EXCP_ILLEGAL_INST;
+-    }
+-    return RISCV_EXCP_NONE;
++    return RISCV_EXCP_ILLEGAL_INST;
+ }
+ static RISCVException rmw_xtopei(CPURISCVState *env, int csrno,
+--
+.48.1

-New patch
+[PULL 03/59] target/riscv/csr.c: fix deadcode in rmw_xiregi()
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Coverity found a DEADCODE issue in rmw_xiregi() claiming that we can't
+reach 'RISCV_EXCP_VIRT_INSTRUCTION_FAULT' at the 'done' label:
+ > 2652     done:
+ >>>>      CID 1590357:  Control flow issues  (DEADCODE)
+ >>>>      Execution cannot reach the expression "RISCV_EXCP_VIRT_INSTRUCTION_FAULT"
+     inside this statement: "return (env->virt_enabled &...".
+ > 2653         return (env->virt_enabled && virt) ?
+ > 2654                 RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
+This happens because 'virt' is being set to 'false' and it will remain
+as 'false' in any code path where 'done' will be called. The label can
+be safely reduced to:
+done:
+     return RISCV_EXCP_ILLEGAL_INST;
+And that will leave us with the following usage of a 'goto' skipping a
+single 'return' to do another single 'return':
+     } else {
+        goto done;
+     }
+     return rmw_xireg_csrind(env, csrno, isel, val, new_val, wr_mask);
+done:
+     return RISCV_EXCP_ILLEGAL_INST;
+Which we will eliminate it and just do 'return RISCV_EXCP_ILLEGAL_INST'
+instead.
+Resolves: Coverity CID 1590357
+Fixes: 5e33a20827 ("target/riscv: Support generic CSR indirect access")
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250121184847.2109128-4-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/csr.c | 8 +-------
+file changed, 1 insertion(+), 7 deletions(-)
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/csr.c
++++ b/target/riscv/csr.c
+@@ -XXX,XX +XXX,XX @@ static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
+ static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
+                       target_ulong new_val, target_ulong wr_mask)
+ {
+-    bool virt = false;
+     int ret = -EINVAL;
+     target_ulong isel;
+@@ -XXX,XX +XXX,XX @@ static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
+     } else if (CSR_VSIREG <= csrno && csrno <= CSR_VSIREG6 &&
+                csrno != CSR_VSIREG4 - 1) {
+         isel = env->vsiselect;
+-        virt = true;
+     } else {
+-        goto done;
++        return RISCV_EXCP_ILLEGAL_INST;
+     }
+     return rmw_xireg_csrind(env, csrno, isel, val, new_val, wr_mask);
+-
+-done:
+-    return (env->virt_enabled && virt) ?
+-            RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
+ }
+ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
+--
+.48.1

-New patch
+[PULL 04/59] target/riscv/csr.c: fix deadcode in aia_smode32()
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Coverity reported a DEADCODE ticket in this function, as follows:
+ >>>>      CID 1590358:  Control flow issues  (DEADCODE)
+ >>>>      Execution cannot reach this statement: "return ret;".
+ > 380             return ret;
+ > 381         }
+The cause is that the 'if (ret != RISCV_EXCP_NONE)' conditional is
+duplicated:
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_AIA);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+Remove the duplication to fix the deadcode.
+Resolves: Coverity CID 1590358
+Fixes: dbcb6e1ccf ("target/riscv: Enable S*stateen bits for AIA")
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250121184847.2109128-5-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/csr.c | 4 ----
+file changed, 4 deletions(-)
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/csr.c
++++ b/target/riscv/csr.c
+@@ -XXX,XX +XXX,XX @@ static RISCVException aia_smode32(CPURISCVState *env, int csrno)
+         return ret;
+     }
+-    if (ret != RISCV_EXCP_NONE) {
+-        return ret;
+-    }
+-
+     return smode32(env, csrno);
+ }
+--
+.48.1

-New patch
+[PULL 05/59] target/riscv/cpu_helper.c: fix bad_shift in riscv_cpu_interrupt()
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Coverity reported a BAD_SHIFT issue in the following code:
+ > 2097
+ >>>>      CID 1590355:  Integer handling issues  (BAD_SHIFT)
+ >>>>      In expression "hdeleg >> cause", right shifting by more than 63
+       bits has undefined behavior.  The shift amount, "cause", is at least 64.
+ > 2098         vsmode_exc = env->virt_enabled && (((hdeleg >> cause) & 1) || vs_injected);
+ > 2099         /*
+It is not clear to me how the tool guarantees that '"cause" is at least
+', but indeed there's no guarantees that it would be < 64 in the
+'async = true' code path.
+A simple fix to avoid a potential UB is to add a 'cause < 64' guard like
+'mode' is already doing right before 'vsmode_exc'.
+Resolves: Coverity CID 1590355
+Fixes: 967760f62c ("target/riscv: Implement Ssdbltrp exception handling")
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250121184847.2109128-6-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_helper.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_helper.c
++++ b/target/riscv/cpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
+     mode = env->priv <= PRV_S && cause < 64 &&
+         (((deleg >> cause) & 1) || s_injected || vs_injected) ? PRV_S : PRV_M;
+-    vsmode_exc = env->virt_enabled && (((hdeleg >> cause) & 1) || vs_injected);
++    vsmode_exc = env->virt_enabled && cause < 64 &&
++        (((hdeleg >> cause) & 1) || vs_injected);
++
+     /*
+      * Check double trap condition only if already in S-mode and targeting
+      * S-mode
+--
+.48.1

-New patch
+[PULL 06/59] target/riscv: rvv: Fix unexpected behavior of vector reduction instructions when vl is 0
+From: Max Chou <max.chou@sifive.com>
+According to the Vector Reduction Operations section in the RISC-V "V"
+Vector Extension spec,
+"If vl=0, no operation is performed and the destination register is not
+updated."
+The vd should be updated when vl is larger than 0.
+Fixes: fe5c9ab1fc ("target/riscv: vector single-width integer reduction instructions")
+Fixes: f714361ed7 ("target/riscv: rvv-1.0: implement vstart CSR")
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20250124101452.2519171-1-max.chou@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/vector_helper.c | 8 ++++++--
+file changed, 6 insertions(+), 2 deletions(-)
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/vector_helper.c
++++ b/target/riscv/vector_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
+         }                                                 \
+         s1 = OP(s1, (TD)s2);                              \
+     }                                                     \
+-    *((TD *)vd + HD(0)) = s1;                             \
++    if (vl > 0) {                                         \
++        *((TD *)vd + HD(0)) = s1;                         \
++    }                                                     \
+     env->vstart = 0;                                      \
+     /* set tail elements to 1s */                         \
+     vext_set_elems_1s(vd, vta, esz, vlenb);               \
+@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,           \
+         }                                                  \
+         s1 = OP(s1, (TD)s2, &env->fp_status);              \
+     }                                                      \
+-    *((TD *)vd + HD(0)) = s1;                              \
++    if (vl > 0) {                                          \
++        *((TD *)vd + HD(0)) = s1;                          \
++    }                                                      \
+     env->vstart = 0;                                       \
+     /* set tail elements to 1s */                          \
+     vext_set_elems_1s(vd, vta, esz, vlenb);                \
+--
+.48.1

-[PULL 13/13] target/riscv: expose zfinx, zdinx, zhinx{min} properties
+[PULL 07/59] target/riscv: rvv: Fix incorrect vlen comparison in prop_vlen_set
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Max Chou <max.chou@sifive.com>
-Co-authored-by: ardxwe <ardxwe@gmail.com>
+In prop_vlen_set function, there is an incorrect comparison between
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+vlen(bit) and vlenb(byte).
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+This will cause unexpected error when user applies the `vlen=1024` cpu
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+option with a vendor predefined cpu type that the default vlen is
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+(vlenb=128).
-Message-Id: <20220211043920.28981-7-liweiwei@iscas.ac.cn>
 Fixes: 4f6d036ccc ("target/riscv/cpu.c: remove cpu->cfg.vlen")
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20250124090539.2506448-1-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 5 +++++
+ target/riscv/cpu.c | 5 +++--
-file changed, 5 insertions(+)
+file changed, 3 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static void prop_vlen_set(Object *obj, Visitor *v, const char *name,
-     DEFINE_PROP_BOOL("zbc", RISCVCPU, cfg.ext_zbc, true),
+                          void *opaque, Error **errp)
-     DEFINE_PROP_BOOL("zbs", RISCVCPU, cfg.ext_zbs, true),
+ {
+     RISCVCPU *cpu = RISCV_CPU(obj);
-+    DEFINE_PROP_BOOL("zdinx", RISCVCPU, cfg.ext_zdinx, false),
++    uint16_t cpu_vlen = cpu->cfg.vlenb << 3;
-+    DEFINE_PROP_BOOL("zfinx", RISCVCPU, cfg.ext_zfinx, false),
+     uint16_t value;
-+    DEFINE_PROP_BOOL("zhinx", RISCVCPU, cfg.ext_zhinx, false),
-+    DEFINE_PROP_BOOL("zhinxmin", RISCVCPU, cfg.ext_zhinxmin, false),
+     if (!visit_type_uint16(v, name, &value, errp)) {
-+
+@@ -XXX,XX +XXX,XX @@ static void prop_vlen_set(Object *obj, Visitor *v, const char *name,
-     /* Vendor-specific custom extensions */
+         return;
-     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
+     }
 -    if (value != cpu->cfg.vlenb && riscv_cpu_is_vendor(obj)) {
 +    if (value != cpu_vlen && riscv_cpu_is_vendor(obj)) {
          cpu_set_prop_err(cpu, name, errp);
          error_append_hint(errp, "Current '%s' val: %u\n",
 -                          name, cpu->cfg.vlenb << 3);
 +                          name, cpu_vlen);
          return;
      }
 --
-.35.1
+.48.1

-New patch
+[PULL 08/59] target/riscv/debug.c: use wp size = 4 for 32-bit CPUs
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+The mcontrol select bit (19) is always zero, meaning our triggers will
+always match virtual addresses. In this condition, if the user does not
+specify a size for the trigger, the access size defaults to XLEN.
+At this moment we're using def_size = 8 regardless of CPU XLEN. Use
+def_size = 4 in case we're running 32 bits.
+Fixes: 95799e36c1 ("target/riscv: Add initial support for the Sdtrig extension")
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-ID: <20250121170626.1992570-2-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/debug.c | 6 ++++--
+file changed, 4 insertions(+), 2 deletions(-)
+diff --git a/target/riscv/debug.c b/target/riscv/debug.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/debug.c
++++ b/target/riscv/debug.c
+@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
+     bool enabled = type2_breakpoint_enabled(ctrl);
+     CPUState *cs = env_cpu(env);
+     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
+-    uint32_t size;
++    uint32_t size, def_size;
+     if (!enabled) {
+         return;
+@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
+             cpu_watchpoint_insert(cs, addr, size, flags,
+                                   &env->cpu_watchpoint[index]);
+         } else {
+-            cpu_watchpoint_insert(cs, addr, 8, flags,
++            def_size = riscv_cpu_mxl(env) == MXL_RV64 ? 8 : 4;
++
++            cpu_watchpoint_insert(cs, addr, def_size, flags,
+                                   &env->cpu_watchpoint[index]);
+         }
+     }
+--
+.48.1

-New patch
+[PULL 09/59] target/riscv: throw debug exception before page fault
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+In the RISC-V privileged ISA section 3.1.15 table 15, it is determined
+that a debug exception that is triggered from a load/store has a higher
+priority than a possible fault that this access might trigger.
+This is not the case ATM as shown in [1]. Adding a breakpoint in an
+address that deliberately will fault is causing a load page fault
+instead of a debug exception. The reason is that we're throwing in the
+page fault as soon as the fault occurs (end of riscv_cpu_tlb_fill(),
+raise_mmu_exception()), not allowing the installed watchpoints to
+trigger.
+Call cpu_check_watchpoint() in the page fault path to search and execute
+any watchpoints that might exist for the address, never returning back
+to the fault path. If no watchpoints are found cpu_check_watchpoint()
+will return and we'll fall-through the regular path to
+raise_mmu_exception().
+[1] https://gitlab.com/qemu-project/qemu/-/issues/2627
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2627
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20250121170626.1992570-3-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_helper.c | 18 ++++++++++++++++++
+file changed, 18 insertions(+)
+diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_helper.c
++++ b/target/riscv/cpu_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/page-protection.h"
+ #include "instmap.h"
+ #include "tcg/tcg-op.h"
++#include "hw/core/tcg-cpu-ops.h"
+ #include "trace.h"
+ #include "semihosting/common-semi.h"
+ #include "system/cpu-timers.h"
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+     } else if (probe) {
+         return false;
+     } else {
++        int wp_access = 0;
++
++        if (access_type == MMU_DATA_LOAD) {
++            wp_access |= BP_MEM_READ;
++        } else if (access_type == MMU_DATA_STORE) {
++            wp_access |= BP_MEM_WRITE;
++        }
++
++        /*
++         * If a watchpoint isn't found for 'addr' this will
++         * be a no-op and we'll resume the mmu_exception path.
++         * Otherwise we'll throw a debug exception and execution
++         * will continue elsewhere.
++         */
++        cpu_check_watchpoint(cs, address, size, MEMTXATTRS_UNSPECIFIED,
++                             wp_access, retaddr);
++
+         raise_mmu_exception(env, address, access_type, pmp_violation,
+                             first_stage_error, two_stage_lookup,
+                             two_stage_indirect_error);
+--
+.48.1

-New patch
+[PULL 10/59] hw/intc/riscv_aplic: Remove redundant "hart_idx" masking
+From: Huang Borong <huangborong@bosc.ac.cn>
+Remove the redundant masking of "hart_idx", as the same operation is
+performed later during address calculation.
+This change impacts the "hart_idx" value in the final qemu_log_mask()
+call. The original "hart_idx" parameter should be used for logging to
+ensure accuracy, rather than the masked value.
+Signed-off-by: Huang Borong <huangborong@bosc.ac.cn>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20250115035105.19600-1-huangborong@bosc.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/intc/riscv_aplic.c | 1 -
+file changed, 1 deletion(-)
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/riscv_aplic.c
++++ b/hw/intc/riscv_aplic.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
+             APLIC_xMSICFGADDRH_HHXW_MASK;
+     group_idx = hart_idx >> lhxw;
+-    hart_idx &= APLIC_xMSICFGADDR_PPN_LHX_MASK(lhxw);
+     addr = msicfgaddr;
+     addr |= ((uint64_t)(msicfgaddrH & APLIC_xMSICFGADDRH_BAPPN_MASK)) << 32;
+--
+.48.1

-New patch
+[PULL 11/59] target/riscv: add ssu64xl
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+ssu64xl is defined in RVA22 as:
+"sstatus.UXL must be capable of holding the value 2 (i.e., UXLEN=64 must
+be supported)."
+This is always true in TCG and it's mandatory for RVA23, so claim
+support for it.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250115184316.2344583-2-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.c                |   1 +
+ tests/data/acpi/riscv64/virt/RHCT | Bin 390 -> 398 bytes
+files changed, 1 insertion(+)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
+     ISA_EXT_DATA_ENTRY(sstvala, PRIV_VERSION_1_12_0, has_priv_1_12),
+     ISA_EXT_DATA_ENTRY(sstvecd, PRIV_VERSION_1_12_0, has_priv_1_12),
++    ISA_EXT_DATA_ENTRY(ssu64xl, PRIV_VERSION_1_12_0, has_priv_1_12),
+     ISA_EXT_DATA_ENTRY(supm, PRIV_VERSION_1_13_0, ext_supm),
+     ISA_EXT_DATA_ENTRY(svade, PRIV_VERSION_1_11_0, ext_svade),
+     ISA_EXT_DATA_ENTRY(svadu, PRIV_VERSION_1_12_0, ext_svadu),
+diff --git a/tests/data/acpi/riscv64/virt/RHCT b/tests/data/acpi/riscv64/virt/RHCT
+index XXXXXXX..XXXXXXX 100644
+Binary files a/tests/data/acpi/riscv64/virt/RHCT and b/tests/data/acpi/riscv64/virt/RHCT differ
+--
+.48.1

-New patch
+[PULL 12/59] target/riscv: use RVB in RVA22U64
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+From the time we added RVA22U64 until now the spec didn't declare 'RVB'
+as a dependency, using zba/zbb/zbs instead. Since then the RVA22 spec
+[1] added the following in the 'RVA22U64 Mandatory Extensions' section:
+"B Bit-manipulation instructions
+Note: The B extension comprises the Zba, Zbb, and Zbs extensions. At the
+time of RVA22U64's ratification, the B extension had not yet been
+defined, and so RVA22U64 explicitly mandated Zba, Zbb, and Zbs instead.
+Mandating B is equivalent."
+It is also equivalent to QEMU (see riscv_cpu_validate_b() in
+target/riscv/tcg/tcg-cpu.c).
+Finally, RVA23U64 [2] directly mentions RVB as a mandatory extension,
+not citing zba/zbb/zbs.
+To make it clear that RVA23U64 will extend RVA22U64 (i.e. RVA22 is a
+parent of RVA23), use RVB in RVA22U64 as well.
+(bios-tables-test change: RVB added to riscv,isa)
+[1] https://github.com/riscv/riscv-profiles/blob/main/src/profiles.adoc#61-rva22u64-profile
+[2] https://github.com/riscv/riscv-profiles/blob/main/src/rva23-profile.adoc#rva23u64-profile
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250115184316.2344583-3-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.c                |   2 +-
+ tests/data/acpi/riscv64/virt/RHCT | Bin 398 -> 400 bytes
+files changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const PropertyInfo prop_marchid = {
+ static RISCVCPUProfile RVA22U64 = {
+     .parent = NULL,
+     .name = "rva22u64",
+-    .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
++    .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVB | RVU,
+     .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
+     .satp_mode = RISCV_PROFILE_ATTR_UNUSED,
+     .ext_offsets = {
+diff --git a/tests/data/acpi/riscv64/virt/RHCT b/tests/data/acpi/riscv64/virt/RHCT
+index XXXXXXX..XXXXXXX 100644
+Binary files a/tests/data/acpi/riscv64/virt/RHCT and b/tests/data/acpi/riscv64/virt/RHCT differ
+--
+.48.1

-[PULL 08/13] target/riscv: add cfg properties for zfinx, zdinx and zhinx{min}
+[PULL 13/59] target/riscv: add profile u_parent and s_parent
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Co-authored-by: ardxwe <ardxwe@gmail.com>
+The current 'parent' mechanic for profiles allows for one profile to be
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+a child of a previous/older profile, enabling all its extensions (and
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+the parent profile itself) and sparing us from tediously listing all
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+extensions for every profile.
 This works fine for u-mode profiles. For s-mode profiles this is not
 enough: a s-mode profile extends not only his equivalent u-mode profile
 but also the previous s-mode profile. This means, for example, that
 RVA23S64 extends both RVA23U64 and RVA22S64.
 To fit this usage, rename the existing 'parent' to 'u_parent' and add a
 new 's_parent' attribute for profiles. Handle both like we were doing
 with the previous 'parent' attribute, i.e. if set, enable it. This
 change does nothing for the existing profiles but will make RVA23S64
 simpler.
 Suggested-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220211043920.28981-2-liweiwei@iscas.ac.cn>
+Message-ID: <20250115184316.2344583-4-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h |  4 ++++
+ target/riscv/cpu.h         |  3 ++-
- target/riscv/cpu.c | 12 ++++++++++++
+ target/riscv/cpu.c         |  6 ++++--
-files changed, 16 insertions(+)
+ target/riscv/tcg/tcg-cpu.c | 35 ++++++++++++++++++++++++++---------
 files changed, 32 insertions(+), 12 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+@@ -XXX,XX +XXX,XX @@ const char *riscv_get_misa_ext_description(uint32_t bit);
-     bool ext_svinval;
+ #define CPU_CFG_OFFSET(_prop) offsetof(struct RISCVCPUConfig, _prop)
-     bool ext_svnapot;
-     bool ext_svpbmt;
+ typedef struct riscv_cpu_profile {
-+    bool ext_zdinx;
+-    struct riscv_cpu_profile *parent;
-     bool ext_zfh;
++    struct riscv_cpu_profile *u_parent;
-     bool ext_zfhmin;
++    struct riscv_cpu_profile *s_parent;
-+    bool ext_zfinx;
+     const char *name;
-+    bool ext_zhinx;
+     uint32_t misa_ext;
-+    bool ext_zhinxmin;
+     bool enabled;
      bool ext_zve32f;
      bool ext_zve64f;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static const PropertyInfo prop_marchid = {
-             cpu->cfg.ext_d = true;
+  * doesn't need to be manually enabled by the profile.
-         }
+  */
+ static RISCVCPUProfile RVA22U64 = {
-+        if (cpu->cfg.ext_zdinx || cpu->cfg.ext_zhinx ||
+-    .parent = NULL,
-+            cpu->cfg.ext_zhinxmin) {
++    .u_parent = NULL,
-+            cpu->cfg.ext_zfinx = true;
++    .s_parent = NULL,
-+        }
+     .name = "rva22u64",
      .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVB | RVU,
      .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
   * The remaining features/extensions comes from RVA22U64.
   */
  static RISCVCPUProfile RVA22S64 = {
 -    .parent = &RVA22U64,
 +    .u_parent = &RVA22U64,
 +    .s_parent = NULL,
      .name = "rva22s64",
      .misa_ext = RVS,
      .priv_spec = PRIV_VERSION_1_12_0,
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_validate_profile_satp(RISCVCPU *cpu,
  }
  #endif
 +static void riscv_cpu_check_parent_profile(RISCVCPU *cpu,
 +                                           RISCVCPUProfile *profile,
 +                                           RISCVCPUProfile *parent)
 +{
 +    const char *parent_name;
 +    bool parent_enabled;
 +
-         /* Set the ISA extensions, checks should have happened above */
++    if (!profile->enabled || !parent) {
-         if (cpu->cfg.ext_i) {
++        return;
-             ext |= RVI;
++    }
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
++
-         if (cpu->cfg.ext_j) {
++    parent_name = parent->name;
-             ext |= RVJ;
++    parent_enabled = object_property_get_bool(OBJECT(cpu), parent_name, NULL);
-         }
++    profile->enabled = parent_enabled;
-+        if (cpu->cfg.ext_zfinx && ((ext & (RVF | RVD)) || cpu->cfg.ext_zfh ||
++}
-+                                   cpu->cfg.ext_zfhmin)) {
++
-+            error_setg(errp,
+ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
-+                    "'Zfinx' cannot be supported together with 'F', 'D', 'Zfh',"
+                                        RISCVCPUProfile *profile)
-+                    " 'Zfhmin'");
+ {
-+            return;
+     CPURISCVState *env = &cpu->env;
-+        }
+     const char *warn_msg = "Profile %s mandates disabled extension %s";
+     bool send_warn = profile->user_set && profile->enabled;
-         set_misa(env, env->misa_mxl, ext);
+-    bool parent_enabled, profile_impl = true;
 +    bool profile_impl = true;
      int i;
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
      profile->enabled = profile_impl;
 -    if (profile->parent != NULL) {
 -        parent_enabled = object_property_get_bool(OBJECT(cpu),
 -                                                  profile->parent->name,
 -                                                  NULL);
 -        profile->enabled = profile->enabled && parent_enabled;
 -    }
 +    riscv_cpu_check_parent_profile(cpu, profile, profile->u_parent);
 +    riscv_cpu_check_parent_profile(cpu, profile, profile->s_parent);
  }
  static void riscv_cpu_validate_profiles(RISCVCPU *cpu)
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
      profile->user_set = true;
      profile->enabled = value;
 -    if (profile->parent != NULL) {
 -        object_property_set_bool(obj, profile->parent->name,
 +    if (profile->u_parent != NULL) {
 +        object_property_set_bool(obj, profile->u_parent->name,
 +                                 profile->enabled, NULL);
 +    }
 +
 +    if (profile->s_parent != NULL) {
 +        object_property_set_bool(obj, profile->s_parent->name,
                                   profile->enabled, NULL);
      }
 --
-.35.1
+.48.1

-New patch
+[PULL 14/59] target/riscv: change priv_ver check in validate_profile()
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+The S profiles do a priv_ver check during validation to see if the
+running priv_ver is compatible with it. This check is done by comparing
+if the running priv_ver is equal to the priv_ver the profile specifies.
+There is an universe where we added RVA23S64 support based on both
+RVA23U64 and RVA22S64 and this error is being thrown:
+qemu-system-riscv64: warning: Profile rva22s64 requires
+    priv spec v1.12.0, but priv ver v1.13.0 was set
+We're enabling RVA22S64 (priv_ver 1.12) as a dependency of RVA23S64
+(priv_ver 1.13) and complaining to users about what we did ourselves.
+There's no drawback in allowing a profile to run in an env that has a
+priv_ver newer than it's required by it. So, like Hiro Nakamura saves
+the future by changing the past, change the priv_ver check now to allow
+profiles to run in a newer priv_ver. This universe will have one less
+warning to deal with.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250115184316.2344583-5-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/tcg/tcg-cpu.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/tcg/tcg-cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
+ #endif
+     if (profile->priv_spec != RISCV_PROFILE_ATTR_UNUSED &&
+-        profile->priv_spec != env->priv_ver) {
++        profile->priv_spec > env->priv_ver) {
+         profile_impl = false;
+         if (send_warn) {
+--
+.48.1

-New patch
+[PULL 15/59] target/riscv: add RVA23U64 profile
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Add RVA23U64 as described in [1]. Add it as a child of RVA22U64 since
+all RVA22U64 mandatory extensions are also present in RVA23U64. What's
+left then is to list the mandatory extensions that are RVA23 only.
+A new "rva23u64" CPU is also added.
+[1] https://github.com/riscv/riscv-profiles/blob/main/src/rva23-profile.adoc
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250115184316.2344583-6-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu-qom.h |  1 +
+ target/riscv/cpu.c     | 33 +++++++++++++++++++++++++++++++++
+files changed, 34 insertions(+)
+diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu-qom.h
++++ b/target/riscv/cpu-qom.h
+@@ -XXX,XX +XXX,XX @@
+ #define TYPE_RISCV_CPU_RV64E            RISCV_CPU_TYPE_NAME("rv64e")
+ #define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
+ #define TYPE_RISCV_CPU_RVA22S64         RISCV_CPU_TYPE_NAME("rva22s64")
++#define TYPE_RISCV_CPU_RVA23U64         RISCV_CPU_TYPE_NAME("rva23u64")
+ #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
+ #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
+ #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22S64 = {
+     }
+ };
++/*
++ * All mandatory extensions from RVA22U64 are present
++ * in RVA23U64 so set RVA22 as a parent. We need to
++ * declare just the newly added mandatory extensions.
++ */
++static RISCVCPUProfile RVA23U64 = {
++    .u_parent = &RVA22U64,
++    .s_parent = NULL,
++    .name = "rva23u64",
++    .misa_ext = RVV,
++    .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
++    .satp_mode = RISCV_PROFILE_ATTR_UNUSED,
++    .ext_offsets = {
++        CPU_CFG_OFFSET(ext_zvfhmin), CPU_CFG_OFFSET(ext_zvbb),
++        CPU_CFG_OFFSET(ext_zvkt), CPU_CFG_OFFSET(ext_zihintntl),
++        CPU_CFG_OFFSET(ext_zicond), CPU_CFG_OFFSET(ext_zimop),
++        CPU_CFG_OFFSET(ext_zcmop), CPU_CFG_OFFSET(ext_zcb),
++        CPU_CFG_OFFSET(ext_zfa), CPU_CFG_OFFSET(ext_zawrs),
++        CPU_CFG_OFFSET(ext_supm),
++
++        RISCV_PROFILE_EXT_LIST_END
++    }
++};
++
+ RISCVCPUProfile *riscv_profiles[] = {
+     &RVA22U64,
+     &RVA22S64,
++    &RVA23U64,
+     NULL,
+ };
+@@ -XXX,XX +XXX,XX @@ static void rva22s64_profile_cpu_init(Object *obj)
+     RVA22S64.enabled = true;
+ }
++
++static void rva23u64_profile_cpu_init(Object *obj)
++{
++    rv64i_bare_cpu_init(obj);
++
++    RVA23U64.enabled = true;
++}
+ #endif
+ static const gchar *riscv_gdb_arch_name(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
+     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64E,        MXL_RV64,  rv64e_bare_cpu_init),
+     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  MXL_RV64,  rva22u64_profile_cpu_init),
+     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  MXL_RV64,  rva22s64_profile_cpu_init),
++    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23U64,  MXL_RV64,  rva23u64_profile_cpu_init),
+ #endif /* TARGET_RISCV64 */
+ };
+--
+.48.1

-New patch
+[PULL 16/59] target/riscv: add RVA23S64 profile
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Add RVA23S64 as described in [1]. This profile inherits all mandatory
+extensions of RVA23U64 and RVA22S64, making it a child of both profiles.
+A new "rva23s64" profile CPU is also added. This is the generated
+riscv,isa for it (taken via -M dumpdtb):
+rv64imafdcbvh_zic64b_zicbom_zicbop_zicboz_ziccamoa_ziccif_zicclsm_
+ziccrse_zicond_zicntr_zicsr_zifencei_zihintntl_zihintpause_zihpm_zimop_
+zmmul_za64rs_zaamo_zalrsc_zawrs_zfa_zfhmin_zca_zcb_zcd_zcmop_zba_zbb_zbs_
+zkt_zvbb_zve32f_zve32x_zve64f_zve64d_zve64x_zvfhmin_zvkb_zvkt_shcounterenw_
+sha_shgatpa_shtvala_shvsatpa_shvstvala_shvstvecd_smnpm_smstateen_ssccptr_
+sscofpmf_sscounterenw_ssnpm_ssstateen_sstc_sstvala_sstvecd_ssu64xl_
+supm_svade_svinval_svnapot_svpbmt
+[1] https://github.com/riscv/riscv-profiles/blob/main/src/rva23-profile.adoc
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250115184316.2344583-7-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu-qom.h |  1 +
+ target/riscv/cpu.c     | 39 +++++++++++++++++++++++++++++++++++++++
+files changed, 40 insertions(+)
+diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu-qom.h
++++ b/target/riscv/cpu-qom.h
+@@ -XXX,XX +XXX,XX @@
+ #define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
+ #define TYPE_RISCV_CPU_RVA22S64         RISCV_CPU_TYPE_NAME("rva22s64")
+ #define TYPE_RISCV_CPU_RVA23U64         RISCV_CPU_TYPE_NAME("rva23u64")
++#define TYPE_RISCV_CPU_RVA23S64         RISCV_CPU_TYPE_NAME("rva23s64")
+ #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
+ #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
+ #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA23U64 = {
+     }
+ };
++/*
++ * As with RVA23U64, RVA23S64 also defines 'named features'.
++ *
++ * Cache related features that we consider enabled since we don't
++ * implement cache: Ssccptr
++ *
++ * Other named features that we already implement: Sstvecd, Sstvala,
++ * Sscounterenw, Ssu64xl
++ *
++ * The remaining features/extensions comes from RVA23S64.
++ */
++static RISCVCPUProfile RVA23S64 = {
++    .u_parent = &RVA23U64,
++    .s_parent = &RVA22S64,
++    .name = "rva23s64",
++    .misa_ext = RVS,
++    .priv_spec = PRIV_VERSION_1_13_0,
++    .satp_mode = VM_1_10_SV39,
++    .ext_offsets = {
++        /* New in RVA23S64 */
++        CPU_CFG_OFFSET(ext_svnapot), CPU_CFG_OFFSET(ext_sstc),
++        CPU_CFG_OFFSET(ext_sscofpmf), CPU_CFG_OFFSET(ext_ssnpm),
++
++        /* Named features: Sha */
++        CPU_CFG_OFFSET(ext_sha),
++
++        RISCV_PROFILE_EXT_LIST_END
++    }
++};
++
+ RISCVCPUProfile *riscv_profiles[] = {
+     &RVA22U64,
+     &RVA22S64,
+     &RVA23U64,
++    &RVA23S64,
+     NULL,
+ };
+@@ -XXX,XX +XXX,XX @@ static void rva23u64_profile_cpu_init(Object *obj)
+     RVA23U64.enabled = true;
+ }
++
++static void rva23s64_profile_cpu_init(Object *obj)
++{
++    rv64i_bare_cpu_init(obj);
++
++    RVA23S64.enabled = true;
++}
+ #endif
+ static const gchar *riscv_gdb_arch_name(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
+     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  MXL_RV64,  rva22u64_profile_cpu_init),
+     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  MXL_RV64,  rva22s64_profile_cpu_init),
+     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23U64,  MXL_RV64,  rva23u64_profile_cpu_init),
++    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23S64,  MXL_RV64,  rva23s64_profile_cpu_init),
+ #endif /* TARGET_RISCV64 */
+ };
+--
+.48.1

-New patch
+[PULL 17/59] hw/riscv/riscv-iommu: Remove redundant struct members
+From: Jason Chien <jason.chien@sifive.com>
+Initially, the IOMMU would create a thread, but this thread was removed in
+the merged version. The struct members for thread control should have been
+removed as well, but they were not removed in commit 0c54acb8243
+("hw/riscv: add RISC-V IOMMU base emulation").
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250115141730.30858-1-jason.chien@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/riscv/riscv-iommu.h | 5 -----
+file changed, 5 deletions(-)
+diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu.h
++++ b/hw/riscv/riscv-iommu.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
+     /* interrupt notifier */
+     void (*notify)(RISCVIOMMUState *iommu, unsigned vector);
+-    /* IOMMU State Machine */
+-    QemuThread core_proc; /* Background processing thread */
+-    QemuCond core_cond;   /* Background processing wake up signal */
+-    unsigned core_exec;   /* Processing thread execution actions */
+-
+     /* IOMMU target address space */
+     AddressSpace *target_as;
+     MemoryRegion *target_mr;
+--
+.48.1

-New patch
+[PULL 18/59] hw/riscv/riscv-iommu-bits: Remove duplicate definitions
+From: Jason Chien <jason.chien@sifive.com>
+The header contains duplicate macro definitions.
+This commit eliminates the duplicate part.
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250115141730.30858-2-jason.chien@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/riscv/riscv-iommu-bits.h | 22 ++++++----------------
+file changed, 6 insertions(+), 16 deletions(-)
+diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu-bits.h
++++ b/hw/riscv/riscv-iommu-bits.h
+@@ -XXX,XX +XXX,XX @@ struct riscv_iommu_pq_record {
+ #define RISCV_IOMMU_PREQ_HDR_PRIV       BIT_ULL(33)
+ #define RISCV_IOMMU_PREQ_HDR_EXEC       BIT_ULL(34)
+ #define RISCV_IOMMU_PREQ_HDR_DID        GENMASK_ULL(63, 40)
++
+ /* Payload fields */
++#define RISCV_IOMMU_PREQ_PAYLOAD_R      BIT_ULL(0)
++#define RISCV_IOMMU_PREQ_PAYLOAD_W      BIT_ULL(1)
++#define RISCV_IOMMU_PREQ_PAYLOAD_L      BIT_ULL(2)
+ #define RISCV_IOMMU_PREQ_PAYLOAD_M      GENMASK_ULL(2, 0)
++#define RISCV_IOMMU_PREQ_PRG_INDEX      GENMASK_ULL(11, 3)
++#define RISCV_IOMMU_PREQ_UADDR          GENMASK_ULL(63, 12)
+ /* Common field positions */
+ #define RISCV_IOMMU_PPN_FIELD           GENMASK_ULL(53, 10)
+@@ -XXX,XX +XXX,XX @@ enum riscv_iommu_fq_ttypes {
+     RISCV_IOMMU_FW_TTYPE_PCIE_MSG_REQ = 9,
+ };
+-/* Header fields */
+-#define RISCV_IOMMU_PREQ_HDR_PID        GENMASK_ULL(31, 12)
+-#define RISCV_IOMMU_PREQ_HDR_PV         BIT_ULL(32)
+-#define RISCV_IOMMU_PREQ_HDR_PRIV       BIT_ULL(33)
+-#define RISCV_IOMMU_PREQ_HDR_EXEC       BIT_ULL(34)
+-#define RISCV_IOMMU_PREQ_HDR_DID        GENMASK_ULL(63, 40)
+-
+-/* Payload fields */
+-#define RISCV_IOMMU_PREQ_PAYLOAD_R      BIT_ULL(0)
+-#define RISCV_IOMMU_PREQ_PAYLOAD_W      BIT_ULL(1)
+-#define RISCV_IOMMU_PREQ_PAYLOAD_L      BIT_ULL(2)
+-#define RISCV_IOMMU_PREQ_PAYLOAD_M      GENMASK_ULL(2, 0)
+-#define RISCV_IOMMU_PREQ_PRG_INDEX      GENMASK_ULL(11, 3)
+-#define RISCV_IOMMU_PREQ_UADDR          GENMASK_ULL(63, 12)
+-
+-
+ /*
+  * struct riscv_iommu_msi_pte - MSI Page Table Entry
+  */
+--
+.48.1

-New patch
+[PULL 19/59] goldfish_rtc: Fix tick_offset migration
+From: Rodrigo Dias Correa <r@drigo.nl>
+Instead of migrating the raw tick_offset, goldfish_rtc migrates a
+recalculated value based on QEMU_CLOCK_VIRTUAL. As QEMU_CLOCK_VIRTUAL
+stands still across a save-and-restore cycle, the guest RTC becomes out
+of sync with the host RTC when the VM is restored.
+As described in the bug description, it looks like this calculation was
+copied from pl031 RTC, which had its tick_offset migration fixed by
+Commit 032cfe6a79c8 ("pl031: Correctly migrate state when using -rtc
+clock=host").
+Migrate the tick_offset directly, adding it as a version-dependent field
+to VMState. Keep the old behavior when migrating from previous versions.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2033
+Signed-off-by: Rodrigo Dias Correa <r@drigo.nl>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250114212150.228241-1-r@drigo.nl>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/rtc/goldfish_rtc.c | 43 +++++++++++++------------------------------
+file changed, 13 insertions(+), 30 deletions(-)
+diff --git a/hw/rtc/goldfish_rtc.c b/hw/rtc/goldfish_rtc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/rtc/goldfish_rtc.c
++++ b/hw/rtc/goldfish_rtc.c
+@@ -XXX,XX +XXX,XX @@ static void goldfish_rtc_write(void *opaque, hwaddr offset,
+     trace_goldfish_rtc_write(offset, value);
+ }
+-static int goldfish_rtc_pre_save(void *opaque)
+-{
+-    uint64_t delta;
+-    GoldfishRTCState *s = opaque;
+-
+-    /*
+-     * We want to migrate this offset, which sounds straightforward.
+-     * Unfortunately, we cannot directly pass tick_offset because
+-     * rtc_clock on destination Host might not be same source Host.
+-     *
+-     * To tackle, this we pass tick_offset relative to vm_clock from
+-     * source Host and make it relative to rtc_clock at destination Host.
+-     */
+-    delta = qemu_clock_get_ns(rtc_clock) -
+-            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+-    s->tick_offset_vmstate = s->tick_offset + delta;
+-
+-    return 0;
+-}
+-
+ static int goldfish_rtc_post_load(void *opaque, int version_id)
+ {
+-    uint64_t delta;
+     GoldfishRTCState *s = opaque;
+-    /*
+-     * We extract tick_offset from tick_offset_vmstate by doing
+-     * reverse math compared to pre_save() function.
+-     */
+-    delta = qemu_clock_get_ns(rtc_clock) -
+-            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+-    s->tick_offset = s->tick_offset_vmstate - delta;
++    if (version_id < 3) {
++        /*
++         * Previous versions didn't migrate tick_offset directly. Instead, they
++         * migrated tick_offset_vmstate, which is a recalculation based on
++         * QEMU_CLOCK_VIRTUAL. We use tick_offset_vmstate when migrating from
++         * older versions.
++         */
++        uint64_t delta = qemu_clock_get_ns(rtc_clock) -
++                 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
++        s->tick_offset = s->tick_offset_vmstate - delta;
++    }
+     goldfish_rtc_set_alarm(s);
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps goldfish_rtc_ops[2] = {
+ static const VMStateDescription goldfish_rtc_vmstate = {
+     .name = TYPE_GOLDFISH_RTC,
+-    .version_id = 2,
+-    .pre_save = goldfish_rtc_pre_save,
++    .version_id = 3,
+     .post_load = goldfish_rtc_post_load,
+     .fields = (const VMStateField[]) {
+         VMSTATE_UINT64(tick_offset_vmstate, GoldfishRTCState),
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription goldfish_rtc_vmstate = {
+         VMSTATE_UINT32(irq_pending, GoldfishRTCState),
+         VMSTATE_UINT32(irq_enabled, GoldfishRTCState),
+         VMSTATE_UINT32(time_high, GoldfishRTCState),
++        VMSTATE_UINT64_V(tick_offset, GoldfishRTCState, 3),
+         VMSTATE_END_OF_LIST()
+     }
+ };
+--
+.48.1

-[PULL 06/13] hw/riscv: virt: Increase maximum number of allowed CPUs
+[PULL 20/59] hw/riscv/virt: Add serial alias in DTB
-From: Anup Patel <anup.patel@wdc.com>
+From: Vasilis Liaskovitis <vliaskovitis@suse.com>
-To facilitate software development of RISC-V systems with large number
+Add an "aliases" node with a "serial0" entry for the single UART
-of HARTs, we increase the maximum number of allowed CPUs to 512 (2^9).
+in the riscv virt machine.
-We also add a detailed source level comments about limit defines which
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2774
-impact the physical address space utilization.
+Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Anup Patel <anup.patel@wdc.com>
 Signed-off-by: Anup Patel <anup@brainfault.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Message-ID: <20250116161007.39710-1-vliaskovitis@suse.com>
 Message-Id: <20220220085526.808674-6-anup@brainfault.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h |  2 +-
+ hw/riscv/virt.c | 3 +++
- hw/riscv/virt.c         | 10 ++++++++++
+file changed, 3 insertions(+)
 files changed, 11 insertions(+), 1 deletion(-)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
-+++ b/include/hw/riscv/virt.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/block/flash.h"
- #include "qom/object.h"
--#define VIRT_CPUS_MAX_BITS             3
-+#define VIRT_CPUS_MAX_BITS             9
- #define VIRT_CPUS_MAX                  (1 << VIRT_CPUS_MAX_BITS)
- #define VIRT_SOCKETS_MAX_BITS          2
- #define VIRT_SOCKETS_MAX               (1 << VIRT_SOCKETS_MAX_BITS)
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_uart(RISCVVirtState *s, const MemMapEntry *memmap,
- #include "hw/pci-host/gpex.h"
+     }
- #include "hw/display/ramfb.h"
+     qemu_fdt_setprop_string(ms->fdt, "/chosen", "stdout-path", name);
-+/*
++    qemu_fdt_setprop_string(ms->fdt, "/aliases", "serial0", name);
-+ * The virt machine physical address space used by some of the devices
+ }
-+ * namely ACLINT, PLIC, APLIC, and IMSIC depend on number of Sockets,
-+ * number of CPUs, and number of IMSIC guest files.
+ static void create_fdt_rtc(RISCVVirtState *s, const MemMapEntry *memmap,
-+ *
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
-+ * Various limits defined by VIRT_SOCKETS_MAX_BITS, VIRT_CPUS_MAX_BITS,
+     qemu_fdt_setprop(ms->fdt, "/chosen", "rng-seed",
-+ * and VIRT_IRQCHIP_MAX_GUESTS_BITS are tuned for maximum utilization
+                      rng_seed, sizeof(rng_seed));
-+ * of virt machine physical address space.
-+ */
++    qemu_fdt_add_subnode(ms->fdt, "/aliases");
 +
- #define VIRT_IMSIC_GROUP_MAX_SIZE      (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
+     create_fdt_flash(s, memmap);
- #if VIRT_IMSIC_GROUP_MAX_SIZE < \
+     create_fdt_fw_cfg(s, memmap);
-     IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
+     create_fdt_pmu(s);
 --
-.35.1
+.48.1

-New patch
+[PULL 21/59] MAINTAINERS: Remove Bin Meng from RISC-V maintainers
+From: Alistair Francis <alistair23@gmail.com>
+Bin Meng has been a long time contributor and maintainer for QEMU RISC-V
+and has been very beneficial to the RISC-V ecosystem.
+Unfortunately his email has started to bounce so this patch is removing
+them from MAINTAINERS. If in the future Bin Meng wants to return we will
+happily re-add them.
+Note that I'm not removing Bin Meng as a "SD (Secure Card)" maintainer.
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20250128060546.1374394-1-alistair.francis@wdc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ MAINTAINERS | 5 +----
+file changed, 1 insertion(+), 4 deletions(-)
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_ppc_74xx.py
+ RISC-V TCG CPUs
+ M: Palmer Dabbelt <palmer@dabbelt.com>
+ M: Alistair Francis <alistair.francis@wdc.com>
+-M: Bin Meng <bmeng.cn@gmail.com>
+ R: Weiwei Li <liwei1518@gmail.com>
+ R: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+ R: Liu Zhiwei <zhiwei_liu@linux.alibaba.com>
+@@ -XXX,XX +XXX,XX @@ F: include/hw/riscv/opentitan.h
+ F: include/hw/*/ibex_*.h
+ Microchip PolarFire SoC Icicle Kit
+-M: Bin Meng <bmeng.cn@gmail.com>
+ L: qemu-riscv@nongnu.org
+ S: Supported
+ F: docs/system/riscv/microchip-icicle-kit.rst
+@@ -XXX,XX +XXX,XX @@ F: include/hw/char/shakti_uart.h
+ SiFive Machines
+ M: Alistair Francis <Alistair.Francis@wdc.com>
+-M: Bin Meng <bmeng.cn@gmail.com>
+ M: Palmer Dabbelt <palmer@dabbelt.com>
+ L: qemu-riscv@nongnu.org
+ S: Supported
+@@ -XXX,XX +XXX,XX @@ S: Orphan
+ F: hw/i386/amd_iommu.?
+ OpenSBI Firmware
+-M: Bin Meng <bmeng.cn@gmail.com>
++L: qemu-riscv@nongnu.org
+ S: Supported
+ F: pc-bios/opensbi-*
+ F: .gitlab-ci.d/opensbi.yml
+--
+.48.1

-New patch
+[PULL 22/59] target/riscv: Remove obsolete sfence.vm instruction
+From: Rajnesh Kanwal <rkanwal@rivosinc.com>
+Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Jason Chien <jason.chien@sifive.com>
+Message-ID: <20250205-b4-ctr_upstream_v6-v6-1-439d8e06c8ef@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/insn32.decode                     | 1 -
+ target/riscv/insn_trans/trans_privileged.c.inc | 5 -----
+files changed, 6 deletions(-)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn32.decode
++++ b/target/riscv/insn32.decode
+@@ -XXX,XX +XXX,XX @@ sret        0001000    00010 00000 000 00000 1110011
+ mret        0011000    00010 00000 000 00000 1110011
+ wfi         0001000    00101 00000 000 00000 1110011
+ sfence_vma  0001001    ..... ..... 000 00000 1110011 @sfence_vma
+-sfence_vm   0001000    00100 ..... 000 00000 1110011 @sfence_vm
+ # *** NMI ***
+ mnret       0111000    00010 00000 000 00000 1110011
+diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/insn_trans/trans_privileged.c.inc
++++ b/target/riscv/insn_trans/trans_privileged.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool trans_sfence_vma(DisasContext *ctx, arg_sfence_vma *a)
+ #endif
+     return false;
+ }
+-
+-static bool trans_sfence_vm(DisasContext *ctx, arg_sfence_vm *a)
+-{
+-    return false;
+-}
+--
+.48.1

-New patch
+[PULL 23/59] target/riscv: Add Control Transfer Records CSR definitions.
+From: Rajnesh Kanwal <rkanwal@rivosinc.com>
+The Control Transfer Records (CTR) extension provides a method to
+record a limited branch history in register-accessible internal chip
+storage.
+This extension is similar to Arch LBR in x86 and BRBE in ARM.
+The Extension has been stable and the latest release can be found here
+https://github.com/riscv/riscv-control-transfer-records/releases/tag/v1.0_rc5
+Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250205-b4-ctr_upstream_v6-v6-2-439d8e06c8ef@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_bits.h | 145 ++++++++++++++++++++++++++++++++++++++++
+file changed, 145 insertions(+)
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@
+ #define CSR_SIEH            0x114
+ #define CSR_SIPH            0x154
++/* Machine-Level Control transfer records CSRs */
++#define CSR_MCTRCTL         0x34e
++
++/* Supervisor-Level Control transfer records CSRs */
++#define CSR_SCTRCTL         0x14e
++#define CSR_SCTRSTATUS      0x14f
++#define CSR_SCTRDEPTH       0x15f
++
++/* VS-Level Control transfer records CSRs */
++#define CSR_VSCTRCTL        0x24e
++
+ /* Hpervisor CSRs */
+ #define CSR_HSTATUS         0x600
+ #define CSR_HEDELEG         0x602
+@@ -XXX,XX +XXX,XX @@
+ #define SMSTATEEN0_CS       (1ULL << 0)
+ #define SMSTATEEN0_FCSR     (1ULL << 1)
+ #define SMSTATEEN0_JVT      (1ULL << 2)
++#define SMSTATEEN0_CTR      (1ULL << 54)
+ #define SMSTATEEN0_P1P13    (1ULL << 56)
+ #define SMSTATEEN0_HSCONTXT (1ULL << 57)
+ #define SMSTATEEN0_IMSIC    (1ULL << 58)
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+ #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
+ #define HENVCFGH_STCE                       MENVCFGH_STCE
++/* Offsets for every pair of control bits per each priv level */
++#define XS_OFFSET    0ULL
++#define U_OFFSET     2ULL
++#define S_OFFSET     5ULL
++#define M_OFFSET     8ULL
++
++#define PM_XS_BITS   (EXT_STATUS_MASK << XS_OFFSET)
++#define U_PM_ENABLE  (PM_ENABLE  << U_OFFSET)
++#define U_PM_CURRENT (PM_CURRENT << U_OFFSET)
++#define U_PM_INSN    (PM_INSN    << U_OFFSET)
++#define S_PM_ENABLE  (PM_ENABLE  << S_OFFSET)
++#define S_PM_CURRENT (PM_CURRENT << S_OFFSET)
++#define S_PM_INSN    (PM_INSN    << S_OFFSET)
++#define M_PM_ENABLE  (PM_ENABLE  << M_OFFSET)
++#define M_PM_CURRENT (PM_CURRENT << M_OFFSET)
++#define M_PM_INSN    (PM_INSN    << M_OFFSET)
++
++/* mmte CSR bits */
++#define MMTE_PM_XS_BITS     PM_XS_BITS
++#define MMTE_U_PM_ENABLE    U_PM_ENABLE
++#define MMTE_U_PM_CURRENT   U_PM_CURRENT
++#define MMTE_U_PM_INSN      U_PM_INSN
++#define MMTE_S_PM_ENABLE    S_PM_ENABLE
++#define MMTE_S_PM_CURRENT   S_PM_CURRENT
++#define MMTE_S_PM_INSN      S_PM_INSN
++#define MMTE_M_PM_ENABLE    M_PM_ENABLE
++#define MMTE_M_PM_CURRENT   M_PM_CURRENT
++#define MMTE_M_PM_INSN      M_PM_INSN
++#define MMTE_MASK    (MMTE_U_PM_ENABLE | MMTE_U_PM_CURRENT | MMTE_U_PM_INSN | \
++                      MMTE_S_PM_ENABLE | MMTE_S_PM_CURRENT | MMTE_S_PM_INSN | \
++                      MMTE_M_PM_ENABLE | MMTE_M_PM_CURRENT | MMTE_M_PM_INSN | \
++                      MMTE_PM_XS_BITS)
++
++/* (v)smte CSR bits */
++#define SMTE_PM_XS_BITS     PM_XS_BITS
++#define SMTE_U_PM_ENABLE    U_PM_ENABLE
++#define SMTE_U_PM_CURRENT   U_PM_CURRENT
++#define SMTE_U_PM_INSN      U_PM_INSN
++#define SMTE_S_PM_ENABLE    S_PM_ENABLE
++#define SMTE_S_PM_CURRENT   S_PM_CURRENT
++#define SMTE_S_PM_INSN      S_PM_INSN
++#define SMTE_MASK    (SMTE_U_PM_ENABLE | SMTE_U_PM_CURRENT | SMTE_U_PM_INSN | \
++                      SMTE_S_PM_ENABLE | SMTE_S_PM_CURRENT | SMTE_S_PM_INSN | \
++                      SMTE_PM_XS_BITS)
++
++/* umte CSR bits */
++#define UMTE_U_PM_ENABLE    U_PM_ENABLE
++#define UMTE_U_PM_CURRENT   U_PM_CURRENT
++#define UMTE_U_PM_INSN      U_PM_INSN
++#define UMTE_MASK     (UMTE_U_PM_ENABLE | MMTE_U_PM_CURRENT | UMTE_U_PM_INSN)
++
++/* CTR control register commom fields */
++#define XCTRCTL_U              BIT_ULL(0)
++#define XCTRCTL_S              BIT_ULL(1)
++#define XCTRCTL_RASEMU         BIT_ULL(7)
++#define XCTRCTL_STE            BIT_ULL(8)
++#define XCTRCTL_BPFRZ          BIT_ULL(11)
++#define XCTRCTL_LCOFIFRZ       BIT_ULL(12)
++#define XCTRCTL_EXCINH         BIT_ULL(33)
++#define XCTRCTL_INTRINH        BIT_ULL(34)
++#define XCTRCTL_TRETINH        BIT_ULL(35)
++#define XCTRCTL_NTBREN         BIT_ULL(36)
++#define XCTRCTL_TKBRINH        BIT_ULL(37)
++#define XCTRCTL_INDCALLINH     BIT_ULL(40)
++#define XCTRCTL_DIRCALLINH     BIT_ULL(41)
++#define XCTRCTL_INDJMPINH      BIT_ULL(42)
++#define XCTRCTL_DIRJMPINH      BIT_ULL(43)
++#define XCTRCTL_CORSWAPINH     BIT_ULL(44)
++#define XCTRCTL_RETINH         BIT_ULL(45)
++#define XCTRCTL_INDLJMPINH     BIT_ULL(46)
++#define XCTRCTL_DIRLJMPINH     BIT_ULL(47)
++
++#define XCTRCTL_MASK (XCTRCTL_U | XCTRCTL_S | XCTRCTL_RASEMU |                \
++                      XCTRCTL_STE | XCTRCTL_BPFRZ | XCTRCTL_LCOFIFRZ |        \
++                      XCTRCTL_EXCINH | XCTRCTL_INTRINH | XCTRCTL_TRETINH |    \
++                      XCTRCTL_NTBREN | XCTRCTL_TKBRINH | XCTRCTL_INDCALLINH | \
++                      XCTRCTL_DIRCALLINH | XCTRCTL_INDJMPINH |                \
++                      XCTRCTL_DIRJMPINH | XCTRCTL_CORSWAPINH |                \
++                      XCTRCTL_RETINH | XCTRCTL_INDLJMPINH | XCTRCTL_DIRLJMPINH)
++
++#define XCTRCTL_INH_START         32U
++
++/* CTR mctrctl bits */
++#define MCTRCTL_M                 BIT_ULL(2)
++#define MCTRCTL_MTE               BIT_ULL(9)
++
++#define MCTRCTL_MASK              (XCTRCTL_MASK | MCTRCTL_M | MCTRCTL_MTE)
++#define SCTRCTL_MASK              XCTRCTL_MASK
++#define VSCTRCTL_MASK             XCTRCTL_MASK
++
++/* sctrstatus CSR bits. */
++#define SCTRSTATUS_WRPTR_MASK       0xFF
++#define SCTRSTATUS_FROZEN           BIT(31)
++#define SCTRSTATUS_MASK             (SCTRSTATUS_WRPTR_MASK | SCTRSTATUS_FROZEN)
++
++/* sctrdepth CSR bits. */
++#define SCTRDEPTH_MASK              0x7
++#define SCTRDEPTH_MIN               0U  /* 16 Entries. */
++#define SCTRDEPTH_MAX               4U  /* 256 Entries. */
++
++#define CTR_ENTRIES_FIRST           0x200
++#define CTR_ENTRIES_LAST            0x2ff
++
++#define CTRSOURCE_VALID             BIT(0)
++#define CTRTARGET_MISP              BIT(0)
++
++#define CTRDATA_TYPE_MASK           0xF
++#define CTRDATA_CCV                 BIT(15)
++#define CTRDATA_CCM_MASK            0xFFF0000
++#define CTRDATA_CCE_MASK            0xF0000000
++
++#define CTRDATA_MASK            (CTRDATA_TYPE_MASK | CTRDATA_CCV |  \
++                                 CTRDATA_CCM_MASK | CTRDATA_CCE_MASK)
++
++typedef enum CTRType {
++    CTRDATA_TYPE_NONE                   = 0,
++    CTRDATA_TYPE_EXCEPTION              = 1,
++    CTRDATA_TYPE_INTERRUPT              = 2,
++    CTRDATA_TYPE_EXCEP_INT_RET          = 3,
++    CTRDATA_TYPE_NONTAKEN_BRANCH        = 4,
++    CTRDATA_TYPE_TAKEN_BRANCH           = 5,
++    CTRDATA_TYPE_RESERVED_0             = 6,
++    CTRDATA_TYPE_RESERVED_1             = 7,
++    CTRDATA_TYPE_INDIRECT_CALL          = 8,
++    CTRDATA_TYPE_DIRECT_CALL            = 9,
++    CTRDATA_TYPE_INDIRECT_JUMP          = 10,
++    CTRDATA_TYPE_DIRECT_JUMP            = 11,
++    CTRDATA_TYPE_CO_ROUTINE_SWAP        = 12,
++    CTRDATA_TYPE_RETURN                 = 13,
++    CTRDATA_TYPE_OTHER_INDIRECT_JUMP    = 14,
++    CTRDATA_TYPE_OTHER_DIRECT_JUMP      = 15,
++} CTRType;
++
+ /* MISELECT, SISELECT, and VSISELECT bits (AIA) */
+ #define ISELECT_IPRIO0                     0x30
+ #define ISELECT_IPRIO15                    0x3f
+--
+.48.1

-New patch
+[PULL 24/59] target/riscv: Add support for Control Transfer Records extension CSRs.
+From: Rajnesh Kanwal <rkanwal@rivosinc.com>
+This commit adds support for [m|s|vs]ctrcontrol, sctrstatus and
+sctrdepth CSRs handling.
+Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250205-b4-ctr_upstream_v6-v6-3-439d8e06c8ef@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu.h     |   5 ++
+ target/riscv/cpu_cfg.h |   2 +
+ target/riscv/csr.c     | 144 +++++++++++++++++++++++++++++++++++++++++
+files changed, 151 insertions(+)
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.h
++++ b/target/riscv/cpu.h
+@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
+     target_ulong mcause;
+     target_ulong mtval;  /* since: priv-1.10.0 */
++    uint64_t mctrctl;
++    uint32_t sctrdepth;
++    uint32_t sctrstatus;
++    uint64_t vsctrctl;
++
+     /* Machine and Supervisor interrupt priorities */
+     uint8_t miprio[64];
+     uint8_t siprio[64];
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_zvfhmin;
+     bool ext_smaia;
+     bool ext_ssaia;
++    bool ext_smctr;
++    bool ext_ssctr;
+     bool ext_sscofpmf;
+     bool ext_smepmp;
+     bool ext_smrnmi;
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/csr.c
++++ b/target/riscv/csr.c
+@@ -XXX,XX +XXX,XX @@ static RISCVException hgatp(CPURISCVState *env, int csrno)
+     return hmode(env, csrno);
+ }
++/*
++ * M-mode:
++ * Without ext_smctr raise illegal inst excep.
++ * Otherwise everything is accessible to m-mode.
++ *
++ * S-mode:
++ * Without ext_ssctr or mstateen.ctr raise illegal inst excep.
++ * Otherwise everything other than mctrctl is accessible.
++ *
++ * VS-mode:
++ * Without ext_ssctr or mstateen.ctr raise illegal inst excep.
++ * Without hstateen.ctr raise virtual illegal inst excep.
++ * Otherwise allow sctrctl (vsctrctl), sctrstatus, 0x200-0x2ff entry range.
++ * Always raise illegal instruction exception for sctrdepth.
++ */
++static RISCVException ctr_mmode(CPURISCVState *env, int csrno)
++{
++    /* Check if smctr-ext is present */
++    if (riscv_cpu_cfg(env)->ext_smctr) {
++        return RISCV_EXCP_NONE;
++    }
++
++    return RISCV_EXCP_ILLEGAL_INST;
++}
++
++static RISCVException ctr_smode(CPURISCVState *env, int csrno)
++{
++    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
++
++    if (!cfg->ext_smctr && !cfg->ext_ssctr) {
++        return RISCV_EXCP_ILLEGAL_INST;
++    }
++
++    RISCVException ret = smstateen_acc_ok(env, 0, SMSTATEEN0_CTR);
++    if (ret == RISCV_EXCP_NONE && csrno == CSR_SCTRDEPTH &&
++        env->virt_enabled) {
++        return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
++    }
++
++    return ret;
++}
++
+ static RISCVException aia_hmode(CPURISCVState *env, int csrno)
+ {
+     int ret;
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
+         wr_mask |= (SMSTATEEN0_AIA | SMSTATEEN0_IMSIC);
+     }
++    if (riscv_cpu_cfg(env)->ext_ssctr) {
++        wr_mask |= SMSTATEEN0_CTR;
++    }
++
+     return write_mstateen(env, csrno, wr_mask, new_val);
+ }
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
+         wr_mask |= SMSTATEEN0_P1P13;
+     }
++    if (riscv_cpu_cfg(env)->ext_ssctr) {
++        wr_mask |= SMSTATEEN0_CTR;
++    }
++
+     return write_mstateenh(env, csrno, wr_mask, new_val);
+ }
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
+         wr_mask |= (SMSTATEEN0_AIA | SMSTATEEN0_IMSIC);
+     }
++    if (riscv_cpu_cfg(env)->ext_ssctr) {
++        wr_mask |= SMSTATEEN0_CTR;
++    }
++
+     return write_hstateen(env, csrno, wr_mask, new_val);
+ }
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
+ {
+     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
++    if (riscv_cpu_cfg(env)->ext_ssctr) {
++        wr_mask |= SMSTATEEN0_CTR;
++    }
++
+     return write_hstateenh(env, csrno, wr_mask, new_val);
+ }
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_satp(CPURISCVState *env, int csrno,
+     return RISCV_EXCP_NONE;
+ }
++static RISCVException rmw_sctrdepth(CPURISCVState *env, int csrno,
++                                    target_ulong *ret_val,
++                                    target_ulong new_val, target_ulong wr_mask)
++{
++    uint64_t mask = wr_mask & SCTRDEPTH_MASK;
++
++    if (ret_val) {
++        *ret_val = env->sctrdepth;
++    }
++
++    env->sctrdepth = (env->sctrdepth & ~mask) | (new_val & mask);
++
++    /* Correct depth. */
++    if (mask) {
++        uint64_t depth = get_field(env->sctrdepth, SCTRDEPTH_MASK);
++
++        if (depth > SCTRDEPTH_MAX) {
++            depth = SCTRDEPTH_MAX;
++            env->sctrdepth = set_field(env->sctrdepth, SCTRDEPTH_MASK, depth);
++        }
++
++        /* Update sctrstatus.WRPTR with a legal value */
++        depth = 16 << depth;
++        env->sctrstatus =
++            env->sctrstatus & (~SCTRSTATUS_WRPTR_MASK | (depth - 1));
++    }
++
++    return RISCV_EXCP_NONE;
++}
++
++static RISCVException rmw_sctrstatus(CPURISCVState *env, int csrno,
++                                     target_ulong *ret_val,
++                                     target_ulong new_val, target_ulong wr_mask)
++{
++    uint32_t depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
++    uint32_t mask = wr_mask & SCTRSTATUS_MASK;
++
++    if (ret_val) {
++        *ret_val = env->sctrstatus;
++    }
++
++    env->sctrstatus = (env->sctrstatus & ~mask) | (new_val & mask);
++
++    /* Update sctrstatus.WRPTR with a legal value */
++    env->sctrstatus = env->sctrstatus & (~SCTRSTATUS_WRPTR_MASK | (depth - 1));
++
++    return RISCV_EXCP_NONE;
++}
++
++static RISCVException rmw_xctrctl(CPURISCVState *env, int csrno,
++                                    target_ulong *ret_val,
++                                    target_ulong new_val, target_ulong wr_mask)
++{
++    uint64_t csr_mask, mask = wr_mask;
++    uint64_t *ctl_ptr = &env->mctrctl;
++
++    if (csrno == CSR_MCTRCTL) {
++        csr_mask = MCTRCTL_MASK;
++    } else if (csrno == CSR_SCTRCTL && !env->virt_enabled) {
++        csr_mask = SCTRCTL_MASK;
++    } else {
++        /*
++         * This is for csrno == CSR_SCTRCTL and env->virt_enabled == true
++         * or csrno == CSR_VSCTRCTL.
++         */
++        csr_mask = VSCTRCTL_MASK;
++        ctl_ptr = &env->vsctrctl;
++    }
++
++    mask &= csr_mask;
++
++    if (ret_val) {
++        *ret_val = *ctl_ptr & csr_mask;
++    }
++
++    *ctl_ptr = (*ctl_ptr & ~mask) | (new_val & mask);
++
++    return RISCV_EXCP_NONE;
++}
++
+ static RISCVException read_vstopi(CPURISCVState *env, int csrno,
+                                   target_ulong *val)
+ {
+@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
+     [CSR_TINFO]     =  { "tinfo",    debug, read_tinfo,    write_ignore   },
+     [CSR_MCONTEXT]  =  { "mcontext", debug, read_mcontext, write_mcontext },
++    [CSR_MCTRCTL]    = { "mctrctl",    ctr_mmode,  NULL, NULL, rmw_xctrctl    },
++    [CSR_SCTRCTL]    = { "sctrctl",    ctr_smode,  NULL, NULL, rmw_xctrctl    },
++    [CSR_VSCTRCTL]   = { "vsctrctl",   ctr_smode,  NULL, NULL, rmw_xctrctl    },
++    [CSR_SCTRDEPTH]  = { "sctrdepth",  ctr_smode,  NULL, NULL, rmw_sctrdepth  },
++    [CSR_SCTRSTATUS] = { "sctrstatus", ctr_smode,  NULL, NULL, rmw_sctrstatus },
++
+     /* Performance Counters */
+     [CSR_HPMCOUNTER3]    = { "hpmcounter3",    ctr,    read_hpmcounter },
+     [CSR_HPMCOUNTER4]    = { "hpmcounter4",    ctr,    read_hpmcounter },
+--
+.48.1

-[PULL 10/13] target/riscv: add support for zfinx
+[PULL 25/59] target/riscv: Add support to record CTR entries.
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Rajnesh Kanwal <rkanwal@rivosinc.com>
-  - update extension check REQUIRE_ZFINX_OR_F
+This commit adds logic to records CTR entries of different types
-  - update single float point register read/write
+and adds required hooks in TCG and interrupt/Exception logic to
-  - disable nanbox_s check
+record events.
-Co-authored-by: ardxwe <ardxwe@gmail.com>
+This commit also adds support to invoke freeze CTR logic for breakpoint
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+exceptions and counter overflow interrupts.
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220211043920.28981-4-liweiwei@iscas.ac.cn>
+Message-ID: <20250205-b4-ctr_upstream_v6-v6-4-439d8e06c8ef@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/helper.h                   |   2 +-
+ target/riscv/cpu.h                            |   7 +
- target/riscv/internals.h                |  16 +-
+ target/riscv/helper.h                         |   1 +
- target/riscv/fpu_helper.c               |  89 +++----
+ target/riscv/cpu_helper.c                     | 259 ++++++++++++++++++
- target/riscv/translate.c                |  93 ++++++-
+ target/riscv/op_helper.c                      |  19 ++
- target/riscv/insn_trans/trans_rvf.c.inc | 314 ++++++++++++++++--------
+ target/riscv/translate.c                      |  46 ++++
-files changed, 369 insertions(+), 145 deletions(-)
+ .../riscv/insn_trans/trans_privileged.c.inc   |   2 +
  target/riscv/insn_trans/trans_rvi.c.inc       |  75 +++++
  target/riscv/insn_trans/trans_rvzce.c.inc     |  21 ++
 files changed, 430 insertions(+)
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.h
++++ b/target/riscv/cpu.h
+@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
+     uint32_t sctrstatus;
+     uint64_t vsctrctl;
++    uint64_t ctr_src[16 << SCTRDEPTH_MAX];
++    uint64_t ctr_dst[16 << SCTRDEPTH_MAX];
++    uint64_t ctr_data[16 << SCTRDEPTH_MAX];
++
+     /* Machine and Supervisor interrupt priorities */
+     uint8_t miprio[64];
+     uint8_t siprio[64];
+@@ -XXX,XX +XXX,XX @@ RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit);
+ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv, bool virt_en);
++void riscv_ctr_add_entry(CPURISCVState *env, target_long src, target_long dst,
++    enum CTRType type, target_ulong prev_priv, bool prev_virt);
++
+ void riscv_translate_init(void);
+ void riscv_translate_code(CPUState *cs, TranslationBlock *tb,
+                           int *max_insns, vaddr pc, void *host_pc);
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_w, TCG_CALL_NO_RWG, i64, env, tl)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(wfi, void, env)
- DEF_HELPER_FLAGS_2(fcvt_s_wu, TCG_CALL_NO_RWG, i64, env, tl)
+ DEF_HELPER_1(wrs_nto, void, env)
- DEF_HELPER_FLAGS_2(fcvt_s_l, TCG_CALL_NO_RWG, i64, env, tl)
+ DEF_HELPER_1(tlb_flush, void, env)
- DEF_HELPER_FLAGS_2(fcvt_s_lu, TCG_CALL_NO_RWG, i64, env, tl)
+ DEF_HELPER_1(tlb_flush_all, void, env)
--DEF_HELPER_FLAGS_1(fclass_s, TCG_CALL_NO_RWG_SE, tl, i64)
++DEF_HELPER_4(ctr_add_entry, void, env, tl, tl, tl)
-+DEF_HELPER_FLAGS_2(fclass_s, TCG_CALL_NO_RWG_SE, tl, env, i64)
+ /* Native Debug */
+ DEF_HELPER_1(itrigger_match, void, env)
- /* Floating Point - Double Precision */
+ #endif
- DEF_HELPER_FLAGS_3(fadd_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
+diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
-diff --git a/target/riscv/internals.h b/target/riscv/internals.h
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_helper.c
---- a/target/riscv/internals.h
++++ b/target/riscv/cpu_helper.c
-+++ b/target/riscv/internals.h
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_aia_ireg_rmw_fn(CPURISCVState *env, uint32_t priv,
-@@ -XXX,XX +XXX,XX @@ enum {
+     }
-     RISCV_FRM_ROD = 8,  /* Round to Odd */
+ }
- };
++static void riscv_ctr_freeze(CPURISCVState *env, uint64_t freeze_mask,
--static inline uint64_t nanbox_s(float32 f)
++                             bool virt)
-+static inline uint64_t nanbox_s(CPURISCVState *env, float32 f)
++{
 +    uint64_t ctl = virt ? env->vsctrctl : env->mctrctl;
 +
 +    assert((freeze_mask & (~(XCTRCTL_BPFRZ | XCTRCTL_LCOFIFRZ))) == 0);
 +
 +    if (ctl & freeze_mask) {
 +        env->sctrstatus |= SCTRSTATUS_FROZEN;
 +    }
 +}
 +
 +static uint64_t riscv_ctr_priv_to_mask(target_ulong priv, bool virt)
 +{
 +    switch (priv) {
 +    case PRV_M:
 +        return MCTRCTL_M;
 +    case PRV_S:
 +        if (virt) {
 +            return XCTRCTL_S;
 +        }
 +        return XCTRCTL_S;
 +    case PRV_U:
 +        if (virt) {
 +            return XCTRCTL_U;
 +        }
 +        return XCTRCTL_U;
 +    }
 +
 +    g_assert_not_reached();
 +}
 +
 +static uint64_t riscv_ctr_get_control(CPURISCVState *env, target_long priv,
 +                                      bool virt)
 +{
 +    switch (priv) {
 +    case PRV_M:
 +        return env->mctrctl;
 +    case PRV_S:
 +    case PRV_U:
 +        if (virt) {
 +            return env->vsctrctl;
 +        }
 +        return env->mctrctl;
 +    }
 +
 +    g_assert_not_reached();
 +}
 +
 +/*
 + * This function assumes that src privilege and target privilege are not same
 + * and src privilege is less than target privilege. This includes the virtual
 + * state as well.
 + */
 +static bool riscv_ctr_check_xte(CPURISCVState *env, target_long src_prv,
 +                                bool src_virt)
 +{
 +    target_long tgt_prv = env->priv;
 +    bool res = true;
 +
 +    /*
 +     * VS and U mode are same in terms of xTE bits required to record an
 +     * external trap. See 6.1.2. External Traps, table 8 External Trap Enable
 +     * Requirements. This changes VS to U to simplify the logic a bit.
 +     */
 +    if (src_virt && src_prv == PRV_S) {
 +        src_prv = PRV_U;
 +    } else if (env->virt_enabled && tgt_prv == PRV_S) {
 +        tgt_prv = PRV_U;
 +    }
 +
 +    /* VU mode is an outlier here. */
 +    if (src_virt && src_prv == PRV_U) {
 +        res &= !!(env->vsctrctl & XCTRCTL_STE);
 +    }
 +
 +    switch (src_prv) {
 +    case PRV_U:
 +        if (tgt_prv == PRV_U) {
 +            break;
 +        }
 +        res &= !!(env->mctrctl & XCTRCTL_STE);
 +        /* fall-through */
 +    case PRV_S:
 +        if (tgt_prv == PRV_S) {
 +            break;
 +        }
 +        res &= !!(env->mctrctl & MCTRCTL_MTE);
 +        /* fall-through */
 +    case PRV_M:
 +        break;
 +    }
 +
 +    return res;
 +}
 +
 +/*
 + * Special cases for traps and trap returns:
 + *
 + * 1- Traps, and trap returns, between enabled modes are recorded as normal.
 + * 2- Traps from an inhibited mode to an enabled mode, and trap returns from an
 + * enabled mode back to an inhibited mode, are partially recorded.  In such
 + * cases, the PC from the inhibited mode (source PC for traps, and target PC
 + * for trap returns) is 0.
 + *
 + * 3- Trap returns from an inhibited mode to an enabled mode are not recorded.
 + * Traps from an enabled mode to an inhibited mode, known as external traps,
 + * receive special handling.
 + * By default external traps are not recorded, but a handshake mechanism exists
 + * to allow partial recording.  Software running in the target mode of the trap
 + * can opt-in to allowing CTR to record traps into that mode even when the mode
 + * is inhibited.  The MTE, STE, and VSTE bits allow M-mode, S-mode, and VS-mode,
 + * respectively, to opt-in. When an External Trap occurs, and xTE=1, such that
 + * x is the target privilege mode of the trap, will CTR record the trap. In such
 + * cases, the target PC is 0.
 + */
 +/*
 + * CTR arrays are implemented as circular buffers and new entry is stored at
 + * sctrstatus.WRPTR, but they are presented to software as moving circular
 + * buffers. Which means, software get's the illusion that whenever a new entry
 + * is added the whole buffer is moved by one place and the new entry is added at
 + * the start keeping new entry at idx 0 and older ones follow.
 + *
 + * Depth = 16.
 + *
 + * buffer [0] [1] [2] [3] [4] [5] [6] [7] [8] [9] [A] [B] [C] [D] [E] [F]
 + * WRPTR                                   W
 + * entry   7   6   5   4   3   2   1   0   F   E   D   C   B   A   9   8
 + *
 + * When a new entry is added:
 + * buffer [0] [1] [2] [3] [4] [5] [6] [7] [8] [9] [A] [B] [C] [D] [E] [F]
 + * WRPTR                                       W
 + * entry   8   7   6   5   4   3   2   1   0   F   E   D   C   B   A   9
 + *
 + * entry here denotes the logical entry number that software can access
 + * using ctrsource, ctrtarget and ctrdata registers. So xiselect 0x200
 + * will return entry 0 i-e buffer[8] and 0x201 will return entry 1 i-e
 + * buffer[7]. Here is how we convert entry to buffer idx.
 + *
 + *    entry = isel - CTR_ENTRIES_FIRST;
 + *    idx = (sctrstatus.WRPTR - entry - 1) & (depth - 1);
 + */
 +void riscv_ctr_add_entry(CPURISCVState *env, target_long src, target_long dst,
 +    enum CTRType type, target_ulong src_priv, bool src_virt)
 +{
 +    bool tgt_virt = env->virt_enabled;
 +    uint64_t src_mask = riscv_ctr_priv_to_mask(src_priv, src_virt);
 +    uint64_t tgt_mask = riscv_ctr_priv_to_mask(env->priv, tgt_virt);
 +    uint64_t src_ctrl = riscv_ctr_get_control(env, src_priv, src_virt);
 +    uint64_t tgt_ctrl = riscv_ctr_get_control(env, env->priv, tgt_virt);
 +    uint64_t depth, head;
 +    bool ext_trap = false;
 +
 +    /*
 +     * Return immediately if both target and src recording is disabled or if
 +     * CTR is in frozen state.
 +     */
 +    if ((!(src_ctrl & src_mask) && !(tgt_ctrl & tgt_mask)) ||
 +        env->sctrstatus & SCTRSTATUS_FROZEN) {
 +        return;
 +    }
 +
 +    /*
 +     * With RAS Emul enabled, only allow Indirect, direct calls, Function
 +     * returns and Co-routine swap types.
 +     */
 +    if (tgt_ctrl & XCTRCTL_RASEMU &&
 +        type != CTRDATA_TYPE_INDIRECT_CALL &&
 +        type != CTRDATA_TYPE_DIRECT_CALL &&
 +        type != CTRDATA_TYPE_RETURN &&
 +        type != CTRDATA_TYPE_CO_ROUTINE_SWAP) {
 +        return;
 +    }
 +
 +    if (type == CTRDATA_TYPE_EXCEPTION || type == CTRDATA_TYPE_INTERRUPT) {
 +        /* Case 2 for traps. */
 +        if (!(src_ctrl & src_mask)) {
 +            src = 0;
 +        } else if (!(tgt_ctrl & tgt_mask)) {
 +            /* Check if target priv-mode has allowed external trap recording. */
 +            if (!riscv_ctr_check_xte(env, src_priv, src_virt)) {
 +                return;
 +            }
 +
 +            ext_trap = true;
 +            dst = 0;
 +        }
 +    } else if (type == CTRDATA_TYPE_EXCEP_INT_RET) {
 +        /*
 +         * Case 3 for trap returns.  Trap returns from inhibited mode are not
 +         * recorded.
 +         */
 +        if (!(src_ctrl & src_mask)) {
 +            return;
 +        }
 +
 +        /* Case 2 for trap returns. */
 +        if (!(tgt_ctrl & tgt_mask)) {
 +            dst = 0;
 +        }
 +    }
 +
 +    /* Ignore filters in case of RASEMU mode or External trap. */
 +    if (!(tgt_ctrl & XCTRCTL_RASEMU) && !ext_trap) {
 +        /*
 +         * Check if the specific type is inhibited. Not taken branch filter is
 +         * an enable bit and needs to be checked separatly.
 +         */
 +        bool check = tgt_ctrl & BIT_ULL(type + XCTRCTL_INH_START);
 +        if ((type == CTRDATA_TYPE_NONTAKEN_BRANCH && !check) ||
 +            (type != CTRDATA_TYPE_NONTAKEN_BRANCH && check)) {
 +            return;
 +        }
 +    }
 +
 +    head = get_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK);
 +
 +    depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
 +    if (tgt_ctrl & XCTRCTL_RASEMU && type == CTRDATA_TYPE_RETURN) {
 +        head = (head - 1) & (depth - 1);
 +
 +        env->ctr_src[head] &= ~CTRSOURCE_VALID;
 +        env->sctrstatus =
 +            set_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK, head);
 +        return;
 +    }
 +
 +    /* In case of Co-routine SWAP we overwrite latest entry. */
 +    if (tgt_ctrl & XCTRCTL_RASEMU && type == CTRDATA_TYPE_CO_ROUTINE_SWAP) {
 +        head = (head - 1) & (depth - 1);
 +    }
 +
 +    env->ctr_src[head] = src | CTRSOURCE_VALID;
 +    env->ctr_dst[head] = dst & ~CTRTARGET_MISP;
 +    env->ctr_data[head] = set_field(0, CTRDATA_TYPE_MASK, type);
 +
 +    head = (head + 1) & (depth - 1);
 +
 +    env->sctrstatus = set_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK, head);
 +}
 +
  void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv, bool virt_en)
  {
--    return f | MAKE_64BIT_MASK(32, 32);
+     g_assert(newpriv <= PRV_M && newpriv != PRV_RESERVED);
-+    /* the value is sign-extended instead of NaN-boxing for zfinx */
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-+    if (RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+         !(env->mip & (1ULL << cause));
-+        return (int32_t)f;
+     bool smode_double_trap = false;
-+    } else {
+     uint64_t hdeleg = async ? env->hideleg : env->hedeleg;
-+        return f | MAKE_64BIT_MASK(32, 32);
++    const bool prev_virt = env->virt_enabled;
-+    }
++    const target_ulong prev_priv = env->priv;
      target_ulong tval = 0;
      target_ulong tinst = 0;
      target_ulong htval = 0;
      target_ulong mtval2 = 0;
 +    target_ulong src;
      int sxlen = 0;
      int mxlen = 16 << riscv_cpu_mxl(env);
      bool nnmi_excep = false;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
          env->pc = (env->stvec >> 2 << 2) +
                    ((async && (env->stvec & 3) == 1) ? cause * 4 : 0);
          riscv_cpu_set_mode(env, PRV_S, virt);
 +
 +        src = env->sepc;
      } else {
          /*
           * If the hart encounters an exception while executing in M-mode
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                        ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
          }
          riscv_cpu_set_mode(env, PRV_M, virt);
 +        src = env->mepc;
 +    }
 +
 +    if (riscv_cpu_cfg(env)->ext_smctr || riscv_cpu_cfg(env)->ext_ssctr) {
 +        if (async && cause == IRQ_PMU_OVF) {
 +            riscv_ctr_freeze(env, XCTRCTL_LCOFIFRZ, virt);
 +        } else if (!async && cause == RISCV_EXCP_BREAKPOINT) {
 +            riscv_ctr_freeze(env, XCTRCTL_BPFRZ, virt);
 +        }
 +
 +        riscv_ctr_add_entry(env, src, env->pc,
 +                        async ? CTRDATA_TYPE_INTERRUPT : CTRDATA_TYPE_EXCEPTION,
 +                        prev_priv, prev_virt);
      }
      /*
 diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/op_helper.c
 +++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
  {
      uint64_t mstatus;
      target_ulong prev_priv, prev_virt = env->virt_enabled;
 +    const target_ulong src_priv = env->priv;
 +    const bool src_virt = env->virt_enabled;
      if (!(env->priv >= PRV_S)) {
          riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
      }
      env->mstatus = set_field(env->mstatus, MSTATUS_SPELP, 0);
 +    if (riscv_cpu_cfg(env)->ext_smctr || riscv_cpu_cfg(env)->ext_ssctr) {
 +        riscv_ctr_add_entry(env, env->pc, retpc, CTRDATA_TYPE_EXCEP_INT_RET,
 +                            src_priv, src_virt);
 +    }
 +
      return retpc;
  }
--static inline float32 check_nanbox_s(uint64_t f)
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
-+static inline float32 check_nanbox_s(CPURISCVState *env, uint64_t f)
+     }
      env->mstatus = set_field(env->mstatus, MSTATUS_MPELP, 0);
 +    if (riscv_cpu_cfg(env)->ext_smctr || riscv_cpu_cfg(env)->ext_ssctr) {
 +        riscv_ctr_add_entry(env, env->pc, retpc, CTRDATA_TYPE_EXCEP_INT_RET,
 +                            PRV_M, false);
 +    }
 +
      return retpc;
  }
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mnret(CPURISCVState *env)
      return retpc;
  }
 +void helper_ctr_add_entry(CPURISCVState *env, target_ulong src,
 +                          target_ulong dest, target_ulong type)
 +{
 +    riscv_ctr_add_entry(env, src, dest, (enum CTRType)type,
 +                        env->priv, env->virt_enabled);
 +}
 +
  void helper_wfi(CPURISCVState *env)
  {
-+    /* Disable NaN-boxing check when enable zfinx */
+     CPUState *cs = env_cpu(env);
 +    if (RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
 +        return (uint32_t)f;
 +    }
 +
      uint64_t mask = MAKE_64BIT_MASK(32, 32);
      if (likely((f & mask) == mask)) {
 diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/fpu_helper.c
 +++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_fmadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2,
  static uint64_t do_fmadd_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2,
                             uint64_t rs3, int flags)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 -    float32 frs2 = check_nanbox_s(rs2);
 -    float32 frs3 = check_nanbox_s(rs3);
 -    return nanbox_s(float32_muladd(frs1, frs2, frs3, flags, &env->fp_status));
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    float32 frs3 = check_nanbox_s(env, rs3);
 +    return nanbox_s(env, float32_muladd(frs1, frs2, frs3, flags,
 +                                        &env->fp_status));
  }
  uint64_t helper_fmadd_s(CPURISCVState *env, uint64_t frs1, uint64_t frs2,
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fnmadd_h(CPURISCVState *env, uint64_t frs1, uint64_t frs2,
  uint64_t helper_fadd_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 -    float32 frs2 = check_nanbox_s(rs2);
 -    return nanbox_s(float32_add(frs1, frs2, &env->fp_status));
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    return nanbox_s(env, float32_add(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fsub_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 -    float32 frs2 = check_nanbox_s(rs2);
 -    return nanbox_s(float32_sub(frs1, frs2, &env->fp_status));
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    return nanbox_s(env, float32_sub(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fmul_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 -    float32 frs2 = check_nanbox_s(rs2);
 -    return nanbox_s(float32_mul(frs1, frs2, &env->fp_status));
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    return nanbox_s(env, float32_mul(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fdiv_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 -    float32 frs2 = check_nanbox_s(rs2);
 -    return nanbox_s(float32_div(frs1, frs2, &env->fp_status));
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    return nanbox_s(env, float32_div(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 -    float32 frs2 = check_nanbox_s(rs2);
 -    return nanbox_s(env->priv_ver < PRIV_VERSION_1_11_0 ?
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    return nanbox_s(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
                      float32_minnum(frs1, frs2, &env->fp_status) :
                      float32_minimum_number(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 -    float32 frs2 = check_nanbox_s(rs2);
 -    return nanbox_s(env->priv_ver < PRIV_VERSION_1_11_0 ?
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
 +    return nanbox_s(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
                      float32_maxnum(frs1, frs2, &env->fp_status) :
                      float32_maximum_number(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 -    return nanbox_s(float32_sqrt(frs1, &env->fp_status));
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    return nanbox_s(env, float32_sqrt(frs1, &env->fp_status));
  }
  target_ulong helper_fle_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 -    float32 frs2 = check_nanbox_s(rs2);
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
      return float32_le(frs1, frs2, &env->fp_status);
  }
  target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 -    float32 frs2 = check_nanbox_s(rs2);
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
      return float32_lt(frs1, frs2, &env->fp_status);
  }
  target_ulong helper_feq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 -    float32 frs2 = check_nanbox_s(rs2);
 +    float32 frs1 = check_nanbox_s(env, rs1);
 +    float32 frs2 = check_nanbox_s(env, rs2);
      return float32_eq_quiet(frs1, frs2, &env->fp_status);
  }
  target_ulong helper_fcvt_w_s(CPURISCVState *env, uint64_t rs1)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 +    float32 frs1 = check_nanbox_s(env, rs1);
      return float32_to_int32(frs1, &env->fp_status);
  }
  target_ulong helper_fcvt_wu_s(CPURISCVState *env, uint64_t rs1)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 +    float32 frs1 = check_nanbox_s(env, rs1);
      return (int32_t)float32_to_uint32(frs1, &env->fp_status);
  }
  target_ulong helper_fcvt_l_s(CPURISCVState *env, uint64_t rs1)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 +    float32 frs1 = check_nanbox_s(env, rs1);
      return float32_to_int64(frs1, &env->fp_status);
  }
  target_ulong helper_fcvt_lu_s(CPURISCVState *env, uint64_t rs1)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 +    float32 frs1 = check_nanbox_s(env, rs1);
      return float32_to_uint64(frs1, &env->fp_status);
  }
  uint64_t helper_fcvt_s_w(CPURISCVState *env, target_ulong rs1)
  {
 -    return nanbox_s(int32_to_float32((int32_t)rs1, &env->fp_status));
 +    return nanbox_s(env, int32_to_float32((int32_t)rs1, &env->fp_status));
  }
  uint64_t helper_fcvt_s_wu(CPURISCVState *env, target_ulong rs1)
  {
 -    return nanbox_s(uint32_to_float32((uint32_t)rs1, &env->fp_status));
 +    return nanbox_s(env, uint32_to_float32((uint32_t)rs1, &env->fp_status));
  }
  uint64_t helper_fcvt_s_l(CPURISCVState *env, target_ulong rs1)
  {
 -    return nanbox_s(int64_to_float32(rs1, &env->fp_status));
 +    return nanbox_s(env, int64_to_float32(rs1, &env->fp_status));
  }
  uint64_t helper_fcvt_s_lu(CPURISCVState *env, target_ulong rs1)
  {
 -    return nanbox_s(uint64_to_float32(rs1, &env->fp_status));
 +    return nanbox_s(env, uint64_to_float32(rs1, &env->fp_status));
  }
 -target_ulong helper_fclass_s(uint64_t rs1)
 +target_ulong helper_fclass_s(CPURISCVState *env, uint64_t rs1)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 +    float32 frs1 = check_nanbox_s(env, rs1);
      return fclass_s(frs1);
  }
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
  uint64_t helper_fcvt_s_d(CPURISCVState *env, uint64_t rs1)
  {
 -    return nanbox_s(float64_to_float32(rs1, &env->fp_status));
 +    return nanbox_s(env, float64_to_float32(rs1, &env->fp_status));
  }
  uint64_t helper_fcvt_d_s(CPURISCVState *env, uint64_t rs1)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 +    float32 frs1 = check_nanbox_s(env, rs1);
      return float32_to_float64(frs1, &env->fp_status);
  }
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fcvt_h_lu(CPURISCVState *env, target_ulong rs1)
  uint64_t helper_fcvt_h_s(CPURISCVState *env, uint64_t rs1)
  {
 -    float32 frs1 = check_nanbox_s(rs1);
 +    float32 frs1 = check_nanbox_s(env, rs1);
      return nanbox_h(float32_to_float16(frs1, true, &env->fp_status));
  }
  uint64_t helper_fcvt_s_h(CPURISCVState *env, uint64_t rs1)
  {
      float16 frs1 = check_nanbox_h(rs1);
 -    return nanbox_s(float16_to_float32(frs1, true, &env->fp_status));
 +    return nanbox_s(env, float16_to_float32(frs1, true, &env->fp_status));
  }
  uint64_t helper_fcvt_h_d(CPURISCVState *env, uint64_t rs1)
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+@@ -XXX,XX +XXX,XX @@ static void gen_set_fpr_d(DisasContext *ctx, int reg_num, TCGv_i64 t)
      TCGv zero;
      /* Space for 3 operands plus 1 extra for address computation. */
      TCGv temp[4];
 +    /* Space for 4 operands(1 dest and <=3 src) for float point computation */
 +    TCGv_i64 ftemp[4];
 +    uint8_t nftemp;
      /* PointerMasking extension */
      bool pm_mask_enabled;
      bool pm_base_enabled;
@@ -XXX,XX +XXX,XX @@ static void gen_set_gpr128(DisasContext *ctx, int reg_num, TCGv rl, TCGv rh)
      }
  }
-+static TCGv_i64 ftemp_new(DisasContext *ctx)
++#ifndef CONFIG_USER_ONLY
-+{
++/*
-+    assert(ctx->nftemp < ARRAY_SIZE(ctx->ftemp));
++ * Direct calls
-+    return ctx->ftemp[ctx->nftemp++] = tcg_temp_new_i64();
++ * - jal x1;
-+}
++ * - jal x5;
-+
++ * - c.jal.
-+static TCGv_i64 get_fpr_hs(DisasContext *ctx, int reg_num)
++ * - cm.jalt.
-+{
++ *
-+    if (!ctx->cfg_ptr->ext_zfinx) {
++ * Direct jumps
-+        return cpu_fpr[reg_num];
++ * - jal x0;
-+    }
++ * - c.j;
-+
++ * - cm.jt.
-+    if (reg_num == 0) {
++ *
-+        return tcg_constant_i64(0);
++ * Other direct jumps
-+    }
++ * - jal rd where rd != x1 and rd != x5 and rd != x0;
-+    switch (get_xl(ctx)) {
++ */
-+    case MXL_RV32:
++static void gen_ctr_jal(DisasContext *ctx, int rd, target_ulong imm)
-+#ifdef TARGET_RISCV32
++{
-+    {
++    TCGv dest = tcg_temp_new();
-+        TCGv_i64 t = ftemp_new(ctx);
++    TCGv src = tcg_temp_new();
-+        tcg_gen_ext_i32_i64(t, cpu_gpr[reg_num]);
++    TCGv type;
-+        return t;
++
-+    }
++    /*
-+#else
++     * If rd is x1 or x5 link registers, treat this as direct call otherwise
-+    /* fall through */
++     * its a direct jump.
-+    case MXL_RV64:
++     */
-+        return cpu_gpr[reg_num];
++    if (rd == 1 || rd == 5) {
-+#endif
++        type = tcg_constant_tl(CTRDATA_TYPE_DIRECT_CALL);
-+    default:
++    } else if (rd == 0) {
-+        g_assert_not_reached();
++        type = tcg_constant_tl(CTRDATA_TYPE_DIRECT_JUMP);
-+    }
++    } else {
-+}
++        type = tcg_constant_tl(CTRDATA_TYPE_OTHER_DIRECT_JUMP);
-+
++    }
-+static TCGv_i64 dest_fpr(DisasContext *ctx, int reg_num)
++
-+{
++    gen_pc_plus_diff(dest, ctx, imm);
-+    if (!ctx->cfg_ptr->ext_zfinx) {
++    gen_pc_plus_diff(src, ctx, 0);
-+        return cpu_fpr[reg_num];
++    gen_helper_ctr_add_entry(tcg_env, src, dest, type);
-+    }
++}
-+
++#endif
 +    if (reg_num == 0) {
 +        return ftemp_new(ctx);
 +    }
 +
 +    switch (get_xl(ctx)) {
 +    case MXL_RV32:
 +        return ftemp_new(ctx);
 +#ifdef TARGET_RISCV64
 +    case MXL_RV64:
 +        return cpu_gpr[reg_num];
 +#endif
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
 +/* assume t is nanboxing (for normal) or sign-extended (for zfinx) */
 +static void gen_set_fpr_hs(DisasContext *ctx, int reg_num, TCGv_i64 t)
 +{
 +    if (!ctx->cfg_ptr->ext_zfinx) {
 +        tcg_gen_mov_i64(cpu_fpr[reg_num], t);
 +        return;
 +    }
 +    if (reg_num != 0) {
 +        switch (get_xl(ctx)) {
 +        case MXL_RV32:
 +#ifdef TARGET_RISCV32
 +            tcg_gen_extrl_i64_i32(cpu_gpr[reg_num], t);
 +            break;
 +#else
 +        /* fall through */
 +        case MXL_RV64:
 +            tcg_gen_mov_i64(cpu_gpr[reg_num], t);
 +            break;
 +#endif
 +        default:
 +            g_assert_not_reached();
 +        }
 +    }
 +}
 +
  static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
  {
-     target_ulong next_pc;
+     TCGv succ_pc = dest_gpr(ctx, rd);
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
-     ctx->cs = cs;
+         }
-     ctx->ntemp = 0;
+     }
-     memset(ctx->temp, 0, sizeof(ctx->temp));
-+    ctx->nftemp = 0;
++#ifndef CONFIG_USER_ONLY
-+    memset(ctx->ftemp, 0, sizeof(ctx->ftemp));
++    if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
-     ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
++        gen_ctr_jal(ctx, rd, imm);
-     ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
++    }
-     ctx->zero = tcg_constant_tl(0);
++#endif
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
++
-     DisasContext *ctx = container_of(dcbase, DisasContext, base);
+     gen_pc_plus_diff(succ_pc, ctx, ctx->cur_insn_len);
-     CPURISCVState *env = cpu->env_ptr;
+     gen_set_gpr(ctx, rd, succ_pc);
-     uint16_t opcode16 = translator_lduw(env, &ctx->base, ctx->base.pc_next);
-+    int i;
+diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
+index XXXXXXX..XXXXXXX 100644
-     ctx->ol = ctx->xl;
+--- a/target/riscv/insn_trans/trans_privileged.c.inc
-     decode_opc(env, ctx, opcode16);
++++ b/target/riscv/insn_trans/trans_privileged.c.inc
-     ctx->base.pc_next = ctx->pc_succ_insn;
+@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
+     if (has_ext(ctx, RVS)) {
--    for (int i = ctx->ntemp - 1; i >= 0; --i) {
+         decode_save_opc(ctx, 0);
-+    for (i = ctx->ntemp - 1; i >= 0; --i) {
+         translator_io_start(&ctx->base);
-         tcg_temp_free(ctx->temp[i]);
++        gen_update_pc(ctx, 0);
-         ctx->temp[i] = NULL;
+         gen_helper_sret(cpu_pc, tcg_env);
-     }
+         exit_tb(ctx); /* no chaining */
-     ctx->ntemp = 0;
+         ctx->base.is_jmp = DISAS_NORETURN;
-+    for (i = ctx->nftemp - 1; i >= 0; --i) {
+@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
-+        tcg_temp_free_i64(ctx->ftemp[i]);
+ #ifndef CONFIG_USER_ONLY
-+        ctx->ftemp[i] = NULL;
+     decode_save_opc(ctx, 0);
-+    }
+     translator_io_start(&ctx->base);
-+    ctx->nftemp = 0;
++    gen_update_pc(ctx, 0);
+     gen_helper_mret(cpu_pc, tcg_env);
-     if (ctx->base.is_jmp == DISAS_NEXT) {
+     exit_tb(ctx); /* no chaining */
-         target_ulong page_start;
+     ctx->base.is_jmp = DISAS_NORETURN;
-diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
+diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvf.c.inc
+--- a/target/riscv/insn_trans/trans_rvi.c.inc
-+++ b/target/riscv/insn_trans/trans_rvf.c.inc
++++ b/target/riscv/insn_trans/trans_rvi.c.inc
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool trans_jal(DisasContext *ctx, arg_jal *a)
  #define REQUIRE_FPU do {\
      if (ctx->mstatus_fs == 0) \
 -        return false;                       \
 +        if (!ctx->cfg_ptr->ext_zfinx) \
 +            return false; \
 +} while (0)
 +
 +#define REQUIRE_ZFINX_OR_F(ctx) do {\
 +    if (!ctx->cfg_ptr->ext_zfinx) { \
 +        REQUIRE_EXT(ctx, RVF); \
 +    } \
  } while (0)
  static bool trans_flw(DisasContext *ctx, arg_flw *a)
@@ -XXX,XX +XXX,XX @@ static bool trans_fsw(DisasContext *ctx, arg_fsw *a)
  static bool trans_fmadd_s(DisasContext *ctx, arg_fmadd_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
 +
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fmadd_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
 +    gen_helper_fmadd_s(dest, cpu_env, src1, src2, src3);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fmadd_s(DisasContext *ctx, arg_fmadd_s *a)
- static bool trans_fmsub_s(DisasContext *ctx, arg_fmsub_s *a)
++#ifndef CONFIG_USER_ONLY
 +/*
 + * Indirect calls
 + * - jalr x1, rs where rs != x5;
 + * - jalr x5, rs where rs != x1;
 + * - c.jalr rs1 where rs1 != x5;
 + *
 + * Indirect jumps
 + * - jalr x0, rs where rs != x1 and rs != x5;
 + * - c.jr rs1 where rs1 != x1 and rs1 != x5.
 + *
 + * Returns
 + * - jalr rd, rs where (rs == x1 or rs == x5) and rd != x1 and rd != x5;
 + * - c.jr rs1 where rs1 == x1 or rs1 == x5.
 + *
 + * Co-routine swap
 + * - jalr x1, x5;
 + * - jalr x5, x1;
 + * - c.jalr x5.
 + *
 + * Other indirect jumps
 + * - jalr rd, rs where rs != x1, rs != x5, rd != x0, rd != x1 and rd != x5.
 + */
 +static void gen_ctr_jalr(DisasContext *ctx, arg_jalr *a, TCGv dest)
 +{
 +    TCGv src = tcg_temp_new();
 +    TCGv type;
 +
 +    if ((a->rd == 1 && a->rs1 != 5) || (a->rd == 5 && a->rs1 != 1)) {
 +        type = tcg_constant_tl(CTRDATA_TYPE_INDIRECT_CALL);
 +    } else if (a->rd == 0 && a->rs1 != 1 && a->rs1 != 5) {
 +        type = tcg_constant_tl(CTRDATA_TYPE_INDIRECT_JUMP);
 +    } else if ((a->rs1 == 1 || a->rs1 == 5) && (a->rd != 1 && a->rd != 5)) {
 +        type = tcg_constant_tl(CTRDATA_TYPE_RETURN);
 +    } else if ((a->rs1 == 1 && a->rd == 5) || (a->rs1 == 5 && a->rd == 1)) {
 +        type = tcg_constant_tl(CTRDATA_TYPE_CO_ROUTINE_SWAP);
 +    } else {
 +        type = tcg_constant_tl(CTRDATA_TYPE_OTHER_INDIRECT_JUMP);
 +    }
 +
 +    gen_pc_plus_diff(src, ctx, 0);
 +    gen_helper_ctr_add_entry(tcg_env, src, dest, type);
 +}
 +#endif
 +
  static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
  {
-     REQUIRE_FPU;
+     TCGLabel *misaligned = NULL;
--    REQUIRE_EXT(ctx, RVF);
+@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
-+    REQUIRE_ZFINX_OR_F(ctx);
+     gen_pc_plus_diff(succ_pc, ctx, ctx->cur_insn_len);
-+
+     gen_set_gpr(ctx, a->rd, succ_pc);
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
++#ifndef CONFIG_USER_ONLY
-+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
++    if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
-+    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
++        gen_ctr_jalr(ctx, a, target_pc);
-+
++    }
-     gen_set_rm(ctx, a->rm);
++#endif
--    gen_helper_fmsub_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
++
--                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+     tcg_gen_mov_tl(cpu_pc, target_pc);
-+    gen_helper_fmsub_s(dest, cpu_env, src1, src2, src3);
+     if (ctx->fcfi_enabled) {
-+    gen_set_fpr_hs(ctx, a->rd, dest);
+         /*
-     mark_fs_dirty(ctx);
+@@ -XXX,XX +XXX,XX @@ static bool gen_branch(DisasContext *ctx, arg_b *a, TCGCond cond)
-     return true;
+     } else {
- }
+         tcg_gen_brcond_tl(cond, src1, src2, l);
-@@ -XXX,XX +XXX,XX @@ static bool trans_fmsub_s(DisasContext *ctx, arg_fmsub_s *a)
+     }
- static bool trans_fnmsub_s(DisasContext *ctx, arg_fnmsub_s *a)
++
- {
++#ifndef CONFIG_USER_ONLY
-     REQUIRE_FPU;
++    if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
--    REQUIRE_EXT(ctx, RVF);
++        TCGv type = tcg_constant_tl(CTRDATA_TYPE_NONTAKEN_BRANCH);
-+    REQUIRE_ZFINX_OR_F(ctx);
++        TCGv dest = tcg_temp_new();
-+
++        TCGv src = tcg_temp_new();
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
++
-+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
++        gen_pc_plus_diff(src, ctx, 0);
-+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
++        gen_pc_plus_diff(dest, ctx, ctx->cur_insn_len);
-+    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
++        gen_helper_ctr_add_entry(tcg_env, src, dest, type);
-+
++    }
-     gen_set_rm(ctx, a->rm);
++#endif
--    gen_helper_fnmsub_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
++
--                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+     gen_goto_tb(ctx, 1, ctx->cur_insn_len);
-+    gen_helper_fnmsub_s(dest, cpu_env, src1, src2, src3);
+     ctx->pc_save = orig_pc_save;
-+    gen_set_fpr_hs(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
+@@ -XXX,XX +XXX,XX @@ static bool gen_branch(DisasContext *ctx, arg_b *a, TCGCond cond)
-     return true;
+         gen_pc_plus_diff(target_pc, ctx, a->imm);
- }
+         gen_exception_inst_addr_mis(ctx, target_pc);
-@@ -XXX,XX +XXX,XX @@ static bool trans_fnmsub_s(DisasContext *ctx, arg_fnmsub_s *a)
+     } else {
- static bool trans_fnmadd_s(DisasContext *ctx, arg_fnmadd_s *a)
++#ifndef CONFIG_USER_ONLY
- {
++        if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
-     REQUIRE_FPU;
++            TCGv type = tcg_constant_tl(CTRDATA_TYPE_TAKEN_BRANCH);
--    REQUIRE_EXT(ctx, RVF);
++            TCGv dest = tcg_temp_new();
-+    REQUIRE_ZFINX_OR_F(ctx);
++            TCGv src = tcg_temp_new();
 +
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
++            gen_pc_plus_diff(src, ctx, 0);
-+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
++            gen_pc_plus_diff(dest, ctx, a->imm);
-+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
++            gen_helper_ctr_add_entry(tcg_env, src, dest, type);
-+    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
++        }
-+
++#endif
-     gen_set_rm(ctx, a->rm);
+         gen_goto_tb(ctx, 0, a->imm);
--    gen_helper_fnmadd_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
+     }
--                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+     ctx->pc_save = -1;
-+    gen_helper_fnmadd_s(dest, cpu_env, src1, src2, src3);
+diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
-+    gen_set_fpr_hs(ctx, a->rd, dest);
+index XXXXXXX..XXXXXXX 100644
-     mark_fs_dirty(ctx);
+--- a/target/riscv/insn_trans/trans_rvzce.c.inc
-     return true;
++++ b/target/riscv/insn_trans/trans_rvzce.c.inc
- }
+@@ -XXX,XX +XXX,XX @@ static bool gen_pop(DisasContext *ctx, arg_cmpp *a, bool ret, bool ret_val)
-@@ -XXX,XX +XXX,XX @@ static bool trans_fnmadd_s(DisasContext *ctx, arg_fnmadd_s *a)
- static bool trans_fadd_s(DisasContext *ctx, arg_fadd_s *a)
+     if (ret) {
- {
+         TCGv ret_addr = get_gpr(ctx, xRA, EXT_SIGN);
-     REQUIRE_FPU;
++#ifndef CONFIG_USER_ONLY
--    REQUIRE_EXT(ctx, RVF);
++        if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
-+    REQUIRE_ZFINX_OR_F(ctx);
++            TCGv type = tcg_constant_tl(CTRDATA_TYPE_RETURN);
-+
++            TCGv src = tcg_temp_new();
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
++            gen_pc_plus_diff(src, ctx, 0);
-+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
++            gen_helper_ctr_add_entry(tcg_env, src, ret_addr, type);
-+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
++        }
++#endif
-     gen_set_rm(ctx, a->rm);
+         tcg_gen_mov_tl(cpu_pc, ret_addr);
--    gen_helper_fadd_s(cpu_fpr[a->rd], cpu_env,
+         tcg_gen_lookup_and_goto_ptr();
--                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+         ctx->base.is_jmp = DISAS_NORETURN;
-+    gen_helper_fadd_s(dest, cpu_env, src1, src2);
+@@ -XXX,XX +XXX,XX @@ static bool trans_cm_jalt(DisasContext *ctx, arg_cm_jalt *a)
-+    gen_set_fpr_hs(ctx, a->rd, dest);
+         gen_set_gpr(ctx, xRA, succ_pc);
-     mark_fs_dirty(ctx);
+     }
-     return true;
- }
++#ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static bool trans_fadd_s(DisasContext *ctx, arg_fadd_s *a)
++    if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
- static bool trans_fsub_s(DisasContext *ctx, arg_fsub_s *a)
++        if (a->index >= 32) {
- {
++            TCGv type = tcg_constant_tl(CTRDATA_TYPE_DIRECT_CALL);
-     REQUIRE_FPU;
++            gen_helper_ctr_add_entry(tcg_env, cpu_pc, addr, type);
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fsub_s(cpu_fpr[a->rd], cpu_env,
 -                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_fsub_s(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsub_s(DisasContext *ctx, arg_fsub_s *a)
  static bool trans_fmul_s(DisasContext *ctx, arg_fmul_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fmul_s(cpu_fpr[a->rd], cpu_env,
 -                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_fmul_s(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmul_s(DisasContext *ctx, arg_fmul_s *a)
  static bool trans_fdiv_s(DisasContext *ctx, arg_fdiv_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fdiv_s(cpu_fpr[a->rd], cpu_env,
 -                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_fdiv_s(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fdiv_s(DisasContext *ctx, arg_fdiv_s *a)
  static bool trans_fsqrt_s(DisasContext *ctx, arg_fsqrt_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fsqrt_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fsqrt_s(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsqrt_s(DisasContext *ctx, arg_fsqrt_s *a)
  static bool trans_fsgnj_s(DisasContext *ctx, arg_fsgnj_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      if (a->rs1 == a->rs2) { /* FMOV */
 -        gen_check_nanbox_s(cpu_fpr[a->rd], cpu_fpr[a->rs1]);
 +        if (!ctx->cfg_ptr->ext_zfinx) {
 +            gen_check_nanbox_s(dest, src1);
 +        } else {
-+            tcg_gen_ext32s_i64(dest, src1);
++            TCGv type = tcg_constant_tl(CTRDATA_TYPE_DIRECT_JUMP);
-+        }
++            gen_helper_ctr_add_entry(tcg_env, cpu_pc, addr, type);
-     } else { /* FSGNJ */
++        }
--        TCGv_i64 rs1 = tcg_temp_new_i64();
++    }
--        TCGv_i64 rs2 = tcg_temp_new_i64();
++#endif
--
++
--        gen_check_nanbox_s(rs1, cpu_fpr[a->rs1]);
++
--        gen_check_nanbox_s(rs2, cpu_fpr[a->rs2]);
+     tcg_gen_mov_tl(cpu_pc, addr);
--
--        /* This formulation retains the nanboxing of rs2. */
+     tcg_gen_lookup_and_goto_ptr();
 -        tcg_gen_deposit_i64(cpu_fpr[a->rd], rs2, rs1, 0, 31);
 -        tcg_temp_free_i64(rs1);
 -        tcg_temp_free_i64(rs2);
 +        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +        if (!ctx->cfg_ptr->ext_zfinx) {
 +            TCGv_i64 rs1 = tcg_temp_new_i64();
 +            TCGv_i64 rs2 = tcg_temp_new_i64();
 +            gen_check_nanbox_s(rs1, src1);
 +            gen_check_nanbox_s(rs2, src2);
 +
 +            /* This formulation retains the nanboxing of rs2 in normal 'F'. */
 +            tcg_gen_deposit_i64(dest, rs2, rs1, 0, 31);
 +
 +            tcg_temp_free_i64(rs1);
 +            tcg_temp_free_i64(rs2);
 +        } else {
 +            tcg_gen_deposit_i64(dest, src2, src1, 0, 31);
 +            tcg_gen_ext32s_i64(dest, dest);
 +        }
      }
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjn_s(DisasContext *ctx, arg_fsgnjn_s *a)
      TCGv_i64 rs1, rs2, mask;
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 -    rs1 = tcg_temp_new_i64();
 -    gen_check_nanbox_s(rs1, cpu_fpr[a->rs1]);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    rs1 = tcg_temp_new_i64();
 +    if (!ctx->cfg_ptr->ext_zfinx) {
 +        gen_check_nanbox_s(rs1, src1);
 +    } else {
 +        tcg_gen_mov_i64(rs1, src1);
 +    }
      if (a->rs1 == a->rs2) { /* FNEG */
 -        tcg_gen_xori_i64(cpu_fpr[a->rd], rs1, MAKE_64BIT_MASK(31, 1));
 +        tcg_gen_xori_i64(dest, rs1, MAKE_64BIT_MASK(31, 1));
      } else {
 +        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
          rs2 = tcg_temp_new_i64();
 -        gen_check_nanbox_s(rs2, cpu_fpr[a->rs2]);
 +        if (!ctx->cfg_ptr->ext_zfinx) {
 +            gen_check_nanbox_s(rs2, src2);
 +        } else {
 +            tcg_gen_mov_i64(rs2, src2);
 +        }
          /*
           * Replace bit 31 in rs1 with inverse in rs2.
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjn_s(DisasContext *ctx, arg_fsgnjn_s *a)
           */
          mask = tcg_constant_i64(~MAKE_64BIT_MASK(31, 1));
          tcg_gen_nor_i64(rs2, rs2, mask);
 -        tcg_gen_and_i64(rs1, mask, rs1);
 -        tcg_gen_or_i64(cpu_fpr[a->rd], rs1, rs2);
 +        tcg_gen_and_i64(dest, mask, rs1);
 +        tcg_gen_or_i64(dest, dest, rs2);
          tcg_temp_free_i64(rs2);
      }
 +    /* signed-extended intead of nanboxing for result if enable zfinx */
 +    if (ctx->cfg_ptr->ext_zfinx) {
 +        tcg_gen_ext32s_i64(dest, dest);
 +    }
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      tcg_temp_free_i64(rs1);
 -
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjx_s(DisasContext *ctx, arg_fsgnjx_s *a)
      TCGv_i64 rs1, rs2;
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      rs1 = tcg_temp_new_i64();
 -    gen_check_nanbox_s(rs1, cpu_fpr[a->rs1]);
 +
 +    if (!ctx->cfg_ptr->ext_zfinx) {
 +        gen_check_nanbox_s(rs1, src1);
 +    } else {
 +        tcg_gen_mov_i64(rs1, src1);
 +    }
      if (a->rs1 == a->rs2) { /* FABS */
 -        tcg_gen_andi_i64(cpu_fpr[a->rd], rs1, ~MAKE_64BIT_MASK(31, 1));
 +        tcg_gen_andi_i64(dest, rs1, ~MAKE_64BIT_MASK(31, 1));
      } else {
 +        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
          rs2 = tcg_temp_new_i64();
 -        gen_check_nanbox_s(rs2, cpu_fpr[a->rs2]);
 +
 +        if (!ctx->cfg_ptr->ext_zfinx) {
 +            gen_check_nanbox_s(rs2, src2);
 +        } else {
 +            tcg_gen_mov_i64(rs2, src2);
 +        }
          /*
           * Xor bit 31 in rs1 with that in rs2.
           * This formulation retains the nanboxing of rs1.
           */
 -        tcg_gen_andi_i64(rs2, rs2, MAKE_64BIT_MASK(31, 1));
 -        tcg_gen_xor_i64(cpu_fpr[a->rd], rs1, rs2);
 +        tcg_gen_andi_i64(dest, rs2, MAKE_64BIT_MASK(31, 1));
 +        tcg_gen_xor_i64(dest, rs1, dest);
          tcg_temp_free_i64(rs2);
      }
 +    /* signed-extended intead of nanboxing for result if enable zfinx */
 +    if (ctx->cfg_ptr->ext_zfinx) {
 +        tcg_gen_ext32s_i64(dest, dest);
 +    }
      tcg_temp_free_i64(rs1);
 -
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjx_s(DisasContext *ctx, arg_fsgnjx_s *a)
  static bool trans_fmin_s(DisasContext *ctx, arg_fmin_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 -    gen_helper_fmin_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                      cpu_fpr[a->rs2]);
 +    gen_helper_fmin_s(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmin_s(DisasContext *ctx, arg_fmin_s *a)
  static bool trans_fmax_s(DisasContext *ctx, arg_fmax_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 -    gen_helper_fmax_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                      cpu_fpr[a->rs2]);
 +    gen_helper_fmax_s(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmax_s(DisasContext *ctx, arg_fmax_s *a)
  static bool trans_fcvt_w_s(DisasContext *ctx, arg_fcvt_w_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_w_s(dest, cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fcvt_w_s(dest, cpu_env, src1);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_w_s(DisasContext *ctx, arg_fcvt_w_s *a)
  static bool trans_fcvt_wu_s(DisasContext *ctx, arg_fcvt_wu_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_wu_s(dest, cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fcvt_wu_s(dest, cpu_env, src1);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_x_w(DisasContext *ctx, arg_fmv_x_w *a)
  {
      /* NOTE: This was FMV.X.S in an earlier version of the ISA spec! */
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 -
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
  #if defined(TARGET_RISCV64)
 -    tcg_gen_ext32s_tl(dest, cpu_fpr[a->rs1]);
 +    tcg_gen_ext32s_tl(dest, src1);
  #else
 -    tcg_gen_extrl_i64_i32(dest, cpu_fpr[a->rs1]);
 +    tcg_gen_extrl_i64_i32(dest, src1);
  #endif
      gen_set_gpr(ctx, a->rd, dest);
@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_x_w(DisasContext *ctx, arg_fmv_x_w *a)
  static bool trans_feq_s(DisasContext *ctx, arg_feq_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 -    gen_helper_feq_s(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_feq_s(dest, cpu_env, src1, src2);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_feq_s(DisasContext *ctx, arg_feq_s *a)
  static bool trans_flt_s(DisasContext *ctx, arg_flt_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 -    gen_helper_flt_s(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_flt_s(dest, cpu_env, src1, src2);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_flt_s(DisasContext *ctx, arg_flt_s *a)
  static bool trans_fle_s(DisasContext *ctx, arg_fle_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 -    gen_helper_fle_s(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_fle_s(dest, cpu_env, src1, src2);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fle_s(DisasContext *ctx, arg_fle_s *a)
  static bool trans_fclass_s(DisasContext *ctx, arg_fclass_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 -    gen_helper_fclass_s(dest, cpu_fpr[a->rs1]);
 +    gen_helper_fclass_s(dest, cpu_env, src1);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fclass_s(DisasContext *ctx, arg_fclass_s *a)
  static bool trans_fcvt_s_w(DisasContext *ctx, arg_fcvt_s_w *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
      TCGv src = get_gpr(ctx, a->rs1, EXT_SIGN);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_s_w(cpu_fpr[a->rd], cpu_env, src);
 -
 +    gen_helper_fcvt_s_w(dest, cpu_env, src);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_w(DisasContext *ctx, arg_fcvt_s_w *a)
  static bool trans_fcvt_s_wu(DisasContext *ctx, arg_fcvt_s_wu *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
      TCGv src = get_gpr(ctx, a->rs1, EXT_ZERO);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_s_wu(cpu_fpr[a->rd], cpu_env, src);
 -
 +    gen_helper_fcvt_s_wu(dest, cpu_env, src);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_w_x(DisasContext *ctx, arg_fmv_w_x *a)
  {
      /* NOTE: This was FMV.S.X in an earlier version of the ISA spec! */
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
      TCGv src = get_gpr(ctx, a->rs1, EXT_ZERO);
 -    tcg_gen_extu_tl_i64(cpu_fpr[a->rd], src);
 -    gen_nanbox_s(cpu_fpr[a->rd], cpu_fpr[a->rd]);
 -
 +    tcg_gen_extu_tl_i64(dest, src);
 +    gen_nanbox_s(dest, dest);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_l_s(DisasContext *ctx, arg_fcvt_l_s *a)
  {
      REQUIRE_64BIT(ctx);
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_l_s(dest, cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fcvt_l_s(dest, cpu_env, src1);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_lu_s(DisasContext *ctx, arg_fcvt_lu_s *a)
  {
      REQUIRE_64BIT(ctx);
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_lu_s(dest, cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fcvt_lu_s(dest, cpu_env, src1);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_l(DisasContext *ctx, arg_fcvt_s_l *a)
  {
      REQUIRE_64BIT(ctx);
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
      TCGv src = get_gpr(ctx, a->rs1, EXT_SIGN);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_s_l(cpu_fpr[a->rd], cpu_env, src);
 -
 +    gen_helper_fcvt_s_l(dest, cpu_env, src);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_lu(DisasContext *ctx, arg_fcvt_s_lu *a)
  {
      REQUIRE_64BIT(ctx);
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVF);
 +    REQUIRE_ZFINX_OR_F(ctx);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
      TCGv src = get_gpr(ctx, a->rs1, EXT_ZERO);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_s_lu(cpu_fpr[a->rd], cpu_env, src);
 -
 +    gen_helper_fcvt_s_lu(dest, cpu_env, src);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
 --
-.35.1
+.48.1

-[PULL 12/13] target/riscv: add support for zhinx/zhinxmin
+[PULL 26/59] target/riscv: Add CTR sctrclr instruction.
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Rajnesh Kanwal <rkanwal@rivosinc.com>
-  - update extension check REQUIRE_ZHINX_OR_ZFH and REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN
+CTR extension adds a new instruction sctrclr to quickly
-  - update half float point register read/write
+clear the recorded entries buffer.
   - disable nanbox_h check
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
 Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220211043920.28981-6-liweiwei@iscas.ac.cn>
+Message-ID: <20250205-b4-ctr_upstream_v6-v6-5-439d8e06c8ef@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/helper.h                     |   2 +-
+ target/riscv/cpu.h                            |  1 +
- target/riscv/internals.h                  |  16 +-
+ target/riscv/helper.h                         |  1 +
- target/riscv/fpu_helper.c                 |  89 +++---
+ target/riscv/insn32.decode                    |  1 +
- target/riscv/insn_trans/trans_rvzfh.c.inc | 332 +++++++++++++++-------
+ target/riscv/cpu_helper.c                     |  7 +++++
-files changed, 296 insertions(+), 143 deletions(-)
+ target/riscv/op_helper.c                      | 29 +++++++++++++++++++
  .../riscv/insn_trans/trans_privileged.c.inc   | 11 +++++++
 files changed, 50 insertions(+)
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.h
++++ b/target/riscv/cpu.h
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv, bool virt_en);
+ void riscv_ctr_add_entry(CPURISCVState *env, target_long src, target_long dst,
+     enum CTRType type, target_ulong prev_priv, bool prev_virt);
++void riscv_ctr_clear(CPURISCVState *env);
+ void riscv_translate_init(void);
+ void riscv_translate_code(CPUState *cs, TranslationBlock *tb,
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_h_w, TCG_CALL_NO_RWG, i64, env, tl)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
- DEF_HELPER_FLAGS_2(fcvt_h_wu, TCG_CALL_NO_RWG, i64, env, tl)
+ DEF_HELPER_1(sret, tl, env)
- DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
+ DEF_HELPER_1(mret, tl, env)
- DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
+ DEF_HELPER_1(mnret, tl, env)
--DEF_HELPER_FLAGS_1(fclass_h, TCG_CALL_NO_RWG_SE, tl, i64)
++DEF_HELPER_1(ctr_clear, void, env)
-+DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
+ DEF_HELPER_1(wfi, void, env)
+ DEF_HELPER_1(wrs_nto, void, env)
- /* Special functions */
+ DEF_HELPER_1(tlb_flush, void, env)
- DEF_HELPER_2(csrr, tl, env, int)
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 diff --git a/target/riscv/internals.h b/target/riscv/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/internals.h
+--- a/target/riscv/insn32.decode
-+++ b/target/riscv/internals.h
++++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ static inline float32 check_nanbox_s(CPURISCVState *env, uint64_t f)
+@@ -XXX,XX +XXX,XX @@
  # *** Privileged Instructions ***
  ecall       000000000000     00000 000 00000 1110011
  ebreak      000000000001     00000 000 00000 1110011
 +sctrclr     000100000100     00000 000 00000 1110011
  uret        0000000    00010 00000 000 00000 1110011
  sret        0001000    00010 00000 000 00000 1110011
  mret        0011000    00010 00000 000 00000 1110011
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void riscv_ctr_freeze(CPURISCVState *env, uint64_t freeze_mask,
      }
  }
--static inline uint64_t nanbox_h(float16 f)
++void riscv_ctr_clear(CPURISCVState *env)
-+static inline uint64_t nanbox_h(CPURISCVState *env, float16 f)
++{
 +    memset(env->ctr_src, 0x0, sizeof(env->ctr_src));
 +    memset(env->ctr_dst, 0x0, sizeof(env->ctr_dst));
 +    memset(env->ctr_data, 0x0, sizeof(env->ctr_data));
 +}
 +
  static uint64_t riscv_ctr_priv_to_mask(target_ulong priv, bool virt)
  {
--    return f | MAKE_64BIT_MASK(16, 48);
+     switch (priv) {
-+    /* the value is sign-extended instead of NaN-boxing for zfinx */
+diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-+    if (RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+index XXXXXXX..XXXXXXX 100644
-+        return (int16_t)f;
+--- a/target/riscv/op_helper.c
-+    } else {
++++ b/target/riscv/op_helper.c
-+        return f | MAKE_64BIT_MASK(16, 48);
+@@ -XXX,XX +XXX,XX @@ void helper_ctr_add_entry(CPURISCVState *env, target_ulong src,
-+    }
+                         env->priv, env->virt_enabled);
  }
--static inline float16 check_nanbox_h(uint64_t f)
++void helper_ctr_clear(CPURISCVState *env)
-+static inline float16 check_nanbox_h(CPURISCVState *env, uint64_t f)
++{
- {
++    /*
-+    /* Disable nanbox check when enable zfinx */
++     * It's safe to call smstateen_acc_ok() for umode access regardless of the
-+    if (RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
++     * state of bit 54 (CTR bit in case of m/hstateen) of sstateen. If the bit
-+        return (uint16_t)f;
++     * is zero, smstateen_acc_ok() will return the correct exception code and
 +     * if it's one, smstateen_acc_ok() will return RISCV_EXCP_NONE. In that
 +     * scenario the U-mode check below will handle that case.
 +     */
 +    RISCVException ret = smstateen_acc_ok(env, 0, SMSTATEEN0_CTR);
 +    if (ret != RISCV_EXCP_NONE) {
 +        riscv_raise_exception(env, ret, GETPC());
 +    }
 +
-     uint64_t mask = MAKE_64BIT_MASK(16, 48);
++    if (env->priv == PRV_U) {
++        /*
-     if (likely((f & mask) == mask)) {
++         * One corner case is when sctrclr is executed from VU-mode and
-diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
++         * mstateen.CTR = 0, in which case we are supposed to raise
 +         * RISCV_EXCP_ILLEGAL_INST. This case is already handled in
 +         * smstateen_acc_ok().
 +         */
 +        uint32_t excep = env->virt_enabled ? RISCV_EXCP_VIRT_INSTRUCTION_FAULT :
 +            RISCV_EXCP_ILLEGAL_INST;
 +        riscv_raise_exception(env, excep, GETPC());
 +    }
 +
 +    riscv_ctr_clear(env);
 +}
 +
  void helper_wfi(CPURISCVState *env)
  {
      CPUState *cs = env_cpu(env);
 diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/fpu_helper.c
+--- a/target/riscv/insn_trans/trans_privileged.c.inc
-+++ b/target/riscv/fpu_helper.c
++++ b/target/riscv/insn_trans/trans_privileged.c.inc
-@@ -XXX,XX +XXX,XX @@ void helper_set_rod_rounding_mode(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
  static uint64_t do_fmadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2,
                             uint64_t rs3, int flags)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 -    float16 frs2 = check_nanbox_h(rs2);
 -    float16 frs3 = check_nanbox_h(rs3);
 -    return nanbox_h(float16_muladd(frs1, frs2, frs3, flags, &env->fp_status));
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    float16 frs3 = check_nanbox_h(env, rs3);
 +    return nanbox_h(env, float16_muladd(frs1, frs2, frs3, flags,
 +                                        &env->fp_status));
  }
  static uint64_t do_fmadd_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2,
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_d(uint64_t frs1)
  uint64_t helper_fadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 -    float16 frs2 = check_nanbox_h(rs2);
 -    return nanbox_h(float16_add(frs1, frs2, &env->fp_status));
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return nanbox_h(env, float16_add(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fsub_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 -    float16 frs2 = check_nanbox_h(rs2);
 -    return nanbox_h(float16_sub(frs1, frs2, &env->fp_status));
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return nanbox_h(env, float16_sub(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fmul_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 -    float16 frs2 = check_nanbox_h(rs2);
 -    return nanbox_h(float16_mul(frs1, frs2, &env->fp_status));
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return nanbox_h(env, float16_mul(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fdiv_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 -    float16 frs2 = check_nanbox_h(rs2);
 -    return nanbox_h(float16_div(frs1, frs2, &env->fp_status));
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return nanbox_h(env, float16_div(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 -    float16 frs2 = check_nanbox_h(rs2);
 -    return nanbox_h(env->priv_ver < PRIV_VERSION_1_11_0 ?
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return nanbox_h(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
                      float16_minnum(frs1, frs2, &env->fp_status) :
                      float16_minimum_number(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 -    float16 frs2 = check_nanbox_h(rs2);
 -    return nanbox_h(env->priv_ver < PRIV_VERSION_1_11_0 ?
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
 +    return nanbox_h(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
                      float16_maxnum(frs1, frs2, &env->fp_status) :
                      float16_maximum_number(frs1, frs2, &env->fp_status));
  }
  uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 -    return nanbox_h(float16_sqrt(frs1, &env->fp_status));
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    return nanbox_h(env, float16_sqrt(frs1, &env->fp_status));
  }
  target_ulong helper_fle_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 -    float16 frs2 = check_nanbox_h(rs2);
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
      return float16_le(frs1, frs2, &env->fp_status);
  }
  target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 -    float16 frs2 = check_nanbox_h(rs2);
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
      return float16_lt(frs1, frs2, &env->fp_status);
  }
  target_ulong helper_feq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 -    float16 frs2 = check_nanbox_h(rs2);
 +    float16 frs1 = check_nanbox_h(env, rs1);
 +    float16 frs2 = check_nanbox_h(env, rs2);
      return float16_eq_quiet(frs1, frs2, &env->fp_status);
  }
 -target_ulong helper_fclass_h(uint64_t rs1)
 +target_ulong helper_fclass_h(CPURISCVState *env, uint64_t rs1)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 +    float16 frs1 = check_nanbox_h(env, rs1);
      return fclass_h(frs1);
  }
  target_ulong helper_fcvt_w_h(CPURISCVState *env, uint64_t rs1)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 +    float16 frs1 = check_nanbox_h(env, rs1);
      return float16_to_int32(frs1, &env->fp_status);
  }
  target_ulong helper_fcvt_wu_h(CPURISCVState *env, uint64_t rs1)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 +    float16 frs1 = check_nanbox_h(env, rs1);
      return (int32_t)float16_to_uint32(frs1, &env->fp_status);
  }
  target_ulong helper_fcvt_l_h(CPURISCVState *env, uint64_t rs1)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 +    float16 frs1 = check_nanbox_h(env, rs1);
      return float16_to_int64(frs1, &env->fp_status);
  }
  target_ulong helper_fcvt_lu_h(CPURISCVState *env, uint64_t rs1)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 +    float16 frs1 = check_nanbox_h(env, rs1);
      return float16_to_uint64(frs1, &env->fp_status);
  }
  uint64_t helper_fcvt_h_w(CPURISCVState *env, target_ulong rs1)
  {
 -    return nanbox_h(int32_to_float16((int32_t)rs1, &env->fp_status));
 +    return nanbox_h(env, int32_to_float16((int32_t)rs1, &env->fp_status));
  }
  uint64_t helper_fcvt_h_wu(CPURISCVState *env, target_ulong rs1)
  {
 -    return nanbox_h(uint32_to_float16((uint32_t)rs1, &env->fp_status));
 +    return nanbox_h(env, uint32_to_float16((uint32_t)rs1, &env->fp_status));
  }
  uint64_t helper_fcvt_h_l(CPURISCVState *env, target_ulong rs1)
  {
 -    return nanbox_h(int64_to_float16(rs1, &env->fp_status));
 +    return nanbox_h(env, int64_to_float16(rs1, &env->fp_status));
  }
  uint64_t helper_fcvt_h_lu(CPURISCVState *env, target_ulong rs1)
  {
 -    return nanbox_h(uint64_to_float16(rs1, &env->fp_status));
 +    return nanbox_h(env, uint64_to_float16(rs1, &env->fp_status));
  }
  uint64_t helper_fcvt_h_s(CPURISCVState *env, uint64_t rs1)
  {
      float32 frs1 = check_nanbox_s(env, rs1);
 -    return nanbox_h(float32_to_float16(frs1, true, &env->fp_status));
 +    return nanbox_h(env, float32_to_float16(frs1, true, &env->fp_status));
  }
  uint64_t helper_fcvt_s_h(CPURISCVState *env, uint64_t rs1)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 +    float16 frs1 = check_nanbox_h(env, rs1);
      return nanbox_s(env, float16_to_float32(frs1, true, &env->fp_status));
  }
  uint64_t helper_fcvt_h_d(CPURISCVState *env, uint64_t rs1)
  {
 -    return nanbox_h(float64_to_float16(rs1, true, &env->fp_status));
 +    return nanbox_h(env, float64_to_float16(rs1, true, &env->fp_status));
  }
  uint64_t helper_fcvt_d_h(CPURISCVState *env, uint64_t rs1)
  {
 -    float16 frs1 = check_nanbox_h(rs1);
 +    float16 frs1 = check_nanbox_h(env, rs1);
      return float16_to_float64(frs1, true, &env->fp_status);
  }
 diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvzfh.c.inc
 +++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
@@ -XXX,XX +XXX,XX @@
      }                         \
  } while (0)
 +#define REQUIRE_ZHINX_OR_ZFH(ctx) do { \
 +    if (!ctx->cfg_ptr->ext_zhinx && !ctx->cfg_ptr->ext_zfh) { \
 +        return false;                  \
 +    }                                  \
 +} while (0)
 +
  #define REQUIRE_ZFH_OR_ZFHMIN(ctx) do {       \
      if (!(ctx->cfg_ptr->ext_zfh || ctx->cfg_ptr->ext_zfhmin)) { \
          return false;                         \
      }                                         \
  } while (0)
 +#define REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN(ctx) do { \
 +    if (!(ctx->cfg_ptr->ext_zfh || ctx->cfg_ptr->ext_zfhmin ||          \
 +          ctx->cfg_ptr->ext_zhinx || ctx->cfg_ptr->ext_zhinxmin)) {     \
 +        return false;                                        \
 +    }                                                        \
 +} while (0)
 +
  static bool trans_flh(DisasContext *ctx, arg_flh *a)
  {
      TCGv_i64 dest;
@@ -XXX,XX +XXX,XX @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
  static bool trans_fmadd_h(DisasContext *ctx, arg_fmadd_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fmadd_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
 +    gen_helper_fmadd_h(dest, cpu_env, src1, src2, src3);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fmadd_h(DisasContext *ctx, arg_fmadd_h *a)
- static bool trans_fmsub_h(DisasContext *ctx, arg_fmsub_h *a)
++static bool trans_sctrclr(DisasContext *ctx, arg_sctrclr *a)
 +{
 +#ifndef CONFIG_USER_ONLY
 +    if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
 +        gen_helper_ctr_clear(tcg_env);
 +        return true;
 +    }
 +#endif
 +    return false;
 +}
 +
  static bool trans_uret(DisasContext *ctx, arg_uret *a)
  {
-     REQUIRE_FPU;
+     return false;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fmsub_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
 +    gen_helper_fmsub_h(dest, cpu_env, src1, src2, src3);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmsub_h(DisasContext *ctx, arg_fmsub_h *a)
  static bool trans_fnmsub_h(DisasContext *ctx, arg_fnmsub_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fnmsub_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
 +    gen_helper_fnmsub_h(dest, cpu_env, src1, src2, src3);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fnmsub_h(DisasContext *ctx, arg_fnmsub_h *a)
  static bool trans_fnmadd_h(DisasContext *ctx, arg_fnmadd_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fnmadd_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
 +    gen_helper_fnmadd_h(dest, cpu_env, src1, src2, src3);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fnmadd_h(DisasContext *ctx, arg_fnmadd_h *a)
  static bool trans_fadd_h(DisasContext *ctx, arg_fadd_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fadd_h(cpu_fpr[a->rd], cpu_env,
 -                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_fadd_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fadd_h(DisasContext *ctx, arg_fadd_h *a)
  static bool trans_fsub_h(DisasContext *ctx, arg_fsub_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fsub_h(cpu_fpr[a->rd], cpu_env,
 -                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_fsub_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsub_h(DisasContext *ctx, arg_fsub_h *a)
  static bool trans_fmul_h(DisasContext *ctx, arg_fmul_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fmul_h(cpu_fpr[a->rd], cpu_env,
 -                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_fmul_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmul_h(DisasContext *ctx, arg_fmul_h *a)
  static bool trans_fdiv_h(DisasContext *ctx, arg_fdiv_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fdiv_h(cpu_fpr[a->rd], cpu_env,
 -                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_fdiv_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fdiv_h(DisasContext *ctx, arg_fdiv_h *a)
  static bool trans_fsqrt_h(DisasContext *ctx, arg_fsqrt_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fsqrt_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fsqrt_h(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsqrt_h(DisasContext *ctx, arg_fsqrt_h *a)
  static bool trans_fsgnj_h(DisasContext *ctx, arg_fsgnj_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      if (a->rs1 == a->rs2) { /* FMOV */
 -        gen_check_nanbox_h(cpu_fpr[a->rd], cpu_fpr[a->rs1]);
 +        if (!ctx->cfg_ptr->ext_zfinx) {
 +            gen_check_nanbox_h(dest, src1);
 +        } else {
 +            tcg_gen_ext16s_i64(dest, src1);
 +        }
      } else {
 -        TCGv_i64 rs1 = tcg_temp_new_i64();
 -        TCGv_i64 rs2 = tcg_temp_new_i64();
 -
 -        gen_check_nanbox_h(rs1, cpu_fpr[a->rs1]);
 -        gen_check_nanbox_h(rs2, cpu_fpr[a->rs2]);
 -
 -        /* This formulation retains the nanboxing of rs2. */
 -        tcg_gen_deposit_i64(cpu_fpr[a->rd], rs2, rs1, 0, 15);
 -        tcg_temp_free_i64(rs1);
 -        tcg_temp_free_i64(rs2);
 +        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +        if (!ctx->cfg_ptr->ext_zfinx) {
 +            TCGv_i64 rs1 = tcg_temp_new_i64();
 +            TCGv_i64 rs2 = tcg_temp_new_i64();
 +            gen_check_nanbox_h(rs1, src1);
 +            gen_check_nanbox_h(rs2, src2);
 +
 +            /* This formulation retains the nanboxing of rs2 in normal 'Zfh'. */
 +            tcg_gen_deposit_i64(dest, rs2, rs1, 0, 15);
 +
 +            tcg_temp_free_i64(rs1);
 +            tcg_temp_free_i64(rs2);
 +        } else {
 +            tcg_gen_deposit_i64(dest, src2, src1, 0, 15);
 +            tcg_gen_ext16s_i64(dest, dest);
 +        }
      }
 -
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjn_h(DisasContext *ctx, arg_fsgnjn_h *a)
      TCGv_i64 rs1, rs2, mask;
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      rs1 = tcg_temp_new_i64();
 -    gen_check_nanbox_h(rs1, cpu_fpr[a->rs1]);
 +    if (!ctx->cfg_ptr->ext_zfinx) {
 +        gen_check_nanbox_h(rs1, src1);
 +    } else {
 +        tcg_gen_mov_i64(rs1, src1);
 +    }
      if (a->rs1 == a->rs2) { /* FNEG */
 -        tcg_gen_xori_i64(cpu_fpr[a->rd], rs1, MAKE_64BIT_MASK(15, 1));
 +        tcg_gen_xori_i64(dest, rs1, MAKE_64BIT_MASK(15, 1));
      } else {
 +        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
          rs2 = tcg_temp_new_i64();
 -        gen_check_nanbox_h(rs2, cpu_fpr[a->rs2]);
 +
 +        if (!ctx->cfg_ptr->ext_zfinx) {
 +            gen_check_nanbox_h(rs2, src2);
 +        } else {
 +            tcg_gen_mov_i64(rs2, src2);
 +        }
          /*
           * Replace bit 15 in rs1 with inverse in rs2.
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjn_h(DisasContext *ctx, arg_fsgnjn_h *a)
          mask = tcg_const_i64(~MAKE_64BIT_MASK(15, 1));
          tcg_gen_not_i64(rs2, rs2);
          tcg_gen_andc_i64(rs2, rs2, mask);
 -        tcg_gen_and_i64(rs1, mask, rs1);
 -        tcg_gen_or_i64(cpu_fpr[a->rd], rs1, rs2);
 +        tcg_gen_and_i64(dest, mask, rs1);
 +        tcg_gen_or_i64(dest, dest, rs2);
          tcg_temp_free_i64(mask);
          tcg_temp_free_i64(rs2);
      }
 +    /* signed-extended intead of nanboxing for result if enable zfinx */
 +    if (ctx->cfg_ptr->ext_zfinx) {
 +        tcg_gen_ext16s_i64(dest, dest);
 +    }
 +    tcg_temp_free_i64(rs1);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjx_h(DisasContext *ctx, arg_fsgnjx_h *a)
      TCGv_i64 rs1, rs2;
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      rs1 = tcg_temp_new_i64();
 -    gen_check_nanbox_s(rs1, cpu_fpr[a->rs1]);
 +    if (!ctx->cfg_ptr->ext_zfinx) {
 +        gen_check_nanbox_h(rs1, src1);
 +    } else {
 +        tcg_gen_mov_i64(rs1, src1);
 +    }
      if (a->rs1 == a->rs2) { /* FABS */
 -        tcg_gen_andi_i64(cpu_fpr[a->rd], rs1, ~MAKE_64BIT_MASK(15, 1));
 +        tcg_gen_andi_i64(dest, rs1, ~MAKE_64BIT_MASK(15, 1));
      } else {
 +        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
          rs2 = tcg_temp_new_i64();
 -        gen_check_nanbox_s(rs2, cpu_fpr[a->rs2]);
 +
 +        if (!ctx->cfg_ptr->ext_zfinx) {
 +            gen_check_nanbox_h(rs2, src2);
 +        } else {
 +            tcg_gen_mov_i64(rs2, src2);
 +        }
          /*
           * Xor bit 15 in rs1 with that in rs2.
           * This formulation retains the nanboxing of rs1.
           */
 -        tcg_gen_andi_i64(rs2, rs2, MAKE_64BIT_MASK(15, 1));
 -        tcg_gen_xor_i64(cpu_fpr[a->rd], rs1, rs2);
 +        tcg_gen_andi_i64(dest, rs2, MAKE_64BIT_MASK(15, 1));
 +        tcg_gen_xor_i64(dest, rs1, dest);
          tcg_temp_free_i64(rs2);
      }
 -
 +    /* signed-extended intead of nanboxing for result if enable zfinx */
 +    if (ctx->cfg_ptr->ext_zfinx) {
 +        tcg_gen_ext16s_i64(dest, dest);
 +    }
 +    tcg_temp_free_i64(rs1);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjx_h(DisasContext *ctx, arg_fsgnjx_h *a)
  static bool trans_fmin_h(DisasContext *ctx, arg_fmin_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 -    gen_helper_fmin_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                      cpu_fpr[a->rs2]);
 +    gen_helper_fmin_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmin_h(DisasContext *ctx, arg_fmin_h *a)
  static bool trans_fmax_h(DisasContext *ctx, arg_fmax_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 -    gen_helper_fmax_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                      cpu_fpr[a->rs2]);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 +
 +    gen_helper_fmax_h(dest, cpu_env, src1, src2);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmax_h(DisasContext *ctx, arg_fmax_h *a)
  static bool trans_fcvt_s_h(DisasContext *ctx, arg_fcvt_s_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH_OR_ZFHMIN(ctx);
 +    REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_s_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fcvt_s_h(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_h(DisasContext *ctx, arg_fcvt_s_h *a)
  static bool trans_fcvt_d_h(DisasContext *ctx, arg_fcvt_d_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH_OR_ZFHMIN(ctx);
 -    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN(ctx);
 +    REQUIRE_ZDINX_OR_D(ctx);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_d_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fcvt_d_h(dest, cpu_env, src1);
 +    gen_set_fpr_d(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
 -
      return true;
  }
  static bool trans_fcvt_h_s(DisasContext *ctx, arg_fcvt_h_s *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH_OR_ZFHMIN(ctx);
 +    REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN(ctx);
 -    gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_h_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fcvt_h_s(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_s(DisasContext *ctx, arg_fcvt_h_s *a)
  static bool trans_fcvt_h_d(DisasContext *ctx, arg_fcvt_h_d *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH_OR_ZFHMIN(ctx);
 -    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN(ctx);
 +    REQUIRE_ZDINX_OR_D(ctx);
 -    gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_h_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fcvt_h_d(dest, cpu_env, src1);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_d(DisasContext *ctx, arg_fcvt_h_d *a)
  static bool trans_feq_h(DisasContext *ctx, arg_feq_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 -    gen_helper_feq_h(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_feq_h(dest, cpu_env, src1, src2);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_feq_h(DisasContext *ctx, arg_feq_h *a)
  static bool trans_flt_h(DisasContext *ctx, arg_flt_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 -    gen_helper_flt_h(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_flt_h(dest, cpu_env, src1, src2);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_flt_h(DisasContext *ctx, arg_flt_h *a)
  static bool trans_fle_h(DisasContext *ctx, arg_fle_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 -    gen_helper_fle_h(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    gen_helper_fle_h(dest, cpu_env, src1, src2);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fle_h(DisasContext *ctx, arg_fle_h *a)
  static bool trans_fclass_h(DisasContext *ctx, arg_fclass_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 -    gen_helper_fclass_h(dest, cpu_fpr[a->rs1]);
 +    gen_helper_fclass_h(dest, cpu_env, src1);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fclass_h(DisasContext *ctx, arg_fclass_h *a)
  static bool trans_fcvt_w_h(DisasContext *ctx, arg_fcvt_w_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_w_h(dest, cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fcvt_w_h(dest, cpu_env, src1);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_w_h(DisasContext *ctx, arg_fcvt_w_h *a)
  static bool trans_fcvt_wu_h(DisasContext *ctx, arg_fcvt_wu_h *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_wu_h(dest, cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fcvt_wu_h(dest, cpu_env, src1);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_wu_h(DisasContext *ctx, arg_fcvt_wu_h *a)
  static bool trans_fcvt_h_w(DisasContext *ctx, arg_fcvt_h_w *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
      TCGv t0 = get_gpr(ctx, a->rs1, EXT_SIGN);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_h_w(cpu_fpr[a->rd], cpu_env, t0);
 +    gen_helper_fcvt_h_w(dest, cpu_env, t0);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_w(DisasContext *ctx, arg_fcvt_h_w *a)
  static bool trans_fcvt_h_wu(DisasContext *ctx, arg_fcvt_h_wu *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
      TCGv t0 = get_gpr(ctx, a->rs1, EXT_SIGN);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_h_wu(cpu_fpr[a->rd], cpu_env, t0);
 +    gen_helper_fcvt_h_wu(dest, cpu_env, t0);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_l_h(DisasContext *ctx, arg_fcvt_l_h *a)
  {
      REQUIRE_64BIT(ctx);
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_l_h(dest, cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fcvt_l_h(dest, cpu_env, src1);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_lu_h(DisasContext *ctx, arg_fcvt_lu_h *a)
  {
      REQUIRE_64BIT(ctx);
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
      TCGv dest = dest_gpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_lu_h(dest, cpu_env, cpu_fpr[a->rs1]);
 +    gen_helper_fcvt_lu_h(dest, cpu_env, src1);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_l(DisasContext *ctx, arg_fcvt_h_l *a)
  {
      REQUIRE_64BIT(ctx);
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
      TCGv t0 = get_gpr(ctx, a->rs1, EXT_SIGN);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_h_l(cpu_fpr[a->rd], cpu_env, t0);
 +    gen_helper_fcvt_h_l(dest, cpu_env, t0);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_lu(DisasContext *ctx, arg_fcvt_h_lu *a)
  {
      REQUIRE_64BIT(ctx);
      REQUIRE_FPU;
 -    REQUIRE_ZFH(ctx);
 +    REQUIRE_ZHINX_OR_ZFH(ctx);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
      TCGv t0 = get_gpr(ctx, a->rs1, EXT_SIGN);
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fcvt_h_lu(cpu_fpr[a->rd], cpu_env, t0);
 +    gen_helper_fcvt_h_lu(dest, cpu_env, t0);
 +    gen_set_fpr_hs(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
 --
-.35.1
+.48.1

-New patch
+[PULL 27/59] target/riscv: machine: Add Control Transfer Record state description
+From: Rajnesh Kanwal <rkanwal@rivosinc.com>
+Add a subsection to machine.c to migrate CTR CSR state
+Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250205-b4-ctr_upstream_v6-v6-6-439d8e06c8ef@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/machine.c | 25 +++++++++++++++++++++++++
+file changed, 25 insertions(+)
+diff --git a/target/riscv/machine.c b/target/riscv/machine.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/machine.c
++++ b/target/riscv/machine.c
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_envcfg = {
+     }
+ };
++static bool ctr_needed(void *opaque)
++{
++    RISCVCPU *cpu = opaque;
++
++    return cpu->cfg.ext_smctr || cpu->cfg.ext_ssctr;
++}
++
++static const VMStateDescription vmstate_ctr = {
++    .name = "cpu/ctr",
++    .version_id = 1,
++    .minimum_version_id = 1,
++    .needed = ctr_needed,
++    .fields = (const VMStateField[]) {
++        VMSTATE_UINT64(env.mctrctl, RISCVCPU),
++        VMSTATE_UINT32(env.sctrdepth, RISCVCPU),
++        VMSTATE_UINT32(env.sctrstatus, RISCVCPU),
++        VMSTATE_UINT64(env.vsctrctl, RISCVCPU),
++        VMSTATE_UINT64_ARRAY(env.ctr_src, RISCVCPU, 16 << SCTRDEPTH_MAX),
++        VMSTATE_UINT64_ARRAY(env.ctr_dst, RISCVCPU, 16 << SCTRDEPTH_MAX),
++        VMSTATE_UINT64_ARRAY(env.ctr_data, RISCVCPU, 16 << SCTRDEPTH_MAX),
++        VMSTATE_END_OF_LIST()
++    }
++};
++
+ static bool pmu_needed(void *opaque)
+ {
+     RISCVCPU *cpu = opaque;
+@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
+         &vmstate_jvt,
+         &vmstate_elp,
+         &vmstate_ssp,
++        &vmstate_ctr,
+         NULL
+     }
+ };
+--
+.48.1

-[PULL 09/13] target/riscv: hardwire mstatus.FS to zero when enable zfinx
+[PULL 28/59] target/riscv: log guest errors when reserved bits are set in PTEs
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: julia <midnight@trainwit.ch>
-Co-authored-by: ardxwe <ardxwe@gmail.com>
+For instance, QEMUs newer than b6ecc63c569bb88c0fcadf79fb92bf4b88aefea8
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+would silently treat this akin to an unmapped page (as required by the
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+RISC-V spec, admittedly). However, not all hardware platforms do (e.g.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+CVA6) which leads to an apparent QEMU bug.
-Message-Id: <20220211043920.28981-3-liweiwei@iscas.ac.cn>
 Instead, log a guest error so that in future, incorrectly set up page
 tables can be debugged without bisecting QEMU.
 Signed-off-by: julia <midnight@trainwit.ch>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20250203061852.2931556-1-midnight@trainwit.ch>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c |  6 +++++-
+ target/riscv/cpu_helper.c | 27 ++++++++++++++++++++++++++-
- target/riscv/csr.c        | 25 ++++++++++++++++++++-----
+file changed, 26 insertions(+), 1 deletion(-)
  target/riscv/translate.c  |  4 ++++
 files changed, 29 insertions(+), 6 deletions(-)
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_vector_enabled(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
+             ppn = pte >> PTE_PPN_SHIFT;
- void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
+         } else {
- {
+             if (pte & PTE_RESERVED) {
--    uint64_t mstatus_mask = MSTATUS_MXR | MSTATUS_SUM | MSTATUS_FS |
++                qemu_log_mask(LOG_GUEST_ERROR, "%s: reserved bits set in PTE: "
-+    uint64_t mstatus_mask = MSTATUS_MXR | MSTATUS_SUM |
++                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
-                             MSTATUS_SPP | MSTATUS_SPIE | MSTATUS_SIE |
++                              __func__, pte_addr, pte);
-                             MSTATUS64_UXL | MSTATUS_VS;
+                 return TRANSLATE_FAIL;
              }
              if (!pbmte && (pte & PTE_PBMT)) {
 +                /* Reserved without Svpbmt. */
 +                qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits set in PTE, "
 +                              "and Svpbmt extension is disabled: "
 +                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
 +                              __func__, pte_addr, pte);
                  return TRANSLATE_FAIL;
              }
              if (!riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
 +                /* Reserved without Svnapot extension */
 +                qemu_log_mask(LOG_GUEST_ERROR, "%s: N bit set in PTE, "
 +                              "and Svnapot extension is disabled: "
 +                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
 +                              __func__, pte_addr, pte);
                  return TRANSLATE_FAIL;
              }
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
              /* Invalid PTE */
              return TRANSLATE_FAIL;
          }
 +
-+    if (riscv_has_ext(env, RVF)) {
+         if (pte & (PTE_R | PTE_W | PTE_X)) {
-+        mstatus_mask |= MSTATUS_FS;
+             goto leaf;
-+    }
+         }
-     bool current_virt = riscv_cpu_virt_enabled(env);
+-        /* Inner PTE, continue walking */
-     g_assert(riscv_has_ext(env, RVH));
+         if (pte & (PTE_D | PTE_A | PTE_U | PTE_ATTR)) {
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
++            /* D, A, and U bits are reserved in non-leaf/inner PTEs */
-index XXXXXXX..XXXXXXX 100644
++            qemu_log_mask(LOG_GUEST_ERROR, "%s: D, A, or U bits set in non-leaf PTE: "
---- a/target/riscv/csr.c
++                          "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
-+++ b/target/riscv/csr.c
++                          __func__, pte_addr, pte);
-@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
+             return TRANSLATE_FAIL;
- static RISCVException fs(CPURISCVState *env, int csrno)
+         }
- {
++        /* Inner PTE, continue walking */
- #if !defined(CONFIG_USER_ONLY)
+         base = ppn << PGSHIFT;
 -    if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
 +    if (!env->debugger && !riscv_cpu_fp_enabled(env) &&
 +        !RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
          return RISCV_EXCP_ILLEGAL_INST;
      }
- #endif
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_fflags(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
-                                    target_ulong val)
+  leaf:
- {
+     if (ppn & ((1ULL << ptshift) - 1)) {
- #if !defined(CONFIG_USER_ONLY)
+         /* Misaligned PPN */
--    env->mstatus |= MSTATUS_FS;
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: PPN bits in PTE is misaligned: "
-+    if (riscv_has_ext(env, RVF)) {
++                      "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
-+        env->mstatus |= MSTATUS_FS;
++                      __func__, pte_addr, pte);
-+    }
+         return TRANSLATE_FAIL;
  #endif
      riscv_cpu_set_fflags(env, val & (FSR_AEXC >> FSR_AEXC_SHIFT));
      return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_frm(CPURISCVState *env, int csrno,
                                  target_ulong val)
  {
  #if !defined(CONFIG_USER_ONLY)
 -    env->mstatus |= MSTATUS_FS;
 +    if (riscv_has_ext(env, RVF)) {
 +        env->mstatus |= MSTATUS_FS;
 +    }
  #endif
      env->frm = val & (FSR_RD >> FSR_RD_SHIFT);
      return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_fcsr(CPURISCVState *env, int csrno,
                                   target_ulong val)
  {
  #if !defined(CONFIG_USER_ONLY)
 -    env->mstatus |= MSTATUS_FS;
 +    if (riscv_has_ext(env, RVF)) {
 +        env->mstatus |= MSTATUS_FS;
 +    }
  #endif
      env->frm = (val & FSR_RD) >> FSR_RD_SHIFT;
      riscv_cpu_set_fflags(env, (val & FSR_AEXC) >> FSR_AEXC_SHIFT);
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
          tlb_flush(env_cpu(env));
      }
-     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
+     if (!pbmte && (pte & PTE_PBMT)) {
--        MSTATUS_SPP | MSTATUS_FS | MSTATUS_MPRV | MSTATUS_SUM |
+         /* Reserved without Svpbmt. */
-+        MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits set in PTE, "
-         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
++                      "and Svpbmt extension is disabled: "
-         MSTATUS_TW | MSTATUS_VS;
++                      "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
++                      __func__, pte_addr, pte);
-+    if (riscv_has_ext(env, RVF)) {
+         return TRANSLATE_FAIL;
 +        mask |= MSTATUS_FS;
 +    }
 +
      if (xl != MXL_RV32 || env->debugger) {
          /*
           * RV32: MPV and GVA are not in mstatus. The current plan is to
@@ -XXX,XX +XXX,XX @@ static RISCVException write_misa(CPURISCVState *env, int csrno,
          return RISCV_EXCP_NONE;
      }
-+    if (!(val & RVF)) {
-+        env->mstatus &= ~MSTATUS_FS;
-+    }
-+
-     /* flush translation cache */
-     tb_flush(env_cpu(env));
-     env->misa_ext = val;
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
- {
-     TCGv tmp;
-+    if (!has_ext(ctx, RVF)) {
-+        return;
-+    }
-+
-     if (ctx->mstatus_fs != MSTATUS_FS) {
-         /* Remember the state change for the rest of the TB. */
-         ctx->mstatus_fs = MSTATUS_FS;
 --
-.35.1
+.48.1

-New patch
+[PULL 29/59] disas/riscv: Fix minor whitespace issues
+From: Rob Bradford <rbradford@rivosinc.com>
+Some extra spaces made into into the RISC-V opcode data table.
+Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250206153410.236636-2-rbradford@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ disas/riscv.c | 12 ++++++------
+file changed, 6 insertions(+), 6 deletions(-)
+diff --git a/disas/riscv.c b/disas/riscv.c
+index XXXXXXX..XXXXXXX 100644
+--- a/disas/riscv.c
++++ b/disas/riscv.c
+@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
+     { "aes32esi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+     { "aes32dsmi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+     { "aes32dsi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+-    { "aes64ks1i", rv_codec_k_rnum,  rv_fmt_rd_rs1_rnum, NULL, 0, 0, 0 },
++    { "aes64ks1i", rv_codec_k_rnum, rv_fmt_rd_rs1_rnum, NULL, 0, 0, 0 },
+     { "aes64ks2", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+     { "aes64im", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+     { "aes64esm", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
+     { "mop.rr.5", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+     { "mop.rr.6", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+     { "mop.rr.7", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+-    { "c.mop.1",  rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+-    { "c.mop.3",  rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+-    { "c.mop.5",  rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+-    { "c.mop.7",  rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+-    { "c.mop.9",  rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
++    { "c.mop.1", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
++    { "c.mop.3", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
++    { "c.mop.5", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
++    { "c.mop.7", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
++    { "c.mop.9", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+     { "c.mop.11", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+     { "c.mop.13", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+     { "c.mop.15", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+--
+.48.1

-New patch
+[PULL 30/59] disas/riscv: Add missing Sdtrig CSRs
+From: Rob Bradford <rbradford@rivosinc.com>
+This reflects the latest frozen version of the RISC-V Debug
+specification (1.0.0-rc4) which includes the Sdtrig extension.
+Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250206153410.236636-3-rbradford@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ disas/riscv.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/disas/riscv.c b/disas/riscv.c
+index XXXXXXX..XXXXXXX 100644
+--- a/disas/riscv.c
++++ b/disas/riscv.c
+@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
+     case 0x07a1: return "tdata1";
+     case 0x07a2: return "tdata2";
+     case 0x07a3: return "tdata3";
++    case 0x07a4: return "tinfo";
+     case 0x07b0: return "dcsr";
+     case 0x07b1: return "dpc";
+-    case 0x07b2: return "dscratch";
++    case 0x07b2: return "dscratch0";
++    case 0x07b3: return "dscratch1";
+     case 0x0b00: return "mcycle";
+     case 0x0b01: return "mtime";
+     case 0x0b02: return "minstret";
+--
+.48.1

-New patch
+[PULL 31/59] target/riscv: Fix the hpmevent mask
+From: Atish Patra <atishp@rivosinc.com>
+As per the latest privilege specification v1.13[1], the sscofpmf
+only reserves first 8 bits of hpmeventX. Update the corresponding
+masks accordingly.
+[1]https://github.com/riscv/riscv-isa-manual/issues/1578
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250206-pmu_minor_fixes-v2-1-1bb0f4aeb8b4@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_bits.h | 5 ++---
+file changed, 2 insertions(+), 3 deletions(-)
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@ typedef enum CTRType {
+                                             MHPMEVENTH_BIT_VSINH | \
+                                             MHPMEVENTH_BIT_VUINH)
+-#define MHPMEVENT_SSCOF_MASK               _ULL(0xFFFF000000000000)
+-#define MHPMEVENT_IDX_MASK                 0xFFFFF
+-#define MHPMEVENT_SSCOF_RESVD              16
++#define MHPMEVENT_SSCOF_MASK               MAKE_64BIT_MASK(63, 56)
++#define MHPMEVENT_IDX_MASK                 (~MHPMEVENT_SSCOF_MASK)
+ /* RISC-V-specific interrupt pending bits. */
+ #define CPU_INTERRUPT_RNMI                 CPU_INTERRUPT_TGT_EXT_0
+--
+.48.1

-New patch
+[PULL 32/59] target/riscv: Mask out upper sscofpmf bits during validation
+From: Atish Patra <atishp@rivosinc.com>
+As per the ISA definition, the upper 8 bits in hpmevent are defined
+by Sscofpmf for privilege mode filtering and overflow bits while the
+lower 56 bits are desginated for platform specific hpmevent values.
+For the reset case, mhpmevent value should have zero in lower 56 bits.
+Software may set the OF bit to indicate disable interrupt.
+Ensure that correct value is checked after masking while clearing the
+event encodings.
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Atish Patra <atishp@rivosinc.com>
+Message-ID: <20250206-pmu_minor_fixes-v2-2-1bb0f4aeb8b4@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/pmu.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/pmu.c
++++ b/target/riscv/pmu.c
+@@ -XXX,XX +XXX,XX @@ int riscv_pmu_update_event_map(CPURISCVState *env, uint64_t value,
+      * Expected mhpmevent value is zero for reset case. Remove the current
+      * mapping.
+      */
+-    if (!value) {
++    if (!(value & MHPMEVENT_IDX_MASK)) {
+         g_hash_table_foreach_remove(cpu->pmu_event_ctr_map,
+                                     pmu_remove_event_map,
+                                     GUINT_TO_POINTER(ctr_idx));
+--
+.48.1

-New patch
+[PULL 33/59] target/riscv: remove warnings about Smdbltrp/Smrnmi being disabled
+From: Clément Léger <cleger@rivosinc.com>
+As raised by Richard Henderson, these warnings are displayed in user
+only as well. Since they aren't really useful for the end-user, remove
+them and add a "TODO" note in the leading comments.
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20250213145640.117275-1-cleger@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/tcg/tcg-cpu.c | 8 +++-----
+file changed, 3 insertions(+), 5 deletions(-)
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/tcg/tcg-cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
+     }
+     /*
+-     * ext_smrnmi requires OpenSBI changes that our current
++     * TODO: ext_smrnmi requires OpenSBI changes that our current
+      * image does not have. Disable it for now.
+      */
+     if (cpu->cfg.ext_smrnmi) {
+         isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_smrnmi), false);
+-        qemu_log("Smrnmi is disabled in the 'max' type CPU\n");
+     }
+     /*
+-     * ext_smdbltrp requires the firmware to clear MSTATUS.MDT on startup to
+-     * avoid generating a double trap. OpenSBI does not currently support it,
++     * TODO: ext_smdbltrp requires the firmware to clear MSTATUS.MDT on startup
++     * to avoid generating a double trap. OpenSBI does not currently support it,
+      * disable it for now.
+      */
+     if (cpu->cfg.ext_smdbltrp) {
+         isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_smdbltrp), false);
+-        qemu_log("Smdbltrp is disabled in the 'max' type CPU\n");
+     }
+ }
+--
+.48.1

-New patch
+[PULL 34/59] target/riscv: Add support to access ctrsource, ctrtarget, ctrdata regs.
+From: Rajnesh Kanwal <rkanwal@rivosinc.com>
 CTR entries are accessed using ctrsource, ctrtarget and ctrdata
 registers using smcsrind/sscsrind extension. This commits extends
 the csrind extension to support CTR registers.
 ctrsource is accessible through xireg CSR, ctrtarget is accessible
 through xireg1 and ctrdata is accessible through xireg2 CSR.
 CTR supports maximum depth of 256 entries which are accessed using
 xiselect range 0x200 to 0x2ff.
 This commits also adds properties to enable CTR extension. CTR can be
 enabled using smctr=true and ssctr=true now.
 Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20250212-b4-ctr_upstream_v6-v7-1-4e8159ea33bf@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
  target/riscv/cpu.c         |  26 ++++++-
  target/riscv/csr.c         | 150 ++++++++++++++++++++++++++++++++++++-
  target/riscv/tcg/tcg-cpu.c |  11 +++
 files changed, 185 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(ssu64xl, PRIV_VERSION_1_12_0, has_priv_1_12),
      ISA_EXT_DATA_ENTRY(supm, PRIV_VERSION_1_13_0, ext_supm),
      ISA_EXT_DATA_ENTRY(svade, PRIV_VERSION_1_11_0, ext_svade),
 +    ISA_EXT_DATA_ENTRY(smctr, PRIV_VERSION_1_12_0, ext_smctr),
 +    ISA_EXT_DATA_ENTRY(ssctr, PRIV_VERSION_1_12_0, ext_ssctr),
      ISA_EXT_DATA_ENTRY(svadu, PRIV_VERSION_1_12_0, ext_svadu),
      ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
      ISA_EXT_DATA_ENTRY(svnapot, PRIV_VERSION_1_12_0, ext_svnapot),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
      MULTI_EXT_CFG_BOOL("smcdeleg", ext_smcdeleg, false),
      MULTI_EXT_CFG_BOOL("sscsrind", ext_sscsrind, false),
      MULTI_EXT_CFG_BOOL("ssccfg", ext_ssccfg, false),
 +    MULTI_EXT_CFG_BOOL("smctr", ext_smctr, false),
 +    MULTI_EXT_CFG_BOOL("ssctr", ext_ssctr, false),
      MULTI_EXT_CFG_BOOL("zifencei", ext_zifencei, true),
      MULTI_EXT_CFG_BOOL("zicfilp", ext_zicfilp, false),
      MULTI_EXT_CFG_BOOL("zicfiss", ext_zicfiss, false),
@@ -XXX,XX +XXX,XX @@ static RISCVCPUImpliedExtsRule SSPM_IMPLIED = {
      },
  };
 +static RISCVCPUImpliedExtsRule SMCTR_IMPLIED = {
 +    .ext = CPU_CFG_OFFSET(ext_smctr),
 +    .implied_misa_exts = RVS,
 +    .implied_multi_exts = {
 +        CPU_CFG_OFFSET(ext_sscsrind),
 +
 +        RISCV_IMPLIED_EXTS_RULE_END
 +    },
 +};
 +
 +static RISCVCPUImpliedExtsRule SSCTR_IMPLIED = {
 +    .ext = CPU_CFG_OFFSET(ext_ssctr),
 +    .implied_misa_exts = RVS,
 +    .implied_multi_exts = {
 +        CPU_CFG_OFFSET(ext_sscsrind),
 +
 +        RISCV_IMPLIED_EXTS_RULE_END
 +    },
 +};
 +
  RISCVCPUImpliedExtsRule *riscv_misa_ext_implied_rules[] = {
      &RVA_IMPLIED, &RVD_IMPLIED, &RVF_IMPLIED,
      &RVM_IMPLIED, &RVV_IMPLIED, NULL
@@ -XXX,XX +XXX,XX @@ RISCVCPUImpliedExtsRule *riscv_multi_ext_implied_rules[] = {
      &ZVFH_IMPLIED, &ZVFHMIN_IMPLIED, &ZVKN_IMPLIED,
      &ZVKNC_IMPLIED, &ZVKNG_IMPLIED, &ZVKNHB_IMPLIED,
      &ZVKS_IMPLIED,  &ZVKSC_IMPLIED, &ZVKSG_IMPLIED, &SSCFG_IMPLIED,
 -    &SUPM_IMPLIED, &SSPM_IMPLIED,
 +    &SUPM_IMPLIED, &SSPM_IMPLIED, &SMCTR_IMPLIED, &SSCTR_IMPLIED,
      NULL
  };
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static bool xiselect_cd_range(target_ulong isel)
      return (ISELECT_CD_FIRST <= isel && isel <= ISELECT_CD_LAST);
  }
 +static bool xiselect_ctr_range(int csrno, target_ulong isel)
 +{
 +    /* MIREG-MIREG6 for the range 0x200-0x2ff are not used by CTR. */
 +    return CTR_ENTRIES_FIRST <= isel && isel <= CTR_ENTRIES_LAST &&
 +           csrno < CSR_MIREG;
 +}
 +
  static int rmw_iprio(target_ulong xlen,
                       target_ulong iselect, uint8_t *iprio,
                       target_ulong *val, target_ulong new_val,
@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
      return 0;
  }
 +static int rmw_ctrsource(CPURISCVState *env, int isel, target_ulong *val,
 +                          target_ulong new_val, target_ulong wr_mask)
 +{
 +    /*
 +     * CTR arrays are treated as circular buffers and TOS always points to next
 +     * empty slot, keeping TOS - 1 always pointing to latest entry. Given entry
 +     * 0 is always the latest one, traversal is a bit different here. See the
 +     * below example.
 +     *
 +     * Depth = 16.
 +     *
 +     * idx    [0] [1] [2] [3] [4] [5] [6] [7] [8] [9] [A] [B] [C] [D] [E] [F]
 +     * TOS                                 H
 +     * entry   6   5   4   3   2   1   0   F   E   D   C   B   A   9   8   7
 +     */
 +    const uint64_t entry = isel - CTR_ENTRIES_FIRST;
 +    const uint64_t depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
 +    uint64_t idx;
 +
 +    /* Entry greater than depth-1 is read-only zero */
 +    if (entry >= depth) {
 +        if (val) {
 +            *val = 0;
 +        }
 +        return 0;
 +    }
 +
 +    idx = get_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK);
 +    idx = (idx - entry - 1) & (depth - 1);
 +
 +    if (val) {
 +        *val = env->ctr_src[idx];
 +    }
 +
 +    env->ctr_src[idx] = (env->ctr_src[idx] & ~wr_mask) | (new_val & wr_mask);
 +
 +    return 0;
 +}
 +
 +static int rmw_ctrtarget(CPURISCVState *env, int isel, target_ulong *val,
 +                          target_ulong new_val, target_ulong wr_mask)
 +{
 +    /*
 +     * CTR arrays are treated as circular buffers and TOS always points to next
 +     * empty slot, keeping TOS - 1 always pointing to latest entry. Given entry
 +     * 0 is always the latest one, traversal is a bit different here. See the
 +     * below example.
 +     *
 +     * Depth = 16.
 +     *
 +     * idx    [0] [1] [2] [3] [4] [5] [6] [7] [8] [9] [A] [B] [C] [D] [E] [F]
 +     * head                                H
 +     * entry   6   5   4   3   2   1   0   F   E   D   C   B   A   9   8   7
 +     */
 +    const uint64_t entry = isel - CTR_ENTRIES_FIRST;
 +    const uint64_t depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
 +    uint64_t idx;
 +
 +    /* Entry greater than depth-1 is read-only zero */
 +    if (entry >= depth) {
 +        if (val) {
 +            *val = 0;
 +        }
 +        return 0;
 +    }
 +
 +    idx = get_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK);
 +    idx = (idx - entry - 1) & (depth - 1);
 +
 +    if (val) {
 +        *val = env->ctr_dst[idx];
 +    }
 +
 +    env->ctr_dst[idx] = (env->ctr_dst[idx] & ~wr_mask) | (new_val & wr_mask);
 +
 +    return 0;
 +}
 +
 +static int rmw_ctrdata(CPURISCVState *env, int isel, target_ulong *val,
 +                        target_ulong new_val, target_ulong wr_mask)
 +{
 +    /*
 +     * CTR arrays are treated as circular buffers and TOS always points to next
 +     * empty slot, keeping TOS - 1 always pointing to latest entry. Given entry
 +     * 0 is always the latest one, traversal is a bit different here. See the
 +     * below example.
 +     *
 +     * Depth = 16.
 +     *
 +     * idx    [0] [1] [2] [3] [4] [5] [6] [7] [8] [9] [A] [B] [C] [D] [E] [F]
 +     * head                                H
 +     * entry   6   5   4   3   2   1   0   F   E   D   C   B   A   9   8   7
 +     */
 +    const uint64_t entry = isel - CTR_ENTRIES_FIRST;
 +    const uint64_t mask = wr_mask & CTRDATA_MASK;
 +    const uint64_t depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
 +    uint64_t idx;
 +
 +    /* Entry greater than depth-1 is read-only zero */
 +    if (entry >= depth) {
 +        if (val) {
 +            *val = 0;
 +        }
 +        return 0;
 +    }
 +
 +    idx = get_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK);
 +    idx = (idx - entry - 1) & (depth - 1);
 +
 +    if (val) {
 +        *val = env->ctr_data[idx];
 +    }
 +
 +    env->ctr_data[idx] = (env->ctr_data[idx] & ~mask) | (new_val & mask);
 +
 +    return 0;
 +}
 +
  static RISCVException rmw_xireg_aia(CPURISCVState *env, int csrno,
                           target_ulong isel, target_ulong *val,
                           target_ulong new_val, target_ulong wr_mask)
@@ -XXX,XX +XXX,XX @@ done:
      return ret;
  }
 +static int rmw_xireg_ctr(CPURISCVState *env, int csrno,
 +                        target_ulong isel, target_ulong *val,
 +                        target_ulong new_val, target_ulong wr_mask)
 +{
 +    if (!riscv_cpu_cfg(env)->ext_smctr && !riscv_cpu_cfg(env)->ext_ssctr) {
 +        return -EINVAL;
 +    }
 +
 +    if (csrno == CSR_SIREG || csrno == CSR_VSIREG) {
 +        return rmw_ctrsource(env, isel, val, new_val, wr_mask);
 +    } else if (csrno == CSR_SIREG2 || csrno == CSR_VSIREG2) {
 +        return rmw_ctrtarget(env, isel, val, new_val, wr_mask);
 +    } else if (csrno == CSR_SIREG3 || csrno == CSR_VSIREG3) {
 +        return rmw_ctrdata(env, isel, val, new_val, wr_mask);
 +    } else if (val) {
 +        *val = 0;
 +    }
 +
 +    return 0;
 +}
 +
  /*
   * rmw_xireg_csrind: Perform indirect access to xireg and xireg2-xireg6
   *
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
                                target_ulong isel, target_ulong *val,
                                target_ulong new_val, target_ulong wr_mask)
  {
 -    int ret = -EINVAL;
      bool virt = csrno == CSR_VSIREG ? true : false;
 +    int ret = -EINVAL;
      if (xiselect_cd_range(isel)) {
          ret = rmw_xireg_cd(env, csrno, isel, val, new_val, wr_mask);
 +    } else if (xiselect_ctr_range(csrno, isel)) {
 +        ret = rmw_xireg_ctr(env, csrno, isel, val, new_val, wr_mask);
      } else {
          /*
           * As per the specification, access to unimplented region is undefined
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
 +    if ((cpu->cfg.ext_smctr || cpu->cfg.ext_ssctr) &&
 +        (!riscv_has_ext(env, RVS) || !cpu->cfg.ext_sscsrind)) {
 +        if (cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_smctr)) ||
 +            cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_ssctr))) {
 +            error_setg(errp, "Smctr and Ssctr require S-mode and Sscsrind");
 +            return;
 +        }
 +        cpu->cfg.ext_smctr = false;
 +        cpu->cfg.ext_ssctr = false;
 +    }
 +
      /*
       * Disable isa extensions based on priv spec after we
       * validated and set everything we need.
 --
 .48.1

-New patch
+[PULL 35/59] target/riscv: Respect mseccfg.RLB bit for TOR mode PMP entry
+From: Rob Bradford <rbradford@rivosinc.com>
+When running in TOR mode (Top of Range) the next PMP entry controls
+whether the entry is locked. However simply checking if the PMP_LOCK bit
+is set is not sufficient with the Smepmp extension which now provides a
+bit (mseccfg.RLB (Rule Lock Bypass)) to disregard the lock bits. In
+order to respect this bit use the convenience pmp_is_locked() function
+rather than directly checking PMP_LOCK since this function checks
+mseccfg.RLB.
+Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20250210153713.343626-1-rbradford@rivosinc.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/pmp.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/pmp.c
++++ b/target/riscv/pmp.c
+@@ -XXX,XX +XXX,XX @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
+             uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg;
+             is_next_cfg_tor = PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg);
+-            if (pmp_cfg & PMP_LOCK && is_next_cfg_tor) {
++            if (pmp_is_locked(env, addr_index + 1) && is_next_cfg_tor) {
+                 qemu_log_mask(LOG_GUEST_ERROR,
+                               "ignoring pmpaddr write - pmpcfg + 1 locked\n");
+                 return;
+--
+.48.1

-New patch
+[PULL 36/59] linux-headers: Update to Linux v6.14-rc3
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Update headers to retrieve the latest KVM caps for RISC-V.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20250221153758.652078-2-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ include/standard-headers/linux/ethtool.h      |  4 +
+ include/standard-headers/linux/fuse.h         | 76 ++++++++++++++++++-
+ .../linux/input-event-codes.h                 |  1 +
+ include/standard-headers/linux/pci_regs.h     | 16 ++--
+ include/standard-headers/linux/virtio_pci.h   | 14 ++++
+ linux-headers/asm-arm64/kvm.h                 |  3 -
+ linux-headers/asm-loongarch/kvm_para.h        |  1 +
+ linux-headers/asm-riscv/kvm.h                 |  7 +-
+ linux-headers/asm-x86/kvm.h                   |  1 +
+ linux-headers/linux/iommufd.h                 | 35 ++++++---
+ linux-headers/linux/kvm.h                     |  8 +-
+ linux-headers/linux/stddef.h                  | 13 +++-
+ linux-headers/linux/vduse.h                   |  2 +-
+files changed, 146 insertions(+), 35 deletions(-)
+diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/standard-headers/linux/ethtool.h
++++ b/include/standard-headers/linux/ethtool.h
+@@ -XXX,XX +XXX,XX @@ enum ethtool_link_ext_substate_module {
+  * @ETH_SS_STATS_ETH_MAC: names of IEEE 802.3 MAC statistics
+  * @ETH_SS_STATS_ETH_CTRL: names of IEEE 802.3 MAC Control statistics
+  * @ETH_SS_STATS_RMON: names of RMON statistics
++ * @ETH_SS_STATS_PHY: names of PHY(dev) statistics
++ * @ETH_SS_TS_FLAGS: hardware timestamping flags
+  *
+  * @ETH_SS_COUNT: number of defined string sets
+  */
+@@ -XXX,XX +XXX,XX @@ enum ethtool_stringset {
+     ETH_SS_STATS_ETH_MAC,
+     ETH_SS_STATS_ETH_CTRL,
+     ETH_SS_STATS_RMON,
++    ETH_SS_STATS_PHY,
++    ETH_SS_TS_FLAGS,
+     /* add new constants above here */
+     ETH_SS_COUNT
+diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/standard-headers/linux/fuse.h
++++ b/include/standard-headers/linux/fuse.h
+@@ -XXX,XX +XXX,XX @@
+  *
+  *  7.41
+  *  - add FUSE_ALLOW_IDMAP
++ *  7.42
++ *  - Add FUSE_OVER_IO_URING and all other io-uring related flags and data
++ *    structures:
++ *    - struct fuse_uring_ent_in_out
++ *    - struct fuse_uring_req_header
++ *    - struct fuse_uring_cmd_req
++ *    - FUSE_URING_IN_OUT_HEADER_SZ
++ *    - FUSE_URING_OP_IN_OUT_SZ
++ *    - enum fuse_uring_cmd
+  */
+ #ifndef _LINUX_FUSE_H
+@@ -XXX,XX +XXX,XX @@
+ #define FUSE_KERNEL_VERSION 7
+ /** Minor version number of this interface */
+-#define FUSE_KERNEL_MINOR_VERSION 41
++#define FUSE_KERNEL_MINOR_VERSION 42
+ /** The node ID of the root inode */
+ #define FUSE_ROOT_ID 1
+@@ -XXX,XX +XXX,XX @@ struct fuse_file_lock {
+  * FUSE_HAS_RESEND: kernel supports resending pending requests, and the high bit
+  *            of the request ID indicates resend requests
+  * FUSE_ALLOW_IDMAP: allow creation of idmapped mounts
++ * FUSE_OVER_IO_URING: Indicate that client supports io-uring
+  */
+ #define FUSE_ASYNC_READ        (1 << 0)
+ #define FUSE_POSIX_LOCKS    (1 << 1)
+@@ -XXX,XX +XXX,XX @@ struct fuse_file_lock {
+ /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */
+ #define FUSE_DIRECT_IO_RELAX    FUSE_DIRECT_IO_ALLOW_MMAP
+ #define FUSE_ALLOW_IDMAP    (1ULL << 40)
++#define FUSE_OVER_IO_URING    (1ULL << 41)
+ /**
+  * CUSE INIT request/reply flags
+@@ -XXX,XX +XXX,XX @@ struct fuse_supp_groups {
+     uint32_t    groups[];
+ };
++/**
++ * Size of the ring buffer header
++ */
++#define FUSE_URING_IN_OUT_HEADER_SZ 128
++#define FUSE_URING_OP_IN_OUT_SZ 128
++
++/* Used as part of the fuse_uring_req_header */
++struct fuse_uring_ent_in_out {
++    uint64_t flags;
++
++    /*
++     * commit ID to be used in a reply to a ring request (see also
++     * struct fuse_uring_cmd_req)
++     */
++    uint64_t commit_id;
++
++    /* size of user payload buffer */
++    uint32_t payload_sz;
++    uint32_t padding;
++
++    uint64_t reserved;
++};
++
++/**
++ * Header for all fuse-io-uring requests
++ */
++struct fuse_uring_req_header {
++    /* struct fuse_in_header / struct fuse_out_header */
++    char in_out[FUSE_URING_IN_OUT_HEADER_SZ];
++
++    /* per op code header */
++    char op_in[FUSE_URING_OP_IN_OUT_SZ];
++
++    struct fuse_uring_ent_in_out ring_ent_in_out;
++};
++
++/**
++ * sqe commands to the kernel
++ */
++enum fuse_uring_cmd {
++    FUSE_IO_URING_CMD_INVALID = 0,
++
++    /* register the request buffer and fetch a fuse request */
++    FUSE_IO_URING_CMD_REGISTER = 1,
++
++    /* commit fuse request result and fetch next request */
++    FUSE_IO_URING_CMD_COMMIT_AND_FETCH = 2,
++};
++
++/**
++ * In the 80B command area of the SQE.
++ */
++struct fuse_uring_cmd_req {
++    uint64_t flags;
++
++    /* entry identifier for commits */
++    uint64_t commit_id;
++
++    /* queue the command is for (queue index) */
++    uint16_t qid;
++    uint8_t padding[6];
++};
++
+ #endif /* _LINUX_FUSE_H */
+diff --git a/include/standard-headers/linux/input-event-codes.h b/include/standard-headers/linux/input-event-codes.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/standard-headers/linux/input-event-codes.h
++++ b/include/standard-headers/linux/input-event-codes.h
+@@ -XXX,XX +XXX,XX @@
+ #define KEY_NOTIFICATION_CENTER    0x1bc    /* Show/hide the notification center */
+ #define KEY_PICKUP_PHONE    0x1bd    /* Answer incoming call */
+ #define KEY_HANGUP_PHONE    0x1be    /* Decline incoming call */
++#define KEY_LINK_PHONE        0x1bf   /* AL Phone Syncing */
+ #define KEY_DEL_EOL        0x1c0
+ #define KEY_DEL_EOS        0x1c1
+diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/standard-headers/linux/pci_regs.h
++++ b/include/standard-headers/linux/pci_regs.h
+@@ -XXX,XX +XXX,XX @@
+ #define  PCI_EXP_DEVSTA_TRPND    0x0020    /* Transactions Pending */
+ #define PCI_CAP_EXP_RC_ENDPOINT_SIZEOF_V1    12    /* v1 endpoints without link end here */
+ #define PCI_EXP_LNKCAP        0x0c    /* Link Capabilities */
+-#define  PCI_EXP_LNKCAP_SLS    0x0000000f /* Supported Link Speeds */
++#define  PCI_EXP_LNKCAP_SLS    0x0000000f /* Max Link Speed (prior to PCIe r3.0: Supported Link Speeds) */
+ #define  PCI_EXP_LNKCAP_SLS_2_5GB 0x00000001 /* LNKCAP2 SLS Vector bit 0 */
+ #define  PCI_EXP_LNKCAP_SLS_5_0GB 0x00000002 /* LNKCAP2 SLS Vector bit 1 */
+ #define  PCI_EXP_LNKCAP_SLS_8_0GB 0x00000003 /* LNKCAP2 SLS Vector bit 2 */
+@@ -XXX,XX +XXX,XX @@
+ #define  PCI_EXP_DEVCAP2_OBFF_MSG    0x00040000 /* New message signaling */
+ #define  PCI_EXP_DEVCAP2_OBFF_WAKE    0x00080000 /* Re-use WAKE# for OBFF */
+ #define  PCI_EXP_DEVCAP2_EE_PREFIX    0x00200000 /* End-End TLP Prefix */
++#define  PCI_EXP_DEVCAP2_EE_PREFIX_MAX    0x00c00000 /* Max End-End TLP Prefixes */
+ #define PCI_EXP_DEVCTL2        0x28    /* Device Control 2 */
+ #define  PCI_EXP_DEVCTL2_COMP_TIMEOUT    0x000f    /* Completion Timeout Value */
+ #define  PCI_EXP_DEVCTL2_COMP_TMOUT_DIS    0x0010    /* Completion Timeout Disable */
+@@ -XXX,XX +XXX,XX @@
+     /* Same bits as above */
+ #define PCI_ERR_CAP        0x18    /* Advanced Error Capabilities & Ctrl*/
+ #define  PCI_ERR_CAP_FEP(x)    ((x) & 0x1f)    /* First Error Pointer */
+-#define  PCI_ERR_CAP_ECRC_GENC    0x00000020    /* ECRC Generation Capable */
+-#define  PCI_ERR_CAP_ECRC_GENE    0x00000040    /* ECRC Generation Enable */
+-#define  PCI_ERR_CAP_ECRC_CHKC    0x00000080    /* ECRC Check Capable */
+-#define  PCI_ERR_CAP_ECRC_CHKE    0x00000100    /* ECRC Check Enable */
++#define  PCI_ERR_CAP_ECRC_GENC        0x00000020 /* ECRC Generation Capable */
++#define  PCI_ERR_CAP_ECRC_GENE        0x00000040 /* ECRC Generation Enable */
++#define  PCI_ERR_CAP_ECRC_CHKC        0x00000080 /* ECRC Check Capable */
++#define  PCI_ERR_CAP_ECRC_CHKE        0x00000100 /* ECRC Check Enable */
++#define  PCI_ERR_CAP_PREFIX_LOG_PRESENT    0x00000800 /* TLP Prefix Log Present */
+ #define PCI_ERR_HEADER_LOG    0x1c    /* Header Log Register (16 bytes) */
+ #define PCI_ERR_ROOT_COMMAND    0x2c    /* Root Error Command */
+ #define  PCI_ERR_ROOT_CMD_COR_EN    0x00000001 /* Correctable Err Reporting Enable */
+@@ -XXX,XX +XXX,XX @@
+ #define  PCI_ERR_ROOT_FATAL_RCV        0x00000040 /* Fatal Received */
+ #define  PCI_ERR_ROOT_AER_IRQ        0xf8000000 /* Advanced Error Interrupt Message Number */
+ #define PCI_ERR_ROOT_ERR_SRC    0x34    /* Error Source Identification */
++#define PCI_ERR_PREFIX_LOG    0x38    /* TLP Prefix LOG Register (up to 16 bytes) */
+ /* Virtual Channel */
+ #define PCI_VC_PORT_CAP1    0x04
+@@ -XXX,XX +XXX,XX @@
+ #define PCI_ACS_CTRL        0x06    /* ACS Control Register */
+ #define PCI_ACS_EGRESS_CTL_V    0x08    /* ACS Egress Control Vector */
+-#define PCI_VSEC_HDR        4    /* extended cap - vendor-specific */
+-#define  PCI_VSEC_HDR_LEN_SHIFT    20    /* shift for length field */
+-
+ /* SATA capability */
+ #define PCI_SATA_REGS        4    /* SATA REGs specifier */
+ #define  PCI_SATA_REGS_MASK    0xF    /* location - BAR#/inline */
+diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/standard-headers/linux/virtio_pci.h
++++ b/include/standard-headers/linux/virtio_pci.h
+@@ -XXX,XX +XXX,XX @@
+ #define VIRTIO_PCI_CAP_PCI_CFG        5
+ /* Additional shared memory capability */
+ #define VIRTIO_PCI_CAP_SHARED_MEMORY_CFG 8
++/* PCI vendor data configuration */
++#define VIRTIO_PCI_CAP_VENDOR_CFG    9
+ /* This is the PCI capability header: */
+ struct virtio_pci_cap {
+@@ -XXX,XX +XXX,XX @@ struct virtio_pci_cap {
+     uint32_t length;        /* Length of the structure, in bytes. */
+ };
++/* This is the PCI vendor data capability header: */
++struct virtio_pci_vndr_data {
++    uint8_t cap_vndr;        /* Generic PCI field: PCI_CAP_ID_VNDR */
++    uint8_t cap_next;        /* Generic PCI field: next ptr. */
++    uint8_t cap_len;        /* Generic PCI field: capability length */
++    uint8_t cfg_type;        /* Identifies the structure. */
++    uint16_t vendor_id;    /* Identifies the vendor-specific format. */
++    /* For Vendor Definition */
++    /* Pads structure to a multiple of 4 bytes */
++    /* Reads must not have side effects */
++};
++
+ struct virtio_pci_cap64 {
+     struct virtio_pci_cap cap;
+     uint32_t offset_hi;             /* Most sig 32 bits of offset */
+diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-headers/asm-arm64/kvm.h
++++ b/linux-headers/asm-arm64/kvm.h
+@@ -XXX,XX +XXX,XX @@
+ #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+ #define KVM_DIRTY_LOG_PAGE_OFFSET 64
+-#define KVM_REG_SIZE(id)                        \
+-    (1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
+-
+ struct kvm_regs {
+     struct user_pt_regs regs;    /* sp = sp_el0 */
+diff --git a/linux-headers/asm-loongarch/kvm_para.h b/linux-headers/asm-loongarch/kvm_para.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-headers/asm-loongarch/kvm_para.h
++++ b/linux-headers/asm-loongarch/kvm_para.h
+@@ -XXX,XX +XXX,XX @@
+ #define  KVM_FEATURE_STEAL_TIME        2
+ /* BIT 24 - 31 are features configurable by user space vmm */
+ #define  KVM_FEATURE_VIRT_EXTIOI    24
++#define  KVM_FEATURE_USER_HCALL        25
+ #endif /* _ASM_KVM_PARA_H */
+diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-headers/asm-riscv/kvm.h
++++ b/linux-headers/asm-riscv/kvm.h
+@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_ISA_EXT_ID {
+     KVM_RISCV_ISA_EXT_SSNPM,
+     KVM_RISCV_ISA_EXT_SVADE,
+     KVM_RISCV_ISA_EXT_SVADU,
++    KVM_RISCV_ISA_EXT_SVVPTC,
++    KVM_RISCV_ISA_EXT_ZABHA,
++    KVM_RISCV_ISA_EXT_ZICCRSE,
+     KVM_RISCV_ISA_EXT_MAX,
+ };
+@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
+     KVM_RISCV_SBI_EXT_VENDOR,
+     KVM_RISCV_SBI_EXT_DBCN,
+     KVM_RISCV_SBI_EXT_STA,
++    KVM_RISCV_SBI_EXT_SUSP,
+     KVM_RISCV_SBI_EXT_MAX,
+ };
+@@ -XXX,XX +XXX,XX @@ struct kvm_riscv_sbi_sta {
+ #define KVM_RISCV_TIMER_STATE_OFF    0
+ #define KVM_RISCV_TIMER_STATE_ON    1
+-#define KVM_REG_SIZE(id)        \
+-    (1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
+-
+ /* If you need to interpret the index values, here is the key: */
+ #define KVM_REG_RISCV_TYPE_MASK        0x00000000FF000000
+ #define KVM_REG_RISCV_TYPE_SHIFT    24
+diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-headers/asm-x86/kvm.h
++++ b/linux-headers/asm-x86/kvm.h
+@@ -XXX,XX +XXX,XX @@ struct kvm_hyperv_eventfd {
+ #define KVM_X86_SEV_VM        2
+ #define KVM_X86_SEV_ES_VM    3
+ #define KVM_X86_SNP_VM        4
++#define KVM_X86_TDX_VM        5
+ #endif /* _ASM_X86_KVM_H */
+diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-headers/linux/iommufd.h
++++ b/linux-headers/linux/iommufd.h
+@@ -XXX,XX +XXX,XX @@ struct iommu_ioas_unmap {
+  *                       ioctl(IOMMU_OPTION_HUGE_PAGES)
+  * @IOMMU_OPTION_RLIMIT_MODE:
+  *    Change how RLIMIT_MEMLOCK accounting works. The caller must have privilege
+- *    to invoke this. Value 0 (default) is user based accouting, 1 uses process
++ *    to invoke this. Value 0 (default) is user based accounting, 1 uses process
+  *    based accounting. Global option, object_id must be 0
+  * @IOMMU_OPTION_HUGE_PAGES:
+  *    Value 1 (default) allows contiguous pages to be combined when generating
+@@ -XXX,XX +XXX,XX @@ struct iommu_vfio_ioas {
+  * @IOMMU_HWPT_ALLOC_PASID: Requests a domain that can be used with PASID. The
+  *                          domain can be attached to any PASID on the device.
+  *                          Any domain attached to the non-PASID part of the
+- *                          device must also be flaged, otherwise attaching a
++ *                          device must also be flagged, otherwise attaching a
+  *                          PASID will blocked.
+  *                          If IOMMU does not support PASID it will return
+  *                          error (-EOPNOTSUPP).
+@@ -XXX,XX +XXX,XX @@ struct iommu_hw_info_vtd {
+  * For the details of @idr, @iidr and @aidr, please refer to the chapters
+  * from 6.3.1 to 6.3.6 in the SMMUv3 Spec.
+  *
+- * User space should read the underlying ARM SMMUv3 hardware information for
+- * the list of supported features.
++ * This reports the raw HW capability, and not all bits are meaningful to be
++ * read by userspace. Only the following fields should be used:
+  *
+- * Note that these values reflect the raw HW capability, without any insight if
+- * any required kernel driver support is present. Bits may be set indicating the
+- * HW has functionality that is lacking kernel software support, such as BTM. If
+- * a VMM is using this information to construct emulated copies of these
+- * registers it should only forward bits that it knows it can support.
++ * idr[0]: ST_LEVEL, TERM_MODEL, STALL_MODEL, TTENDIAN , CD2L, ASID16, TTF
++ * idr[1]: SIDSIZE, SSIDSIZE
++ * idr[3]: BBML, RIL
++ * idr[5]: VAX, GRAN64K, GRAN16K, GRAN4K
+  *
+- * In future, presence of required kernel support will be indicated in flags.
++ * - S1P should be assumed to be true if a NESTED HWPT can be created
++ * - VFIO/iommufd only support platforms with COHACC, it should be assumed to be
++ *   true.
++ * - ATS is a per-device property. If the VMM describes any devices as ATS
++ *   capable in ACPI/DT it should set the corresponding idr.
++ *
++ * This list may expand in future (eg E0PD, AIE, PBHA, D128, DS etc). It is
++ * important that VMMs do not read bits outside the list to allow for
++ * compatibility with future kernels. Several features in the SMMUv3
++ * architecture are not currently supported by the kernel for nesting: HTTU,
++ * BTM, MPAM and others.
+  */
+ struct iommu_hw_info_arm_smmuv3 {
+     __u32 flags;
+@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_vtd_s1_invalidate {
+ };
+ /**
+- * struct iommu_viommu_arm_smmuv3_invalidate - ARM SMMUv3 cahce invalidation
++ * struct iommu_viommu_arm_smmuv3_invalidate - ARM SMMUv3 cache invalidation
+  *         (IOMMU_VIOMMU_INVALIDATE_DATA_ARM_SMMUV3)
+  * @cmd: 128-bit cache invalidation command that runs in SMMU CMDQ.
+  *       Must be little-endian.
+@@ -XXX,XX +XXX,XX @@ enum iommu_hwpt_pgfault_perm {
+  * @pasid: Process Address Space ID
+  * @grpid: Page Request Group Index
+  * @perm: Combination of enum iommu_hwpt_pgfault_perm
++ * @__reserved: Must be 0.
+  * @addr: Fault address
+  * @length: a hint of how much data the requestor is expecting to fetch. For
+  *          example, if the PRI initiator knows it is going to do a 10MB
+@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_pgfault {
+     __u32 pasid;
+     __u32 grpid;
+     __u32 perm;
+-    __u64 addr;
++    __u32 __reserved;
++    __aligned_u64 addr;
+     __u32 length;
+     __u32 cookie;
+ };
+diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-headers/linux/kvm.h
++++ b/linux-headers/linux/kvm.h
+@@ -XXX,XX +XXX,XX @@ struct kvm_ioeventfd {
+ #define KVM_X86_DISABLE_EXITS_HLT            (1 << 1)
+ #define KVM_X86_DISABLE_EXITS_PAUSE          (1 << 2)
+ #define KVM_X86_DISABLE_EXITS_CSTATE         (1 << 3)
+-#define KVM_X86_DISABLE_VALID_EXITS          (KVM_X86_DISABLE_EXITS_MWAIT | \
+-                                              KVM_X86_DISABLE_EXITS_HLT | \
+-                                              KVM_X86_DISABLE_EXITS_PAUSE | \
+-                                              KVM_X86_DISABLE_EXITS_CSTATE)
+ /* for KVM_ENABLE_CAP */
+ struct kvm_enable_cap {
+@@ -XXX,XX +XXX,XX @@ struct kvm_dirty_tlb {
+ #define KVM_REG_SIZE_SHIFT    52
+ #define KVM_REG_SIZE_MASK    0x00f0000000000000ULL
++
++#define KVM_REG_SIZE(id)        \
++    (1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
++
+ #define KVM_REG_SIZE_U8        0x0000000000000000ULL
+ #define KVM_REG_SIZE_U16    0x0010000000000000ULL
+ #define KVM_REG_SIZE_U32    0x0020000000000000ULL
+diff --git a/linux-headers/linux/stddef.h b/linux-headers/linux/stddef.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-headers/linux/stddef.h
++++ b/linux-headers/linux/stddef.h
+@@ -XXX,XX +XXX,XX @@
+ #define __always_inline __inline__
+ #endif
++/* Not all C++ standards support type declarations inside an anonymous union */
++#ifndef __cplusplus
++#define __struct_group_tag(TAG)        TAG
++#else
++#define __struct_group_tag(TAG)
++#endif
++
+ /**
+  * __struct_group() - Create a mirrored named and anonyomous struct
+  *
+@@ -XXX,XX +XXX,XX @@
+  * and size: one anonymous and one named. The former's members can be used
+  * normally without sub-struct naming, and the latter can be used to
+  * reason about the start, end, and size of the group of struct members.
+- * The named struct can also be explicitly tagged for layer reuse, as well
+- * as both having struct attributes appended.
++ * The named struct can also be explicitly tagged for layer reuse (C only),
++ * as well as both having struct attributes appended.
+  */
+ #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+     union { \
+         struct { MEMBERS } ATTRS; \
+-        struct TAG { MEMBERS } ATTRS NAME; \
++        struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \
+     } ATTRS
+ #ifdef __cplusplus
+diff --git a/linux-headers/linux/vduse.h b/linux-headers/linux/vduse.h
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-headers/linux/vduse.h
++++ b/linux-headers/linux/vduse.h
+@@ -XXX,XX +XXX,XX @@
+-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+ #ifndef _VDUSE_H_
+ #define _VDUSE_H_
+--
+.48.1

-New patch
+[PULL 37/59] target/riscv/cpu.c: create flag for ziccrse
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+At this moment ziccrse is a TCG always enabled named feature for
+priv_ver > 1.11 that has no exclusive flag. In the next patch we'll make
+the KVM driver turn ziccrse off if the extension isn't available in the
+host, and we'll need an ext_ziccrse flag in the CPU state for that.
+Create an exclusive flag for it like we do with other named features.
+As with any named features we already have, it won't be exposed to
+users.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20250221153758.652078-3-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/cpu_cfg.h     | 3 +++
+ target/riscv/cpu.c         | 3 ++-
+ target/riscv/tcg/tcg-cpu.c | 2 ++
+files changed, 7 insertions(+), 1 deletion(-)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool has_priv_1_12;
+     bool has_priv_1_11;
++    /* Always enabled for TCG if has_priv_1_11 */
++    bool ext_ziccrse;
++
+     /* Vendor-specific custom extensions */
+     bool ext_xtheadba;
+     bool ext_xtheadbb;
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
+     ISA_EXT_DATA_ENTRY(ziccamoa, PRIV_VERSION_1_11_0, has_priv_1_11),
+     ISA_EXT_DATA_ENTRY(ziccif, PRIV_VERSION_1_11_0, has_priv_1_11),
+     ISA_EXT_DATA_ENTRY(zicclsm, PRIV_VERSION_1_11_0, has_priv_1_11),
+-    ISA_EXT_DATA_ENTRY(ziccrse, PRIV_VERSION_1_11_0, has_priv_1_11),
++    ISA_EXT_DATA_ENTRY(ziccrse, PRIV_VERSION_1_11_0, ext_ziccrse),
+     ISA_EXT_DATA_ENTRY(zicfilp, PRIV_VERSION_1_12_0, ext_zicfilp),
+     ISA_EXT_DATA_ENTRY(zicfiss, PRIV_VERSION_1_13_0, ext_zicfiss),
+     ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
+     MULTI_EXT_CFG_BOOL("zic64b", ext_zic64b, true),
+     MULTI_EXT_CFG_BOOL("ssstateen", ext_ssstateen, true),
+     MULTI_EXT_CFG_BOOL("sha", ext_sha, true),
++    MULTI_EXT_CFG_BOOL("ziccrse", ext_ziccrse, true),
+     { },
+ };
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/tcg/tcg-cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
+     cpu->cfg.ext_sha = riscv_has_ext(&cpu->env, RVH) &&
+                        cpu->cfg.ext_ssstateen;
++
++    cpu->cfg.ext_ziccrse = cpu->cfg.has_priv_1_11;
+ }
+ static void riscv_cpu_validate_g(RISCVCPU *cpu)
+--
+.48.1

-New patch
+[PULL 38/59] target/riscv/kvm: add extensions after 6.14-rc3 update
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Expose ziccrse, zabha and svvptc.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Message-ID: <20250221153758.652078-4-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/kvm/kvm-cpu.c | 3 +++
+file changed, 3 insertions(+)
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm/kvm-cpu.c
++++ b/target/riscv/kvm/kvm-cpu.c
+@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
+ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
+     KVM_EXT_CFG("zicbom", ext_zicbom, KVM_RISCV_ISA_EXT_ZICBOM),
+     KVM_EXT_CFG("zicboz", ext_zicboz, KVM_RISCV_ISA_EXT_ZICBOZ),
++    KVM_EXT_CFG("ziccrse", ext_ziccrse, KVM_RISCV_ISA_EXT_ZICCRSE),
+     KVM_EXT_CFG("zicntr", ext_zicntr, KVM_RISCV_ISA_EXT_ZICNTR),
+     KVM_EXT_CFG("zicond", ext_zicond, KVM_RISCV_ISA_EXT_ZICOND),
+     KVM_EXT_CFG("zicsr", ext_zicsr, KVM_RISCV_ISA_EXT_ZICSR),
+@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
+     KVM_EXT_CFG("zihpm", ext_zihpm, KVM_RISCV_ISA_EXT_ZIHPM),
+     KVM_EXT_CFG("zimop", ext_zimop, KVM_RISCV_ISA_EXT_ZIMOP),
+     KVM_EXT_CFG("zcmop", ext_zcmop, KVM_RISCV_ISA_EXT_ZCMOP),
++    KVM_EXT_CFG("zabha", ext_zabha, KVM_RISCV_ISA_EXT_ZABHA),
+     KVM_EXT_CFG("zacas", ext_zacas, KVM_RISCV_ISA_EXT_ZACAS),
+     KVM_EXT_CFG("zawrs", ext_zawrs, KVM_RISCV_ISA_EXT_ZAWRS),
+     KVM_EXT_CFG("zfa", ext_zfa, KVM_RISCV_ISA_EXT_ZFA),
+@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
+     KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
+     KVM_EXT_CFG("svnapot", ext_svnapot, KVM_RISCV_ISA_EXT_SVNAPOT),
+     KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
++    KVM_EXT_CFG("svvptc", ext_svvptc, KVM_RISCV_ISA_EXT_SVVPTC),
+ };
+ static void *kvmconfig_get_cfg_addr(RISCVCPU *cpu, KVMCPUConfig *kvmcfg)
+--
+.48.1

-New patch
+[PULL 39/59] hw/riscv/riscv-iommu.h: add missing headers
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+This header is incomplete, i.e. it is using definitions that are being
+supplied by the .c files that are including it.
+Adding this header into a fresh .c file will result in errors:
+/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:30:17: error: field ‘parent_obj’ has incomplete type
+|     DeviceState parent_obj;
+      |                 ^~~~~~~~~~
+/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:50:5: error: unknown type name ‘dma_addr_t’; did you mean ‘in_addr_t’?
+|     dma_addr_t cq_addr;   /* Command queue base physical address */
+      |     ^~~~~~~~~~
+      |     in_addr_t
+(...)
+/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:62:5: error: unknown type name ‘QemuThread’; did you mean ‘GThread’?
+|     QemuThread core_proc; /* Background processing thread */
+      |     ^~~~~~~~~~
+      |     GThread
+/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:63:5: error: unknown type name ‘QemuCond’
+|     QemuCond core_cond;   /* Background processing wake up signal */
+      |     ^~~~~~~~
+/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:71:18: error: field ‘trap_as’ has incomplete type
+|     AddressSpace trap_as;
+      |                  ^~~~~~~
+/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:72:18: error: field ‘trap_mr’ has incomplete type
+|     MemoryRegion trap_mr;
+      |                  ^~~~~~~
+/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:80:18: error: field ‘regs_mr’ has incomplete type
+|     MemoryRegion regs_mr;
+      |                  ^~~~~~~
+Fix it by adding the missing headers for these definitions.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250224190826.1858473-2-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/riscv/riscv-iommu.h | 2 ++
+file changed, 2 insertions(+)
+diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu.h
++++ b/hw/riscv/riscv-iommu.h
+@@ -XXX,XX +XXX,XX @@
+ #define HW_RISCV_IOMMU_STATE_H
+ #include "qom/object.h"
++#include "hw/qdev-properties.h"
++#include "system/dma.h"
+ #include "hw/riscv/iommu.h"
+ #include "hw/riscv/riscv-iommu-bits.h"
+--
+.48.1

-New patch
+[PULL 40/59] hw/riscv/riscv-iommu-bits.h: HPM bits
+From: Tomasz Jeznach <tjeznach@rivosinc.com>
+Add the relevant HPM (High Performance Monitor) bits that we'll be using
+in the next patches.
+Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250224190826.1858473-3-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/riscv/riscv-iommu-bits.h | 47 +++++++++++++++++++++++++++++++++++++
+file changed, 47 insertions(+)
+diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu-bits.h
++++ b/hw/riscv/riscv-iommu-bits.h
+@@ -XXX,XX +XXX,XX @@ struct riscv_iommu_pq_record {
+ #define RISCV_IOMMU_CAP_ATS             BIT_ULL(25)
+ #define RISCV_IOMMU_CAP_T2GPA           BIT_ULL(26)
+ #define RISCV_IOMMU_CAP_IGS             GENMASK_ULL(29, 28)
++#define RISCV_IOMMU_CAP_HPM             BIT_ULL(30)
+ #define RISCV_IOMMU_CAP_DBG             BIT_ULL(31)
+ #define RISCV_IOMMU_CAP_PAS             GENMASK_ULL(37, 32)
+ #define RISCV_IOMMU_CAP_PD8             BIT_ULL(38)
+@@ -XXX,XX +XXX,XX @@ enum {
+     RISCV_IOMMU_INTR_COUNT
+ };
++#define RISCV_IOMMU_IOCOUNT_NUM         31
++
++/* 5.19 Performance monitoring counter overflow status (32bits) */
++#define RISCV_IOMMU_REG_IOCOUNTOVF      0x0058
++#define RISCV_IOMMU_IOCOUNTOVF_CY       BIT(0)
++
++/* 5.20 Performance monitoring counter inhibits (32bits) */
++#define RISCV_IOMMU_REG_IOCOUNTINH      0x005C
++#define RISCV_IOMMU_IOCOUNTINH_CY       BIT(0)
++
++/* 5.21 Performance monitoring cycles counter (64bits) */
++#define RISCV_IOMMU_REG_IOHPMCYCLES     0x0060
++#define RISCV_IOMMU_IOHPMCYCLES_COUNTER GENMASK_ULL(62, 0)
++#define RISCV_IOMMU_IOHPMCYCLES_OVF     BIT_ULL(63)
++
++/* 5.22 Performance monitoring event counters (31 * 64bits) */
++#define RISCV_IOMMU_REG_IOHPMCTR_BASE   0x0068
++#define RISCV_IOMMU_REG_IOHPMCTR(_n)    \
++    (RISCV_IOMMU_REG_IOHPMCTR_BASE + (_n * 0x8))
++
++/* 5.23 Performance monitoring event selectors (31 * 64bits) */
++#define RISCV_IOMMU_REG_IOHPMEVT_BASE   0x0160
++#define RISCV_IOMMU_REG_IOHPMEVT(_n)    \
++    (RISCV_IOMMU_REG_IOHPMEVT_BASE + (_n * 0x8))
++#define RISCV_IOMMU_IOHPMEVT_EVENT_ID   GENMASK_ULL(14, 0)
++#define RISCV_IOMMU_IOHPMEVT_DMASK      BIT_ULL(15)
++#define RISCV_IOMMU_IOHPMEVT_PID_PSCID  GENMASK_ULL(35, 16)
++#define RISCV_IOMMU_IOHPMEVT_DID_GSCID  GENMASK_ULL(59, 36)
++#define RISCV_IOMMU_IOHPMEVT_PV_PSCV    BIT_ULL(60)
++#define RISCV_IOMMU_IOHPMEVT_DV_GSCV    BIT_ULL(61)
++#define RISCV_IOMMU_IOHPMEVT_IDT        BIT_ULL(62)
++#define RISCV_IOMMU_IOHPMEVT_OF         BIT_ULL(63)
++
++enum RISCV_IOMMU_HPMEVENT_id {
++    RISCV_IOMMU_HPMEVENT_INVALID    = 0,
++    RISCV_IOMMU_HPMEVENT_URQ        = 1,
++    RISCV_IOMMU_HPMEVENT_TRQ        = 2,
++    RISCV_IOMMU_HPMEVENT_ATS_RQ     = 3,
++    RISCV_IOMMU_HPMEVENT_TLB_MISS   = 4,
++    RISCV_IOMMU_HPMEVENT_DD_WALK    = 5,
++    RISCV_IOMMU_HPMEVENT_PD_WALK    = 6,
++    RISCV_IOMMU_HPMEVENT_S_VS_WALKS = 7,
++    RISCV_IOMMU_HPMEVENT_G_WALKS    = 8,
++    RISCV_IOMMU_HPMEVENT_MAX        = 9
++};
++
+ /* 5.24 Translation request IOVA (64bits) */
+ #define RISCV_IOMMU_REG_TR_REQ_IOVA     0x0258
+--
+.48.1

-[PULL 03/13] hw/intc: Add RISC-V AIA IMSIC device emulation
+[PULL 41/59] hw/riscv/riscv-iommu: add riscv-iommu-hpm file
-From: Anup Patel <anup.patel@wdc.com>
+From: Tomasz Jeznach <tjeznach@rivosinc.com>
-The RISC-V AIA (Advanced Interrupt Architecture) defines a new
+The HPM (Hardware Performance Monitor) support consists of almost 7
-interrupt controller for MSIs (message signal interrupts) called
+hundred lines that would be put on top of the base riscv-iommu
-IMSIC (Incoming Message Signal Interrupt Controller). The IMSIC
+emulation.
 is per-HART device and also suppport virtualizaiton of MSIs using
 dedicated VS-level guest interrupt files.
-This patch adds device emulation for RISC-V AIA IMSIC which
+To avoid clogging riscv-iommu.c, add a separated riscv-iommu-hpm file
-supports M-level, S-level, and VS-level MSIs.
+that will contain HPM specific code.
-Signed-off-by: Anup Patel <anup.patel@wdc.com>
+We'll start by adding riscv_iommu_hpmcycle_read(), a helper that will be
-Signed-off-by: Anup Patel <anup@brainfault.org>
+called during the riscv_iommu_mmio_read() callback.
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Message-Id: <20220220085526.808674-3-anup@brainfault.org>
+This change will have no effect on the existing emulation since we're
 not declaring HPM feature support.
 Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20250224190826.1858473-4-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/intc/riscv_imsic.h |  68 ++++++
+ hw/riscv/riscv-iommu-hpm.h | 27 +++++++++++++++++++
- hw/intc/riscv_imsic.c         | 448 ++++++++++++++++++++++++++++++++++
+ hw/riscv/riscv-iommu.h     |  4 +++
- hw/intc/Kconfig               |   3 +
+ hw/riscv/riscv-iommu-hpm.c | 54 ++++++++++++++++++++++++++++++++++++++
- hw/intc/meson.build           |   1 +
+ hw/riscv/riscv-iommu.c     | 24 ++++++++++++++++-
-files changed, 520 insertions(+)
+ hw/riscv/meson.build       |  3 ++-
- create mode 100644 include/hw/intc/riscv_imsic.h
+files changed, 110 insertions(+), 2 deletions(-)
- create mode 100644 hw/intc/riscv_imsic.c
+ create mode 100644 hw/riscv/riscv-iommu-hpm.h
  create mode 100644 hw/riscv/riscv-iommu-hpm.c
-diff --git a/include/hw/intc/riscv_imsic.h b/include/hw/intc/riscv_imsic.h
+diff --git a/hw/riscv/riscv-iommu-hpm.h b/hw/riscv/riscv-iommu-hpm.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/intc/riscv_imsic.h
++++ b/hw/riscv/riscv-iommu-hpm.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * RISC-V IMSIC (Incoming Message Signal Interrupt Controller) interface
++ * RISC-V IOMMU - Hardware Performance Monitor (HPM) helpers
 + *
-+ * Copyright (c) 2021 Western Digital Corporation or its affiliates.
++ * Copyright (C) 2022-2023 Rivos Inc.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
++ * This program is distributed in the hope that it will be useful,
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * more details.
++ * GNU General Public License for more details.
 + *
-+ * You should have received a copy of the GNU General Public License along with
++ * You should have received a copy of the GNU General Public License along
-+ * this program.  If not, see <http://www.gnu.org/licenses/>.
++ * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#ifndef HW_RISCV_IMSIC_H
++#ifndef HW_RISCV_IOMMU_HPM_H
-+#define HW_RISCV_IMSIC_H
++#define HW_RISCV_IOMMU_HPM_H
 +
-+#include "hw/sysbus.h"
 +#include "qom/object.h"
++#include "hw/riscv/riscv-iommu.h"
 +
-+#define TYPE_RISCV_IMSIC "riscv.imsic"
++uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s);
 +
 +typedef struct RISCVIMSICState RISCVIMSICState;
 +DECLARE_INSTANCE_CHECKER(RISCVIMSICState, RISCV_IMSIC, TYPE_RISCV_IMSIC)
 +
 +#define IMSIC_MMIO_PAGE_SHIFT          12
 +#define IMSIC_MMIO_PAGE_SZ             (1UL << IMSIC_MMIO_PAGE_SHIFT)
 +#define IMSIC_MMIO_SIZE(__num_pages)   ((__num_pages) * IMSIC_MMIO_PAGE_SZ)
 +
 +#define IMSIC_MMIO_HART_GUEST_MAX_BTIS 6
 +#define IMSIC_MMIO_GROUP_MIN_SHIFT     24
 +
 +#define IMSIC_HART_NUM_GUESTS(__guest_bits)           \
 +    (1U << (__guest_bits))
 +#define IMSIC_HART_SIZE(__guest_bits)                 \
 +    (IMSIC_HART_NUM_GUESTS(__guest_bits) * IMSIC_MMIO_PAGE_SZ)
 +#define IMSIC_GROUP_NUM_HARTS(__hart_bits)            \
 +    (1U << (__hart_bits))
 +#define IMSIC_GROUP_SIZE(__hart_bits, __guest_bits)   \
 +    (IMSIC_GROUP_NUM_HARTS(__hart_bits) * IMSIC_HART_SIZE(__guest_bits))
 +
 +struct RISCVIMSICState {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +    qemu_irq *external_irqs;
 +
 +    /*< public >*/
 +    MemoryRegion mmio;
 +    uint32_t num_eistate;
 +    uint32_t *eidelivery;
 +    uint32_t *eithreshold;
 +    uint32_t *eistate;
 +
 +    /* config */
 +    bool mmode;
 +    uint32_t hartid;
 +    uint32_t num_pages;
 +    uint32_t num_irqs;
 +};
 +
 +DeviceState *riscv_imsic_create(hwaddr addr, uint32_t hartid, bool mmode,
 +                                uint32_t num_pages, uint32_t num_ids);
 +
 +#endif
-diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
+diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv-iommu.h
 +++ b/hw/riscv/riscv-iommu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
      QLIST_ENTRY(RISCVIOMMUState) iommus;
      QLIST_HEAD(, RISCVIOMMUSpace) spaces;
 +
 +    /* HPM cycle counter */
 +    uint64_t hpmcycle_val;      /* Current value of cycle register */
 +    uint64_t hpmcycle_prev;     /* Saved value of QEMU_CLOCK_VIRTUAL clock */
  };
  void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, PCIBus *bus,
 diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/intc/riscv_imsic.c
++++ b/hw/riscv/riscv-iommu-hpm.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * RISC-V IMSIC (Incoming Message Signaled Interrupt Controller)
++ * RISC-V IOMMU - Hardware Performance Monitor (HPM) helpers
 + *
-+ * Copyright (c) 2021 Western Digital Corporation or its affiliates.
++ * Copyright (C) 2022-2023 Rivos Inc.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
++ * This program is distributed in the hope that it will be useful,
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * more details.
++ * GNU General Public License for more details.
 + *
-+ * You should have received a copy of the GNU General Public License along with
++ * You should have received a copy of the GNU General Public License along
-+ * this program.  If not, see <http://www.gnu.org/licenses/>.
++ * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
-+#include "qapi/error.h"
++#include "qemu/timer.h"
-+#include "qemu/log.h"
++#include "cpu_bits.h"
-+#include "qemu/module.h"
++#include "riscv-iommu-hpm.h"
-+#include "qemu/error-report.h"
++#include "riscv-iommu.h"
-+#include "qemu/bswap.h"
++#include "riscv-iommu-bits.h"
-+#include "exec/address-spaces.h"
++#include "trace.h"
 +#include "hw/sysbus.h"
 +#include "hw/pci/msi.h"
 +#include "hw/boards.h"
 +#include "hw/qdev-properties.h"
 +#include "hw/intc/riscv_imsic.h"
 +#include "hw/irq.h"
 +#include "target/riscv/cpu.h"
 +#include "target/riscv/cpu_bits.h"
 +#include "sysemu/sysemu.h"
 +#include "migration/vmstate.h"
 +
-+#define IMSIC_MMIO_PAGE_LE             0x00
++/* For now we assume IOMMU HPM frequency to be 1GHz so 1-cycle is of 1-ns. */
-+#define IMSIC_MMIO_PAGE_BE             0x04
++static inline uint64_t get_cycles(void)
 +{
 +    return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +}
 +
-+#define IMSIC_MIN_ID                   ((IMSIC_EIPx_BITS * 2) - 1)
++uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s)
-+#define IMSIC_MAX_ID                   (IMSIC_TOPEI_IID_MASK)
++{
 +    const uint64_t cycle = riscv_iommu_reg_get64(
 +        s, RISCV_IOMMU_REG_IOHPMCYCLES);
 +    const uint32_t inhibit = riscv_iommu_reg_get32(
 +        s, RISCV_IOMMU_REG_IOCOUNTINH);
 +    const uint64_t ctr_prev = s->hpmcycle_prev;
 +    const uint64_t ctr_val = s->hpmcycle_val;
 +
-+#define IMSIC_EISTATE_PENDING          (1U << 0)
++    if (get_field(inhibit, RISCV_IOMMU_IOCOUNTINH_CY)) {
-+#define IMSIC_EISTATE_ENABLED          (1U << 1)
++        /*
-+#define IMSIC_EISTATE_ENPEND           (IMSIC_EISTATE_ENABLED | \
++         * Counter should not increment if inhibit bit is set. We can't really
-+                                        IMSIC_EISTATE_PENDING)
++         * stop the QEMU_CLOCK_VIRTUAL, so we just return the last updated
-+
++         * counter value to indicate that counter was not incremented.
-+static uint32_t riscv_imsic_topei(RISCVIMSICState *imsic, uint32_t page)
++         */
-+{
++        return (ctr_val & RISCV_IOMMU_IOHPMCYCLES_COUNTER) |
-+    uint32_t i, max_irq, base;
++               (cycle & RISCV_IOMMU_IOHPMCYCLES_OVF);
 +
 +    base = page * imsic->num_irqs;
 +    max_irq = (imsic->eithreshold[page] &&
 +               (imsic->eithreshold[page] <= imsic->num_irqs)) ?
 +               imsic->eithreshold[page] : imsic->num_irqs;
 +    for (i = 1; i < max_irq; i++) {
 +        if ((imsic->eistate[base + i] & IMSIC_EISTATE_ENPEND) ==
 +                IMSIC_EISTATE_ENPEND) {
 +            return (i << IMSIC_TOPEI_IID_SHIFT) | i;
 +        }
 +    }
 +
-+    return 0;
++    return (ctr_val + get_cycles() - ctr_prev) |
 +        (cycle & RISCV_IOMMU_IOHPMCYCLES_OVF);
 +}
-+
+diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
-+static void riscv_imsic_update(RISCVIMSICState *imsic, uint32_t page)
+index XXXXXXX..XXXXXXX 100644
-+{
+--- a/hw/riscv/riscv-iommu.c
-+    if (imsic->eidelivery[page] && riscv_imsic_topei(imsic, page)) {
++++ b/hw/riscv/riscv-iommu.c
-+        qemu_irq_raise(imsic->external_irqs[page]);
+@@ -XXX,XX +XXX,XX @@
  #include "cpu_bits.h"
  #include "riscv-iommu.h"
  #include "riscv-iommu-bits.h"
 +#include "riscv-iommu-hpm.h"
  #include "trace.h"
  #define LIMIT_CACHE_CTX               (1U << 7)
@@ -XXX,XX +XXX,XX @@ static MemTxResult riscv_iommu_mmio_read(void *opaque, hwaddr addr,
          return MEMTX_ACCESS_ERROR;
      }
 -    ptr = &s->regs_rw[addr];
 +    /* Compute cycle register value. */
 +    if ((addr & ~7) == RISCV_IOMMU_REG_IOHPMCYCLES) {
 +        val = riscv_iommu_hpmcycle_read(s);
 +        ptr = (uint8_t *)&val + (addr & 7);
 +    } else if ((addr & ~3) == RISCV_IOMMU_REG_IOCOUNTOVF) {
 +        /*
 +         * Software can read RISCV_IOMMU_REG_IOCOUNTOVF before timer
 +         * callback completes. In which case CY_OF bit in
 +         * RISCV_IOMMU_IOHPMCYCLES_OVF would be 0. Here we take the
 +         * CY_OF bit state from RISCV_IOMMU_REG_IOHPMCYCLES register as
 +         * it's not dependent over the timer callback and is computed
 +         * from cycle overflow.
 +         */
 +        val = ldq_le_p(&s->regs_rw[addr]);
 +        val |= (riscv_iommu_hpmcycle_read(s) & RISCV_IOMMU_IOHPMCYCLES_OVF)
 +                   ? RISCV_IOMMU_IOCOUNTOVF_CY
 +                   : 0;
 +        ptr = (uint8_t *)&val + (addr & 3);
 +    } else {
-+        qemu_irq_lower(imsic->external_irqs[page]);
++        ptr = &s->regs_rw[addr];
 +    }
 +}
 +
 +static int riscv_imsic_eidelivery_rmw(RISCVIMSICState *imsic, uint32_t page,
 +                                      target_ulong *val,
 +                                      target_ulong new_val,
 +                                      target_ulong wr_mask)
 +{
 +    target_ulong old_val = imsic->eidelivery[page];
 +
 +    if (val) {
 +        *val = old_val;
 +    }
 +
-+    wr_mask &= 0x1;
+     val = ldn_le_p(ptr, size);
-+    imsic->eidelivery[page] = (old_val & ~wr_mask) | (new_val & wr_mask);
-+
+     *data = val;
-+    riscv_imsic_update(imsic, page);
+diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
 +    return 0;
 +}
 +
 +static int riscv_imsic_eithreshold_rmw(RISCVIMSICState *imsic, uint32_t page,
 +                                      target_ulong *val,
 +                                      target_ulong new_val,
 +                                      target_ulong wr_mask)
 +{
 +    target_ulong old_val = imsic->eithreshold[page];
 +
 +    if (val) {
 +        *val = old_val;
 +    }
 +
 +    wr_mask &= IMSIC_MAX_ID;
 +    imsic->eithreshold[page] = (old_val & ~wr_mask) | (new_val & wr_mask);
 +
 +    riscv_imsic_update(imsic, page);
 +    return 0;
 +}
 +
 +static int riscv_imsic_topei_rmw(RISCVIMSICState *imsic, uint32_t page,
 +                                 target_ulong *val, target_ulong new_val,
 +                                 target_ulong wr_mask)
 +{
 +    uint32_t base, topei = riscv_imsic_topei(imsic, page);
 +
 +    /* Read pending and enabled interrupt with highest priority */
 +    if (val) {
 +        *val = topei;
 +    }
 +
 +    /* Writes ignore value and clear top pending interrupt */
 +    if (topei && wr_mask) {
 +        topei >>= IMSIC_TOPEI_IID_SHIFT;
 +        base = page * imsic->num_irqs;
 +        if (topei) {
 +            imsic->eistate[base + topei] &= ~IMSIC_EISTATE_PENDING;
 +        }
 +
 +        riscv_imsic_update(imsic, page);
 +    }
 +
 +    return 0;
 +}
 +
 +static int riscv_imsic_eix_rmw(RISCVIMSICState *imsic,
 +                               uint32_t xlen, uint32_t page,
 +                               uint32_t num, bool pend, target_ulong *val,
 +                               target_ulong new_val, target_ulong wr_mask)
 +{
 +    uint32_t i, base;
 +    target_ulong mask;
 +    uint32_t state = (pend) ? IMSIC_EISTATE_PENDING : IMSIC_EISTATE_ENABLED;
 +
 +    if (xlen != 32) {
 +        if (num & 0x1) {
 +            return -EINVAL;
 +        }
 +        num >>= 1;
 +    }
 +    if (num >= (imsic->num_irqs / xlen)) {
 +        return -EINVAL;
 +    }
 +
 +    base = (page * imsic->num_irqs) + (num * xlen);
 +
 +    if (val) {
 +        *val = 0;
 +        for (i = 0; i < xlen; i++) {
 +            mask = (target_ulong)1 << i;
 +            *val |= (imsic->eistate[base + i] & state) ? mask : 0;
 +        }
 +    }
 +
 +    for (i = 0; i < xlen; i++) {
 +        /* Bit0 of eip0 and eie0 are read-only zero */
 +        if (!num && !i) {
 +            continue;
 +        }
 +
 +        mask = (target_ulong)1 << i;
 +        if (wr_mask & mask) {
 +            if (new_val & mask) {
 +                imsic->eistate[base + i] |= state;
 +            } else {
 +                imsic->eistate[base + i] &= ~state;
 +            }
 +        }
 +    }
 +
 +    riscv_imsic_update(imsic, page);
 +    return 0;
 +}
 +
 +static int riscv_imsic_rmw(void *arg, target_ulong reg, target_ulong *val,
 +                           target_ulong new_val, target_ulong wr_mask)
 +{
 +    RISCVIMSICState *imsic = arg;
 +    uint32_t isel, priv, virt, vgein, xlen, page;
 +
 +    priv = AIA_IREG_PRIV(reg);
 +    virt = AIA_IREG_VIRT(reg);
 +    isel = AIA_IREG_ISEL(reg);
 +    vgein = AIA_IREG_VGEIN(reg);
 +    xlen = AIA_IREG_XLEN(reg);
 +
 +    if (imsic->mmode) {
 +        if (priv == PRV_M && !virt) {
 +            page = 0;
 +        } else {
 +            goto err;
 +        }
 +    } else {
 +        if (priv == PRV_S) {
 +            if (virt) {
 +                if (vgein && vgein < imsic->num_pages) {
 +                    page = vgein;
 +                } else {
 +                    goto err;
 +                }
 +            } else {
 +                page = 0;
 +            }
 +        } else {
 +            goto err;
 +        }
 +    }
 +
 +    switch (isel) {
 +    case ISELECT_IMSIC_EIDELIVERY:
 +        return riscv_imsic_eidelivery_rmw(imsic, page, val,
 +                                          new_val, wr_mask);
 +    case ISELECT_IMSIC_EITHRESHOLD:
 +        return riscv_imsic_eithreshold_rmw(imsic, page, val,
 +                                           new_val, wr_mask);
 +    case ISELECT_IMSIC_TOPEI:
 +        return riscv_imsic_topei_rmw(imsic, page, val, new_val, wr_mask);
 +    case ISELECT_IMSIC_EIP0 ... ISELECT_IMSIC_EIP63:
 +        return riscv_imsic_eix_rmw(imsic, xlen, page,
 +                                   isel - ISELECT_IMSIC_EIP0,
 +                                   true, val, new_val, wr_mask);
 +    case ISELECT_IMSIC_EIE0 ... ISELECT_IMSIC_EIE63:
 +        return riscv_imsic_eix_rmw(imsic, xlen, page,
 +                                   isel - ISELECT_IMSIC_EIE0,
 +                                   false, val, new_val, wr_mask);
 +    default:
 +        break;
 +    };
 +
 +err:
 +    qemu_log_mask(LOG_GUEST_ERROR,
 +                  "%s: Invalid register priv=%d virt=%d isel=%d vgein=%d\n",
 +                  __func__, priv, virt, isel, vgein);
 +    return -EINVAL;
 +}
 +
 +static uint64_t riscv_imsic_read(void *opaque, hwaddr addr, unsigned size)
 +{
 +    RISCVIMSICState *imsic = opaque;
 +
 +    /* Reads must be 4 byte words */
 +    if ((addr & 0x3) != 0) {
 +        goto err;
 +    }
 +
 +    /* Reads cannot be out of range */
 +    if (addr > IMSIC_MMIO_SIZE(imsic->num_pages)) {
 +        goto err;
 +    }
 +
 +    return 0;
 +
 +err:
 +    qemu_log_mask(LOG_GUEST_ERROR,
 +                  "%s: Invalid register read 0x%" HWADDR_PRIx "\n",
 +                  __func__, addr);
 +    return 0;
 +}
 +
 +static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
 +        unsigned size)
 +{
 +    RISCVIMSICState *imsic = opaque;
 +    uint32_t page;
 +
 +    /* Writes must be 4 byte words */
 +    if ((addr & 0x3) != 0) {
 +        goto err;
 +    }
 +
 +    /* Writes cannot be out of range */
 +    if (addr > IMSIC_MMIO_SIZE(imsic->num_pages)) {
 +        goto err;
 +    }
 +
 +    /* Writes only supported for MSI little-endian registers */
 +    page = addr >> IMSIC_MMIO_PAGE_SHIFT;
 +    if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
 +        if (value && (value < imsic->num_irqs)) {
 +            imsic->eistate[(page * imsic->num_irqs) + value] |=
 +                                                    IMSIC_EISTATE_PENDING;
 +        }
 +    }
 +
 +    /* Update CPU external interrupt status */
 +    riscv_imsic_update(imsic, page);
 +
 +    return;
 +
 +err:
 +    qemu_log_mask(LOG_GUEST_ERROR,
 +                  "%s: Invalid register write 0x%" HWADDR_PRIx "\n",
 +                  __func__, addr);
 +}
 +
 +static const MemoryRegionOps riscv_imsic_ops = {
 +    .read = riscv_imsic_read,
 +    .write = riscv_imsic_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4
 +    }
 +};
 +
 +static void riscv_imsic_realize(DeviceState *dev, Error **errp)
 +{
 +    RISCVIMSICState *imsic = RISCV_IMSIC(dev);
 +    RISCVCPU *rcpu = RISCV_CPU(qemu_get_cpu(imsic->hartid));
 +    CPUState *cpu = qemu_get_cpu(imsic->hartid);
 +    CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 +
 +    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
 +    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
 +    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
 +    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
 +
 +    memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
 +                          imsic, TYPE_RISCV_IMSIC,
 +                          IMSIC_MMIO_SIZE(imsic->num_pages));
 +    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &imsic->mmio);
 +
 +    /* Claim the CPU interrupt to be triggered by this IMSIC */
 +    if (riscv_cpu_claim_interrupts(rcpu,
 +            (imsic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
 +        error_setg(errp, "%s already claimed",
 +                   (imsic->mmode) ? "MEIP" : "SEIP");
 +        return;
 +    }
 +
 +    /* Create output IRQ lines */
 +    imsic->external_irqs = g_malloc(sizeof(qemu_irq) * imsic->num_pages);
 +    qdev_init_gpio_out(dev, imsic->external_irqs, imsic->num_pages);
 +
 +    /* Force select AIA feature and setup CSR read-modify-write callback */
 +    if (env) {
 +        riscv_set_feature(env, RISCV_FEATURE_AIA);
 +        if (!imsic->mmode) {
 +            riscv_cpu_set_geilen(env, imsic->num_pages - 1);
 +        }
 +        riscv_cpu_set_aia_ireg_rmw_fn(env, (imsic->mmode) ? PRV_M : PRV_S,
 +                                      riscv_imsic_rmw, imsic);
 +    }
 +
 +    msi_nonbroken = true;
 +}
 +
 +static Property riscv_imsic_properties[] = {
 +    DEFINE_PROP_BOOL("mmode", RISCVIMSICState, mmode, 0),
 +    DEFINE_PROP_UINT32("hartid", RISCVIMSICState, hartid, 0),
 +    DEFINE_PROP_UINT32("num-pages", RISCVIMSICState, num_pages, 0),
 +    DEFINE_PROP_UINT32("num-irqs", RISCVIMSICState, num_irqs, 0),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static const VMStateDescription vmstate_riscv_imsic = {
 +    .name = "riscv_imsic",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +            VMSTATE_VARRAY_UINT32(eidelivery, RISCVIMSICState,
 +                                  num_pages, 0,
 +                                  vmstate_info_uint32, uint32_t),
 +            VMSTATE_VARRAY_UINT32(eithreshold, RISCVIMSICState,
 +                                  num_pages, 0,
 +                                  vmstate_info_uint32, uint32_t),
 +            VMSTATE_VARRAY_UINT32(eistate, RISCVIMSICState,
 +                                  num_eistate, 0,
 +                                  vmstate_info_uint32, uint32_t),
 +            VMSTATE_END_OF_LIST()
 +        }
 +};
 +
 +static void riscv_imsic_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    device_class_set_props(dc, riscv_imsic_properties);
 +    dc->realize = riscv_imsic_realize;
 +    dc->vmsd = &vmstate_riscv_imsic;
 +}
 +
 +static const TypeInfo riscv_imsic_info = {
 +    .name          = TYPE_RISCV_IMSIC,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(RISCVIMSICState),
 +    .class_init    = riscv_imsic_class_init,
 +};
 +
 +static void riscv_imsic_register_types(void)
 +{
 +    type_register_static(&riscv_imsic_info);
 +}
 +
 +type_init(riscv_imsic_register_types)
 +
 +/*
 + * Create IMSIC device.
 + */
 +DeviceState *riscv_imsic_create(hwaddr addr, uint32_t hartid, bool mmode,
 +                                uint32_t num_pages, uint32_t num_ids)
 +{
 +    DeviceState *dev = qdev_new(TYPE_RISCV_IMSIC);
 +    CPUState *cpu = qemu_get_cpu(hartid);
 +    uint32_t i;
 +
 +    assert(!(addr & (IMSIC_MMIO_PAGE_SZ - 1)));
 +    if (mmode) {
 +        assert(num_pages == 1);
 +    } else {
 +        assert(num_pages >= 1 && num_pages <= (IRQ_LOCAL_GUEST_MAX + 1));
 +    }
 +    assert(IMSIC_MIN_ID <= num_ids);
 +    assert(num_ids <= IMSIC_MAX_ID);
 +    assert((num_ids & IMSIC_MIN_ID) == IMSIC_MIN_ID);
 +
 +    qdev_prop_set_bit(dev, "mmode", mmode);
 +    qdev_prop_set_uint32(dev, "hartid", hartid);
 +    qdev_prop_set_uint32(dev, "num-pages", num_pages);
 +    qdev_prop_set_uint32(dev, "num-irqs", num_ids + 1);
 +
 +    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +
 +    for (i = 0; i < num_pages; i++) {
 +        if (!i) {
 +            qdev_connect_gpio_out_named(dev, NULL, i,
 +                                        qdev_get_gpio_in(DEVICE(cpu),
 +                                            (mmode) ? IRQ_M_EXT : IRQ_S_EXT));
 +        } else {
 +            qdev_connect_gpio_out_named(dev, NULL, i,
 +                                        qdev_get_gpio_in(DEVICE(cpu),
 +                                            IRQ_LOCAL_MAX + i - 1));
 +        }
 +    }
 +
 +    return dev;
 +}
 diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/Kconfig
+--- a/hw/riscv/meson.build
-+++ b/hw/intc/Kconfig
++++ b/hw/riscv/meson.build
-@@ -XXX,XX +XXX,XX @@ config RISCV_ACLINT
+@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
- config RISCV_APLIC
+ riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
-     bool
+ riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
+ riscv_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
-+config RISCV_IMSIC
+-riscv_ss.add(when: 'CONFIG_RISCV_IOMMU', if_true: files('riscv-iommu.c', 'riscv-iommu-pci.c', 'riscv-iommu-sys.c'))
-+    bool
++riscv_ss.add(when: 'CONFIG_RISCV_IOMMU', if_true: files(
-+
++    'riscv-iommu.c', 'riscv-iommu-pci.c', 'riscv-iommu-sys.c', 'riscv-iommu-hpm.c'))
- config SIFIVE_PLIC
+ riscv_ss.add(when: 'CONFIG_MICROBLAZE_V', if_true: files('microblaze-v-generic.c'))
-     bool
+ hw_arch += {'riscv': riscv_ss}
 diff --git a/hw/intc/meson.build b/hw/intc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/meson.build
 +++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: files('s390_flic_kvm.c'))
  specific_ss.add(when: 'CONFIG_SH_INTC', if_true: files('sh_intc.c'))
  specific_ss.add(when: 'CONFIG_RISCV_ACLINT', if_true: files('riscv_aclint.c'))
  specific_ss.add(when: 'CONFIG_RISCV_APLIC', if_true: files('riscv_aplic.c'))
 +specific_ss.add(when: 'CONFIG_RISCV_IMSIC', if_true: files('riscv_imsic.c'))
  specific_ss.add(when: 'CONFIG_SIFIVE_PLIC', if_true: files('sifive_plic.c'))
  specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c', 'xive2.c'))
  specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_XICS'],
 --
-.35.1
+.48.1

-[PULL 02/13] hw/riscv: virt: Add optional AIA APLIC support to virt machine
+[PULL 42/59] hw/riscv/riscv-iommu: add riscv_iommu_hpm_incr_ctr()
-From: Anup Patel <anup.patel@wdc.com>
+From: Tomasz Jeznach <tjeznach@rivosinc.com>
-We extend virt machine to emulate AIA APLIC devices only when
+This function will increment a specific counter, generating an interrupt
-"aia=aplic" parameter is passed along with machine name in QEMU
+when an overflow occurs.
-command-line. When "aia=none" or not specified then we fallback
-to original PLIC device emulation.
+Some extra changes in riscv-iommu.c  were required to add this new
+helper in riscv-iommu-hpm.c:
-Signed-off-by: Anup Patel <anup.patel@wdc.com>
-Signed-off-by: Anup Patel <anup@brainfault.org>
+- RISCVIOMMUContext was moved to riscv-iommu.h, making it visible in
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+  riscv-iommu-hpm.c;
-Message-Id: <20220220085526.808674-2-anup@brainfault.org>
 - riscv_iommu_notify() is now public.
 No behavior change is made since HPM support is not being advertised
 yet.
 Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20250224190826.1858473-5-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h |  26 +++-
+ hw/riscv/riscv-iommu-hpm.h |   2 +
- hw/riscv/virt.c         | 291 ++++++++++++++++++++++++++++++++--------
+ hw/riscv/riscv-iommu.h     |  18 ++++++
- hw/riscv/Kconfig        |   1 +
+ hw/riscv/riscv-iommu-hpm.c | 114 +++++++++++++++++++++++++++++++++++++
-files changed, 259 insertions(+), 59 deletions(-)
+ hw/riscv/riscv-iommu.c     |  43 +++++++++-----
+files changed, 162 insertions(+), 15 deletions(-)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
 diff --git a/hw/riscv/riscv-iommu-hpm.h b/hw/riscv/riscv-iommu-hpm.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
+--- a/hw/riscv/riscv-iommu-hpm.h
-+++ b/include/hw/riscv/virt.h
++++ b/hw/riscv/riscv-iommu-hpm.h
-@@ -XXX,XX +XXX,XX @@ typedef struct RISCVVirtState RISCVVirtState;
+@@ -XXX,XX +XXX,XX @@
- DECLARE_INSTANCE_CHECKER(RISCVVirtState, RISCV_VIRT_MACHINE,
+ #include "hw/riscv/riscv-iommu.h"
-                          TYPE_RISCV_VIRT_MACHINE)
+ uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s);
-+typedef enum RISCVVirtAIAType {
++void riscv_iommu_hpm_incr_ctr(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
-+    VIRT_AIA_TYPE_NONE = 0,
++                              unsigned event_id);
-+    VIRT_AIA_TYPE_APLIC,
-+} RISCVVirtAIAType;
+ #endif
-+
+diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
- struct RISCVVirtState {
+index XXXXXXX..XXXXXXX 100644
-     /*< private >*/
+--- a/hw/riscv/riscv-iommu.h
-     MachineState parent;
++++ b/hw/riscv/riscv-iommu.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
-     /*< public >*/
+     /* HPM cycle counter */
-     RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
+     uint64_t hpmcycle_val;      /* Current value of cycle register */
--    DeviceState *plic[VIRT_SOCKETS_MAX];
+     uint64_t hpmcycle_prev;     /* Saved value of QEMU_CLOCK_VIRTUAL clock */
-+    DeviceState *irqchip[VIRT_SOCKETS_MAX];
++
-     PFlashCFI01 *flash[2];
++    /* HPM event counters */
-     FWCfgState *fw_cfg;
++    GHashTable *hpm_event_ctr_map; /* Mapping of events to counters */
      int fdt_size;
      bool have_aclint;
 +    RISCVVirtAIAType aia_type;
  };
- enum {
+ void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, PCIBus *bus,
-@@ -XXX,XX +XXX,XX @@ enum {
+          Error **errp);
-     VIRT_CLINT,
+ void riscv_iommu_set_cap_igs(RISCVIOMMUState *s, riscv_iommu_igs_mode mode);
-     VIRT_ACLINT_SSWI,
+ void riscv_iommu_reset(RISCVIOMMUState *s);
-     VIRT_PLIC,
++void riscv_iommu_notify(RISCVIOMMUState *s, int vec_type);
-+    VIRT_APLIC_M,
++
-+    VIRT_APLIC_S,
++typedef struct RISCVIOMMUContext RISCVIOMMUContext;
-     VIRT_UART0,
++/* Device translation context state. */
-     VIRT_VIRTIO,
++struct RISCVIOMMUContext {
-     VIRT_FW_CFG,
++    uint64_t devid:24;          /* Requester Id, AKA device_id */
-@@ -XXX,XX +XXX,XX @@ enum {
++    uint64_t process_id:20;     /* Process ID. PASID for PCIe */
-     VIRTIO_NDEV = 0x35 /* Arbitrary maximum number of interrupts */
++    uint64_t tc;                /* Translation Control */
 +    uint64_t ta;                /* Translation Attributes */
 +    uint64_t satp;              /* S-Stage address translation and protection */
 +    uint64_t gatp;              /* G-Stage address translation and protection */
 +    uint64_t msi_addr_mask;     /* MSI filtering - address mask */
 +    uint64_t msi_addr_pattern;  /* MSI filtering - address pattern */
 +    uint64_t msiptp;            /* MSI redirection page table pointer */
 +};
  /* private helpers */
 diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv-iommu-hpm.c
 +++ b/hw/riscv/riscv-iommu-hpm.c
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s)
      return (ctr_val + get_cycles() - ctr_prev) |
          (cycle & RISCV_IOMMU_IOHPMCYCLES_OVF);
  }
 +
 +static void hpm_incr_ctr(RISCVIOMMUState *s, uint32_t ctr_idx)
 +{
 +    const uint32_t off = ctr_idx << 3;
 +    uint64_t cntr_val;
 +
 +    cntr_val = ldq_le_p(&s->regs_rw[RISCV_IOMMU_REG_IOHPMCTR_BASE + off]);
 +    stq_le_p(&s->regs_rw[RISCV_IOMMU_REG_IOHPMCTR_BASE + off], cntr_val + 1);
 +
 +    /* Handle the overflow scenario. */
 +    if (cntr_val == UINT64_MAX) {
 +        /*
 +         * Generate interrupt only if OF bit is clear. +1 to offset the cycle
 +         * register OF bit.
 +         */
 +        const uint32_t ovf =
 +            riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_IOCOUNTOVF,
 +                                  BIT(ctr_idx + 1), 0);
 +        if (!get_field(ovf, BIT(ctr_idx + 1))) {
 +            riscv_iommu_reg_mod64(s,
 +                                  RISCV_IOMMU_REG_IOHPMEVT_BASE + off,
 +                                  RISCV_IOMMU_IOHPMEVT_OF,
 +                                  0);
 +            riscv_iommu_notify(s, RISCV_IOMMU_INTR_PM);
 +        }
 +    }
 +}
 +
 +void riscv_iommu_hpm_incr_ctr(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
 +                              unsigned event_id)
 +{
 +    const uint32_t inhibit = riscv_iommu_reg_get32(
 +        s, RISCV_IOMMU_REG_IOCOUNTINH);
 +    uint32_t did_gscid;
 +    uint32_t pid_pscid;
 +    uint32_t ctr_idx;
 +    gpointer value;
 +    uint32_t ctrs;
 +    uint64_t evt;
 +
 +    if (!(s->cap & RISCV_IOMMU_CAP_HPM)) {
 +        return;
 +    }
 +
 +    value = g_hash_table_lookup(s->hpm_event_ctr_map,
 +                                GUINT_TO_POINTER(event_id));
 +    if (value == NULL) {
 +        return;
 +    }
 +
 +    for (ctrs = GPOINTER_TO_UINT(value); ctrs != 0; ctrs &= ctrs - 1) {
 +        ctr_idx = ctz32(ctrs);
 +        if (get_field(inhibit, BIT(ctr_idx + 1))) {
 +            continue;
 +        }
 +
 +        evt = riscv_iommu_reg_get64(s,
 +            RISCV_IOMMU_REG_IOHPMEVT_BASE + (ctr_idx << 3));
 +
 +        /*
 +         * It's quite possible that event ID has been changed in counter
 +         * but hashtable hasn't been updated yet. We don't want to increment
 +         * counter for the old event ID.
 +         */
 +        if (event_id != get_field(evt, RISCV_IOMMU_IOHPMEVT_EVENT_ID)) {
 +            continue;
 +        }
 +
 +        if (get_field(evt, RISCV_IOMMU_IOHPMEVT_IDT)) {
 +            did_gscid = get_field(ctx->gatp, RISCV_IOMMU_DC_IOHGATP_GSCID);
 +            pid_pscid = get_field(ctx->ta, RISCV_IOMMU_DC_TA_PSCID);
 +        } else {
 +            did_gscid = ctx->devid;
 +            pid_pscid = ctx->process_id;
 +        }
 +
 +        if (get_field(evt, RISCV_IOMMU_IOHPMEVT_PV_PSCV)) {
 +            /*
 +             * If the transaction does not have a valid process_id, counter
 +             * increments if device_id matches DID_GSCID. If the transaction
 +             * has a valid process_id, counter increments if device_id
 +             * matches DID_GSCID and process_id matches PID_PSCID. See
 +             * IOMMU Specification, Chapter 5.23. Performance-monitoring
 +             * event selector.
 +             */
 +            if (ctx->process_id &&
 +                get_field(evt, RISCV_IOMMU_IOHPMEVT_PID_PSCID) != pid_pscid) {
 +                continue;
 +            }
 +        }
 +
 +        if (get_field(evt, RISCV_IOMMU_IOHPMEVT_DV_GSCV)) {
 +            uint32_t mask = ~0;
 +
 +            if (get_field(evt, RISCV_IOMMU_IOHPMEVT_DMASK)) {
 +                /*
 +                 * 1001 1011   mask = GSCID
 +                 * 0000 0111   mask = mask ^ (mask + 1)
 +                 * 1111 1000   mask = ~mask;
 +                 */
 +                mask = get_field(evt, RISCV_IOMMU_IOHPMEVT_DID_GSCID);
 +                mask = mask ^ (mask + 1);
 +                mask = ~mask;
 +            }
 +
 +            if ((get_field(evt, RISCV_IOMMU_IOHPMEVT_DID_GSCID) & mask) !=
 +                (did_gscid & mask)) {
 +                continue;
 +            }
 +        }
 +
 +        hpm_incr_ctr(s, ctr_idx);
 +    }
 +}
 diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv-iommu.c
 +++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@
  #define PPN_PHYS(ppn)                 ((ppn) << TARGET_PAGE_BITS)
  #define PPN_DOWN(phy)                 ((phy) >> TARGET_PAGE_BITS)
 -typedef struct RISCVIOMMUContext RISCVIOMMUContext;
  typedef struct RISCVIOMMUEntry RISCVIOMMUEntry;
  /* Device assigned I/O address space */
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUSpace {
      QLIST_ENTRY(RISCVIOMMUSpace) list;
  };
--#define VIRT_PLIC_NUM_SOURCES 127
+-/* Device translation context state. */
--#define VIRT_PLIC_NUM_PRIORITIES 7
+-struct RISCVIOMMUContext {
-+#define VIRT_IRQCHIP_NUM_SOURCES 127
+-    uint64_t devid:24;          /* Requester Id, AKA device_id */
-+#define VIRT_IRQCHIP_NUM_PRIO_BITS 3
+-    uint64_t process_id:20;     /* Process ID. PASID for PCIe */
-+
+-    uint64_t tc;                /* Translation Control */
- #define VIRT_PLIC_PRIORITY_BASE 0x04
+-    uint64_t ta;                /* Translation Attributes */
- #define VIRT_PLIC_PENDING_BASE 0x1000
+-    uint64_t satp;              /* S-Stage address translation and protection */
- #define VIRT_PLIC_ENABLE_BASE 0x2000
+-    uint64_t gatp;              /* G-Stage address translation and protection */
-@@ -XXX,XX +XXX,XX @@ enum {
+-    uint64_t msi_addr_mask;     /* MSI filtering - address mask */
+-    uint64_t msi_addr_pattern;  /* MSI filtering - address pattern */
- #define FDT_PCI_ADDR_CELLS    3
+-    uint64_t msiptp;            /* MSI redirection page table pointer */
- #define FDT_PCI_INT_CELLS     1
+-};
--#define FDT_PLIC_ADDR_CELLS   0
+-
- #define FDT_PLIC_INT_CELLS    1
+ typedef enum RISCVIOMMUTransTag {
--#define FDT_INT_MAP_WIDTH     (FDT_PCI_ADDR_CELLS + FDT_PCI_INT_CELLS + 1 + \
+     RISCV_IOMMU_TRANS_TAG_BY,  /* Bypass */
--                               FDT_PLIC_ADDR_CELLS + FDT_PLIC_INT_CELLS)
+     RISCV_IOMMU_TRANS_TAG_SS,  /* Single Stage */
-+#define FDT_APLIC_INT_CELLS   2
+@@ -XXX,XX +XXX,XX @@ static uint8_t riscv_iommu_get_icvec_vector(uint32_t icvec, uint32_t vec_type)
-+#define FDT_MAX_INT_CELLS     2
+     }
 +#define FDT_MAX_INT_MAP_WIDTH (FDT_PCI_ADDR_CELLS + FDT_PCI_INT_CELLS + \
 +                                 1 + FDT_MAX_INT_CELLS)
 +#define FDT_PLIC_INT_MAP_WIDTH  (FDT_PCI_ADDR_CELLS + FDT_PCI_INT_CELLS + \
 +                                 1 + FDT_PLIC_INT_CELLS)
 +#define FDT_APLIC_INT_MAP_WIDTH (FDT_PCI_ADDR_CELLS + FDT_PCI_INT_CELLS + \
 +                                 1 + FDT_APLIC_INT_CELLS)
  #endif
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/riscv/boot.h"
  #include "hw/riscv/numa.h"
  #include "hw/intc/riscv_aclint.h"
 +#include "hw/intc/riscv_aplic.h"
  #include "hw/intc/sifive_plic.h"
  #include "hw/misc/sifive_test.h"
  #include "chardev/char.h"
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
      [VIRT_ACLINT_SSWI] = {  0x2F00000,        0x4000 },
      [VIRT_PCIE_PIO] =    {  0x3000000,       0x10000 },
      [VIRT_PLIC] =        {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
 +    [VIRT_APLIC_M] =     {  0xc000000, APLIC_SIZE(VIRT_CPUS_MAX) },
 +    [VIRT_APLIC_S] =     {  0xd000000, APLIC_SIZE(VIRT_CPUS_MAX) },
      [VIRT_UART0] =       { 0x10000000,         0x100 },
      [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
      [VIRT_FW_CFG] =      { 0x10100000,          0x18 },
@@ -XXX,XX +XXX,XX @@ static void virt_flash_map(RISCVVirtState *s,
                      sysmem);
  }
--static void create_pcie_irq_map(void *fdt, char *nodename,
+-static void riscv_iommu_notify(RISCVIOMMUState *s, int vec_type)
--                                uint32_t plic_phandle)
++void riscv_iommu_notify(RISCVIOMMUState *s, int vec_type)
 +static void create_pcie_irq_map(RISCVVirtState *s, void *fdt, char *nodename,
 +                                uint32_t irqchip_phandle)
  {
-     int pin, dev;
+     uint32_t ipsr, icvec, vector;
--    uint32_t
--        full_irq_map[GPEX_NUM_IRQS * GPEX_NUM_IRQS * FDT_INT_MAP_WIDTH] = {};
+@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
 +    uint32_t irq_map_stride = 0;
 +    uint32_t full_irq_map[GPEX_NUM_IRQS * GPEX_NUM_IRQS *
 +                          FDT_MAX_INT_MAP_WIDTH] = {};
      uint32_t *irq_map = full_irq_map;
      /* This code creates a standard swizzle of interrupts such that
@@ -XXX,XX +XXX,XX @@ static void create_pcie_irq_map(void *fdt, char *nodename,
              int irq_nr = PCIE_IRQ + ((pin + PCI_SLOT(devfn)) % GPEX_NUM_IRQS);
              int i = 0;
 +            /* Fill PCI address cells */
              irq_map[i] = cpu_to_be32(devfn << 8);
 -
              i += FDT_PCI_ADDR_CELLS;
 -            irq_map[i] = cpu_to_be32(pin + 1);
 +            /* Fill PCI Interrupt cells */
 +            irq_map[i] = cpu_to_be32(pin + 1);
              i += FDT_PCI_INT_CELLS;
 -            irq_map[i++] = cpu_to_be32(plic_phandle);
 -            i += FDT_PLIC_ADDR_CELLS;
 -            irq_map[i] = cpu_to_be32(irq_nr);
 +            /* Fill interrupt controller phandle and cells */
 +            irq_map[i++] = cpu_to_be32(irqchip_phandle);
 +            irq_map[i++] = cpu_to_be32(irq_nr);
 +            if (s->aia_type != VIRT_AIA_TYPE_NONE) {
 +                irq_map[i++] = cpu_to_be32(0x4);
 +            }
 -            irq_map += FDT_INT_MAP_WIDTH;
 +            if (!irq_map_stride) {
 +                irq_map_stride = i;
 +            }
 +            irq_map += irq_map_stride;
          }
      }
 -    qemu_fdt_setprop(fdt, nodename, "interrupt-map",
 -                     full_irq_map, sizeof(full_irq_map));
 +    qemu_fdt_setprop(fdt, nodename, "interrupt-map", full_irq_map,
 +                     GPEX_NUM_IRQS * GPEX_NUM_IRQS *
 +                     irq_map_stride * sizeof(uint32_t));
      qemu_fdt_setprop_cells(fdt, nodename, "interrupt-map-mask",
 x1800, 0, 0, 0x7);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
      plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
      plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
      qemu_fdt_add_subnode(mc->fdt, plic_name);
 -    qemu_fdt_setprop_cell(mc->fdt, plic_name,
 -        "#address-cells", FDT_PLIC_ADDR_CELLS);
      qemu_fdt_setprop_cell(mc->fdt, plic_name,
          "#interrupt-cells", FDT_PLIC_INT_CELLS);
      qemu_fdt_setprop_string_array(mc->fdt, plic_name, "compatible",
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
      g_free(plic_cells);
  }
 +static void create_fdt_socket_aia(RISCVVirtState *s,
 +                                  const MemMapEntry *memmap, int socket,
 +                                  uint32_t *phandle, uint32_t *intc_phandles,
 +                                  uint32_t *aplic_phandles)
 +{
 +    int cpu;
 +    char *aplic_name;
 +    uint32_t *aplic_cells;
 +    unsigned long aplic_addr;
 +    MachineState *mc = MACHINE(s);
 +    uint32_t aplic_m_phandle, aplic_s_phandle;
 +
 +    aplic_m_phandle = (*phandle)++;
 +    aplic_s_phandle = (*phandle)++;
 +    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 +
 +    /* M-level APLIC node */
 +    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 +        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 +        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
 +    }
 +    aplic_addr = memmap[VIRT_APLIC_M].base +
 +                 (memmap[VIRT_APLIC_M].size * socket);
 +    aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 +    qemu_fdt_add_subnode(mc->fdt, aplic_name);
 +    qemu_fdt_setprop_string(mc->fdt, aplic_name, "compatible", "riscv,aplic");
 +    qemu_fdt_setprop_cell(mc->fdt, aplic_name,
 +        "#interrupt-cells", FDT_APLIC_INT_CELLS);
 +    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
 +        aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +    qemu_fdt_setprop_cells(mc->fdt, aplic_name, "reg",
 +        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
 +    qemu_fdt_setprop_cell(mc->fdt, aplic_name, "riscv,num-sources",
 +        VIRT_IRQCHIP_NUM_SOURCES);
 +    qemu_fdt_setprop_cell(mc->fdt, aplic_name, "riscv,children",
 +        aplic_s_phandle);
 +    qemu_fdt_setprop_cells(mc->fdt, aplic_name, "riscv,delegate",
 +        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
 +    riscv_socket_fdt_write_id(mc, mc->fdt, aplic_name, socket);
 +    qemu_fdt_setprop_cell(mc->fdt, aplic_name, "phandle", aplic_m_phandle);
 +    g_free(aplic_name);
 +
 +    /* S-level APLIC node */
 +    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 +        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 +        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 +    }
 +    aplic_addr = memmap[VIRT_APLIC_S].base +
 +                 (memmap[VIRT_APLIC_S].size * socket);
 +    aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 +    qemu_fdt_add_subnode(mc->fdt, aplic_name);
 +    qemu_fdt_setprop_string(mc->fdt, aplic_name, "compatible", "riscv,aplic");
 +    qemu_fdt_setprop_cell(mc->fdt, aplic_name,
 +        "#interrupt-cells", FDT_APLIC_INT_CELLS);
 +    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
 +        aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +    qemu_fdt_setprop_cells(mc->fdt, aplic_name, "reg",
 +        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
 +    qemu_fdt_setprop_cell(mc->fdt, aplic_name, "riscv,num-sources",
 +        VIRT_IRQCHIP_NUM_SOURCES);
 +    riscv_socket_fdt_write_id(mc, mc->fdt, aplic_name, socket);
 +    qemu_fdt_setprop_cell(mc->fdt, aplic_name, "phandle", aplic_s_phandle);
 +    g_free(aplic_name);
 +
 +    g_free(aplic_cells);
 +    aplic_phandles[socket] = aplic_s_phandle;
 +}
 +
  static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
                                 bool is_32_bit, uint32_t *phandle,
                                 uint32_t *irq_mmio_phandle,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
              }
          }
--        create_fdt_socket_plic(s, memmap, socket, phandle,
++
--            intc_phandles, xplic_phandles);
++        if (pass == S_STAGE) {
-+        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
++            riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_S_VS_WALKS);
 +            create_fdt_socket_plic(s, memmap, socket, phandle,
 +                intc_phandles, xplic_phandles);
 +        } else {
-+            create_fdt_socket_aia(s, memmap, socket, phandle,
++            riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_G_WALKS);
-+                intc_phandles, xplic_phandles);
++        }
-+        }
++
+         /* Read page table entry */
-         g_free(intc_phandles);
+         if (sc[pass].ptesize == 4) {
-         g_free(clust_name);
+             uint32_t pte32 = 0;
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_virtio(RISCVVirtState *s, const MemMapEntry *memmap,
+@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
-x0, memmap[VIRT_VIRTIO].size);
-         qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent",
+     /* Device directory tree walk */
-             irq_virtio_phandle);
+     for (; depth-- > 0; ) {
--        qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", VIRTIO_IRQ + i);
++        riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_DD_WALK);
-+        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+         /*
-+            qemu_fdt_setprop_cell(mc->fdt, name, "interrupts",
+          * Select device id index bits based on device directory tree level
-+                                  VIRTIO_IRQ + i);
+          * and device context format.
-+        } else {
+@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
-+            qemu_fdt_setprop_cells(mc->fdt, name, "interrupts",
+         addr = PPN_PHYS(get_field(de, RISCV_IOMMU_DDTE_PPN));
-+                                   VIRTIO_IRQ + i, 0x4);
+     }
-+        }
-         g_free(name);
++    riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_DD_WALK);
-     }
++
      /* index into device context entry page */
      addr |= (ctx->devid * dc_len) & ~TARGET_PAGE_MASK;
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
      }
      for (depth = mode - RISCV_IOMMU_DC_FSC_PDTP_MODE_PD8; depth-- > 0; ) {
 +        riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_PD_WALK);
 +
          /*
           * Select process id index bits based on process directory tree
           * level. See IOMMU Specification, 2.2. Process-Directory-Table.
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
          addr = PPN_PHYS(get_field(de, RISCV_IOMMU_PC_FSC_PPN));
      }
 +    riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_PD_WALK);
 +
      /* Leaf entry in PDT */
      addr |= (ctx->process_id << 4) & ~TARGET_PAGE_MASK;
      if (dma_memory_read(s->target_as, addr, &dc.ta, sizeof(uint64_t) * 2,
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
      GHashTable *iot_cache;
      int fault;
 +    riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_URQ);
 +
      iot_cache = g_hash_table_ref(s->iot_cache);
      /*
       * TC[32] is reserved for custom extensions, used here to temporarily
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
      /* Check for ATS request. */
      if (iotlb->perm == IOMMU_NONE) {
 +        riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_ATS_RQ);
          /* Check if ATS is disabled. */
          if (!(ctx->tc & RISCV_IOMMU_DC_TC_EN_ATS)) {
              enable_pri = false;
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
          goto done;
      }
 +    riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_TLB_MISS);
 +
      /* Translate using device directory / page table information. */
      fault = riscv_iommu_spa_fetch(s, ctx, iotlb);
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
      memory_region_init_io(&s->trap_mr, OBJECT(dev), &riscv_iommu_trap_ops, s,
              "riscv-iommu-trap", ~0ULL);
      address_space_init(&s->trap_as, &s->trap_mr, "riscv-iommu-trap-as");
 +
 +    if (s->cap & RISCV_IOMMU_CAP_HPM) {
 +        s->hpm_event_ctr_map = g_hash_table_new(g_direct_hash, g_direct_equal);
 +    }
  }
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
-, virt_high_pcie_memmap.base,
+ static void riscv_iommu_unrealize(DeviceState *dev)
-, virt_high_pcie_memmap.base, 2, virt_high_pcie_memmap.size);
+@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_unrealize(DeviceState *dev)
--    create_pcie_irq_map(mc->fdt, name, irq_pcie_phandle);
+     g_hash_table_unref(s->iot_cache);
-+    create_pcie_irq_map(s, mc->fdt, name, irq_pcie_phandle);
+     g_hash_table_unref(s->ctx_cache);
-     g_free(name);
++
 +    if (s->cap & RISCV_IOMMU_CAP_HPM) {
 +        g_hash_table_unref(s->hpm_event_ctr_map);
 +    }
  }
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_uart(RISCVVirtState *s, const MemMapEntry *memmap,
+ void riscv_iommu_reset(RISCVIOMMUState *s)
 x0, memmap[VIRT_UART0].size);
      qemu_fdt_setprop_cell(mc->fdt, name, "clock-frequency", 3686400);
      qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent", irq_mmio_phandle);
 -    qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", UART0_IRQ);
 +    if (s->aia_type == VIRT_AIA_TYPE_NONE) {
 +        qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", UART0_IRQ);
 +    } else {
 +        qemu_fdt_setprop_cells(mc->fdt, name, "interrupts", UART0_IRQ, 0x4);
 +    }
      qemu_fdt_add_subnode(mc->fdt, "/chosen");
      qemu_fdt_setprop_string(mc->fdt, "/chosen", "stdout-path", name);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_rtc(RISCVVirtState *s, const MemMapEntry *memmap,
 x0, memmap[VIRT_RTC].base, 0x0, memmap[VIRT_RTC].size);
      qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent",
          irq_mmio_phandle);
 -    qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", RTC_IRQ);
 +    if (s->aia_type == VIRT_AIA_TYPE_NONE) {
 +        qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", RTC_IRQ);
 +    } else {
 +        qemu_fdt_setprop_cells(mc->fdt, name, "interrupts", RTC_IRQ, 0x4);
 +    }
      g_free(name);
  }
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
                                            hwaddr high_mmio_base,
                                            hwaddr high_mmio_size,
                                            hwaddr pio_base,
 -                                          DeviceState *plic)
 +                                          DeviceState *irqchip)
  {
      DeviceState *dev;
      MemoryRegion *ecam_alias, *ecam_reg;
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
      sysbus_mmio_map(SYS_BUS_DEVICE(dev), 2, pio_base);
      for (i = 0; i < GPEX_NUM_IRQS; i++) {
 -        irq = qdev_get_gpio_in(plic, PCIE_IRQ + i);
 +        irq = qdev_get_gpio_in(irqchip, PCIE_IRQ + i);
          sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, irq);
          gpex_set_irq_num(GPEX_HOST(dev), i, PCIE_IRQ + i);
@@ -XXX,XX +XXX,XX @@ static FWCfgState *create_fw_cfg(const MachineState *mc)
      return fw_cfg;
  }
 +static DeviceState *virt_create_plic(const MemMapEntry *memmap, int socket,
 +                                     int base_hartid, int hart_count)
 +{
 +    DeviceState *ret;
 +    char *plic_hart_config;
 +
 +    /* Per-socket PLIC hart topology configuration string */
 +    plic_hart_config = riscv_plic_hart_config_string(hart_count);
 +
 +    /* Per-socket PLIC */
 +    ret = sifive_plic_create(
 +            memmap[VIRT_PLIC].base + socket * memmap[VIRT_PLIC].size,
 +            plic_hart_config, hart_count, base_hartid,
 +            VIRT_IRQCHIP_NUM_SOURCES,
 +            ((1U << VIRT_IRQCHIP_NUM_PRIO_BITS) - 1),
 +            VIRT_PLIC_PRIORITY_BASE,
 +            VIRT_PLIC_PENDING_BASE,
 +            VIRT_PLIC_ENABLE_BASE,
 +            VIRT_PLIC_ENABLE_STRIDE,
 +            VIRT_PLIC_CONTEXT_BASE,
 +            VIRT_PLIC_CONTEXT_STRIDE,
 +            memmap[VIRT_PLIC].size);
 +
 +    g_free(plic_hart_config);
 +
 +    return ret;
 +}
 +
 +static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type,
 +                                    const MemMapEntry *memmap, int socket,
 +                                    int base_hartid, int hart_count)
 +{
 +    DeviceState *aplic_m;
 +
 +    /* Per-socket M-level APLIC */
 +    aplic_m = riscv_aplic_create(
 +        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
 +        memmap[VIRT_APLIC_M].size,
 +        base_hartid, hart_count,
 +        VIRT_IRQCHIP_NUM_SOURCES,
 +        VIRT_IRQCHIP_NUM_PRIO_BITS,
 +        false, true, NULL);
 +
 +    if (aplic_m) {
 +        /* Per-socket S-level APLIC */
 +        riscv_aplic_create(
 +            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
 +            memmap[VIRT_APLIC_S].size,
 +            base_hartid, hart_count,
 +            VIRT_IRQCHIP_NUM_SOURCES,
 +            VIRT_IRQCHIP_NUM_PRIO_BITS,
 +            false, false, aplic_m);
 +    }
 +
 +    return aplic_m;
 +}
 +
  static void virt_machine_init(MachineState *machine)
  {
      const MemMapEntry *memmap = virt_memmap;
      RISCVVirtState *s = RISCV_VIRT_MACHINE(machine);
      MemoryRegion *system_memory = get_system_memory();
      MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
 -    char *plic_hart_config, *soc_name;
 +    char *soc_name;
      target_ulong start_addr = memmap[VIRT_DRAM].base;
      target_ulong firmware_end_addr, kernel_start_addr;
      uint32_t fdt_load_addr;
      uint64_t kernel_entry;
 -    DeviceState *mmio_plic, *virtio_plic, *pcie_plic;
 +    DeviceState *mmio_irqchip, *virtio_irqchip, *pcie_irqchip;
      int i, base_hartid, hart_count;
      /* Check socket count limit */
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
      }
      /* Initialize sockets */
 -    mmio_plic = virtio_plic = pcie_plic = NULL;
 +    mmio_irqchip = virtio_irqchip = pcie_irqchip = NULL;
      for (i = 0; i < riscv_socket_count(machine); i++) {
          if (!riscv_socket_check_hartids(machine, i)) {
              error_report("discontinuous hartids in socket%d", i);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
              }
          }
 -        /* Per-socket PLIC hart topology configuration string */
 -        plic_hart_config = riscv_plic_hart_config_string(hart_count);
 -
 -        /* Per-socket PLIC */
 -        s->plic[i] = sifive_plic_create(
 -            memmap[VIRT_PLIC].base + i * memmap[VIRT_PLIC].size,
 -            plic_hart_config, hart_count, base_hartid,
 -            VIRT_PLIC_NUM_SOURCES,
 -            VIRT_PLIC_NUM_PRIORITIES,
 -            VIRT_PLIC_PRIORITY_BASE,
 -            VIRT_PLIC_PENDING_BASE,
 -            VIRT_PLIC_ENABLE_BASE,
 -            VIRT_PLIC_ENABLE_STRIDE,
 -            VIRT_PLIC_CONTEXT_BASE,
 -            VIRT_PLIC_CONTEXT_STRIDE,
 -            memmap[VIRT_PLIC].size);
 -        g_free(plic_hart_config);
 +        /* Per-socket interrupt controller */
 +        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
 +            s->irqchip[i] = virt_create_plic(memmap, i,
 +                                             base_hartid, hart_count);
 +        } else {
 +            s->irqchip[i] = virt_create_aia(s->aia_type, memmap, i,
 +                                            base_hartid, hart_count);
 +        }
 -        /* Try to use different PLIC instance based device type */
 +        /* Try to use different IRQCHIP instance based device type */
          if (i == 0) {
 -            mmio_plic = s->plic[i];
 -            virtio_plic = s->plic[i];
 -            pcie_plic = s->plic[i];
 +            mmio_irqchip = s->irqchip[i];
 +            virtio_irqchip = s->irqchip[i];
 +            pcie_irqchip = s->irqchip[i];
          }
          if (i == 1) {
 -            virtio_plic = s->plic[i];
 -            pcie_plic = s->plic[i];
 +            virtio_irqchip = s->irqchip[i];
 +            pcie_irqchip = s->irqchip[i];
          }
          if (i == 2) {
 -            pcie_plic = s->plic[i];
 +            pcie_irqchip = s->irqchip[i];
          }
      }
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
      for (i = 0; i < VIRTIO_COUNT; i++) {
          sysbus_create_simple("virtio-mmio",
              memmap[VIRT_VIRTIO].base + i * memmap[VIRT_VIRTIO].size,
 -            qdev_get_gpio_in(DEVICE(virtio_plic), VIRTIO_IRQ + i));
 +            qdev_get_gpio_in(DEVICE(virtio_irqchip), VIRTIO_IRQ + i));
      }
      gpex_pcie_init(system_memory,
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                     virt_high_pcie_memmap.base,
                     virt_high_pcie_memmap.size,
                     memmap[VIRT_PCIE_PIO].base,
 -                   DEVICE(pcie_plic));
 +                   DEVICE(pcie_irqchip));
      serial_mm_init(system_memory, memmap[VIRT_UART0].base,
 -        0, qdev_get_gpio_in(DEVICE(mmio_plic), UART0_IRQ), 399193,
 +        0, qdev_get_gpio_in(DEVICE(mmio_irqchip), UART0_IRQ), 399193,
          serial_hd(0), DEVICE_LITTLE_ENDIAN);
      sysbus_create_simple("goldfish_rtc", memmap[VIRT_RTC].base,
 -        qdev_get_gpio_in(DEVICE(mmio_plic), RTC_IRQ));
 +        qdev_get_gpio_in(DEVICE(mmio_irqchip), RTC_IRQ));
      virt_flash_create(s);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_instance_init(Object *obj)
  {
  }
 +static char *virt_get_aia(Object *obj, Error **errp)
 +{
 +    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
 +    const char *val;
 +
 +    switch (s->aia_type) {
 +    case VIRT_AIA_TYPE_APLIC:
 +        val = "aplic";
 +        break;
 +    default:
 +        val = "none";
 +        break;
 +    };
 +
 +    return g_strdup(val);
 +}
 +
 +static void virt_set_aia(Object *obj, const char *val, Error **errp)
 +{
 +    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
 +
 +    if (!strcmp(val, "none")) {
 +        s->aia_type = VIRT_AIA_TYPE_NONE;
 +    } else if (!strcmp(val, "aplic")) {
 +        s->aia_type = VIRT_AIA_TYPE_APLIC;
 +    } else {
 +        error_setg(errp, "Invalid AIA interrupt controller type");
 +        error_append_hint(errp, "Valid values are none, and aplic.\n");
 +    }
 +}
 +
  static bool virt_get_aclint(Object *obj, Error **errp)
  {
      MachineState *ms = MACHINE(obj);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
      object_class_property_set_description(oc, "aclint",
                                            "Set on/off to enable/disable "
                                            "emulating ACLINT devices");
 +
 +    object_class_property_add_str(oc, "aia", virt_get_aia,
 +                                  virt_set_aia);
 +    object_class_property_set_description(oc, "aia",
 +                                          "Set type of AIA interrupt "
 +                                          "conttoller. Valid values are "
 +                                          "none, and aplic.");
  }
  static const TypeInfo virt_machine_typeinfo = {
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      select PFLASH_CFI01
      select SERIAL
      select RISCV_ACLINT
 +    select RISCV_APLIC
      select SIFIVE_PLIC
      select SIFIVE_TEST
      select VIRTIO_MMIO
 --
-.35.1
+.48.1

-New patch
+[PULL 43/59] hw/riscv/riscv-iommu: instantiate hpm_timer
+From: Tomasz Jeznach <tjeznach@rivosinc.com>
+The next HPM related changes requires the HPM overflow timer to be
+initialized by the riscv-iommu base emulation.
+Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250224190826.1858473-6-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/riscv/riscv-iommu-hpm.h |  1 +
+ hw/riscv/riscv-iommu.h     |  2 ++
+ hw/riscv/riscv-iommu-hpm.c | 36 ++++++++++++++++++++++++++++++++++++
+ hw/riscv/riscv-iommu.c     |  3 +++
+files changed, 42 insertions(+)
+diff --git a/hw/riscv/riscv-iommu-hpm.h b/hw/riscv/riscv-iommu-hpm.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu-hpm.h
++++ b/hw/riscv/riscv-iommu-hpm.h
+@@ -XXX,XX +XXX,XX @@
+ uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s);
+ void riscv_iommu_hpm_incr_ctr(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
+                               unsigned event_id);
++void riscv_iommu_hpm_timer_cb(void *priv);
+ #endif
+diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu.h
++++ b/hw/riscv/riscv-iommu.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
+     QLIST_HEAD(, RISCVIOMMUSpace) spaces;
+     /* HPM cycle counter */
++    QEMUTimer *hpm_timer;
+     uint64_t hpmcycle_val;      /* Current value of cycle register */
+     uint64_t hpmcycle_prev;     /* Saved value of QEMU_CLOCK_VIRTUAL clock */
++    uint64_t irq_overflow_left; /* Value beyond INT64_MAX after overflow */
+     /* HPM event counters */
+     GHashTable *hpm_event_ctr_map; /* Mapping of events to counters */
+diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu-hpm.c
++++ b/hw/riscv/riscv-iommu-hpm.c
+@@ -XXX,XX +XXX,XX @@ void riscv_iommu_hpm_incr_ctr(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
+         hpm_incr_ctr(s, ctr_idx);
+     }
+ }
++
++/* Timer callback for cycle counter overflow. */
++void riscv_iommu_hpm_timer_cb(void *priv)
++{
++    RISCVIOMMUState *s = priv;
++    const uint32_t inhibit = riscv_iommu_reg_get32(
++        s, RISCV_IOMMU_REG_IOCOUNTINH);
++    uint32_t ovf;
++
++    if (get_field(inhibit, RISCV_IOMMU_IOCOUNTINH_CY)) {
++        return;
++    }
++
++    if (s->irq_overflow_left > 0) {
++        uint64_t irq_trigger_at =
++            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + s->irq_overflow_left;
++        timer_mod_anticipate_ns(s->hpm_timer, irq_trigger_at);
++        s->irq_overflow_left = 0;
++        return;
++    }
++
++    ovf = riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_IOCOUNTOVF);
++    if (!get_field(ovf, RISCV_IOMMU_IOCOUNTOVF_CY)) {
++        /*
++         * We don't need to set hpmcycle_val to zero and update hpmcycle_prev to
++         * current clock value. The way we calculate iohpmcycs will overflow
++         * and return the correct value. This avoids the need to synchronize
++         * timer callback and write callback.
++         */
++        riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_IOCOUNTOVF,
++            RISCV_IOMMU_IOCOUNTOVF_CY, 0);
++        riscv_iommu_reg_mod64(s, RISCV_IOMMU_REG_IOHPMCYCLES,
++            RISCV_IOMMU_IOHPMCYCLES_OVF, 0);
++        riscv_iommu_notify(s, RISCV_IOMMU_INTR_PM);
++    }
++}
+diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu.c
++++ b/hw/riscv/riscv-iommu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
+     address_space_init(&s->trap_as, &s->trap_mr, "riscv-iommu-trap-as");
+     if (s->cap & RISCV_IOMMU_CAP_HPM) {
++        s->hpm_timer =
++            timer_new_ns(QEMU_CLOCK_VIRTUAL, riscv_iommu_hpm_timer_cb, s);
+         s->hpm_event_ctr_map = g_hash_table_new(g_direct_hash, g_direct_equal);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_unrealize(DeviceState *dev)
+     if (s->cap & RISCV_IOMMU_CAP_HPM) {
+         g_hash_table_unref(s->hpm_event_ctr_map);
++        timer_free(s->hpm_timer);
+     }
+ }
+--
+.48.1

-[PULL 11/13] target/riscv: add support for zdinx
+[PULL 44/59] hw/riscv/riscv-iommu: add IOCOUNTINH mmio writes
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Tomasz Jeznach <tjeznach@rivosinc.com>
-  -- update extension check REQUIRE_ZDINX_OR_D
+RISCV_IOMMU_REG_IOCOUNTINH is done by riscv_iommu_process_iocntinh_cy(),
-  -- update double float point register read/write
+which is called during riscv_iommu_mmio_write() callback via a new
 riscv_iommu_pricess_hpm_writes() helper.
-Co-authored-by: ardxwe <ardxwe@gmail.com>
+Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20250224190826.1858473-7-dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20220211043920.28981-5-liweiwei@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/translate.c                |  52 +++++
+ hw/riscv/riscv-iommu-hpm.h |  1 +
- target/riscv/insn_trans/trans_rvd.c.inc | 285 +++++++++++++++++-------
+ hw/riscv/riscv-iommu-hpm.c | 60 ++++++++++++++++++++++++++++++++++++++
-files changed, 259 insertions(+), 78 deletions(-)
+ hw/riscv/riscv-iommu.c     | 38 ++++++++++++++++++++++++
 files changed, 99 insertions(+)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/hw/riscv/riscv-iommu-hpm.h b/hw/riscv/riscv-iommu-hpm.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/hw/riscv/riscv-iommu-hpm.h
-+++ b/target/riscv/translate.c
++++ b/hw/riscv/riscv-iommu-hpm.h
-@@ -XXX,XX +XXX,XX @@ static TCGv_i64 get_fpr_hs(DisasContext *ctx, int reg_num)
+@@ -XXX,XX +XXX,XX @@ uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s);
  void riscv_iommu_hpm_incr_ctr(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
                                unsigned event_id);
  void riscv_iommu_hpm_timer_cb(void *priv);
 +void riscv_iommu_process_iocntinh_cy(RISCVIOMMUState *s, bool prev_cy_inh);
  #endif
 diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv-iommu-hpm.c
 +++ b/hw/riscv/riscv-iommu-hpm.c
@@ -XXX,XX +XXX,XX @@ void riscv_iommu_hpm_timer_cb(void *priv)
          riscv_iommu_notify(s, RISCV_IOMMU_INTR_PM);
      }
  }
++
-+static TCGv_i64 get_fpr_d(DisasContext *ctx, int reg_num)
++static void hpm_setup_timer(RISCVIOMMUState *s, uint64_t value)
 +{
-+    if (!ctx->cfg_ptr->ext_zfinx) {
++    const uint32_t inhibit = riscv_iommu_reg_get32(
-+        return cpu_fpr[reg_num];
++        s, RISCV_IOMMU_REG_IOCOUNTINH);
 +    uint64_t overflow_at, overflow_ns;
 +
 +    if (get_field(inhibit, RISCV_IOMMU_IOCOUNTINH_CY)) {
 +        return;
 +    }
 +
-+    if (reg_num == 0) {
++    /*
-+        return tcg_constant_i64(0);
++     * We are using INT64_MAX here instead to UINT64_MAX because cycle counter
 +     * has 63-bit precision and INT64_MAX is the maximum it can store.
 +     */
 +    if (value) {
 +        overflow_ns = INT64_MAX - value + 1;
 +    } else {
 +        overflow_ns = INT64_MAX;
 +    }
-+    switch (get_xl(ctx)) {
++
-+    case MXL_RV32:
++    overflow_at = (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + overflow_ns;
-+    {
++
-+        TCGv_i64 t = ftemp_new(ctx);
++    if (overflow_at > INT64_MAX) {
-+        tcg_gen_concat_tl_i64(t, cpu_gpr[reg_num], cpu_gpr[reg_num + 1]);
++        s->irq_overflow_left = overflow_at - INT64_MAX;
-+        return t;
++        overflow_at = INT64_MAX;
 +    }
-+#ifdef TARGET_RISCV64
++
-+    case MXL_RV64:
++    timer_mod_anticipate_ns(s->hpm_timer, overflow_at);
-+        return cpu_gpr[reg_num];
++}
-+#endif
++
-+    default:
++/* Updates the internal cycle counter state when iocntinh:CY is changed. */
-+        g_assert_not_reached();
++void riscv_iommu_process_iocntinh_cy(RISCVIOMMUState *s, bool prev_cy_inh)
 +{
 +    const uint32_t inhibit = riscv_iommu_reg_get32(
 +        s, RISCV_IOMMU_REG_IOCOUNTINH);
 +
 +    /* We only need to process CY bit toggle. */
 +    if (!(inhibit ^ prev_cy_inh)) {
 +        return;
 +    }
 +
 +    if (!(inhibit & RISCV_IOMMU_IOCOUNTINH_CY)) {
 +        /*
 +         * Cycle counter is enabled. Just start the timer again and update
 +         * the clock snapshot value to point to the current time to make
 +         * sure iohpmcycles read is correct.
 +         */
 +        s->hpmcycle_prev = get_cycles();
 +        hpm_setup_timer(s, s->hpmcycle_val);
 +    } else {
 +        /*
 +         * Cycle counter is disabled. Stop the timer and update the cycle
 +         * counter to record the current value which is last programmed
 +         * value + the cycles passed so far.
 +         */
 +        s->hpmcycle_val = s->hpmcycle_val + (get_cycles() - s->hpmcycle_prev);
 +        timer_del(s->hpm_timer);
 +    }
 +}
 diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/riscv-iommu.c
 +++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_update_ipsr(RISCVIOMMUState *s, uint64_t data)
      riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_IPSR, ipsr_set, ipsr_clr);
  }
 +static void riscv_iommu_process_hpm_writes(RISCVIOMMUState *s,
 +                                           uint32_t regb,
 +                                           bool prev_cy_inh)
 +{
 +    switch (regb) {
 +    case RISCV_IOMMU_REG_IOCOUNTINH:
 +        riscv_iommu_process_iocntinh_cy(s, prev_cy_inh);
 +        break;
 +
 +    case RISCV_IOMMU_REG_IOHPMCYCLES:
 +    case RISCV_IOMMU_REG_IOHPMCYCLES + 4:
 +        /* not yet implemented */
 +        break;
 +
 +    case RISCV_IOMMU_REG_IOHPMEVT_BASE ...
 +        RISCV_IOMMU_REG_IOHPMEVT(RISCV_IOMMU_IOCOUNT_NUM) + 4:
 +        /* not yet implemented */
 +        break;
 +    }
 +}
 +
- static TCGv_i64 dest_fpr(DisasContext *ctx, int reg_num)
+ /*
- {
+  * Write the resulting value of 'data' for the reg specified
-     if (!ctx->cfg_ptr->ext_zfinx) {
+  * by 'reg_addr', after considering read-only/read-write/write-clear
-@@ -XXX,XX +XXX,XX @@ static void gen_set_fpr_hs(DisasContext *ctx, int reg_num, TCGv_i64 t)
+@@ -XXX,XX +XXX,XX @@ static MemTxResult riscv_iommu_mmio_write(void *opaque, hwaddr addr,
      uint32_t regb = addr & ~3;
      uint32_t busy = 0;
      uint64_t val = 0;
 +    bool cy_inh = false;
      if ((addr & (size - 1)) != 0) {
          /* Unsupported MMIO alignment or access size */
@@ -XXX,XX +XXX,XX @@ static MemTxResult riscv_iommu_mmio_write(void *opaque, hwaddr addr,
          busy = RISCV_IOMMU_TR_REQ_CTL_GO_BUSY;
          break;
 +    case RISCV_IOMMU_REG_IOCOUNTINH:
 +        if (addr != RISCV_IOMMU_REG_IOCOUNTINH) {
 +            break;
 +        }
 +        /* Store previous value of CY bit. */
 +        cy_inh = !!(riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_IOCOUNTINH) &
 +            RISCV_IOMMU_IOCOUNTINH_CY);
 +        break;
 +
 +
      default:
          break;
      }
- }
+@@ -XXX,XX +XXX,XX @@ static MemTxResult riscv_iommu_mmio_write(void *opaque, hwaddr addr,
+         stl_le_p(&s->regs_rw[regb], rw | busy);
-+static void gen_set_fpr_d(DisasContext *ctx, int reg_num, TCGv_i64 t)
+     }
-+{
-+    if (!ctx->cfg_ptr->ext_zfinx) {
++    /* Process HPM writes and update any internal state if needed. */
-+        tcg_gen_mov_i64(cpu_fpr[reg_num], t);
++    if (regb >= RISCV_IOMMU_REG_IOCOUNTOVF &&
-+        return;
++        regb <= (RISCV_IOMMU_REG_IOHPMEVT(RISCV_IOMMU_IOCOUNT_NUM) + 4)) {
 +        riscv_iommu_process_hpm_writes(s, regb, cy_inh);
 +    }
 +
-+    if (reg_num != 0) {
+     if (process_fn) {
-+        switch (get_xl(ctx)) {
+         process_fn(s);
 +        case MXL_RV32:
 +#ifdef TARGET_RISCV32
 +            tcg_gen_extr_i64_i32(cpu_gpr[reg_num], cpu_gpr[reg_num + 1], t);
 +            break;
 +#else
 +            tcg_gen_ext32s_i64(cpu_gpr[reg_num], t);
 +            tcg_gen_sari_i64(cpu_gpr[reg_num + 1], t, 32);
 +            break;
 +        case MXL_RV64:
 +            tcg_gen_mov_i64(cpu_gpr[reg_num], t);
 +            break;
 +#endif
 +        default:
 +            g_assert_not_reached();
 +        }
 +    }
 +}
 +
  static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
  {
      target_ulong next_pc;
 diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvd.c.inc
 +++ b/target/riscv/insn_trans/trans_rvd.c.inc
@@ -XXX,XX +XXX,XX @@
   * this program.  If not, see <http://www.gnu.org/licenses/>.
   */
 +#define REQUIRE_ZDINX_OR_D(ctx) do { \
 +    if (!ctx->cfg_ptr->ext_zdinx) { \
 +        REQUIRE_EXT(ctx, RVD); \
 +    } \
 +} while (0)
 +
 +#define REQUIRE_EVEN(ctx, reg) do { \
 +    if (ctx->cfg_ptr->ext_zdinx && (get_xl(ctx) == MXL_RV32) && \
 +        ((reg) & 0x1)) { \
 +        return false; \
 +    } \
 +} while (0)
 +
  static bool trans_fld(DisasContext *ctx, arg_fld *a)
  {
      TCGv addr;
@@ -XXX,XX +XXX,XX @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
  static bool trans_fmadd_d(DisasContext *ctx, arg_fmadd_d *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_ZDINX_OR_D(ctx);
 +    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2 | a->rs3);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +    TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
 +
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fmadd_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
 +    gen_helper_fmadd_d(dest, cpu_env, src1, src2, src3);
 +    gen_set_fpr_d(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmadd_d(DisasContext *ctx, arg_fmadd_d *a)
  static bool trans_fmsub_d(DisasContext *ctx, arg_fmsub_d *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_ZDINX_OR_D(ctx);
 +    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2 | a->rs3);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +    TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
 +
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fmsub_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
 +    gen_helper_fmsub_d(dest, cpu_env, src1, src2, src3);
 +    gen_set_fpr_d(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmsub_d(DisasContext *ctx, arg_fmsub_d *a)
  static bool trans_fnmsub_d(DisasContext *ctx, arg_fnmsub_d *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_ZDINX_OR_D(ctx);
 +    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2 | a->rs3);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +    TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
 +
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fnmsub_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
 +    gen_helper_fnmsub_d(dest, cpu_env, src1, src2, src3);
 +    gen_set_fpr_d(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fnmsub_d(DisasContext *ctx, arg_fnmsub_d *a)
  static bool trans_fnmadd_d(DisasContext *ctx, arg_fnmadd_d *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_ZDINX_OR_D(ctx);
 +    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2 | a->rs3);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +    TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
 +
      gen_set_rm(ctx, a->rm);
 -    gen_helper_fnmadd_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
 -                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
 +    gen_helper_fnmadd_d(dest, cpu_env, src1, src2, src3);
 +    gen_set_fpr_d(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fnmadd_d(DisasContext *ctx, arg_fnmadd_d *a)
  static bool trans_fadd_d(DisasContext *ctx, arg_fadd_d *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_ZDINX_OR_D(ctx);
 +    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
 -    gen_set_rm(ctx, a->rm);
 -    gen_helper_fadd_d(cpu_fpr[a->rd], cpu_env,
 -                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fadd_d(dest, cpu_env, src1, src2);
 +    gen_set_fpr_d(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fadd_d(DisasContext *ctx, arg_fadd_d *a)
  static bool trans_fsub_d(DisasContext *ctx, arg_fsub_d *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_ZDINX_OR_D(ctx);
 +    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
 -    gen_set_rm(ctx, a->rm);
 -    gen_helper_fsub_d(cpu_fpr[a->rd], cpu_env,
 -                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fsub_d(dest, cpu_env, src1, src2);
 +    gen_set_fpr_d(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsub_d(DisasContext *ctx, arg_fsub_d *a)
  static bool trans_fmul_d(DisasContext *ctx, arg_fmul_d *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_ZDINX_OR_D(ctx);
 +    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
 -    gen_set_rm(ctx, a->rm);
 -    gen_helper_fmul_d(cpu_fpr[a->rd], cpu_env,
 -                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fmul_d(dest, cpu_env, src1, src2);
 +    gen_set_fpr_d(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmul_d(DisasContext *ctx, arg_fmul_d *a)
  static bool trans_fdiv_d(DisasContext *ctx, arg_fdiv_d *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_ZDINX_OR_D(ctx);
 +    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
 -    gen_set_rm(ctx, a->rm);
 -    gen_helper_fdiv_d(cpu_fpr[a->rd], cpu_env,
 -                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fdiv_d(dest, cpu_env, src1, src2);
 +    gen_set_fpr_d(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_fdiv_d(DisasContext *ctx, arg_fdiv_d *a)
  static bool trans_fsqrt_d(DisasContext *ctx, arg_fsqrt_d *a)
  {
      REQUIRE_FPU;
 -    REQUIRE_EXT(ctx, RVD);
 +    REQUIRE_ZDINX_OR_D(ctx);
 +    REQUIRE_EVEN(ctx, a->rd | a->rs1);
 -    gen_set_rm(ctx, a->rm);
 -    gen_helper_fsqrt_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
 +    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +    gen_set_rm(ctx, a->rm);
 +    gen_helper_fsqrt_d(dest, cpu_env, src1);
 +    gen_set_fpr_d(ctx, a->rd, dest);
      mark_fs_dirty(ctx);
      return true;
  }
  static bool trans_fsgnj_d(DisasContext *ctx, arg_fsgnj_d *a)
  {
 +    REQUIRE_FPU;
 +    REQUIRE_ZDINX_OR_D(ctx);
 +    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
 +
 +    TCGv_i64 dest = dest_fpr(ctx, a->rd);
      if (a->rs1 == a->rs2) { /* FMOV */
 -        tcg_gen_mov_i64(cpu_fpr[a->rd], cpu_fpr[a->rs1]);
 +        dest = get_fpr_d(ctx, a->rs1);
      } else {
 -        tcg_gen_deposit_i64(cpu_fpr[a->rd], cpu_fpr[a->rs2],
 -                            cpu_fpr[a->rs1], 0, 63);
 +        TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 +        TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 +        tcg_gen_deposit_i64(dest, src2, src1, 0, 63);
      }
-+    gen_set_fpr_d(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnj_d(DisasContext *ctx, arg_fsgnj_d *a)
- static bool trans_fsgnjn_d(DisasContext *ctx, arg_fsgnjn_d *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
-+
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-+
-     if (a->rs1 == a->rs2) { /* FNEG */
--        tcg_gen_xori_i64(cpu_fpr[a->rd], cpu_fpr[a->rs1], INT64_MIN);
-+        tcg_gen_xori_i64(dest, src1, INT64_MIN);
-     } else {
-+        TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
-         TCGv_i64 t0 = tcg_temp_new_i64();
--        tcg_gen_not_i64(t0, cpu_fpr[a->rs2]);
--        tcg_gen_deposit_i64(cpu_fpr[a->rd], t0, cpu_fpr[a->rs1], 0, 63);
-+        tcg_gen_not_i64(t0, src2);
-+        tcg_gen_deposit_i64(dest, t0, src1, 0, 63);
-         tcg_temp_free_i64(t0);
-     }
-+    gen_set_fpr_d(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjn_d(DisasContext *ctx, arg_fsgnjn_d *a)
- static bool trans_fsgnjx_d(DisasContext *ctx, arg_fsgnjx_d *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
-+
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-+
-     if (a->rs1 == a->rs2) { /* FABS */
--        tcg_gen_andi_i64(cpu_fpr[a->rd], cpu_fpr[a->rs1], ~INT64_MIN);
-+        tcg_gen_andi_i64(dest, src1, ~INT64_MIN);
-     } else {
-+        TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
-         TCGv_i64 t0 = tcg_temp_new_i64();
--        tcg_gen_andi_i64(t0, cpu_fpr[a->rs2], INT64_MIN);
--        tcg_gen_xor_i64(cpu_fpr[a->rd], cpu_fpr[a->rs1], t0);
-+        tcg_gen_andi_i64(t0, src2, INT64_MIN);
-+        tcg_gen_xor_i64(dest, src1, t0);
-         tcg_temp_free_i64(t0);
-     }
-+    gen_set_fpr_d(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjx_d(DisasContext *ctx, arg_fsgnjx_d *a)
- static bool trans_fmin_d(DisasContext *ctx, arg_fmin_d *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
--    gen_helper_fmin_d(cpu_fpr[a->rd], cpu_env,
--                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
-+    gen_helper_fmin_d(dest, cpu_env, src1, src2);
-+    gen_set_fpr_d(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fmin_d(DisasContext *ctx, arg_fmin_d *a)
- static bool trans_fmax_d(DisasContext *ctx, arg_fmax_d *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
--    gen_helper_fmax_d(cpu_fpr[a->rd], cpu_env,
--                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
-+    gen_helper_fmax_d(dest, cpu_env, src1, src2);
-+    gen_set_fpr_d(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fmax_d(DisasContext *ctx, arg_fmax_d *a)
- static bool trans_fcvt_s_d(DisasContext *ctx, arg_fcvt_s_d *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rs1);
--    gen_set_rm(ctx, a->rm);
--    gen_helper_fcvt_s_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-+    gen_set_rm(ctx, a->rm);
-+    gen_helper_fcvt_s_d(dest, cpu_env, src1);
-+    gen_set_fpr_hs(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_d(DisasContext *ctx, arg_fcvt_s_d *a)
- static bool trans_fcvt_d_s(DisasContext *ctx, arg_fcvt_d_s *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rd);
--    gen_set_rm(ctx, a->rm);
--    gen_helper_fcvt_d_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
-+    gen_set_rm(ctx, a->rm);
-+    gen_helper_fcvt_d_s(dest, cpu_env, src1);
-+    gen_set_fpr_d(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_d_s(DisasContext *ctx, arg_fcvt_d_s *a)
- static bool trans_feq_d(DisasContext *ctx, arg_feq_d *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rs1 | a->rs2);
-     TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
--    gen_helper_feq_d(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
-+    gen_helper_feq_d(dest, cpu_env, src1, src2);
-     gen_set_gpr(ctx, a->rd, dest);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_feq_d(DisasContext *ctx, arg_feq_d *a)
- static bool trans_flt_d(DisasContext *ctx, arg_flt_d *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rs1 | a->rs2);
-     TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
--    gen_helper_flt_d(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
-+    gen_helper_flt_d(dest, cpu_env, src1, src2);
-     gen_set_gpr(ctx, a->rd, dest);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_flt_d(DisasContext *ctx, arg_flt_d *a)
- static bool trans_fle_d(DisasContext *ctx, arg_fle_d *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rs1 | a->rs2);
-     TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
--    gen_helper_fle_d(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
-+    gen_helper_fle_d(dest, cpu_env, src1, src2);
-     gen_set_gpr(ctx, a->rd, dest);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fle_d(DisasContext *ctx, arg_fle_d *a)
- static bool trans_fclass_d(DisasContext *ctx, arg_fclass_d *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rs1);
-     TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
--    gen_helper_fclass_d(dest, cpu_fpr[a->rs1]);
-+    gen_helper_fclass_d(dest, src1);
-     gen_set_gpr(ctx, a->rd, dest);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fclass_d(DisasContext *ctx, arg_fclass_d *a)
- static bool trans_fcvt_w_d(DisasContext *ctx, arg_fcvt_w_d *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rs1);
-     TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-     gen_set_rm(ctx, a->rm);
--    gen_helper_fcvt_w_d(dest, cpu_env, cpu_fpr[a->rs1]);
-+    gen_helper_fcvt_w_d(dest, cpu_env, src1);
-     gen_set_gpr(ctx, a->rd, dest);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_w_d(DisasContext *ctx, arg_fcvt_w_d *a)
- static bool trans_fcvt_wu_d(DisasContext *ctx, arg_fcvt_wu_d *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rs1);
-     TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-     gen_set_rm(ctx, a->rm);
--    gen_helper_fcvt_wu_d(dest, cpu_env, cpu_fpr[a->rs1]);
-+    gen_helper_fcvt_wu_d(dest, cpu_env, src1);
-     gen_set_gpr(ctx, a->rd, dest);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_wu_d(DisasContext *ctx, arg_fcvt_wu_d *a)
- static bool trans_fcvt_d_w(DisasContext *ctx, arg_fcvt_d_w *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rd);
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-     TCGv src = get_gpr(ctx, a->rs1, EXT_SIGN);
-     gen_set_rm(ctx, a->rm);
--    gen_helper_fcvt_d_w(cpu_fpr[a->rd], cpu_env, src);
-+    gen_helper_fcvt_d_w(dest, cpu_env, src);
-+    gen_set_fpr_d(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
-     return true;
-@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_d_w(DisasContext *ctx, arg_fcvt_d_w *a)
- static bool trans_fcvt_d_wu(DisasContext *ctx, arg_fcvt_d_wu *a)
- {
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rd);
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-     TCGv src = get_gpr(ctx, a->rs1, EXT_ZERO);
-     gen_set_rm(ctx, a->rm);
--    gen_helper_fcvt_d_wu(cpu_fpr[a->rd], cpu_env, src);
-+    gen_helper_fcvt_d_wu(dest, cpu_env, src);
-+    gen_set_fpr_d(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
-     return true;
-@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_l_d(DisasContext *ctx, arg_fcvt_l_d *a)
- {
-     REQUIRE_64BIT(ctx);
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rs1);
-     TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-     gen_set_rm(ctx, a->rm);
--    gen_helper_fcvt_l_d(dest, cpu_env, cpu_fpr[a->rs1]);
-+    gen_helper_fcvt_l_d(dest, cpu_env, src1);
-     gen_set_gpr(ctx, a->rd, dest);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_lu_d(DisasContext *ctx, arg_fcvt_lu_d *a)
- {
-     REQUIRE_64BIT(ctx);
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rs1);
-     TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
-     gen_set_rm(ctx, a->rm);
--    gen_helper_fcvt_lu_d(dest, cpu_env, cpu_fpr[a->rs1]);
-+    gen_helper_fcvt_lu_d(dest, cpu_env, src1);
-     gen_set_gpr(ctx, a->rd, dest);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_d_l(DisasContext *ctx, arg_fcvt_d_l *a)
- {
-     REQUIRE_64BIT(ctx);
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rd);
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-     TCGv src = get_gpr(ctx, a->rs1, EXT_SIGN);
-     gen_set_rm(ctx, a->rm);
--    gen_helper_fcvt_d_l(cpu_fpr[a->rd], cpu_env, src);
-+    gen_helper_fcvt_d_l(dest, cpu_env, src);
-+    gen_set_fpr_d(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
-     return true;
-@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_d_lu(DisasContext *ctx, arg_fcvt_d_lu *a)
- {
-     REQUIRE_64BIT(ctx);
-     REQUIRE_FPU;
--    REQUIRE_EXT(ctx, RVD);
-+    REQUIRE_ZDINX_OR_D(ctx);
-+    REQUIRE_EVEN(ctx, a->rd);
-+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
-     TCGv src = get_gpr(ctx, a->rs1, EXT_ZERO);
-     gen_set_rm(ctx, a->rm);
--    gen_helper_fcvt_d_lu(cpu_fpr[a->rd], cpu_env, src);
-+    gen_helper_fcvt_d_lu(dest, cpu_env, src);
-+    gen_set_fpr_d(ctx, a->rd, dest);
-     mark_fs_dirty(ctx);
-     return true;
 --
-.35.1
+.48.1

-New patch
+[PULL 45/59] hw/riscv/riscv-iommu: add IOHPMCYCLES mmio write
+From: Tomasz Jeznach <tjeznach@rivosinc.com>
+RISCV_IOMMU_REG_IOHPMCYCLES writes are done by
+riscv_iommu_process_hpmcycle_write(), called by the mmio write callback
+via riscv_iommu_process_hpm_writes().
+Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250224190826.1858473-8-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/riscv/riscv-iommu-hpm.h |  1 +
+ hw/riscv/riscv-iommu-hpm.c | 19 +++++++++++++++++++
+ hw/riscv/riscv-iommu.c     |  2 +-
+files changed, 21 insertions(+), 1 deletion(-)
+diff --git a/hw/riscv/riscv-iommu-hpm.h b/hw/riscv/riscv-iommu-hpm.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu-hpm.h
++++ b/hw/riscv/riscv-iommu-hpm.h
+@@ -XXX,XX +XXX,XX @@ void riscv_iommu_hpm_incr_ctr(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
+                               unsigned event_id);
+ void riscv_iommu_hpm_timer_cb(void *priv);
+ void riscv_iommu_process_iocntinh_cy(RISCVIOMMUState *s, bool prev_cy_inh);
++void riscv_iommu_process_hpmcycle_write(RISCVIOMMUState *s);
+ #endif
+diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu-hpm.c
++++ b/hw/riscv/riscv-iommu-hpm.c
+@@ -XXX,XX +XXX,XX @@ void riscv_iommu_process_iocntinh_cy(RISCVIOMMUState *s, bool prev_cy_inh)
+         timer_del(s->hpm_timer);
+     }
+ }
++
++void riscv_iommu_process_hpmcycle_write(RISCVIOMMUState *s)
++{
++    const uint64_t val = riscv_iommu_reg_get64(s, RISCV_IOMMU_REG_IOHPMCYCLES);
++    const uint32_t ovf = riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_IOCOUNTOVF);
++
++    /*
++     * Clear OF bit in IOCNTOVF if it's being cleared in IOHPMCYCLES register.
++     */
++    if (get_field(ovf, RISCV_IOMMU_IOCOUNTOVF_CY) &&
++        !get_field(val, RISCV_IOMMU_IOHPMCYCLES_OVF)) {
++        riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_IOCOUNTOVF, 0,
++            RISCV_IOMMU_IOCOUNTOVF_CY);
++    }
++
++    s->hpmcycle_val = val & ~RISCV_IOMMU_IOHPMCYCLES_OVF;
++    s->hpmcycle_prev = get_cycles();
++    hpm_setup_timer(s, s->hpmcycle_val);
++}
+diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu.c
++++ b/hw/riscv/riscv-iommu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_process_hpm_writes(RISCVIOMMUState *s,
+     case RISCV_IOMMU_REG_IOHPMCYCLES:
+     case RISCV_IOMMU_REG_IOHPMCYCLES + 4:
+-        /* not yet implemented */
++        riscv_iommu_process_hpmcycle_write(s);
+         break;
+     case RISCV_IOMMU_REG_IOHPMEVT_BASE ...
+--
+.48.1

-[PULL 04/13] hw/riscv: virt: Add optional AIA IMSIC support to virt machine
+[PULL 46/59] hw/riscv/riscv-iommu: add hpm events mmio write
-From: Anup Patel <anup.patel@wdc.com>
+From: Tomasz Jeznach <tjeznach@rivosinc.com>
-We extend virt machine to emulate both AIA IMSIC and AIA APLIC
+To support hpm events mmio writes, done via
-devices only when "aia=aplic-imsic" parameter is passed along
+riscv_iommu_process_hpmevt_write(), we're also adding the 'hpm-counters'
-with machine name in the QEMU command-line. The AIA IMSIC is
+IOMMU property that are used to determine the amount of counters
-only a per-HART MSI controller so we use AIA APLIC in MSI-mode
+available in the IOMMU.
 to forward all wired interrupts as MSIs to the AIA IMSIC.
-We also provide "aia-guests=<xyz>" parameter which can be used
+Note that everything we did so far didn't change any IOMMU behavior
-to specify number of VS-level AIA IMSIC Guests MMIO pages for
+because we're still not advertising HPM capability to software. This
-each HART.
+will be done in the next patch.
-Signed-off-by: Anup Patel <anup.patel@wdc.com>
+Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
-Signed-off-by: Anup Patel <anup@brainfault.org>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220220085526.808674-4-anup@brainfault.org>
+Message-ID: <20250224190826.1858473-9-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h |  17 +-
+ hw/riscv/riscv-iommu-hpm.h |  1 +
- hw/riscv/virt.c         | 439 ++++++++++++++++++++++++++++++++--------
+ hw/riscv/riscv-iommu.h     |  1 +
- hw/riscv/Kconfig        |   1 +
+ hw/riscv/riscv-iommu-hpm.c | 88 ++++++++++++++++++++++++++++++++++++++
-files changed, 373 insertions(+), 84 deletions(-)
+ hw/riscv/riscv-iommu.c     |  4 +-
 files changed, 93 insertions(+), 1 deletion(-)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
+diff --git a/hw/riscv/riscv-iommu-hpm.h b/hw/riscv/riscv-iommu-hpm.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
+--- a/hw/riscv/riscv-iommu-hpm.h
-+++ b/include/hw/riscv/virt.h
++++ b/hw/riscv/riscv-iommu-hpm.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void riscv_iommu_hpm_incr_ctr(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
- #include "hw/block/flash.h"
+ void riscv_iommu_hpm_timer_cb(void *priv);
- #include "qom/object.h"
+ void riscv_iommu_process_iocntinh_cy(RISCVIOMMUState *s, bool prev_cy_inh);
+ void riscv_iommu_process_hpmcycle_write(RISCVIOMMUState *s);
--#define VIRT_CPUS_MAX 32
++void riscv_iommu_process_hpmevt_write(RISCVIOMMUState *s, uint32_t evt_reg);
--#define VIRT_SOCKETS_MAX 8
-+#define VIRT_CPUS_MAX_BITS             3
+ #endif
-+#define VIRT_CPUS_MAX                  (1 << VIRT_CPUS_MAX_BITS)
+diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
-+#define VIRT_SOCKETS_MAX_BITS          2
+index XXXXXXX..XXXXXXX 100644
-+#define VIRT_SOCKETS_MAX               (1 << VIRT_SOCKETS_MAX_BITS)
+--- a/hw/riscv/riscv-iommu.h
++++ b/hw/riscv/riscv-iommu.h
- #define TYPE_RISCV_VIRT_MACHINE MACHINE_TYPE_NAME("virt")
+@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
- typedef struct RISCVVirtState RISCVVirtState;
-@@ -XXX,XX +XXX,XX @@ DECLARE_INSTANCE_CHECKER(RISCVVirtState, RISCV_VIRT_MACHINE,
+     /* HPM event counters */
- typedef enum RISCVVirtAIAType {
+     GHashTable *hpm_event_ctr_map; /* Mapping of events to counters */
-     VIRT_AIA_TYPE_NONE = 0,
++    uint8_t hpm_cntrs;
      VIRT_AIA_TYPE_APLIC,
 +    VIRT_AIA_TYPE_APLIC_IMSIC,
  } RISCVVirtAIAType;
  struct RISCVVirtState {
@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
      int fdt_size;
      bool have_aclint;
      RISCVVirtAIAType aia_type;
 +    int aia_guests;
  };
- enum {
+ void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, PCIBus *bus,
-@@ -XXX,XX +XXX,XX @@ enum {
+diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
      VIRT_UART0,
      VIRT_VIRTIO,
      VIRT_FW_CFG,
 +    VIRT_IMSIC_M,
 +    VIRT_IMSIC_S,
      VIRT_FLASH,
      VIRT_DRAM,
      VIRT_PCIE_MMIO,
@@ -XXX,XX +XXX,XX @@ enum {
      VIRTIO_NDEV = 0x35 /* Arbitrary maximum number of interrupts */
  };
 -#define VIRT_IRQCHIP_NUM_SOURCES 127
 +#define VIRT_IRQCHIP_IPI_MSI 1
 +#define VIRT_IRQCHIP_NUM_MSIS 255
 +#define VIRT_IRQCHIP_NUM_SOURCES VIRTIO_NDEV
  #define VIRT_IRQCHIP_NUM_PRIO_BITS 3
 +#define VIRT_IRQCHIP_MAX_GUESTS_BITS 3
 +#define VIRT_IRQCHIP_MAX_GUESTS ((1U << VIRT_IRQCHIP_MAX_GUESTS_BITS) - 1U)
  #define VIRT_PLIC_PRIORITY_BASE 0x04
  #define VIRT_PLIC_PENDING_BASE 0x1000
@@ -XXX,XX +XXX,XX @@ enum {
  #define FDT_PCI_INT_CELLS     1
  #define FDT_PLIC_INT_CELLS    1
  #define FDT_APLIC_INT_CELLS   2
 +#define FDT_IMSIC_INT_CELLS   0
  #define FDT_MAX_INT_CELLS     2
  #define FDT_MAX_INT_MAP_WIDTH (FDT_PCI_ADDR_CELLS + FDT_PCI_INT_CELLS + \
 + FDT_MAX_INT_CELLS)
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
+--- a/hw/riscv/riscv-iommu-hpm.c
-+++ b/hw/riscv/virt.c
++++ b/hw/riscv/riscv-iommu-hpm.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void riscv_iommu_process_hpmcycle_write(RISCVIOMMUState *s)
- #include "hw/riscv/numa.h"
+     s->hpmcycle_prev = get_cycles();
- #include "hw/intc/riscv_aclint.h"
+     hpm_setup_timer(s, s->hpmcycle_val);
- #include "hw/intc/riscv_aplic.h"
+ }
 +#include "hw/intc/riscv_imsic.h"
  #include "hw/intc/sifive_plic.h"
  #include "hw/misc/sifive_test.h"
  #include "chardev/char.h"
@@ -XXX,XX +XXX,XX @@
  #include "hw/pci-host/gpex.h"
  #include "hw/display/ramfb.h"
 +#define VIRT_IMSIC_GROUP_MAX_SIZE      (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
 +#if VIRT_IMSIC_GROUP_MAX_SIZE < \
 +    IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
 +#error "Can't accomodate single IMSIC group in address space"
 +#endif
 +
-+#define VIRT_IMSIC_MAX_SIZE            (VIRT_SOCKETS_MAX * \
++static inline bool check_valid_event_id(unsigned event_id)
-+                                        VIRT_IMSIC_GROUP_MAX_SIZE)
++{
-+#if 0x4000000 < VIRT_IMSIC_MAX_SIZE
++    return event_id > RISCV_IOMMU_HPMEVENT_INVALID &&
-+#error "Can't accomodate all IMSIC groups in address space"
++           event_id < RISCV_IOMMU_HPMEVENT_MAX;
-+#endif
++}
 +
- static const MemMapEntry virt_memmap[] = {
++static gboolean hpm_event_equal(gpointer key, gpointer value, gpointer udata)
      [VIRT_DEBUG] =       {        0x0,         0x100 },
      [VIRT_MROM] =        {     0x1000,        0xf000 },
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
      [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
      [VIRT_FW_CFG] =      { 0x10100000,          0x18 },
      [VIRT_FLASH] =       { 0x20000000,     0x4000000 },
 +    [VIRT_IMSIC_M] =     { 0x24000000, VIRT_IMSIC_MAX_SIZE },
 +    [VIRT_IMSIC_S] =     { 0x28000000, VIRT_IMSIC_MAX_SIZE },
      [VIRT_PCIE_ECAM] =   { 0x30000000,    0x10000000 },
      [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
      [VIRT_DRAM] =        { 0x80000000,           0x0 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
  {
      int cpu;
      char *name;
 -    unsigned long addr;
 +    unsigned long addr, size;
      uint32_t aclint_cells_size;
      uint32_t *aclint_mswi_cells;
      uint32_t *aclint_sswi_cells;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
      }
      aclint_cells_size = s->soc[socket].num_harts * sizeof(uint32_t) * 2;
 -    addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
 -    name = g_strdup_printf("/soc/mswi@%lx", addr);
 -    qemu_fdt_add_subnode(mc->fdt, name);
 -    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "riscv,aclint-mswi");
 -    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 -        0x0, addr, 0x0, RISCV_ACLINT_SWI_SIZE);
 -    qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
 -        aclint_mswi_cells, aclint_cells_size);
 -    qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
 -    qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
 -    riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
 -    g_free(name);
 +    if (s->aia_type != VIRT_AIA_TYPE_APLIC_IMSIC) {
 +        addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
 +        name = g_strdup_printf("/soc/mswi@%lx", addr);
 +        qemu_fdt_add_subnode(mc->fdt, name);
 +        qemu_fdt_setprop_string(mc->fdt, name, "compatible",
 +            "riscv,aclint-mswi");
 +        qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 +            0x0, addr, 0x0, RISCV_ACLINT_SWI_SIZE);
 +        qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
 +            aclint_mswi_cells, aclint_cells_size);
 +        qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
 +        qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
 +        riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
 +        g_free(name);
 +    }
 -    addr = memmap[VIRT_CLINT].base + RISCV_ACLINT_SWI_SIZE +
 -        (memmap[VIRT_CLINT].size * socket);
 +    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
 +        addr = memmap[VIRT_CLINT].base +
 +               (RISCV_ACLINT_DEFAULT_MTIMER_SIZE * socket);
 +        size = RISCV_ACLINT_DEFAULT_MTIMER_SIZE;
 +    } else {
 +        addr = memmap[VIRT_CLINT].base + RISCV_ACLINT_SWI_SIZE +
 +            (memmap[VIRT_CLINT].size * socket);
 +        size = memmap[VIRT_CLINT].size - RISCV_ACLINT_SWI_SIZE;
 +    }
      name = g_strdup_printf("/soc/mtimer@%lx", addr);
      qemu_fdt_add_subnode(mc->fdt, name);
      qemu_fdt_setprop_string(mc->fdt, name, "compatible",
          "riscv,aclint-mtimer");
      qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 x0, addr + RISCV_ACLINT_DEFAULT_MTIME,
 -        0x0, memmap[VIRT_CLINT].size - RISCV_ACLINT_SWI_SIZE -
 -             RISCV_ACLINT_DEFAULT_MTIME,
 +        0x0, size - RISCV_ACLINT_DEFAULT_MTIME,
 x0, addr + RISCV_ACLINT_DEFAULT_MTIMECMP,
 x0, RISCV_ACLINT_DEFAULT_MTIME);
      qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
      riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
      g_free(name);
 -    addr = memmap[VIRT_ACLINT_SSWI].base +
 -        (memmap[VIRT_ACLINT_SSWI].size * socket);
 -    name = g_strdup_printf("/soc/sswi@%lx", addr);
 -    qemu_fdt_add_subnode(mc->fdt, name);
 -    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "riscv,aclint-sswi");
 -    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 -        0x0, addr, 0x0, memmap[VIRT_ACLINT_SSWI].size);
 -    qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
 -        aclint_sswi_cells, aclint_cells_size);
 -    qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
 -    qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
 -    riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
 -    g_free(name);
 +    if (s->aia_type != VIRT_AIA_TYPE_APLIC_IMSIC) {
 +        addr = memmap[VIRT_ACLINT_SSWI].base +
 +            (memmap[VIRT_ACLINT_SSWI].size * socket);
 +        name = g_strdup_printf("/soc/sswi@%lx", addr);
 +        qemu_fdt_add_subnode(mc->fdt, name);
 +        qemu_fdt_setprop_string(mc->fdt, name, "compatible",
 +            "riscv,aclint-sswi");
 +        qemu_fdt_setprop_cells(mc->fdt, name, "reg",
 +            0x0, addr, 0x0, memmap[VIRT_ACLINT_SSWI].size);
 +        qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
 +            aclint_sswi_cells, aclint_cells_size);
 +        qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
 +        qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
 +        riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
 +        g_free(name);
 +    }
      g_free(aclint_mswi_cells);
      g_free(aclint_mtimer_cells);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
      g_free(plic_cells);
  }
 -static void create_fdt_socket_aia(RISCVVirtState *s,
 -                                  const MemMapEntry *memmap, int socket,
 -                                  uint32_t *phandle, uint32_t *intc_phandles,
 -                                  uint32_t *aplic_phandles)
 +static uint32_t imsic_num_bits(uint32_t count)
 +{
-+    uint32_t ret = 0;
++    uint32_t *pair = udata;
 +
-+    while (BIT(ret) < count) {
++    if (GPOINTER_TO_UINT(value) & (1 << pair[0])) {
-+        ret++;
++        pair[1] = GPOINTER_TO_UINT(key);
 +        return true;
 +    }
 +
-+    return ret;
++    return false;
 +}
 +
-+static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
++/* Caller must check ctr_idx against hpm_ctrs to see if its supported or not. */
-+                             uint32_t *phandle, uint32_t *intc_phandles,
++static void update_event_map(RISCVIOMMUState *s, uint64_t value,
-+                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
++                             uint32_t ctr_idx)
 +{
-+    int cpu, socket;
++    unsigned event_id = get_field(value, RISCV_IOMMU_IOHPMEVT_EVENT_ID);
-+    char *imsic_name;
++    uint32_t pair[2] = { ctr_idx, RISCV_IOMMU_HPMEVENT_INVALID };
-+    MachineState *mc = MACHINE(s);
++    uint32_t new_value = 1 << ctr_idx;
-+    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
++    gpointer data;
 +    uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
 +
-+    *msi_m_phandle = (*phandle)++;
++    /*
-+    *msi_s_phandle = (*phandle)++;
++     * If EventID field is RISCV_IOMMU_HPMEVENT_INVALID
-+    imsic_cells = g_new0(uint32_t, mc->smp.cpus * 2);
++     * remove the current mapping.
-+    imsic_regs = g_new0(uint32_t, riscv_socket_count(mc) * 4);
++     */
 +    if (event_id == RISCV_IOMMU_HPMEVENT_INVALID) {
 +        data = g_hash_table_find(s->hpm_event_ctr_map, hpm_event_equal, pair);
 +
-+    /* M-level IMSIC node */
++        new_value = GPOINTER_TO_UINT(data) & ~(new_value);
-+    for (cpu = 0; cpu < mc->smp.cpus; cpu++) {
++        if (new_value != 0) {
-+        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
++            g_hash_table_replace(s->hpm_event_ctr_map,
-+        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
++                                 GUINT_TO_POINTER(pair[1]),
 +                                 GUINT_TO_POINTER(new_value));
 +        } else {
 +            g_hash_table_remove(s->hpm_event_ctr_map,
 +                                GUINT_TO_POINTER(pair[1]));
 +        }
 +
 +        return;
 +    }
-+    imsic_max_hart_per_socket = 0;
++
-+    for (socket = 0; socket < riscv_socket_count(mc); socket++) {
++    /* Update the counter mask if the event is already enabled. */
-+        imsic_addr = memmap[VIRT_IMSIC_M].base +
++    if (g_hash_table_lookup_extended(s->hpm_event_ctr_map,
-+                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
++                                     GUINT_TO_POINTER(event_id),
-+        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
++                                     NULL,
-+        imsic_regs[socket * 4 + 0] = 0;
++                                     &data)) {
-+        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
++        new_value |= GPOINTER_TO_UINT(data);
 +        imsic_regs[socket * 4 + 2] = 0;
 +        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
 +        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
 +            imsic_max_hart_per_socket = s->soc[socket].num_harts;
 +        }
 +    }
-+    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-+        (unsigned long)memmap[VIRT_IMSIC_M].base);
-+    qemu_fdt_add_subnode(mc->fdt, imsic_name);
-+    qemu_fdt_setprop_string(mc->fdt, imsic_name, "compatible",
-+        "riscv,imsics");
-+    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "#interrupt-cells",
-+        FDT_IMSIC_INT_CELLS);
-+    qemu_fdt_setprop(mc->fdt, imsic_name, "interrupt-controller",
-+        NULL, 0);
-+    qemu_fdt_setprop(mc->fdt, imsic_name, "msi-controller",
-+        NULL, 0);
-+    qemu_fdt_setprop(mc->fdt, imsic_name, "interrupts-extended",
-+        imsic_cells, mc->smp.cpus * sizeof(uint32_t) * 2);
-+    qemu_fdt_setprop(mc->fdt, imsic_name, "reg", imsic_regs,
-+        riscv_socket_count(mc) * sizeof(uint32_t) * 4);
-+    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,num-ids",
-+        VIRT_IRQCHIP_NUM_MSIS);
-+    qemu_fdt_setprop_cells(mc->fdt, imsic_name, "riscv,ipi-id",
-+        VIRT_IRQCHIP_IPI_MSI);
-+    if (riscv_socket_count(mc) > 1) {
-+        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,hart-index-bits",
-+            imsic_num_bits(imsic_max_hart_per_socket));
-+        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,group-index-bits",
-+            imsic_num_bits(riscv_socket_count(mc)));
-+        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,group-index-shift",
-+            IMSIC_MMIO_GROUP_MIN_SHIFT);
-+    }
-+    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "phandle", *msi_m_phandle);
-+    g_free(imsic_name);
 +
-+    /* S-level IMSIC node */
++    g_hash_table_insert(s->hpm_event_ctr_map,
-+    for (cpu = 0; cpu < mc->smp.cpus; cpu++) {
++                        GUINT_TO_POINTER(event_id),
-+        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
++                        GUINT_TO_POINTER(new_value));
 +        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 +    }
 +    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
 +    imsic_max_hart_per_socket = 0;
 +    for (socket = 0; socket < riscv_socket_count(mc); socket++) {
 +        imsic_addr = memmap[VIRT_IMSIC_S].base +
 +                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 +        imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
 +                     s->soc[socket].num_harts;
 +        imsic_regs[socket * 4 + 0] = 0;
 +        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
 +        imsic_regs[socket * 4 + 2] = 0;
 +        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
 +        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
 +            imsic_max_hart_per_socket = s->soc[socket].num_harts;
 +        }
 +    }
 +    imsic_name = g_strdup_printf("/soc/imsics@%lx",
 +        (unsigned long)memmap[VIRT_IMSIC_S].base);
 +    qemu_fdt_add_subnode(mc->fdt, imsic_name);
 +    qemu_fdt_setprop_string(mc->fdt, imsic_name, "compatible",
 +        "riscv,imsics");
 +    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "#interrupt-cells",
 +        FDT_IMSIC_INT_CELLS);
 +    qemu_fdt_setprop(mc->fdt, imsic_name, "interrupt-controller",
 +        NULL, 0);
 +    qemu_fdt_setprop(mc->fdt, imsic_name, "msi-controller",
 +        NULL, 0);
 +    qemu_fdt_setprop(mc->fdt, imsic_name, "interrupts-extended",
 +        imsic_cells, mc->smp.cpus * sizeof(uint32_t) * 2);
 +    qemu_fdt_setprop(mc->fdt, imsic_name, "reg", imsic_regs,
 +        riscv_socket_count(mc) * sizeof(uint32_t) * 4);
 +    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,num-ids",
 +        VIRT_IRQCHIP_NUM_MSIS);
 +    qemu_fdt_setprop_cells(mc->fdt, imsic_name, "riscv,ipi-id",
 +        VIRT_IRQCHIP_IPI_MSI);
 +    if (imsic_guest_bits) {
 +        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,guest-index-bits",
 +            imsic_guest_bits);
 +    }
 +    if (riscv_socket_count(mc) > 1) {
 +        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,hart-index-bits",
 +            imsic_num_bits(imsic_max_hart_per_socket));
 +        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,group-index-bits",
 +            imsic_num_bits(riscv_socket_count(mc)));
 +        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,group-index-shift",
 +            IMSIC_MMIO_GROUP_MIN_SHIFT);
 +    }
 +    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "phandle", *msi_s_phandle);
 +    g_free(imsic_name);
 +
 +    g_free(imsic_regs);
 +    g_free(imsic_cells);
 +}
 +
-+static void create_fdt_socket_aplic(RISCVVirtState *s,
++void riscv_iommu_process_hpmevt_write(RISCVIOMMUState *s, uint32_t evt_reg)
-+                                    const MemMapEntry *memmap, int socket,
++{
-+                                    uint32_t msi_m_phandle,
++    const uint32_t ctr_idx = (evt_reg - RISCV_IOMMU_REG_IOHPMEVT_BASE) >> 3;
-+                                    uint32_t msi_s_phandle,
++    const uint32_t ovf = riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_IOCOUNTOVF);
-+                                    uint32_t *phandle,
++    uint64_t val = riscv_iommu_reg_get64(s, evt_reg);
 +                                    uint32_t *intc_phandles,
 +                                    uint32_t *aplic_phandles)
  {
      int cpu;
      char *aplic_name;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aia(RISCVVirtState *s,
      qemu_fdt_setprop_cell(mc->fdt, aplic_name,
          "#interrupt-cells", FDT_APLIC_INT_CELLS);
      qemu_fdt_setprop(mc->fdt, aplic_name, "interrupt-controller", NULL, 0);
 -    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
 -        aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
 +        qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
 +            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +    } else {
 +        qemu_fdt_setprop_cell(mc->fdt, aplic_name, "msi-parent",
 +            msi_m_phandle);
 +    }
      qemu_fdt_setprop_cells(mc->fdt, aplic_name, "reg",
 x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
      qemu_fdt_setprop_cell(mc->fdt, aplic_name, "riscv,num-sources",
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aia(RISCVVirtState *s,
      qemu_fdt_setprop_cell(mc->fdt, aplic_name,
          "#interrupt-cells", FDT_APLIC_INT_CELLS);
      qemu_fdt_setprop(mc->fdt, aplic_name, "interrupt-controller", NULL, 0);
 -    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
 -        aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
 +        qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
 +            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +    } else {
 +        qemu_fdt_setprop_cell(mc->fdt, aplic_name, "msi-parent",
 +            msi_s_phandle);
 +    }
      qemu_fdt_setprop_cells(mc->fdt, aplic_name, "reg",
 x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
      qemu_fdt_setprop_cell(mc->fdt, aplic_name, "riscv,num-sources",
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
                                 bool is_32_bit, uint32_t *phandle,
                                 uint32_t *irq_mmio_phandle,
                                 uint32_t *irq_pcie_phandle,
 -                               uint32_t *irq_virtio_phandle)
 +                               uint32_t *irq_virtio_phandle,
 +                               uint32_t *msi_pcie_phandle)
  {
 -    int socket;
      char *clust_name;
 -    uint32_t *intc_phandles;
 +    int socket, phandle_pos;
      MachineState *mc = MACHINE(s);
 -    uint32_t xplic_phandles[MAX_NODES];
 +    uint32_t msi_m_phandle = 0, msi_s_phandle = 0;
 +    uint32_t *intc_phandles, xplic_phandles[MAX_NODES];
      qemu_fdt_add_subnode(mc->fdt, "/cpus");
      qemu_fdt_setprop_cell(mc->fdt, "/cpus", "timebase-frequency",
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
      qemu_fdt_setprop_cell(mc->fdt, "/cpus", "#address-cells", 0x1);
      qemu_fdt_add_subnode(mc->fdt, "/cpus/cpu-map");
 +    intc_phandles = g_new0(uint32_t, mc->smp.cpus);
 +
-+    phandle_pos = mc->smp.cpus;
++    if (ctr_idx >= s->hpm_cntrs) {
-     for (socket = (riscv_socket_count(mc) - 1); socket >= 0; socket--) {
++        return;
 +        phandle_pos -= s->soc[socket].num_harts;
 +
          clust_name = g_strdup_printf("/cpus/cpu-map/cluster%d", socket);
          qemu_fdt_add_subnode(mc->fdt, clust_name);
 -        intc_phandles = g_new0(uint32_t, s->soc[socket].num_harts);
 -
          create_fdt_socket_cpus(s, socket, clust_name, phandle,
 -            is_32_bit, intc_phandles);
 +            is_32_bit, &intc_phandles[phandle_pos]);
          create_fdt_socket_memory(s, memmap, socket);
 +        g_free(clust_name);
 +
          if (!kvm_enabled()) {
              if (s->have_aclint) {
 -                create_fdt_socket_aclint(s, memmap, socket, intc_phandles);
 +                create_fdt_socket_aclint(s, memmap, socket,
 +                    &intc_phandles[phandle_pos]);
              } else {
 -                create_fdt_socket_clint(s, memmap, socket, intc_phandles);
 +                create_fdt_socket_clint(s, memmap, socket,
 +                    &intc_phandles[phandle_pos]);
              }
          }
 +    }
 +
-+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
++    /* Clear OF bit in IOCNTOVF if it's being cleared in IOHPMEVT register. */
-+        create_fdt_imsic(s, memmap, phandle, intc_phandles,
++    if (get_field(ovf, BIT(ctr_idx + 1)) &&
-+            &msi_m_phandle, &msi_s_phandle);
++        !get_field(val, RISCV_IOMMU_IOHPMEVT_OF)) {
-+        *msi_pcie_phandle = msi_s_phandle;
++        /* +1 to offset CYCLE register OF bit. */
 +        riscv_iommu_reg_mod32(
 +            s, RISCV_IOMMU_REG_IOCOUNTOVF, 0, BIT(ctr_idx + 1));
 +    }
 +
-+    phandle_pos = mc->smp.cpus;
++    if (!check_valid_event_id(get_field(val, RISCV_IOMMU_IOHPMEVT_EVENT_ID))) {
-+    for (socket = (riscv_socket_count(mc) - 1); socket >= 0; socket--) {
++        /* Reset EventID (WARL) field to invalid. */
-+        phandle_pos -= s->soc[socket].num_harts;
++        val = set_field(val, RISCV_IOMMU_IOHPMEVT_EVENT_ID,
++            RISCV_IOMMU_HPMEVENT_INVALID);
-         if (s->aia_type == VIRT_AIA_TYPE_NONE) {
++        riscv_iommu_reg_set64(s, evt_reg, val);
-             create_fdt_socket_plic(s, memmap, socket, phandle,
++    }
 -                intc_phandles, xplic_phandles);
 +                &intc_phandles[phandle_pos], xplic_phandles);
          } else {
 -            create_fdt_socket_aia(s, memmap, socket, phandle,
 -                intc_phandles, xplic_phandles);
 +            create_fdt_socket_aplic(s, memmap, socket,
 +                msi_m_phandle, msi_s_phandle, phandle,
 +                &intc_phandles[phandle_pos], xplic_phandles);
          }
 -
 -        g_free(intc_phandles);
 -        g_free(clust_name);
      }
 +    g_free(intc_phandles);
 +
-     for (socket = 0; socket < riscv_socket_count(mc); socket++) {
++    update_event_map(s, val, ctr_idx);
          if (socket == 0) {
              *irq_mmio_phandle = xplic_phandles[socket];
@@ -XXX,XX +XXX,XX @@ static void create_fdt_virtio(RISCVVirtState *s, const MemMapEntry *memmap,
  }
  static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
 -                            uint32_t irq_pcie_phandle)
 +                            uint32_t irq_pcie_phandle,
 +                            uint32_t msi_pcie_phandle)
  {
      char *name;
      MachineState *mc = MACHINE(s);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
      qemu_fdt_setprop_cells(mc->fdt, name, "bus-range", 0,
          memmap[VIRT_PCIE_ECAM].size / PCIE_MMCFG_SIZE_MIN - 1);
      qemu_fdt_setprop(mc->fdt, name, "dma-coherent", NULL, 0);
 +    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
 +        qemu_fdt_setprop_cell(mc->fdt, name, "msi-parent", msi_pcie_phandle);
 +    }
      qemu_fdt_setprop_cells(mc->fdt, name, "reg", 0,
          memmap[VIRT_PCIE_ECAM].base, 0, memmap[VIRT_PCIE_ECAM].size);
      qemu_fdt_setprop_sized_cells(mc->fdt, name, "ranges",
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
                         uint64_t mem_size, const char *cmdline, bool is_32_bit)
  {
      MachineState *mc = MACHINE(s);
 -    uint32_t phandle = 1, irq_mmio_phandle = 1;
 +    uint32_t phandle = 1, irq_mmio_phandle = 1, msi_pcie_phandle = 1;
      uint32_t irq_pcie_phandle = 1, irq_virtio_phandle = 1;
      if (mc->dtb) {
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
      qemu_fdt_setprop_cell(mc->fdt, "/soc", "#address-cells", 0x2);
      create_fdt_sockets(s, memmap, is_32_bit, &phandle,
 -        &irq_mmio_phandle, &irq_pcie_phandle, &irq_virtio_phandle);
 +        &irq_mmio_phandle, &irq_pcie_phandle, &irq_virtio_phandle,
 +        &msi_pcie_phandle);
      create_fdt_virtio(s, memmap, irq_virtio_phandle);
 -    create_fdt_pcie(s, memmap, irq_pcie_phandle);
 +    create_fdt_pcie(s, memmap, irq_pcie_phandle, msi_pcie_phandle);
      create_fdt_reset(s, memmap, &phandle);
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_plic(const MemMapEntry *memmap, int socket,
      return ret;
  }
 -static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type,
 +static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
                                      const MemMapEntry *memmap, int socket,
                                      int base_hartid, int hart_count)
  {
 +    int i;
 +    hwaddr addr;
 +    uint32_t guest_bits;
      DeviceState *aplic_m;
 +    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
 +
 +    if (msimode) {
 +        /* Per-socket M-level IMSICs */
 +        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 +        for (i = 0; i < hart_count; i++) {
 +            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
 +                               base_hartid + i, true, 1,
 +                               VIRT_IRQCHIP_NUM_MSIS);
 +        }
 +
 +        /* Per-socket S-level IMSICs */
 +        guest_bits = imsic_num_bits(aia_guests + 1);
 +        addr = memmap[VIRT_IMSIC_S].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 +        for (i = 0; i < hart_count; i++) {
 +            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(guest_bits),
 +                               base_hartid + i, false, 1 + aia_guests,
 +                               VIRT_IRQCHIP_NUM_MSIS);
 +        }
 +    }
      /* Per-socket M-level APLIC */
      aplic_m = riscv_aplic_create(
          memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
          memmap[VIRT_APLIC_M].size,
 -        base_hartid, hart_count,
 +        (msimode) ? 0 : base_hartid,
 +        (msimode) ? 0 : hart_count,
          VIRT_IRQCHIP_NUM_SOURCES,
          VIRT_IRQCHIP_NUM_PRIO_BITS,
 -        false, true, NULL);
 +        msimode, true, NULL);
      if (aplic_m) {
          /* Per-socket S-level APLIC */
          riscv_aplic_create(
              memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
              memmap[VIRT_APLIC_S].size,
 -            base_hartid, hart_count,
 +            (msimode) ? 0 : base_hartid,
 +            (msimode) ? 0 : hart_count,
              VIRT_IRQCHIP_NUM_SOURCES,
              VIRT_IRQCHIP_NUM_PRIO_BITS,
 -            false, false, aplic_m);
 +            msimode, false, aplic_m);
      }
      return aplic_m;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
          sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_abort);
          if (!kvm_enabled()) {
 -            /* Per-socket CLINT */
 -            riscv_aclint_swi_create(
 -                memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
 -                base_hartid, hart_count, false);
 -            riscv_aclint_mtimer_create(
 -                memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size +
 -                    RISCV_ACLINT_SWI_SIZE,
 -                RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
 -                RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
 -                RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
 -
 -            /* Per-socket ACLINT SSWI */
              if (s->have_aclint) {
 +                if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
 +                    /* Per-socket ACLINT MTIMER */
 +                    riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
 +                            i * RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
 +                        RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
 +                        base_hartid, hart_count,
 +                        RISCV_ACLINT_DEFAULT_MTIMECMP,
 +                        RISCV_ACLINT_DEFAULT_MTIME,
 +                        RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
 +                } else {
 +                    /* Per-socket ACLINT MSWI, MTIMER, and SSWI */
 +                    riscv_aclint_swi_create(memmap[VIRT_CLINT].base +
 +                            i * memmap[VIRT_CLINT].size,
 +                        base_hartid, hart_count, false);
 +                    riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
 +                            i * memmap[VIRT_CLINT].size +
 +                            RISCV_ACLINT_SWI_SIZE,
 +                        RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
 +                        base_hartid, hart_count,
 +                        RISCV_ACLINT_DEFAULT_MTIMECMP,
 +                        RISCV_ACLINT_DEFAULT_MTIME,
 +                        RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
 +                    riscv_aclint_swi_create(memmap[VIRT_ACLINT_SSWI].base +
 +                            i * memmap[VIRT_ACLINT_SSWI].size,
 +                        base_hartid, hart_count, true);
 +                }
 +            } else {
 +                /* Per-socket SiFive CLINT */
                  riscv_aclint_swi_create(
 -                    memmap[VIRT_ACLINT_SSWI].base +
 -                        i * memmap[VIRT_ACLINT_SSWI].size,
 -                    base_hartid, hart_count, true);
 +                    memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
 +                    base_hartid, hart_count, false);
 +                riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
 +                        i * memmap[VIRT_CLINT].size + RISCV_ACLINT_SWI_SIZE,
 +                    RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
 +                    RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
 +                    RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
              }
          }
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
              s->irqchip[i] = virt_create_plic(memmap, i,
                                               base_hartid, hart_count);
          } else {
 -            s->irqchip[i] = virt_create_aia(s->aia_type, memmap, i,
 -                                            base_hartid, hart_count);
 +            s->irqchip[i] = virt_create_aia(s->aia_type, s->aia_guests,
 +                                            memmap, i, base_hartid,
 +                                            hart_count);
          }
          /* Try to use different IRQCHIP instance based device type */
@@ -XXX,XX +XXX,XX @@ static void virt_machine_instance_init(Object *obj)
  {
  }
 +static char *virt_get_aia_guests(Object *obj, Error **errp)
 +{
 +    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
 +    char val[32];
 +
 +    sprintf(val, "%d", s->aia_guests);
 +    return g_strdup(val);
 +}
-+
+diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
-+static void virt_set_aia_guests(Object *obj, const char *val, Error **errp)
+index XXXXXXX..XXXXXXX 100644
-+{
+--- a/hw/riscv/riscv-iommu.c
-+    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
++++ b/hw/riscv/riscv-iommu.c
-+
+@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_process_hpm_writes(RISCVIOMMUState *s,
-+    s->aia_guests = atoi(val);
-+    if (s->aia_guests < 0 || s->aia_guests > VIRT_IRQCHIP_MAX_GUESTS) {
+     case RISCV_IOMMU_REG_IOHPMEVT_BASE ...
-+        error_setg(errp, "Invalid number of AIA IMSIC guests");
+         RISCV_IOMMU_REG_IOHPMEVT(RISCV_IOMMU_IOCOUNT_NUM) + 4:
-+        error_append_hint(errp, "Valid values be between 0 and %d.\n",
+-        /* not yet implemented */
-+                          VIRT_IRQCHIP_MAX_GUESTS);
++        riscv_iommu_process_hpmevt_write(s, regb & ~7);
 +    }
 +}
 +
  static char *virt_get_aia(Object *obj, Error **errp)
  {
      RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
@@ -XXX,XX +XXX,XX @@ static char *virt_get_aia(Object *obj, Error **errp)
      case VIRT_AIA_TYPE_APLIC:
          val = "aplic";
          break;
-+    case VIRT_AIA_TYPE_APLIC_IMSIC:
-+        val = "aplic-imsic";
-+        break;
-     default:
-         val = "none";
-         break;
-@@ -XXX,XX +XXX,XX @@ static void virt_set_aia(Object *obj, const char *val, Error **errp)
-         s->aia_type = VIRT_AIA_TYPE_NONE;
-     } else if (!strcmp(val, "aplic")) {
-         s->aia_type = VIRT_AIA_TYPE_APLIC;
-+    } else if (!strcmp(val, "aplic-imsic")) {
-+        s->aia_type = VIRT_AIA_TYPE_APLIC_IMSIC;
-     } else {
-         error_setg(errp, "Invalid AIA interrupt controller type");
--        error_append_hint(errp, "Valid values are none, and aplic.\n");
-+        error_append_hint(errp, "Valid values are none, aplic, and "
-+                          "aplic-imsic.\n");
      }
  }
+@@ -XXX,XX +XXX,XX @@ static const Property riscv_iommu_properties[] = {
-@@ -XXX,XX +XXX,XX @@ static void virt_set_aclint(Object *obj, bool value, Error **errp)
+     DEFINE_PROP_BOOL("g-stage", RISCVIOMMUState, enable_g_stage, TRUE),
+     DEFINE_PROP_LINK("downstream-mr", RISCVIOMMUState, target_mr,
- static void virt_machine_class_init(ObjectClass *oc, void *data)
+         TYPE_MEMORY_REGION, MemoryRegion *),
- {
++    DEFINE_PROP_UINT8("hpm-counters", RISCVIOMMUState, hpm_cntrs,
-+    char str[128];
++                      RISCV_IOMMU_IOCOUNT_NUM),
-     MachineClass *mc = MACHINE_CLASS(oc);
+ };
-     mc->desc = "RISC-V VirtIO board";
+ static void riscv_iommu_class_init(ObjectClass *klass, void* data)
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
      object_class_property_set_description(oc, "aia",
                                            "Set type of AIA interrupt "
                                            "conttoller. Valid values are "
 -                                          "none, and aplic.");
 +                                          "none, aplic, and aplic-imsic.");
 +
 +    object_class_property_add_str(oc, "aia-guests",
 +                                  virt_get_aia_guests,
 +                                  virt_set_aia_guests);
 +    sprintf(str, "Set number of guest MMIO pages for AIA IMSIC. Valid value "
 +                 "should be between 0 and %d.", VIRT_IRQCHIP_MAX_GUESTS);
 +    object_class_property_set_description(oc, "aia-guests", str);
  }
  static const TypeInfo virt_machine_typeinfo = {
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      select SERIAL
      select RISCV_ACLINT
      select RISCV_APLIC
 +    select RISCV_IMSIC
      select SIFIVE_PLIC
      select SIFIVE_TEST
      select VIRTIO_MMIO
 --
-.35.1
+.48.1

-New patch
+[PULL 47/59] hw/riscv/riscv-iommu.c: add RISCV_IOMMU_CAP_HPM cap
+From: Tomasz Jeznach <tjeznach@rivosinc.com>
+Now that we have every piece in place we can advertise CAP_HTM to
+software, allowing any HPM aware driver to make use of the counters.
+HPM is enabled/disabled via the 'hpm-counters' attribute. Default value
+is 31, max value is also 31. Setting it to zero will disable HPM
+support.
+Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250224190826.1858473-10-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/riscv/riscv-iommu.c | 21 +++++++++++++++++++++
+file changed, 21 insertions(+)
+diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu.c
++++ b/hw/riscv/riscv-iommu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
+                   RISCV_IOMMU_CAP_SV48X4 | RISCV_IOMMU_CAP_SV57X4;
+     }
++    if (s->hpm_cntrs > 0) {
++        /* Clip number of HPM counters to maximum supported (31). */
++        if (s->hpm_cntrs > RISCV_IOMMU_IOCOUNT_NUM) {
++            s->hpm_cntrs = RISCV_IOMMU_IOCOUNT_NUM;
++        }
++        /* Enable hardware performance monitor interface */
++        s->cap |= RISCV_IOMMU_CAP_HPM;
++    }
++
+     /* Out-of-reset translation mode: OFF (DMA disabled) BARE (passthrough) */
+     s->ddtp = set_field(0, RISCV_IOMMU_DDTP_MODE, s->enable_off ?
+                         RISCV_IOMMU_DDTP_MODE_OFF : RISCV_IOMMU_DDTP_MODE_BARE);
+@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
+             RISCV_IOMMU_TR_REQ_CTL_GO_BUSY);
+     }
++    /* If HPM registers are enabled. */
++    if (s->cap & RISCV_IOMMU_CAP_HPM) {
++        /* +1 for cycle counter bit. */
++        stl_le_p(&s->regs_ro[RISCV_IOMMU_REG_IOCOUNTINH],
++                 ~((2 << s->hpm_cntrs) - 1));
++        stq_le_p(&s->regs_ro[RISCV_IOMMU_REG_IOHPMCYCLES], 0);
++        memset(&s->regs_ro[RISCV_IOMMU_REG_IOHPMCTR_BASE],
++               0x00, s->hpm_cntrs * 8);
++        memset(&s->regs_ro[RISCV_IOMMU_REG_IOHPMEVT_BASE],
++               0x00, s->hpm_cntrs * 8);
++    }
++
+     /* Memory region for downstream access, if specified. */
+     if (s->target_mr) {
+         s->target_as = g_new0(AddressSpace, 1);
+--
+.48.1

-New patch
+[PULL 48/59] hw/riscv: add IOMMU HPM trace events
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Add a handful of trace events to allow for an easier time debugging the
+HPM feature.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250224190826.1858473-11-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/riscv/riscv-iommu-hpm.c | 10 ++++++++++
+ hw/riscv/trace-events      |  5 +++++
+files changed, 15 insertions(+)
+diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/riscv-iommu-hpm.c
++++ b/hw/riscv/riscv-iommu-hpm.c
+@@ -XXX,XX +XXX,XX @@ uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s)
+     const uint64_t ctr_prev = s->hpmcycle_prev;
+     const uint64_t ctr_val = s->hpmcycle_val;
++    trace_riscv_iommu_hpm_read(cycle, inhibit, ctr_prev, ctr_val);
++
+     if (get_field(inhibit, RISCV_IOMMU_IOCOUNTINH_CY)) {
+         /*
+          * Counter should not increment if inhibit bit is set. We can't really
+@@ -XXX,XX +XXX,XX @@ static void hpm_incr_ctr(RISCVIOMMUState *s, uint32_t ctr_idx)
+     cntr_val = ldq_le_p(&s->regs_rw[RISCV_IOMMU_REG_IOHPMCTR_BASE + off]);
+     stq_le_p(&s->regs_rw[RISCV_IOMMU_REG_IOHPMCTR_BASE + off], cntr_val + 1);
++    trace_riscv_iommu_hpm_incr_ctr(cntr_val);
++
+     /* Handle the overflow scenario. */
+     if (cntr_val == UINT64_MAX) {
+         /*
+@@ -XXX,XX +XXX,XX @@ void riscv_iommu_process_iocntinh_cy(RISCVIOMMUState *s, bool prev_cy_inh)
+         return;
+     }
++    trace_riscv_iommu_hpm_iocntinh_cy(prev_cy_inh);
++
+     if (!(inhibit & RISCV_IOMMU_IOCOUNTINH_CY)) {
+         /*
+          * Cycle counter is enabled. Just start the timer again and update
+@@ -XXX,XX +XXX,XX @@ void riscv_iommu_process_hpmcycle_write(RISCVIOMMUState *s)
+     const uint64_t val = riscv_iommu_reg_get64(s, RISCV_IOMMU_REG_IOHPMCYCLES);
+     const uint32_t ovf = riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_IOCOUNTOVF);
++    trace_riscv_iommu_hpm_cycle_write(ovf, val);
++
+     /*
+      * Clear OF bit in IOCNTOVF if it's being cleared in IOHPMCYCLES register.
+      */
+@@ -XXX,XX +XXX,XX @@ void riscv_iommu_process_hpmevt_write(RISCVIOMMUState *s, uint32_t evt_reg)
+         return;
+     }
++    trace_riscv_iommu_hpm_evt_write(ctr_idx, ovf, val);
++
+     /* Clear OF bit in IOCNTOVF if it's being cleared in IOHPMEVT register. */
+     if (get_field(ovf, BIT(ctr_idx + 1)) &&
+         !get_field(val, RISCV_IOMMU_IOHPMEVT_OF)) {
+diff --git a/hw/riscv/trace-events b/hw/riscv/trace-events
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/riscv/trace-events
++++ b/hw/riscv/trace-events
+@@ -XXX,XX +XXX,XX @@ riscv_iommu_sys_irq_sent(uint32_t vector) "IRQ sent to vector %u"
+ riscv_iommu_sys_msi_sent(uint32_t vector, uint64_t msi_addr, uint32_t msi_data, uint32_t result) "MSI sent to vector %u msi_addr 0x%"PRIx64" msi_data 0x%x result %u"
+ riscv_iommu_sys_reset_hold(int reset_type) "reset type %d"
+ riscv_iommu_pci_reset_hold(int reset_type) "reset type %d"
++riscv_iommu_hpm_read(uint64_t cycle, uint32_t inhibit, uint64_t ctr_prev, uint64_t ctr_val) "cycle 0x%"PRIx64" inhibit 0x%x ctr_prev 0x%"PRIx64" ctr_val 0x%"PRIx64
++riscv_iommu_hpm_incr_ctr(uint64_t cntr_val) "cntr_val 0x%"PRIx64
++riscv_iommu_hpm_iocntinh_cy(bool prev_cy_inh) "prev_cy_inh %d"
++riscv_iommu_hpm_cycle_write(uint32_t ovf, uint64_t val) "ovf 0x%x val 0x%"PRIx64
++riscv_iommu_hpm_evt_write(uint32_t ctr_idx, uint32_t ovf, uint64_t val) "ctr_idx 0x%x ovf 0x%x val 0x%"PRIx64
+--
+.48.1

-New patch
+[PULL 49/59] docs/specs/riscv-iommu.rst: add HPM support info
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250224190826.1858473-12-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ docs/specs/riscv-iommu.rst | 2 ++
+file changed, 2 insertions(+)
+diff --git a/docs/specs/riscv-iommu.rst b/docs/specs/riscv-iommu.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/specs/riscv-iommu.rst
++++ b/docs/specs/riscv-iommu.rst
+@@ -XXX,XX +XXX,XX @@ Several options are available to control the capabilities of the device, namely:
+ - "off" (Out-of-reset translation mode: 'on' for DMA disabled, 'off' for 'BARE' (passthrough))
+ - "s-stage": enable s-stage support
+ - "g-stage": enable g-stage support
++- "hpm-counters": number of hardware performance counters available. Maximum value is 31.
++  Default value is 31. Use 0 (zero) to disable HPM support
+ riscv-iommu-sys device
+ ----------------------
+--
+.48.1

-New patch
+[PULL 50/59] target/riscv/kvm: Add some exts support
+From: Quan Zhou <zhouquan@iscas.ac.cn>
+When the Sscofpmf/Svade/Svadu/Smnpm/Ssnpm exts is available
+expose it to the guest so that guest can use it.
+Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <303616ccad2b5309768157b50d93b3e89fecc9cb.1740371468.git.zhouquan@iscas.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/kvm/kvm-cpu.c | 5 +++++
+file changed, 5 insertions(+)
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm/kvm-cpu.c
++++ b/target/riscv/kvm/kvm-cpu.c
+@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
+     KVM_EXT_CFG("zvksed", ext_zvksed, KVM_RISCV_ISA_EXT_ZVKSED),
+     KVM_EXT_CFG("zvksh", ext_zvksh, KVM_RISCV_ISA_EXT_ZVKSH),
+     KVM_EXT_CFG("zvkt", ext_zvkt, KVM_RISCV_ISA_EXT_ZVKT),
++    KVM_EXT_CFG("smnpm", ext_smnpm, KVM_RISCV_ISA_EXT_SMNPM),
+     KVM_EXT_CFG("smstateen", ext_smstateen, KVM_RISCV_ISA_EXT_SMSTATEEN),
+     KVM_EXT_CFG("ssaia", ext_ssaia, KVM_RISCV_ISA_EXT_SSAIA),
++    KVM_EXT_CFG("sscofpmf", ext_sscofpmf, KVM_RISCV_ISA_EXT_SSCOFPMF),
++    KVM_EXT_CFG("ssnpm", ext_ssnpm, KVM_RISCV_ISA_EXT_SSNPM),
+     KVM_EXT_CFG("sstc", ext_sstc, KVM_RISCV_ISA_EXT_SSTC),
++    KVM_EXT_CFG("svade", ext_svade, KVM_RISCV_ISA_EXT_SVADE),
++    KVM_EXT_CFG("svadu", ext_svadu, KVM_RISCV_ISA_EXT_SVADU),
+     KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
+     KVM_EXT_CFG("svnapot", ext_svnapot, KVM_RISCV_ISA_EXT_SVNAPOT),
+     KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
+--
+.48.1

-New patch
+[PULL 51/59] binfmt: Shuffle things around
+From: Andrea Bolognani <abologna@redhat.com>
+This should make no difference from the functional point of
+view and it's just preparation for upcoming changes.
+Signed-off-by: Andrea Bolognani <abologna@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Laurent Vivier <laurent@vivier.eu>
+Message-ID: <20250127182924.103510-2-abologna@redhat.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ scripts/qemu-binfmt-conf.sh | 17 ++++++++++-------
+file changed, 10 insertions(+), 7 deletions(-)
+diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
+index XXXXXXX..XXXXXXX 100755
+--- a/scripts/qemu-binfmt-conf.sh
++++ b/scripts/qemu-binfmt-conf.sh
+@@ -XXX,XX +XXX,XX @@ qemu_set_binfmts() {
+         mask=$(eval echo \$${cpu}_mask)
+         family=$(eval echo \$${cpu}_family)
++        target="$cpu"
++        if [ "$cpu" = "i486" ] ; then
++            target="i386"
++        fi
++
++        qemu="$QEMU_PATH/qemu-$target$QEMU_SUFFIX"
++
+         if [ "$magic" = "" ] || [ "$mask" = "" ] || [ "$family" = "" ] ; then
+             echo "INTERNAL ERROR: unknown cpu $cpu" 1>&2
+             continue
+         fi
+-        qemu="$QEMU_PATH/qemu-$cpu"
+-        if [ "$cpu" = "i486" ] ; then
+-            qemu="$QEMU_PATH/qemu-i386"
++        if [ "$host_family" = "$family" ] ; then
++            continue
+         fi
+-        qemu="$qemu$QEMU_SUFFIX"
+-        if [ "$host_family" != "$family" ] ; then
+-            $BINFMT_SET
+-        fi
++        $BINFMT_SET
+     done
+ }
+--
+.48.1

-New patch
+[PULL 52/59] binfmt: Normalize host CPU architecture
+From: Andrea Bolognani <abologna@redhat.com>
+Right now information regarding the family each CPU type belongs
+to is recorded in two places: the large data table at the top of
+the script, and the qemu_host_family() function.
+We can make things better by mapping host CPU architecture to
+QEMU target in the few cases where the two don't already match
+and then using the data table to look up the family, same as
+we're already doing for the guest CPU architecture.
+Being able to reason in terms of QEMU target regardless of
+whether we're looking at the host or guest CPU architecture will
+come in handy to implement upcoming changes.
+A couple of entries are dropped in the process: BePC and Power
+Macintosh. I'm quite certain neither of those have ever been
+reported as CPU architectures by Linux. I believe many more of
+the entries that are carried forward could be dropped as well,
+but I don't have the same level of confidence there so I
+decided to play it safe just in case.
+Signed-off-by: Andrea Bolognani <abologna@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Laurent Vivier <laurent@vivier.eu>
+Message-ID: <20250127182924.103510-3-abologna@redhat.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ scripts/qemu-binfmt-conf.sh | 44 +++++++++++++++++++++----------------
+file changed, 25 insertions(+), 19 deletions(-)
+diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
+index XXXXXXX..XXXXXXX 100755
+--- a/scripts/qemu-binfmt-conf.sh
++++ b/scripts/qemu-binfmt-conf.sh
+@@ -XXX,XX +XXX,XX @@ loongarch64_magic='\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x
+ loongarch64_mask='\xff\xff\xff\xff\xff\xff\xff\xfc\x00\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'
+ loongarch64_family=loongarch
+-qemu_get_family() {
+-    cpu=${HOST_ARCH:-$(uname -m)}
++# Converts the name of a host CPU architecture to the corresponding QEMU
++# target.
++#
++# FIXME: This can probably be simplified a lot by dropping most entries.
++#        Remember that the script is only used on Linux, so we only need to
++#        handle the strings Linux uses to report the host CPU architecture.
++qemu_normalize() {
++    cpu="$1"
+     case "$cpu" in
+-    amd64|i386|i486|i586|i686|i86pc|BePC|x86_64)
++    i[3-6]86)
+         echo "i386"
+         ;;
+-    mips*)
+-        echo "mips"
++    amd64)
++        echo "x86_64"
+         ;;
+-    "Power Macintosh"|ppc64|powerpc|ppc)
++    powerpc)
+         echo "ppc"
+         ;;
+-    ppc64el|ppc64le)
+-        echo "ppcle"
++    ppc64el)
++        echo "ppc64le"
+         ;;
+-    arm|armel|armhf|arm64|armv[4-9]*l|aarch64)
++    armel|armhf|armv[4-9]*l)
+         echo "arm"
+         ;;
+-    armeb|armv[4-9]*b|aarch64_be)
++    armv[4-9]*b)
+         echo "armeb"
+         ;;
+-    sparc*)
+-        echo "sparc"
+-        ;;
+-    riscv*)
+-        echo "riscv"
+-        ;;
+-    loongarch*)
+-        echo "loongarch"
++    arm64)
++        echo "aarch64"
+         ;;
+     *)
+         echo "$cpu"
+@@ -XXX,XX +XXX,XX @@ EOF
+ qemu_set_binfmts() {
+     # probe cpu type
+-    host_family=$(qemu_get_family)
++    host_cpu=$(qemu_normalize ${HOST_ARCH:-$(uname -m)})
++    host_family=$(eval echo \$${host_cpu}_family)
++
++    if [ "$host_family" = "" ] ; then
++        echo "INTERNAL ERROR: unknown host cpu $host_cpu" 1>&2
++        exit 1
++    fi
+     # register the interpreter for each cpu except for the native one
+--
+.48.1

-New patch
+[PULL 53/59] binfmt: Add --ignore-family option
+From: Andrea Bolognani <abologna@redhat.com>
+Until now, the script has worked under the assumption that a
+host CPU can run binaries targeting any CPU in the same family.
+That's a fair enough assumption when it comes to running i386
+binaries on x86_64, but it doesn't quite apply in the general
+case.
+For example, while riscv64 CPUs could theoretically run riscv32
+applications natively, in practice there exist few (if any?)
+CPUs that implement the necessary silicon; moreover, even if you
+had one such CPU, your host OS would most likely not have
+enabled the necessary kernel bits.
+This new option gives distro packagers the ability to opt out of
+the assumption, likely on a per-architecture basis, and make
+things work out of the box for a larger fraction of their user
+base.
+As an interesting side effect, this makes it possible to enable
+execution of 64-bit binaries on 32-bit CPUs of the same family,
+which is a perfectly valid use case that apparently hadn't been
+considered until now.
+Link: https://src.fedoraproject.org/rpms/qemu/pull-request/72
+Thanks: David Abdurachmanov <davidlt@rivosinc.com>
+Thanks: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Andrea Bolognani <abologna@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Laurent Vivier <laurent@vivier.eu>
+Message-ID: <20250127182924.103510-4-abologna@redhat.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ scripts/qemu-binfmt-conf.sh | 19 ++++++++++++++++---
+file changed, 16 insertions(+), 3 deletions(-)
+diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
+index XXXXXXX..XXXXXXX 100755
+--- a/scripts/qemu-binfmt-conf.sh
++++ b/scripts/qemu-binfmt-conf.sh
+@@ -XXX,XX +XXX,XX @@ Usage: qemu-binfmt-conf.sh [--qemu-path PATH][--debian][--systemd CPU]
+        --persistent:    if yes, the interpreter is loaded when binfmt is
+                         configured and remains in memory. All future uses
+                         are cloned from the open file.
++       --ignore-family: if yes, it is assumed that the host CPU (e.g. riscv64)
++                        can't natively run programs targeting a CPU that is
++                        part of the same family (e.g. riscv32).
+        --preserve-argv0 preserve argv[0]
+     To import templates with update-binfmts, use :
+@@ -XXX,XX +XXX,XX @@ qemu_set_binfmts() {
+         fi
+         if [ "$host_family" = "$family" ] ; then
+-            continue
++            # When --ignore-family is used, we have to generate rules even
++            # for targets that are in the same family as the host CPU. The
++            # only exception is of course when the CPU types exactly match
++            if [ "$target" = "$host_cpu" ] || [ "$IGNORE_FAMILY" = "no" ] ; then
++                continue
++            fi
+         fi
+         $BINFMT_SET
+@@ -XXX,XX +XXX,XX @@ CREDENTIAL=no
+ PERSISTENT=no
+ PRESERVE_ARG0=no
+ QEMU_SUFFIX=""
++IGNORE_FAMILY=no
+ _longopts="debian,systemd:,qemu-path:,qemu-suffix:,exportdir:,help,credential:,\
+-persistent:,preserve-argv0:"
+-options=$(getopt -o ds:Q:S:e:hc:p:g:F: -l ${_longopts} -- "$@")
++persistent:,preserve-argv0:,ignore-family:"
++options=$(getopt -o ds:Q:S:e:hc:p:g:F:i: -l ${_longopts} -- "$@")
+ eval set -- "$options"
+ while true ; do
+@@ -XXX,XX +XXX,XX @@ while true ; do
+         shift
+         PRESERVE_ARG0="$1"
+         ;;
++    -i|--ignore-family)
++        shift
++        IGNORE_FAMILY="$1"
++        ;;
+     *)
+         break
+         ;;
+--
+.48.1

-New patch
+[PULL 54/59] hw/intc/imsic: refine the IMSIC realize
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+When the IMSIC is emulated in the kernel, the GPIO output lines to CPUs
+and aia_ireg_rmw_fn setting can be remove. In this case the IMSIC
+trigger CPU interrupts by KVM APIs, and the RMW of IREG is handled in
+kernel.
+This patch also move the code that claim the CPU interrupts to the
+beginning of IMSIC realization. This can avoid the unnecessary resource
+allocation before checking failed.
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20250224025722.3999-2-yongxuan.wang@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/intc/riscv_imsic.c | 47 ++++++++++++++++++++++++-------------------
+file changed, 26 insertions(+), 21 deletions(-)
+diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/riscv_imsic.c
++++ b/hw/intc/riscv_imsic.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
+     CPUState *cpu = cpu_by_arch_id(imsic->hartid);
+     CPURISCVState *env = cpu ? cpu_env(cpu) : NULL;
++    /* Claim the CPU interrupt to be triggered by this IMSIC */
++    if (riscv_cpu_claim_interrupts(rcpu,
++            (imsic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
++        error_setg(errp, "%s already claimed",
++                   (imsic->mmode) ? "MEIP" : "SEIP");
++        return;
++    }
++
+     if (!kvm_irqchip_in_kernel()) {
++        /* Create output IRQ lines */
++        imsic->external_irqs = g_malloc(sizeof(qemu_irq) * imsic->num_pages);
++        qdev_init_gpio_out(dev, imsic->external_irqs, imsic->num_pages);
++
+         imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
+         imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
+         imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
+@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
+                           IMSIC_MMIO_SIZE(imsic->num_pages));
+     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &imsic->mmio);
+-    /* Claim the CPU interrupt to be triggered by this IMSIC */
+-    if (riscv_cpu_claim_interrupts(rcpu,
+-            (imsic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
+-        error_setg(errp, "%s already claimed",
+-                   (imsic->mmode) ? "MEIP" : "SEIP");
+-        return;
+-    }
+-
+-    /* Create output IRQ lines */
+-    imsic->external_irqs = g_malloc(sizeof(qemu_irq) * imsic->num_pages);
+-    qdev_init_gpio_out(dev, imsic->external_irqs, imsic->num_pages);
+-
+     /* Force select AIA feature and setup CSR read-modify-write callback */
+     if (env) {
+         if (!imsic->mmode) {
+@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
+         } else {
+             rcpu->cfg.ext_smaia = true;
+         }
+-        riscv_cpu_set_aia_ireg_rmw_fn(env, (imsic->mmode) ? PRV_M : PRV_S,
+-                                      riscv_imsic_rmw, imsic);
++
++        if (!kvm_irqchip_in_kernel()) {
++            riscv_cpu_set_aia_ireg_rmw_fn(env, (imsic->mmode) ? PRV_M : PRV_S,
++                                          riscv_imsic_rmw, imsic);
++        }
+     }
+     msi_nonbroken = true;
+@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_imsic_create(hwaddr addr, uint32_t hartid, bool mmode,
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+-    for (i = 0; i < num_pages; i++) {
+-        if (!i) {
+-            qdev_connect_gpio_out_named(dev, NULL, i,
+-                                        qdev_get_gpio_in(DEVICE(cpu),
++    if (!kvm_irqchip_in_kernel()) {
++        for (i = 0; i < num_pages; i++) {
++            if (!i) {
++                qdev_connect_gpio_out_named(dev, NULL, i,
++                                            qdev_get_gpio_in(DEVICE(cpu),
+                                             (mmode) ? IRQ_M_EXT : IRQ_S_EXT));
+-        } else {
+-            qdev_connect_gpio_out_named(dev, NULL, i,
+-                                        qdev_get_gpio_in(DEVICE(cpu),
++            } else {
++                qdev_connect_gpio_out_named(dev, NULL, i,
++                                            qdev_get_gpio_in(DEVICE(cpu),
+                                             IRQ_LOCAL_MAX + i - 1));
++            }
+         }
+     }
+--
+.48.1

-[PULL 05/13] docs/system: riscv: Document AIA options for virt machine
+[PULL 55/59] hw/intc/aplic: refine the APLIC realize
-From: Anup Patel <anup.patel@wdc.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-We have two new machine options "aia" and "aia-guests" available
+When the APLIC is emulated in the kernel, the GPIO output lines to CPUs
-for the RISC-V virt machine so let's document these options.
+can be remove. In this case the APLIC trigger CPU interrupts by KVM APIs.
-Signed-off-by: Anup Patel <anup.patel@wdc.com>
+This patch also move the code that claim the CPU interrupts to the
-Signed-off-by: Anup Patel <anup@brainfault.org>
+beginning of APLIC realization. This can avoid the unnecessary resource
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+allocation before checking failed.
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Message-Id: <20220220085526.808674-5-anup@brainfault.org>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20250224025722.3999-3-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- docs/system/riscv/virt.rst | 16 ++++++++++++++++
+ hw/intc/riscv_aplic.c | 49 +++++++++++++++++++++++--------------------
-file changed, 16 insertions(+)
+file changed, 26 insertions(+), 23 deletions(-)
-diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/riscv/virt.rst
+--- a/hw/intc/riscv_aplic.c
-+++ b/docs/system/riscv/virt.rst
++++ b/hw/intc/riscv_aplic.c
-@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
-   When this option is "on", ACLINT devices will be emulated instead of
+     RISCVAPLICState *aplic = RISCV_APLIC(dev);
-   SiFive CLINT. When not specified, this option is assumed to be "off".
+     if (riscv_use_emulated_aplic(aplic->msimode)) {
-+- aia=[none|aplic|aplic-imsic]
++        /* Create output IRQ lines for non-MSI mode */
 +        if (!aplic->msimode) {
 +            /* Claim the CPU interrupt to be triggered by this APLIC */
 +            for (i = 0; i < aplic->num_harts; i++) {
 +                RISCVCPU *cpu;
 +
-+  This option allows selecting interrupt controller defined by the AIA
++                cpu = RISCV_CPU(cpu_by_arch_id(aplic->hartid_base + i));
-+  (advanced interrupt architecture) specification. The "aia=aplic" selects
++                if (riscv_cpu_claim_interrupts(cpu,
-+  APLIC (advanced platform level interrupt controller) to handle wired
++                    (aplic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
-+  interrupts whereas the "aia=aplic-imsic" selects APLIC and IMSIC (incoming
++                    error_report("%s already claimed",
-+  message signaled interrupt controller) to handle both wired interrupts and
++                                 (aplic->mmode) ? "MEIP" : "SEIP");
-+  MSIs. When not specified, this option is assumed to be "none" which selects
++                    exit(1);
-+  SiFive PLIC to handle wired interrupts.
++                }
 +            }
 +
-+- aia-guests=nnn
++            aplic->external_irqs = g_malloc(sizeof(qemu_irq) *
 +                                            aplic->num_harts);
 +            qdev_init_gpio_out(dev, aplic->external_irqs, aplic->num_harts);
 +        }
 +
-+  The number of per-HART VS-level AIA IMSIC pages to be emulated for a guest
+         aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
-+  having AIA IMSIC (i.e. "aia=aplic-imsic" selected). When not specified,
+         aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
-+  the default number of per-HART VS-level AIA IMSIC pages is 0.
+         aplic->state = g_new0(uint32_t, aplic->num_irqs);
-+
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
- Running Linux kernel
+         }
- --------------------
+     }
 -    /* Create output IRQ lines for non-MSI mode */
 -    if (!aplic->msimode) {
 -        aplic->external_irqs = g_malloc(sizeof(qemu_irq) * aplic->num_harts);
 -        qdev_init_gpio_out(dev, aplic->external_irqs, aplic->num_harts);
 -
 -        /* Claim the CPU interrupt to be triggered by this APLIC */
 -        for (i = 0; i < aplic->num_harts; i++) {
 -            RISCVCPU *cpu = RISCV_CPU(cpu_by_arch_id(aplic->hartid_base + i));
 -            if (riscv_cpu_claim_interrupts(cpu,
 -                (aplic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
 -                error_report("%s already claimed",
 -                             (aplic->mmode) ? "MEIP" : "SEIP");
 -                exit(1);
 -            }
 -        }
 -    }
 -
      msi_nonbroken = true;
  }
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
      if (riscv_use_emulated_aplic(msimode)) {
          sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 -    }
 -    if (!msimode) {
 -        for (i = 0; i < num_harts; i++) {
 -            CPUState *cpu = cpu_by_arch_id(hartid_base + i);
 +        if (!msimode) {
 +            for (i = 0; i < num_harts; i++) {
 +                CPUState *cpu = cpu_by_arch_id(hartid_base + i);
 -            qdev_connect_gpio_out_named(dev, NULL, i,
 -                                        qdev_get_gpio_in(DEVICE(cpu),
 +                qdev_connect_gpio_out_named(dev, NULL, i,
 +                                            qdev_get_gpio_in(DEVICE(cpu),
                                              (mmode) ? IRQ_M_EXT : IRQ_S_EXT));
 +            }
          }
      }
 --
-.35.1
+.48.1

-New patch
+[PULL 56/59] hw/intc/aplic: refine kvm_msicfgaddr
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+Let kvm_msicfgaddr use the same format with mmsicfgaddr and smsicfgaddr.
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Message-ID: <20250224025722.3999-4-yongxuan.wang@sifive.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ hw/intc/riscv_aplic.c | 24 +++++++++++++-----------
+file changed, 13 insertions(+), 11 deletions(-)
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/riscv_aplic.c
++++ b/hw/intc/riscv_aplic.c
+@@ -XXX,XX +XXX,XX @@ void riscv_aplic_set_kvm_msicfgaddr(RISCVAPLICState *aplic, hwaddr addr)
+ {
+ #ifdef CONFIG_KVM
+     if (riscv_use_emulated_aplic(aplic->msimode)) {
++        addr >>= APLIC_xMSICFGADDR_PPN_SHIFT;
+         aplic->kvm_msicfgaddr = extract64(addr, 0, 32);
+-        aplic->kvm_msicfgaddrH = extract64(addr, 32, 32);
++        aplic->kvm_msicfgaddrH = extract64(addr, 32, 32) &
++                                 APLIC_xMSICFGADDRH_VALID_MASK;
+     }
+ #endif
+ }
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
+         }
+     }
+-    if (aplic->mmode) {
+-        msicfgaddr = aplic_m->mmsicfgaddr;
+-        msicfgaddrH = aplic_m->mmsicfgaddrH;
++    if (aplic->kvm_splitmode) {
++        msicfgaddr = aplic->kvm_msicfgaddr;
++        msicfgaddrH = ((uint64_t)aplic->kvm_msicfgaddrH << 32);
+     } else {
+-        msicfgaddr = aplic_m->smsicfgaddr;
+-        msicfgaddrH = aplic_m->smsicfgaddrH;
++        if (aplic->mmode) {
++            msicfgaddr = aplic_m->mmsicfgaddr;
++            msicfgaddrH = aplic_m->mmsicfgaddrH;
++        } else {
++            msicfgaddr = aplic_m->smsicfgaddr;
++            msicfgaddrH = aplic_m->smsicfgaddrH;
++        }
+     }
+     lhxs = (msicfgaddrH >> APLIC_xMSICFGADDRH_LHXS_SHIFT) &
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
+     addr |= (uint64_t)(guest_idx & APLIC_xMSICFGADDR_PPN_HART(lhxs));
+     addr <<= APLIC_xMSICFGADDR_PPN_SHIFT;
+-    if (aplic->kvm_splitmode) {
+-        addr |= aplic->kvm_msicfgaddr;
+-        addr |= ((uint64_t)aplic->kvm_msicfgaddrH << 32);
+-    }
+-
+     address_space_stl_le(&address_space_memory, addr,
+                          eiid, MEMTXATTRS_UNSPECIFIED, &result);
+     if (result != MEMTX_OK) {
+--
+.48.1

-New patch
+[PULL 57/59] target/riscv/cpu: remove unneeded !kvm_enabled() check
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Remove the !kvm_enabled() check in kvm_riscv_reset_vcpu() since the
+function is already being gated by kvm_enabled() in
+riscv_cpu_reset_hold().
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20250224123120.1644186-2-dbarboza@ventanamicro.com>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+---
+ target/riscv/kvm/kvm-cpu.c | 3 ---
+file changed, 3 deletions(-)
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/kvm/kvm-cpu.c
++++ b/target/riscv/kvm/kvm-cpu.c
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
+     CPURISCVState *env = &cpu->env;
+     int i;
+-    if (!kvm_enabled()) {
+-        return;
+-    }
+     for (i = 0; i < 32; i++) {
+         env->gpr[i] = 0;
+     }
+--
+.48.1

-[PULL 07/13] hw: riscv: opentitan: fixup SPI addresses
+[PULL 58/59] target/riscv/kvm: add kvm_riscv_reset_regs_csr()
-From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-This patch updates the SPI_DEVICE, SPI_HOST0, SPI_HOST1
+We're setting reset vals for KVM csrs during kvm_riscv_reset_vcpu(), but
-base addresses. Also adds these as unimplemented devices.
+in no particular order and missing some of them (like env->mstatus).
-The address references can be found [1].
+Create a helper to do that, unclogging reset_vcpu(), and initialize
 env->mstatus as well. Keep the regs in the same order they appear in
 struct kvm_riscv_csr from the KVM UAPI, similar to what
 kvm_riscv_(get|put)_regs_csr are doing. This will make a bit easier to
 add new KVM CSRs and to verify which values we're writing back to KVM
 during vcpu reset.
-[1] https://github.com/lowRISC/opentitan/blob/6c317992fbd646818b34f2a2dbf44bc850e461e4/hw/top_earlgrey/sw/autogen/top_earlgrey_memory.h#L107
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Message-ID: <20250224123120.1644186-3-dbarboza@ventanamicro.com>
 Message-Id: <20220218063839.405082-1-alistair.francis@opensource.wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/opentitan.h |  4 +++-
+ target/riscv/kvm/kvm-cpu.c | 23 +++++++++++++++--------
- hw/riscv/opentitan.c         | 12 +++++++++---
+file changed, 15 insertions(+), 8 deletions(-)
 files changed, 12 insertions(+), 4 deletions(-)
-diff --git a/include/hw/riscv/opentitan.h b/include/hw/riscv/opentitan.h
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/opentitan.h
+--- a/target/riscv/kvm/kvm-cpu.c
-+++ b/include/hw/riscv/opentitan.h
++++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_core(CPUState *cs)
-     IBEX_DEV_FLASH,
+     return ret;
-     IBEX_DEV_FLASH_VIRTUAL,
+ }
-     IBEX_DEV_UART,
-+    IBEX_DEV_SPI_DEVICE,
++static void kvm_riscv_reset_regs_csr(CPURISCVState *env)
-+    IBEX_DEV_SPI_HOST0,
++{
-+    IBEX_DEV_SPI_HOST1,
++    env->mstatus = 0;
-     IBEX_DEV_GPIO,
++    env->mie = 0;
--    IBEX_DEV_SPI,
++    env->stvec = 0;
-     IBEX_DEV_I2C,
++    env->sscratch = 0;
-     IBEX_DEV_PATTGEN,
++    env->sepc = 0;
-     IBEX_DEV_TIMER,
++    env->scause = 0;
-diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
++    env->stval = 0;
-index XXXXXXX..XXXXXXX 100644
++    env->mip = 0;
---- a/hw/riscv/opentitan.c
++    env->satp = 0;
-+++ b/hw/riscv/opentitan.c
++}
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry ibex_memmap[] = {
++
-     [IBEX_DEV_FLASH] =          {  0x20000000,  0x80000 },
+ static int kvm_riscv_get_regs_csr(CPUState *cs)
-     [IBEX_DEV_UART] =           {  0x40000000,  0x1000  },
+ {
-     [IBEX_DEV_GPIO] =           {  0x40040000,  0x1000  },
+     CPURISCVState *env = &RISCV_CPU(cs)->env;
--    [IBEX_DEV_SPI] =            {  0x40050000,  0x1000  },
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
-+    [IBEX_DEV_SPI_DEVICE] =     {  0x40050000,  0x1000  },
+     env->pc = cpu->env.kernel_addr;
-     [IBEX_DEV_I2C] =            {  0x40080000,  0x1000  },
+     env->gpr[10] = kvm_arch_vcpu_id(CPU(cpu)); /* a0 */
-     [IBEX_DEV_PATTGEN] =        {  0x400e0000,  0x1000  },
+     env->gpr[11] = cpu->env.fdt_addr;          /* a1 */
-     [IBEX_DEV_TIMER] =          {  0x40100000,  0x1000  },
+-    env->satp = 0;
-     [IBEX_DEV_SENSOR_CTRL] =    {  0x40110000,  0x1000  },
+-    env->mie = 0;
-     [IBEX_DEV_OTP_CTRL] =       {  0x40130000,  0x4000  },
+-    env->stvec = 0;
-     [IBEX_DEV_USBDEV] =         {  0x40150000,  0x1000  },
+-    env->sscratch = 0;
-+    [IBEX_DEV_SPI_HOST0] =      {  0x40300000,  0x1000  },
+-    env->sepc = 0;
-+    [IBEX_DEV_SPI_HOST1] =      {  0x40310000,  0x1000  },
+-    env->scause = 0;
-     [IBEX_DEV_PWRMGR] =         {  0x40400000,  0x1000  },
+-    env->stval = 0;
-     [IBEX_DEV_RSTMGR] =         {  0x40410000,  0x1000  },
+-    env->mip = 0;
-     [IBEX_DEV_CLKMGR] =         {  0x40420000,  0x1000  },
++
-@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
++    kvm_riscv_reset_regs_csr(env);
+ }
-     create_unimplemented_device("riscv.lowrisc.ibex.gpio",
-         memmap[IBEX_DEV_GPIO].base, memmap[IBEX_DEV_GPIO].size);
+ void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level)
 -    create_unimplemented_device("riscv.lowrisc.ibex.spi",
 -        memmap[IBEX_DEV_SPI].base, memmap[IBEX_DEV_SPI].size);
 +    create_unimplemented_device("riscv.lowrisc.ibex.spi_device",
 +        memmap[IBEX_DEV_SPI_DEVICE].base, memmap[IBEX_DEV_SPI_DEVICE].size);
 +    create_unimplemented_device("riscv.lowrisc.ibex.spi_host0",
 +        memmap[IBEX_DEV_SPI_HOST0].base, memmap[IBEX_DEV_SPI_HOST0].size);
 +    create_unimplemented_device("riscv.lowrisc.ibex.spi_host1",
 +        memmap[IBEX_DEV_SPI_HOST1].base, memmap[IBEX_DEV_SPI_HOST1].size);
      create_unimplemented_device("riscv.lowrisc.ibex.i2c",
          memmap[IBEX_DEV_I2C].base, memmap[IBEX_DEV_I2C].size);
      create_unimplemented_device("riscv.lowrisc.ibex.pattgen",
 --
-.35.1
+.48.1

-[PULL 01/13] target/riscv: fix inverted checks for ext_zb[abcs]
+[PULL 59/59] target/riscv/kvm: add missing KVM CSRs
-From: Philipp Tomsich <philipp.tomsich@vrull.eu>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-While changing to the use of cfg_ptr, the conditions for REQUIRE_ZB[ABCS]
+We're missing scounteren and senvcfg CSRs, both already present in the
-inadvertently became inverted and slipped through the initial testing (which
+KVM UAPI.
 used RV64GC_XVentanaCondOps as a target).
 This fixes the regression.
-Tested against SPEC2017 w/ GCC 12 (prerelease) for RV64GC_zba_zbb_zbc_zbs.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Fixes: f2a32bec8f0da99 ("target/riscv: access cfg structure through DisasContext")
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu>
+Message-ID: <20250224123120.1644186-4-dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20220203153946.2676353-1-philipp.tomsich@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn_trans/trans_rvb.c.inc | 8 ++++----
+ target/riscv/kvm/kvm-cpu.c | 6 ++++++
-file changed, 4 insertions(+), 4 deletions(-)
+file changed, 6 insertions(+)
-diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvb.c.inc
+--- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/insn_trans/trans_rvb.c.inc
++++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_reset_regs_csr(CPURISCVState *env)
-  */
+     env->stval = 0;
+     env->mip = 0;
- #define REQUIRE_ZBA(ctx) do {                    \
+     env->satp = 0;
--    if (ctx->cfg_ptr->ext_zba) {                 \
++    env->scounteren = 0;
-+    if (!ctx->cfg_ptr->ext_zba) {                \
++    env->senvcfg = 0;
-         return false;                            \
+ }
-     }                                            \
- } while (0)
+ static int kvm_riscv_get_regs_csr(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_csr(CPUState *cs)
- #define REQUIRE_ZBB(ctx) do {                    \
+     KVM_RISCV_GET_CSR(cs, env, stval, env->stval);
--    if (ctx->cfg_ptr->ext_zbb) {                 \
+     KVM_RISCV_GET_CSR(cs, env, sip, env->mip);
-+    if (!ctx->cfg_ptr->ext_zbb) {                \
+     KVM_RISCV_GET_CSR(cs, env, satp, env->satp);
-         return false;                            \
++    KVM_RISCV_GET_CSR(cs, env, scounteren, env->scounteren);
-     }                                            \
++    KVM_RISCV_GET_CSR(cs, env, senvcfg, env->senvcfg);
- } while (0)
+     return 0;
- #define REQUIRE_ZBC(ctx) do {                    \
+ }
--    if (ctx->cfg_ptr->ext_zbc) {                 \
+@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_csr(CPUState *cs)
-+    if (!ctx->cfg_ptr->ext_zbc) {                \
+     KVM_RISCV_SET_CSR(cs, env, stval, env->stval);
-         return false;                            \
+     KVM_RISCV_SET_CSR(cs, env, sip, env->mip);
-     }                                            \
+     KVM_RISCV_SET_CSR(cs, env, satp, env->satp);
- } while (0)
++    KVM_RISCV_SET_CSR(cs, env, scounteren, env->scounteren);
++    KVM_RISCV_SET_CSR(cs, env, senvcfg, env->senvcfg);
- #define REQUIRE_ZBS(ctx) do {                    \
--    if (ctx->cfg_ptr->ext_zbs) {                 \
+     return 0;
-+    if (!ctx->cfg_ptr->ext_zbs) {                \
+ }
          return false;                            \
      }                                            \
  } while (0)
 --
-.35.1
+.48.1

From: Alistair Francis <alistair.francis@wdc.com>

The following changes since commit 64ada298b98a51eb2512607f6e6180cb330c47b1:

Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220302' into staging (2022-03-02 12:38:46 +0000)

are available in the Git repository at:

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20220303

for you to fetch changes up to 6b1accefd4876ea5475d55454c7d5b52c02cb73c:

target/riscv: expose zfinx, zdinx, zhinx{min} properties (2022-03-03 13:14:50 +1000)

----------------------------------------------------------------
Fifth RISC-V PR for QEMU 7.0

* Fixup checks for ext_zb[abcs]
 * Add AIA support for virt machine
 * Increase maximum number of CPUs in virt machine
 * Fixup OpenTitan SPI address
 * Add support for zfinx, zdinx and zhinx{min} extensions

----------------------------------------------------------------
Anup Patel (5):
      hw/riscv: virt: Add optional AIA APLIC support to virt machine
      hw/intc: Add RISC-V AIA IMSIC device emulation
      hw/riscv: virt: Add optional AIA IMSIC support to virt machine
      docs/system: riscv: Document AIA options for virt machine
      hw/riscv: virt: Increase maximum number of allowed CPUs

Philipp Tomsich (1):
      target/riscv: fix inverted checks for ext_zb[abcs]

Weiwei Li (6):
      target/riscv: add cfg properties for zfinx, zdinx and zhinx{min}
      target/riscv: hardwire mstatus.FS to zero when enable zfinx
      target/riscv: add support for zfinx
      target/riscv: add support for zdinx
      target/riscv: add support for zhinx/zhinxmin
      target/riscv: expose zfinx, zdinx, zhinx{min} properties

Wilfred Mallawa (1):
      hw: riscv: opentitan: fixup SPI addresses

From: Philipp Tomsich <philipp.tomsich@vrull.eu>

While changing to the use of cfg_ptr, the conditions for REQUIRE_ZB[ABCS]
inadvertently became inverted and slipped through the initial testing (which
used RV64GC_XVentanaCondOps as a target).
This fixes the regression.

Tested against SPEC2017 w/ GCC 12 (prerelease) for RV64GC_zba_zbb_zbc_zbs.

Fixes: f2a32bec8f0da99 ("target/riscv: access cfg structure through DisasContext")
Signed-off-by: Philipp Tomsich <philipp.tomsich@vrull.eu>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220203153946.2676353-1-philipp.tomsich@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvb.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvb.c.inc
+++ b/target/riscv/insn_trans/trans_rvb.c.inc
@@ -XXX,XX +XXX,XX @@
  */
 
 #define REQUIRE_ZBA(ctx) do {                    \
-    if (ctx->cfg_ptr->ext_zba) {                 \
+    if (!ctx->cfg_ptr->ext_zba) {                \
         return false;                            \
     }                                            \
 } while (0)
 
 #define REQUIRE_ZBB(ctx) do {                    \
-    if (ctx->cfg_ptr->ext_zbb) {                 \
+    if (!ctx->cfg_ptr->ext_zbb) {                \
         return false;                            \
     }                                            \
 } while (0)
 
 #define REQUIRE_ZBC(ctx) do {                    \
-    if (ctx->cfg_ptr->ext_zbc) {                 \
+    if (!ctx->cfg_ptr->ext_zbc) {                \
         return false;                            \
     }                                            \
 } while (0)
 
 #define REQUIRE_ZBS(ctx) do {                    \
-    if (ctx->cfg_ptr->ext_zbs) {                 \
+    if (!ctx->cfg_ptr->ext_zbs) {                \
         return false;                            \
     }                                            \
 } while (0)
-- 
2.35.1

From: Anup Patel <anup.patel@wdc.com>

We extend virt machine to emulate AIA APLIC devices only when
"aia=aplic" parameter is passed along with machine name in QEMU
command-line. When "aia=none" or not specified then we fallback
to original PLIC device emulation.

Signed-off-by: Anup Patel <anup.patel@wdc.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220220085526.808674-2-anup@brainfault.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h |  26 +++-
 hw/riscv/virt.c         | 291 ++++++++++++++++++++++++++++++++--------
 hw/riscv/Kconfig        |   1 +
 3 files changed, 259 insertions(+), 59 deletions(-)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVVirtState RISCVVirtState;
 DECLARE_INSTANCE_CHECKER(RISCVVirtState, RISCV_VIRT_MACHINE,
                          TYPE_RISCV_VIRT_MACHINE)
 
+typedef enum RISCVVirtAIAType {
+    VIRT_AIA_TYPE_NONE = 0,
+    VIRT_AIA_TYPE_APLIC,
+} RISCVVirtAIAType;
+
 struct RISCVVirtState {
     /*< private >*/
     MachineState parent;
 
     /*< public >*/
     RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
-    DeviceState *plic[VIRT_SOCKETS_MAX];
+    DeviceState *irqchip[VIRT_SOCKETS_MAX];
     PFlashCFI01 *flash[2];
     FWCfgState *fw_cfg;
 
     int fdt_size;
     bool have_aclint;
+    RISCVVirtAIAType aia_type;
 };
 
 enum {
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_CLINT,
     VIRT_ACLINT_SSWI,
     VIRT_PLIC,
+    VIRT_APLIC_M,
+    VIRT_APLIC_S,
     VIRT_UART0,
     VIRT_VIRTIO,
     VIRT_FW_CFG,
@@ -XXX,XX +XXX,XX @@ enum {
     VIRTIO_NDEV = 0x35 /* Arbitrary maximum number of interrupts */
 };
 
-#define VIRT_PLIC_NUM_SOURCES 127
-#define VIRT_PLIC_NUM_PRIORITIES 7
+#define VIRT_IRQCHIP_NUM_SOURCES 127
+#define VIRT_IRQCHIP_NUM_PRIO_BITS 3
+
 #define VIRT_PLIC_PRIORITY_BASE 0x04
 #define VIRT_PLIC_PENDING_BASE 0x1000
 #define VIRT_PLIC_ENABLE_BASE 0x2000
@@ -XXX,XX +XXX,XX @@ enum {
 
 #define FDT_PCI_ADDR_CELLS    3
 #define FDT_PCI_INT_CELLS     1
-#define FDT_PLIC_ADDR_CELLS   0
 #define FDT_PLIC_INT_CELLS    1
-#define FDT_INT_MAP_WIDTH     (FDT_PCI_ADDR_CELLS + FDT_PCI_INT_CELLS + 1 + \
-                               FDT_PLIC_ADDR_CELLS + FDT_PLIC_INT_CELLS)
+#define FDT_APLIC_INT_CELLS   2
+#define FDT_MAX_INT_CELLS     2
+#define FDT_MAX_INT_MAP_WIDTH (FDT_PCI_ADDR_CELLS + FDT_PCI_INT_CELLS + \
+                                 1 + FDT_MAX_INT_CELLS)
+#define FDT_PLIC_INT_MAP_WIDTH  (FDT_PCI_ADDR_CELLS + FDT_PCI_INT_CELLS + \
+                                 1 + FDT_PLIC_INT_CELLS)
+#define FDT_APLIC_INT_MAP_WIDTH (FDT_PCI_ADDR_CELLS + FDT_PCI_INT_CELLS + \
+                                 1 + FDT_APLIC_INT_CELLS)
 
 #endif
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
 #include "hw/intc/riscv_aclint.h"
+#include "hw/intc/riscv_aplic.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_test.h"
 #include "chardev/char.h"
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
     [VIRT_ACLINT_SSWI] = {  0x2F00000,        0x4000 },
     [VIRT_PCIE_PIO] =    {  0x3000000,       0x10000 },
     [VIRT_PLIC] =        {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
+    [VIRT_APLIC_M] =     {  0xc000000, APLIC_SIZE(VIRT_CPUS_MAX) },
+    [VIRT_APLIC_S] =     {  0xd000000, APLIC_SIZE(VIRT_CPUS_MAX) },
     [VIRT_UART0] =       { 0x10000000,         0x100 },
     [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
     [VIRT_FW_CFG] =      { 0x10100000,          0x18 },
@@ -XXX,XX +XXX,XX @@ static void virt_flash_map(RISCVVirtState *s,
                     sysmem);
 }
 
-static void create_pcie_irq_map(void *fdt, char *nodename,
-                                uint32_t plic_phandle)
+static void create_pcie_irq_map(RISCVVirtState *s, void *fdt, char *nodename,
+                                uint32_t irqchip_phandle)
 {
     int pin, dev;
-    uint32_t
-        full_irq_map[GPEX_NUM_IRQS * GPEX_NUM_IRQS * FDT_INT_MAP_WIDTH] = {};
+    uint32_t irq_map_stride = 0;
+    uint32_t full_irq_map[GPEX_NUM_IRQS * GPEX_NUM_IRQS *
+                          FDT_MAX_INT_MAP_WIDTH] = {};
     uint32_t *irq_map = full_irq_map;
 
     /* This code creates a standard swizzle of interrupts such that
@@ -XXX,XX +XXX,XX @@ static void create_pcie_irq_map(void *fdt, char *nodename,
             int irq_nr = PCIE_IRQ + ((pin + PCI_SLOT(devfn)) % GPEX_NUM_IRQS);
             int i = 0;
 
+            /* Fill PCI address cells */
             irq_map[i] = cpu_to_be32(devfn << 8);
-
             i += FDT_PCI_ADDR_CELLS;
-            irq_map[i] = cpu_to_be32(pin + 1);
 
+            /* Fill PCI Interrupt cells */
+            irq_map[i] = cpu_to_be32(pin + 1);
             i += FDT_PCI_INT_CELLS;
-            irq_map[i++] = cpu_to_be32(plic_phandle);
 
-            i += FDT_PLIC_ADDR_CELLS;
-            irq_map[i] = cpu_to_be32(irq_nr);
+            /* Fill interrupt controller phandle and cells */
+            irq_map[i++] = cpu_to_be32(irqchip_phandle);
+            irq_map[i++] = cpu_to_be32(irq_nr);
+            if (s->aia_type != VIRT_AIA_TYPE_NONE) {
+                irq_map[i++] = cpu_to_be32(0x4);
+            }
 
-            irq_map += FDT_INT_MAP_WIDTH;
+            if (!irq_map_stride) {
+                irq_map_stride = i;
+            }
+            irq_map += irq_map_stride;
         }
     }
 
-    qemu_fdt_setprop(fdt, nodename, "interrupt-map",
-                     full_irq_map, sizeof(full_irq_map));
+    qemu_fdt_setprop(fdt, nodename, "interrupt-map", full_irq_map,
+                     GPEX_NUM_IRQS * GPEX_NUM_IRQS *
+                     irq_map_stride * sizeof(uint32_t));
 
     qemu_fdt_setprop_cells(fdt, nodename, "interrupt-map-mask",
                            0x1800, 0, 0, 0x7);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
     plic_addr = memmap[VIRT_PLIC].base + (memmap[VIRT_PLIC].size * socket);
     plic_name = g_strdup_printf("/soc/plic@%lx", plic_addr);
     qemu_fdt_add_subnode(mc->fdt, plic_name);
-    qemu_fdt_setprop_cell(mc->fdt, plic_name,
-        "#address-cells", FDT_PLIC_ADDR_CELLS);
     qemu_fdt_setprop_cell(mc->fdt, plic_name,
         "#interrupt-cells", FDT_PLIC_INT_CELLS);
     qemu_fdt_setprop_string_array(mc->fdt, plic_name, "compatible",
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
     g_free(plic_cells);
 }
 
+static void create_fdt_socket_aia(RISCVVirtState *s,
+                                  const MemMapEntry *memmap, int socket,
+                                  uint32_t *phandle, uint32_t *intc_phandles,
+                                  uint32_t *aplic_phandles)
+{
+    int cpu;
+    char *aplic_name;
+    uint32_t *aplic_cells;
+    unsigned long aplic_addr;
+    MachineState *mc = MACHINE(s);
+    uint32_t aplic_m_phandle, aplic_s_phandle;
+
+    aplic_m_phandle = (*phandle)++;
+    aplic_s_phandle = (*phandle)++;
+    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+
+    /* M-level APLIC node */
+    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+    }
+    aplic_addr = memmap[VIRT_APLIC_M].base +
+                 (memmap[VIRT_APLIC_M].size * socket);
+    aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
+    qemu_fdt_add_subnode(mc->fdt, aplic_name);
+    qemu_fdt_setprop_string(mc->fdt, aplic_name, "compatible", "riscv,aplic");
+    qemu_fdt_setprop_cell(mc->fdt, aplic_name,
+        "#interrupt-cells", FDT_APLIC_INT_CELLS);
+    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
+        aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+    qemu_fdt_setprop_cells(mc->fdt, aplic_name, "reg",
+        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
+    qemu_fdt_setprop_cell(mc->fdt, aplic_name, "riscv,num-sources",
+        VIRT_IRQCHIP_NUM_SOURCES);
+    qemu_fdt_setprop_cell(mc->fdt, aplic_name, "riscv,children",
+        aplic_s_phandle);
+    qemu_fdt_setprop_cells(mc->fdt, aplic_name, "riscv,delegate",
+        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
+    riscv_socket_fdt_write_id(mc, mc->fdt, aplic_name, socket);
+    qemu_fdt_setprop_cell(mc->fdt, aplic_name, "phandle", aplic_m_phandle);
+    g_free(aplic_name);
+
+    /* S-level APLIC node */
+    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
+    }
+    aplic_addr = memmap[VIRT_APLIC_S].base +
+                 (memmap[VIRT_APLIC_S].size * socket);
+    aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
+    qemu_fdt_add_subnode(mc->fdt, aplic_name);
+    qemu_fdt_setprop_string(mc->fdt, aplic_name, "compatible", "riscv,aplic");
+    qemu_fdt_setprop_cell(mc->fdt, aplic_name,
+        "#interrupt-cells", FDT_APLIC_INT_CELLS);
+    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
+        aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+    qemu_fdt_setprop_cells(mc->fdt, aplic_name, "reg",
+        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
+    qemu_fdt_setprop_cell(mc->fdt, aplic_name, "riscv,num-sources",
+        VIRT_IRQCHIP_NUM_SOURCES);
+    riscv_socket_fdt_write_id(mc, mc->fdt, aplic_name, socket);
+    qemu_fdt_setprop_cell(mc->fdt, aplic_name, "phandle", aplic_s_phandle);
+    g_free(aplic_name);
+
+    g_free(aplic_cells);
+    aplic_phandles[socket] = aplic_s_phandle;
+}
+
 static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
                                bool is_32_bit, uint32_t *phandle,
                                uint32_t *irq_mmio_phandle,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
             }
         }
 
-        create_fdt_socket_plic(s, memmap, socket, phandle,
-            intc_phandles, xplic_phandles);
+        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+            create_fdt_socket_plic(s, memmap, socket, phandle,
+                intc_phandles, xplic_phandles);
+        } else {
+            create_fdt_socket_aia(s, memmap, socket, phandle,
+                intc_phandles, xplic_phandles);
+        }
 
         g_free(intc_phandles);
         g_free(clust_name);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_virtio(RISCVVirtState *s, const MemMapEntry *memmap,
             0x0, memmap[VIRT_VIRTIO].size);
         qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent",
             irq_virtio_phandle);
-        qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", VIRTIO_IRQ + i);
+        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+            qemu_fdt_setprop_cell(mc->fdt, name, "interrupts",
+                                  VIRTIO_IRQ + i);
+        } else {
+            qemu_fdt_setprop_cells(mc->fdt, name, "interrupts",
+                                   VIRTIO_IRQ + i, 0x4);
+        }
         g_free(name);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
         2, virt_high_pcie_memmap.base,
         2, virt_high_pcie_memmap.base, 2, virt_high_pcie_memmap.size);
 
-    create_pcie_irq_map(mc->fdt, name, irq_pcie_phandle);
+    create_pcie_irq_map(s, mc->fdt, name, irq_pcie_phandle);
     g_free(name);
 }
 
@@ -XXX,XX +XXX,XX @@ static void create_fdt_uart(RISCVVirtState *s, const MemMapEntry *memmap,
         0x0, memmap[VIRT_UART0].size);
     qemu_fdt_setprop_cell(mc->fdt, name, "clock-frequency", 3686400);
     qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent", irq_mmio_phandle);
-    qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", UART0_IRQ);
+    if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+        qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", UART0_IRQ);
+    } else {
+        qemu_fdt_setprop_cells(mc->fdt, name, "interrupts", UART0_IRQ, 0x4);
+    }
 
     qemu_fdt_add_subnode(mc->fdt, "/chosen");
     qemu_fdt_setprop_string(mc->fdt, "/chosen", "stdout-path", name);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_rtc(RISCVVirtState *s, const MemMapEntry *memmap,
         0x0, memmap[VIRT_RTC].base, 0x0, memmap[VIRT_RTC].size);
     qemu_fdt_setprop_cell(mc->fdt, name, "interrupt-parent",
         irq_mmio_phandle);
-    qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", RTC_IRQ);
+    if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+        qemu_fdt_setprop_cell(mc->fdt, name, "interrupts", RTC_IRQ);
+    } else {
+        qemu_fdt_setprop_cells(mc->fdt, name, "interrupts", RTC_IRQ, 0x4);
+    }
     g_free(name);
 }
 
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
                                           hwaddr high_mmio_base,
                                           hwaddr high_mmio_size,
                                           hwaddr pio_base,
-                                          DeviceState *plic)
+                                          DeviceState *irqchip)
 {
     DeviceState *dev;
     MemoryRegion *ecam_alias, *ecam_reg;
@@ -XXX,XX +XXX,XX @@ static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 2, pio_base);
 
     for (i = 0; i < GPEX_NUM_IRQS; i++) {
-        irq = qdev_get_gpio_in(plic, PCIE_IRQ + i);
+        irq = qdev_get_gpio_in(irqchip, PCIE_IRQ + i);
 
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, irq);
         gpex_set_irq_num(GPEX_HOST(dev), i, PCIE_IRQ + i);
@@ -XXX,XX +XXX,XX @@ static FWCfgState *create_fw_cfg(const MachineState *mc)
     return fw_cfg;
 }
 
+static DeviceState *virt_create_plic(const MemMapEntry *memmap, int socket,
+                                     int base_hartid, int hart_count)
+{
+    DeviceState *ret;
+    char *plic_hart_config;
+
+    /* Per-socket PLIC hart topology configuration string */
+    plic_hart_config = riscv_plic_hart_config_string(hart_count);
+
+    /* Per-socket PLIC */
+    ret = sifive_plic_create(
+            memmap[VIRT_PLIC].base + socket * memmap[VIRT_PLIC].size,
+            plic_hart_config, hart_count, base_hartid,
+            VIRT_IRQCHIP_NUM_SOURCES,
+            ((1U << VIRT_IRQCHIP_NUM_PRIO_BITS) - 1),
+            VIRT_PLIC_PRIORITY_BASE,
+            VIRT_PLIC_PENDING_BASE,
+            VIRT_PLIC_ENABLE_BASE,
+            VIRT_PLIC_ENABLE_STRIDE,
+            VIRT_PLIC_CONTEXT_BASE,
+            VIRT_PLIC_CONTEXT_STRIDE,
+            memmap[VIRT_PLIC].size);
+
+    g_free(plic_hart_config);
+
+    return ret;
+}
+
+static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type,
+                                    const MemMapEntry *memmap, int socket,
+                                    int base_hartid, int hart_count)
+{
+    DeviceState *aplic_m;
+
+    /* Per-socket M-level APLIC */
+    aplic_m = riscv_aplic_create(
+        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
+        memmap[VIRT_APLIC_M].size,
+        base_hartid, hart_count,
+        VIRT_IRQCHIP_NUM_SOURCES,
+        VIRT_IRQCHIP_NUM_PRIO_BITS,
+        false, true, NULL);
+
+    if (aplic_m) {
+        /* Per-socket S-level APLIC */
+        riscv_aplic_create(
+            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
+            memmap[VIRT_APLIC_S].size,
+            base_hartid, hart_count,
+            VIRT_IRQCHIP_NUM_SOURCES,
+            VIRT_IRQCHIP_NUM_PRIO_BITS,
+            false, false, aplic_m);
+    }
+
+    return aplic_m;
+}
+
 static void virt_machine_init(MachineState *machine)
 {
     const MemMapEntry *memmap = virt_memmap;
     RISCVVirtState *s = RISCV_VIRT_MACHINE(machine);
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
-    char *plic_hart_config, *soc_name;
+    char *soc_name;
     target_ulong start_addr = memmap[VIRT_DRAM].base;
     target_ulong firmware_end_addr, kernel_start_addr;
     uint32_t fdt_load_addr;
     uint64_t kernel_entry;
-    DeviceState *mmio_plic, *virtio_plic, *pcie_plic;
+    DeviceState *mmio_irqchip, *virtio_irqchip, *pcie_irqchip;
     int i, base_hartid, hart_count;
 
     /* Check socket count limit */
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
     }
 
     /* Initialize sockets */
-    mmio_plic = virtio_plic = pcie_plic = NULL;
+    mmio_irqchip = virtio_irqchip = pcie_irqchip = NULL;
     for (i = 0; i < riscv_socket_count(machine); i++) {
         if (!riscv_socket_check_hartids(machine, i)) {
             error_report("discontinuous hartids in socket%d", i);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
             }
         }
 
-        /* Per-socket PLIC hart topology configuration string */
-        plic_hart_config = riscv_plic_hart_config_string(hart_count);
-
-        /* Per-socket PLIC */
-        s->plic[i] = sifive_plic_create(
-            memmap[VIRT_PLIC].base + i * memmap[VIRT_PLIC].size,
-            plic_hart_config, hart_count, base_hartid,
-            VIRT_PLIC_NUM_SOURCES,
-            VIRT_PLIC_NUM_PRIORITIES,
-            VIRT_PLIC_PRIORITY_BASE,
-            VIRT_PLIC_PENDING_BASE,
-            VIRT_PLIC_ENABLE_BASE,
-            VIRT_PLIC_ENABLE_STRIDE,
-            VIRT_PLIC_CONTEXT_BASE,
-            VIRT_PLIC_CONTEXT_STRIDE,
-            memmap[VIRT_PLIC].size);
-        g_free(plic_hart_config);
+        /* Per-socket interrupt controller */
+        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+            s->irqchip[i] = virt_create_plic(memmap, i,
+                                             base_hartid, hart_count);
+        } else {
+            s->irqchip[i] = virt_create_aia(s->aia_type, memmap, i,
+                                            base_hartid, hart_count);
+        }
 
-        /* Try to use different PLIC instance based device type */
+        /* Try to use different IRQCHIP instance based device type */
         if (i == 0) {
-            mmio_plic = s->plic[i];
-            virtio_plic = s->plic[i];
-            pcie_plic = s->plic[i];
+            mmio_irqchip = s->irqchip[i];
+            virtio_irqchip = s->irqchip[i];
+            pcie_irqchip = s->irqchip[i];
         }
         if (i == 1) {
-            virtio_plic = s->plic[i];
-            pcie_plic = s->plic[i];
+            virtio_irqchip = s->irqchip[i];
+            pcie_irqchip = s->irqchip[i];
         }
         if (i == 2) {
-            pcie_plic = s->plic[i];
+            pcie_irqchip = s->irqchip[i];
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
     for (i = 0; i < VIRTIO_COUNT; i++) {
         sysbus_create_simple("virtio-mmio",
             memmap[VIRT_VIRTIO].base + i * memmap[VIRT_VIRTIO].size,
-            qdev_get_gpio_in(DEVICE(virtio_plic), VIRTIO_IRQ + i));
+            qdev_get_gpio_in(DEVICE(virtio_irqchip), VIRTIO_IRQ + i));
     }
 
     gpex_pcie_init(system_memory,
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                    virt_high_pcie_memmap.base,
                    virt_high_pcie_memmap.size,
                    memmap[VIRT_PCIE_PIO].base,
-                   DEVICE(pcie_plic));
+                   DEVICE(pcie_irqchip));
 
     serial_mm_init(system_memory, memmap[VIRT_UART0].base,
-        0, qdev_get_gpio_in(DEVICE(mmio_plic), UART0_IRQ), 399193,
+        0, qdev_get_gpio_in(DEVICE(mmio_irqchip), UART0_IRQ), 399193,
         serial_hd(0), DEVICE_LITTLE_ENDIAN);
 
     sysbus_create_simple("goldfish_rtc", memmap[VIRT_RTC].base,
-        qdev_get_gpio_in(DEVICE(mmio_plic), RTC_IRQ));
+        qdev_get_gpio_in(DEVICE(mmio_irqchip), RTC_IRQ));
 
     virt_flash_create(s);
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_instance_init(Object *obj)
 {
 }
 
+static char *virt_get_aia(Object *obj, Error **errp)
+{
+    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
+    const char *val;
+
+    switch (s->aia_type) {
+    case VIRT_AIA_TYPE_APLIC:
+        val = "aplic";
+        break;
+    default:
+        val = "none";
+        break;
+    };
+
+    return g_strdup(val);
+}
+
+static void virt_set_aia(Object *obj, const char *val, Error **errp)
+{
+    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
+
+    if (!strcmp(val, "none")) {
+        s->aia_type = VIRT_AIA_TYPE_NONE;
+    } else if (!strcmp(val, "aplic")) {
+        s->aia_type = VIRT_AIA_TYPE_APLIC;
+    } else {
+        error_setg(errp, "Invalid AIA interrupt controller type");
+        error_append_hint(errp, "Valid values are none, and aplic.\n");
+    }
+}
+
 static bool virt_get_aclint(Object *obj, Error **errp)
 {
     MachineState *ms = MACHINE(obj);
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     object_class_property_set_description(oc, "aclint",
                                           "Set on/off to enable/disable "
                                           "emulating ACLINT devices");
+
+    object_class_property_add_str(oc, "aia", virt_get_aia,
+                                  virt_set_aia);
+    object_class_property_set_description(oc, "aia",
+                                          "Set type of AIA interrupt "
+                                          "conttoller. Valid values are "
+                                          "none, and aplic.");
 }
 
 static const TypeInfo virt_machine_typeinfo = {
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select PFLASH_CFI01
     select SERIAL
     select RISCV_ACLINT
+    select RISCV_APLIC
     select SIFIVE_PLIC
     select SIFIVE_TEST
     select VIRTIO_MMIO
-- 
2.35.1

From: Anup Patel <anup.patel@wdc.com>

The RISC-V AIA (Advanced Interrupt Architecture) defines a new
interrupt controller for MSIs (message signal interrupts) called
IMSIC (Incoming Message Signal Interrupt Controller). The IMSIC
is per-HART device and also suppport virtualizaiton of MSIs using
dedicated VS-level guest interrupt files.

This patch adds device emulation for RISC-V AIA IMSIC which
supports M-level, S-level, and VS-level MSIs.

Signed-off-by: Anup Patel <anup.patel@wdc.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-Id: <20220220085526.808674-3-anup@brainfault.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/intc/riscv_imsic.h |  68 ++++++
 hw/intc/riscv_imsic.c         | 448 ++++++++++++++++++++++++++++++++++
 hw/intc/Kconfig               |   3 +
 hw/intc/meson.build           |   1 +
 4 files changed, 520 insertions(+)
 create mode 100644 include/hw/intc/riscv_imsic.h
 create mode 100644 hw/intc/riscv_imsic.c

diff --git a/include/hw/intc/riscv_imsic.h b/include/hw/intc/riscv_imsic.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/intc/riscv_imsic.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V IMSIC (Incoming Message Signal Interrupt Controller) interface
+ *
+ * Copyright (c) 2021 Western Digital Corporation or its affiliates.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_RISCV_IMSIC_H
+#define HW_RISCV_IMSIC_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_RISCV_IMSIC "riscv.imsic"
+
+typedef struct RISCVIMSICState RISCVIMSICState;
+DECLARE_INSTANCE_CHECKER(RISCVIMSICState, RISCV_IMSIC, TYPE_RISCV_IMSIC)
+
+#define IMSIC_MMIO_PAGE_SHIFT          12
+#define IMSIC_MMIO_PAGE_SZ             (1UL << IMSIC_MMIO_PAGE_SHIFT)
+#define IMSIC_MMIO_SIZE(__num_pages)   ((__num_pages) * IMSIC_MMIO_PAGE_SZ)
+
+#define IMSIC_MMIO_HART_GUEST_MAX_BTIS 6
+#define IMSIC_MMIO_GROUP_MIN_SHIFT     24
+
+#define IMSIC_HART_NUM_GUESTS(__guest_bits)           \
+    (1U << (__guest_bits))
+#define IMSIC_HART_SIZE(__guest_bits)                 \
+    (IMSIC_HART_NUM_GUESTS(__guest_bits) * IMSIC_MMIO_PAGE_SZ)
+#define IMSIC_GROUP_NUM_HARTS(__hart_bits)            \
+    (1U << (__hart_bits))
+#define IMSIC_GROUP_SIZE(__hart_bits, __guest_bits)   \
+    (IMSIC_GROUP_NUM_HARTS(__hart_bits) * IMSIC_HART_SIZE(__guest_bits))
+
+struct RISCVIMSICState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    qemu_irq *external_irqs;
+
+    /*< public >*/
+    MemoryRegion mmio;
+    uint32_t num_eistate;
+    uint32_t *eidelivery;
+    uint32_t *eithreshold;
+    uint32_t *eistate;
+
+    /* config */
+    bool mmode;
+    uint32_t hartid;
+    uint32_t num_pages;
+    uint32_t num_irqs;
+};
+
+DeviceState *riscv_imsic_create(hwaddr addr, uint32_t hartid, bool mmode,
+                                uint32_t num_pages, uint32_t num_ids);
+
+#endif
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V IMSIC (Incoming Message Signaled Interrupt Controller)
+ *
+ * Copyright (c) 2021 Western Digital Corporation or its affiliates.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/error-report.h"
+#include "qemu/bswap.h"
+#include "exec/address-spaces.h"
+#include "hw/sysbus.h"
+#include "hw/pci/msi.h"
+#include "hw/boards.h"
+#include "hw/qdev-properties.h"
+#include "hw/intc/riscv_imsic.h"
+#include "hw/irq.h"
+#include "target/riscv/cpu.h"
+#include "target/riscv/cpu_bits.h"
+#include "sysemu/sysemu.h"
+#include "migration/vmstate.h"
+
+#define IMSIC_MMIO_PAGE_LE             0x00
+#define IMSIC_MMIO_PAGE_BE             0x04
+
+#define IMSIC_MIN_ID                   ((IMSIC_EIPx_BITS * 2) - 1)
+#define IMSIC_MAX_ID                   (IMSIC_TOPEI_IID_MASK)
+
+#define IMSIC_EISTATE_PENDING          (1U << 0)
+#define IMSIC_EISTATE_ENABLED          (1U << 1)
+#define IMSIC_EISTATE_ENPEND           (IMSIC_EISTATE_ENABLED | \
+                                        IMSIC_EISTATE_PENDING)
+
+static uint32_t riscv_imsic_topei(RISCVIMSICState *imsic, uint32_t page)
+{
+    uint32_t i, max_irq, base;
+
+    base = page * imsic->num_irqs;
+    max_irq = (imsic->eithreshold[page] &&
+               (imsic->eithreshold[page] <= imsic->num_irqs)) ?
+               imsic->eithreshold[page] : imsic->num_irqs;
+    for (i = 1; i < max_irq; i++) {
+        if ((imsic->eistate[base + i] & IMSIC_EISTATE_ENPEND) ==
+                IMSIC_EISTATE_ENPEND) {
+            return (i << IMSIC_TOPEI_IID_SHIFT) | i;
+        }
+    }
+
+    return 0;
+}
+
+static void riscv_imsic_update(RISCVIMSICState *imsic, uint32_t page)
+{
+    if (imsic->eidelivery[page] && riscv_imsic_topei(imsic, page)) {
+        qemu_irq_raise(imsic->external_irqs[page]);
+    } else {
+        qemu_irq_lower(imsic->external_irqs[page]);
+    }
+}
+
+static int riscv_imsic_eidelivery_rmw(RISCVIMSICState *imsic, uint32_t page,
+                                      target_ulong *val,
+                                      target_ulong new_val,
+                                      target_ulong wr_mask)
+{
+    target_ulong old_val = imsic->eidelivery[page];
+
+    if (val) {
+        *val = old_val;
+    }
+
+    wr_mask &= 0x1;
+    imsic->eidelivery[page] = (old_val & ~wr_mask) | (new_val & wr_mask);
+
+    riscv_imsic_update(imsic, page);
+    return 0;
+}
+
+static int riscv_imsic_eithreshold_rmw(RISCVIMSICState *imsic, uint32_t page,
+                                      target_ulong *val,
+                                      target_ulong new_val,
+                                      target_ulong wr_mask)
+{
+    target_ulong old_val = imsic->eithreshold[page];
+
+    if (val) {
+        *val = old_val;
+    }
+
+    wr_mask &= IMSIC_MAX_ID;
+    imsic->eithreshold[page] = (old_val & ~wr_mask) | (new_val & wr_mask);
+
+    riscv_imsic_update(imsic, page);
+    return 0;
+}
+
+static int riscv_imsic_topei_rmw(RISCVIMSICState *imsic, uint32_t page,
+                                 target_ulong *val, target_ulong new_val,
+                                 target_ulong wr_mask)
+{
+    uint32_t base, topei = riscv_imsic_topei(imsic, page);
+
+    /* Read pending and enabled interrupt with highest priority */
+    if (val) {
+        *val = topei;
+    }
+
+    /* Writes ignore value and clear top pending interrupt */
+    if (topei && wr_mask) {
+        topei >>= IMSIC_TOPEI_IID_SHIFT;
+        base = page * imsic->num_irqs;
+        if (topei) {
+            imsic->eistate[base + topei] &= ~IMSIC_EISTATE_PENDING;
+        }
+
+        riscv_imsic_update(imsic, page);
+    }
+
+    return 0;
+}
+
+static int riscv_imsic_eix_rmw(RISCVIMSICState *imsic,
+                               uint32_t xlen, uint32_t page,
+                               uint32_t num, bool pend, target_ulong *val,
+                               target_ulong new_val, target_ulong wr_mask)
+{
+    uint32_t i, base;
+    target_ulong mask;
+    uint32_t state = (pend) ? IMSIC_EISTATE_PENDING : IMSIC_EISTATE_ENABLED;
+
+    if (xlen != 32) {
+        if (num & 0x1) {
+            return -EINVAL;
+        }
+        num >>= 1;
+    }
+    if (num >= (imsic->num_irqs / xlen)) {
+        return -EINVAL;
+    }
+
+    base = (page * imsic->num_irqs) + (num * xlen);
+
+    if (val) {
+        *val = 0;
+        for (i = 0; i < xlen; i++) {
+            mask = (target_ulong)1 << i;
+            *val |= (imsic->eistate[base + i] & state) ? mask : 0;
+        }
+    }
+
+    for (i = 0; i < xlen; i++) {
+        /* Bit0 of eip0 and eie0 are read-only zero */
+        if (!num && !i) {
+            continue;
+        }
+
+        mask = (target_ulong)1 << i;
+        if (wr_mask & mask) {
+            if (new_val & mask) {
+                imsic->eistate[base + i] |= state;
+            } else {
+                imsic->eistate[base + i] &= ~state;
+            }
+        }
+    }
+
+    riscv_imsic_update(imsic, page);
+    return 0;
+}
+
+static int riscv_imsic_rmw(void *arg, target_ulong reg, target_ulong *val,
+                           target_ulong new_val, target_ulong wr_mask)
+{
+    RISCVIMSICState *imsic = arg;
+    uint32_t isel, priv, virt, vgein, xlen, page;
+
+    priv = AIA_IREG_PRIV(reg);
+    virt = AIA_IREG_VIRT(reg);
+    isel = AIA_IREG_ISEL(reg);
+    vgein = AIA_IREG_VGEIN(reg);
+    xlen = AIA_IREG_XLEN(reg);
+
+    if (imsic->mmode) {
+        if (priv == PRV_M && !virt) {
+            page = 0;
+        } else {
+            goto err;
+        }
+    } else {
+        if (priv == PRV_S) {
+            if (virt) {
+                if (vgein && vgein < imsic->num_pages) {
+                    page = vgein;
+                } else {
+                    goto err;
+                }
+            } else {
+                page = 0;
+            }
+        } else {
+            goto err;
+        }
+    }
+
+    switch (isel) {
+    case ISELECT_IMSIC_EIDELIVERY:
+        return riscv_imsic_eidelivery_rmw(imsic, page, val,
+                                          new_val, wr_mask);
+    case ISELECT_IMSIC_EITHRESHOLD:
+        return riscv_imsic_eithreshold_rmw(imsic, page, val,
+                                           new_val, wr_mask);
+    case ISELECT_IMSIC_TOPEI:
+        return riscv_imsic_topei_rmw(imsic, page, val, new_val, wr_mask);
+    case ISELECT_IMSIC_EIP0 ... ISELECT_IMSIC_EIP63:
+        return riscv_imsic_eix_rmw(imsic, xlen, page,
+                                   isel - ISELECT_IMSIC_EIP0,
+                                   true, val, new_val, wr_mask);
+    case ISELECT_IMSIC_EIE0 ... ISELECT_IMSIC_EIE63:
+        return riscv_imsic_eix_rmw(imsic, xlen, page,
+                                   isel - ISELECT_IMSIC_EIE0,
+                                   false, val, new_val, wr_mask);
+    default:
+        break;
+    };
+
+err:
+    qemu_log_mask(LOG_GUEST_ERROR,
+                  "%s: Invalid register priv=%d virt=%d isel=%d vgein=%d\n",
+                  __func__, priv, virt, isel, vgein);
+    return -EINVAL;
+}
+
+static uint64_t riscv_imsic_read(void *opaque, hwaddr addr, unsigned size)
+{
+    RISCVIMSICState *imsic = opaque;
+
+    /* Reads must be 4 byte words */
+    if ((addr & 0x3) != 0) {
+        goto err;
+    }
+
+    /* Reads cannot be out of range */
+    if (addr > IMSIC_MMIO_SIZE(imsic->num_pages)) {
+        goto err;
+    }
+
+    return 0;
+
+err:
+    qemu_log_mask(LOG_GUEST_ERROR,
+                  "%s: Invalid register read 0x%" HWADDR_PRIx "\n",
+                  __func__, addr);
+    return 0;
+}
+
+static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
+        unsigned size)
+{
+    RISCVIMSICState *imsic = opaque;
+    uint32_t page;
+
+    /* Writes must be 4 byte words */
+    if ((addr & 0x3) != 0) {
+        goto err;
+    }
+
+    /* Writes cannot be out of range */
+    if (addr > IMSIC_MMIO_SIZE(imsic->num_pages)) {
+        goto err;
+    }
+
+    /* Writes only supported for MSI little-endian registers */
+    page = addr >> IMSIC_MMIO_PAGE_SHIFT;
+    if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
+        if (value && (value < imsic->num_irqs)) {
+            imsic->eistate[(page * imsic->num_irqs) + value] |=
+                                                    IMSIC_EISTATE_PENDING;
+        }
+    }
+
+    /* Update CPU external interrupt status */
+    riscv_imsic_update(imsic, page);
+
+    return;
+
+err:
+    qemu_log_mask(LOG_GUEST_ERROR,
+                  "%s: Invalid register write 0x%" HWADDR_PRIx "\n",
+                  __func__, addr);
+}
+
+static const MemoryRegionOps riscv_imsic_ops = {
+    .read = riscv_imsic_read,
+    .write = riscv_imsic_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4
+    }
+};
+
+static void riscv_imsic_realize(DeviceState *dev, Error **errp)
+{
+    RISCVIMSICState *imsic = RISCV_IMSIC(dev);
+    RISCVCPU *rcpu = RISCV_CPU(qemu_get_cpu(imsic->hartid));
+    CPUState *cpu = qemu_get_cpu(imsic->hartid);
+    CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
+
+    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
+    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
+    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
+    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
+
+    memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
+                          imsic, TYPE_RISCV_IMSIC,
+                          IMSIC_MMIO_SIZE(imsic->num_pages));
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &imsic->mmio);
+
+    /* Claim the CPU interrupt to be triggered by this IMSIC */
+    if (riscv_cpu_claim_interrupts(rcpu,
+            (imsic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
+        error_setg(errp, "%s already claimed",
+                   (imsic->mmode) ? "MEIP" : "SEIP");
+        return;
+    }
+
+    /* Create output IRQ lines */
+    imsic->external_irqs = g_malloc(sizeof(qemu_irq) * imsic->num_pages);
+    qdev_init_gpio_out(dev, imsic->external_irqs, imsic->num_pages);
+
+    /* Force select AIA feature and setup CSR read-modify-write callback */
+    if (env) {
+        riscv_set_feature(env, RISCV_FEATURE_AIA);
+        if (!imsic->mmode) {
+            riscv_cpu_set_geilen(env, imsic->num_pages - 1);
+        }
+        riscv_cpu_set_aia_ireg_rmw_fn(env, (imsic->mmode) ? PRV_M : PRV_S,
+                                      riscv_imsic_rmw, imsic);
+    }
+
+    msi_nonbroken = true;
+}
+
+static Property riscv_imsic_properties[] = {
+    DEFINE_PROP_BOOL("mmode", RISCVIMSICState, mmode, 0),
+    DEFINE_PROP_UINT32("hartid", RISCVIMSICState, hartid, 0),
+    DEFINE_PROP_UINT32("num-pages", RISCVIMSICState, num_pages, 0),
+    DEFINE_PROP_UINT32("num-irqs", RISCVIMSICState, num_irqs, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static const VMStateDescription vmstate_riscv_imsic = {
+    .name = "riscv_imsic",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+            VMSTATE_VARRAY_UINT32(eidelivery, RISCVIMSICState,
+                                  num_pages, 0,
+                                  vmstate_info_uint32, uint32_t),
+            VMSTATE_VARRAY_UINT32(eithreshold, RISCVIMSICState,
+                                  num_pages, 0,
+                                  vmstate_info_uint32, uint32_t),
+            VMSTATE_VARRAY_UINT32(eistate, RISCVIMSICState,
+                                  num_eistate, 0,
+                                  vmstate_info_uint32, uint32_t),
+            VMSTATE_END_OF_LIST()
+        }
+};
+
+static void riscv_imsic_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    device_class_set_props(dc, riscv_imsic_properties);
+    dc->realize = riscv_imsic_realize;
+    dc->vmsd = &vmstate_riscv_imsic;
+}
+
+static const TypeInfo riscv_imsic_info = {
+    .name          = TYPE_RISCV_IMSIC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(RISCVIMSICState),
+    .class_init    = riscv_imsic_class_init,
+};
+
+static void riscv_imsic_register_types(void)
+{
+    type_register_static(&riscv_imsic_info);
+}
+
+type_init(riscv_imsic_register_types)
+
+/*
+ * Create IMSIC device.
+ */
+DeviceState *riscv_imsic_create(hwaddr addr, uint32_t hartid, bool mmode,
+                                uint32_t num_pages, uint32_t num_ids)
+{
+    DeviceState *dev = qdev_new(TYPE_RISCV_IMSIC);
+    CPUState *cpu = qemu_get_cpu(hartid);
+    uint32_t i;
+
+    assert(!(addr & (IMSIC_MMIO_PAGE_SZ - 1)));
+    if (mmode) {
+        assert(num_pages == 1);
+    } else {
+        assert(num_pages >= 1 && num_pages <= (IRQ_LOCAL_GUEST_MAX + 1));
+    }
+    assert(IMSIC_MIN_ID <= num_ids);
+    assert(num_ids <= IMSIC_MAX_ID);
+    assert((num_ids & IMSIC_MIN_ID) == IMSIC_MIN_ID);
+
+    qdev_prop_set_bit(dev, "mmode", mmode);
+    qdev_prop_set_uint32(dev, "hartid", hartid);
+    qdev_prop_set_uint32(dev, "num-pages", num_pages);
+    qdev_prop_set_uint32(dev, "num-irqs", num_ids + 1);
+
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+
+    for (i = 0; i < num_pages; i++) {
+        if (!i) {
+            qdev_connect_gpio_out_named(dev, NULL, i,
+                                        qdev_get_gpio_in(DEVICE(cpu),
+                                            (mmode) ? IRQ_M_EXT : IRQ_S_EXT));
+        } else {
+            qdev_connect_gpio_out_named(dev, NULL, i,
+                                        qdev_get_gpio_in(DEVICE(cpu),
+                                            IRQ_LOCAL_MAX + i - 1));
+        }
+    }
+
+    return dev;
+}
diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_ACLINT
 config RISCV_APLIC
     bool
 
+config RISCV_IMSIC
+    bool
+
 config SIFIVE_PLIC
     bool
 
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ specific_ss.add(when: 'CONFIG_S390_FLIC_KVM', if_true: files('s390_flic_kvm.c'))
 specific_ss.add(when: 'CONFIG_SH_INTC', if_true: files('sh_intc.c'))
 specific_ss.add(when: 'CONFIG_RISCV_ACLINT', if_true: files('riscv_aclint.c'))
 specific_ss.add(when: 'CONFIG_RISCV_APLIC', if_true: files('riscv_aplic.c'))
+specific_ss.add(when: 'CONFIG_RISCV_IMSIC', if_true: files('riscv_imsic.c'))
 specific_ss.add(when: 'CONFIG_SIFIVE_PLIC', if_true: files('sifive_plic.c'))
 specific_ss.add(when: 'CONFIG_XICS', if_true: files('xics.c', 'xive2.c'))
 specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_XICS'],
-- 
2.35.1

From: Anup Patel <anup.patel@wdc.com>

We extend virt machine to emulate both AIA IMSIC and AIA APLIC
devices only when "aia=aplic-imsic" parameter is passed along
with machine name in the QEMU command-line. The AIA IMSIC is
only a per-HART MSI controller so we use AIA APLIC in MSI-mode
to forward all wired interrupts as MSIs to the AIA IMSIC.

We also provide "aia-guests=<xyz>" parameter which can be used
to specify number of VS-level AIA IMSIC Guests MMIO pages for
each HART.

Signed-off-by: Anup Patel <anup.patel@wdc.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220220085526.808674-4-anup@brainfault.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h |  17 +-
 hw/riscv/virt.c         | 439 ++++++++++++++++++++++++++++++++--------
 hw/riscv/Kconfig        |   1 +
 3 files changed, 373 insertions(+), 84 deletions(-)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/block/flash.h"
 #include "qom/object.h"
 
-#define VIRT_CPUS_MAX 32
-#define VIRT_SOCKETS_MAX 8
+#define VIRT_CPUS_MAX_BITS             3
+#define VIRT_CPUS_MAX                  (1 << VIRT_CPUS_MAX_BITS)
+#define VIRT_SOCKETS_MAX_BITS          2
+#define VIRT_SOCKETS_MAX               (1 << VIRT_SOCKETS_MAX_BITS)
 
 #define TYPE_RISCV_VIRT_MACHINE MACHINE_TYPE_NAME("virt")
 typedef struct RISCVVirtState RISCVVirtState;
@@ -XXX,XX +XXX,XX @@ DECLARE_INSTANCE_CHECKER(RISCVVirtState, RISCV_VIRT_MACHINE,
 typedef enum RISCVVirtAIAType {
     VIRT_AIA_TYPE_NONE = 0,
     VIRT_AIA_TYPE_APLIC,
+    VIRT_AIA_TYPE_APLIC_IMSIC,
 } RISCVVirtAIAType;
 
 struct RISCVVirtState {
@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
     int fdt_size;
     bool have_aclint;
     RISCVVirtAIAType aia_type;
+    int aia_guests;
 };
 
 enum {
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_UART0,
     VIRT_VIRTIO,
     VIRT_FW_CFG,
+    VIRT_IMSIC_M,
+    VIRT_IMSIC_S,
     VIRT_FLASH,
     VIRT_DRAM,
     VIRT_PCIE_MMIO,
@@ -XXX,XX +XXX,XX @@ enum {
     VIRTIO_NDEV = 0x35 /* Arbitrary maximum number of interrupts */
 };
 
-#define VIRT_IRQCHIP_NUM_SOURCES 127
+#define VIRT_IRQCHIP_IPI_MSI 1
+#define VIRT_IRQCHIP_NUM_MSIS 255
+#define VIRT_IRQCHIP_NUM_SOURCES VIRTIO_NDEV
 #define VIRT_IRQCHIP_NUM_PRIO_BITS 3
+#define VIRT_IRQCHIP_MAX_GUESTS_BITS 3
+#define VIRT_IRQCHIP_MAX_GUESTS ((1U << VIRT_IRQCHIP_MAX_GUESTS_BITS) - 1U)
 
 #define VIRT_PLIC_PRIORITY_BASE 0x04
 #define VIRT_PLIC_PENDING_BASE 0x1000
@@ -XXX,XX +XXX,XX @@ enum {
 #define FDT_PCI_INT_CELLS     1
 #define FDT_PLIC_INT_CELLS    1
 #define FDT_APLIC_INT_CELLS   2
+#define FDT_IMSIC_INT_CELLS   0
 #define FDT_MAX_INT_CELLS     2
 #define FDT_MAX_INT_MAP_WIDTH (FDT_PCI_ADDR_CELLS + FDT_PCI_INT_CELLS + \
                                  1 + FDT_MAX_INT_CELLS)
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/numa.h"
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/riscv_aplic.h"
+#include "hw/intc/riscv_imsic.h"
 #include "hw/intc/sifive_plic.h"
 #include "hw/misc/sifive_test.h"
 #include "chardev/char.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/pci-host/gpex.h"
 #include "hw/display/ramfb.h"
 
+#define VIRT_IMSIC_GROUP_MAX_SIZE      (1U << IMSIC_MMIO_GROUP_MIN_SHIFT)
+#if VIRT_IMSIC_GROUP_MAX_SIZE < \
+    IMSIC_GROUP_SIZE(VIRT_CPUS_MAX_BITS, VIRT_IRQCHIP_MAX_GUESTS_BITS)
+#error "Can't accomodate single IMSIC group in address space"
+#endif
+
+#define VIRT_IMSIC_MAX_SIZE            (VIRT_SOCKETS_MAX * \
+                                        VIRT_IMSIC_GROUP_MAX_SIZE)
+#if 0x4000000 < VIRT_IMSIC_MAX_SIZE
+#error "Can't accomodate all IMSIC groups in address space"
+#endif
+
 static const MemMapEntry virt_memmap[] = {
     [VIRT_DEBUG] =       {        0x0,         0x100 },
     [VIRT_MROM] =        {     0x1000,        0xf000 },
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry virt_memmap[] = {
     [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
     [VIRT_FW_CFG] =      { 0x10100000,          0x18 },
     [VIRT_FLASH] =       { 0x20000000,     0x4000000 },
+    [VIRT_IMSIC_M] =     { 0x24000000, VIRT_IMSIC_MAX_SIZE },
+    [VIRT_IMSIC_S] =     { 0x28000000, VIRT_IMSIC_MAX_SIZE },
     [VIRT_PCIE_ECAM] =   { 0x30000000,    0x10000000 },
     [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
     [VIRT_DRAM] =        { 0x80000000,           0x0 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
 {
     int cpu;
     char *name;
-    unsigned long addr;
+    unsigned long addr, size;
     uint32_t aclint_cells_size;
     uint32_t *aclint_mswi_cells;
     uint32_t *aclint_sswi_cells;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
     }
     aclint_cells_size = s->soc[socket].num_harts * sizeof(uint32_t) * 2;
 
-    addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
-    name = g_strdup_printf("/soc/mswi@%lx", addr);
-    qemu_fdt_add_subnode(mc->fdt, name);
-    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "riscv,aclint-mswi");
-    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
-        0x0, addr, 0x0, RISCV_ACLINT_SWI_SIZE);
-    qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
-        aclint_mswi_cells, aclint_cells_size);
-    qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
-    riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
-    g_free(name);
+    if (s->aia_type != VIRT_AIA_TYPE_APLIC_IMSIC) {
+        addr = memmap[VIRT_CLINT].base + (memmap[VIRT_CLINT].size * socket);
+        name = g_strdup_printf("/soc/mswi@%lx", addr);
+        qemu_fdt_add_subnode(mc->fdt, name);
+        qemu_fdt_setprop_string(mc->fdt, name, "compatible",
+            "riscv,aclint-mswi");
+        qemu_fdt_setprop_cells(mc->fdt, name, "reg",
+            0x0, addr, 0x0, RISCV_ACLINT_SWI_SIZE);
+        qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
+            aclint_mswi_cells, aclint_cells_size);
+        qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
+        qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
+        riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
+        g_free(name);
+    }
 
-    addr = memmap[VIRT_CLINT].base + RISCV_ACLINT_SWI_SIZE +
-        (memmap[VIRT_CLINT].size * socket);
+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
+        addr = memmap[VIRT_CLINT].base +
+               (RISCV_ACLINT_DEFAULT_MTIMER_SIZE * socket);
+        size = RISCV_ACLINT_DEFAULT_MTIMER_SIZE;
+    } else {
+        addr = memmap[VIRT_CLINT].base + RISCV_ACLINT_SWI_SIZE +
+            (memmap[VIRT_CLINT].size * socket);
+        size = memmap[VIRT_CLINT].size - RISCV_ACLINT_SWI_SIZE;
+    }
     name = g_strdup_printf("/soc/mtimer@%lx", addr);
     qemu_fdt_add_subnode(mc->fdt, name);
     qemu_fdt_setprop_string(mc->fdt, name, "compatible",
         "riscv,aclint-mtimer");
     qemu_fdt_setprop_cells(mc->fdt, name, "reg",
         0x0, addr + RISCV_ACLINT_DEFAULT_MTIME,
-        0x0, memmap[VIRT_CLINT].size - RISCV_ACLINT_SWI_SIZE -
-             RISCV_ACLINT_DEFAULT_MTIME,
+        0x0, size - RISCV_ACLINT_DEFAULT_MTIME,
         0x0, addr + RISCV_ACLINT_DEFAULT_MTIMECMP,
         0x0, RISCV_ACLINT_DEFAULT_MTIME);
     qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aclint(RISCVVirtState *s,
     riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
     g_free(name);
 
-    addr = memmap[VIRT_ACLINT_SSWI].base +
-        (memmap[VIRT_ACLINT_SSWI].size * socket);
-    name = g_strdup_printf("/soc/sswi@%lx", addr);
-    qemu_fdt_add_subnode(mc->fdt, name);
-    qemu_fdt_setprop_string(mc->fdt, name, "compatible", "riscv,aclint-sswi");
-    qemu_fdt_setprop_cells(mc->fdt, name, "reg",
-        0x0, addr, 0x0, memmap[VIRT_ACLINT_SSWI].size);
-    qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
-        aclint_sswi_cells, aclint_cells_size);
-    qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
-    riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
-    g_free(name);
+    if (s->aia_type != VIRT_AIA_TYPE_APLIC_IMSIC) {
+        addr = memmap[VIRT_ACLINT_SSWI].base +
+            (memmap[VIRT_ACLINT_SSWI].size * socket);
+        name = g_strdup_printf("/soc/sswi@%lx", addr);
+        qemu_fdt_add_subnode(mc->fdt, name);
+        qemu_fdt_setprop_string(mc->fdt, name, "compatible",
+            "riscv,aclint-sswi");
+        qemu_fdt_setprop_cells(mc->fdt, name, "reg",
+            0x0, addr, 0x0, memmap[VIRT_ACLINT_SSWI].size);
+        qemu_fdt_setprop(mc->fdt, name, "interrupts-extended",
+            aclint_sswi_cells, aclint_cells_size);
+        qemu_fdt_setprop(mc->fdt, name, "interrupt-controller", NULL, 0);
+        qemu_fdt_setprop_cell(mc->fdt, name, "#interrupt-cells", 0);
+        riscv_socket_fdt_write_id(mc, mc->fdt, name, socket);
+        g_free(name);
+    }
 
     g_free(aclint_mswi_cells);
     g_free(aclint_mtimer_cells);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
     g_free(plic_cells);
 }
 
-static void create_fdt_socket_aia(RISCVVirtState *s,
-                                  const MemMapEntry *memmap, int socket,
-                                  uint32_t *phandle, uint32_t *intc_phandles,
-                                  uint32_t *aplic_phandles)
+static uint32_t imsic_num_bits(uint32_t count)
+{
+    uint32_t ret = 0;
+
+    while (BIT(ret) < count) {
+        ret++;
+    }
+
+    return ret;
+}
+
+static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
+                             uint32_t *phandle, uint32_t *intc_phandles,
+                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
+{
+    int cpu, socket;
+    char *imsic_name;
+    MachineState *mc = MACHINE(s);
+    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
+    uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
+
+    *msi_m_phandle = (*phandle)++;
+    *msi_s_phandle = (*phandle)++;
+    imsic_cells = g_new0(uint32_t, mc->smp.cpus * 2);
+    imsic_regs = g_new0(uint32_t, riscv_socket_count(mc) * 4);
+
+    /* M-level IMSIC node */
+    for (cpu = 0; cpu < mc->smp.cpus; cpu++) {
+        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+    }
+    imsic_max_hart_per_socket = 0;
+    for (socket = 0; socket < riscv_socket_count(mc); socket++) {
+        imsic_addr = memmap[VIRT_IMSIC_M].base +
+                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
+        imsic_regs[socket * 4 + 0] = 0;
+        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
+        imsic_regs[socket * 4 + 2] = 0;
+        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
+        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
+            imsic_max_hart_per_socket = s->soc[socket].num_harts;
+        }
+    }
+    imsic_name = g_strdup_printf("/soc/imsics@%lx",
+        (unsigned long)memmap[VIRT_IMSIC_M].base);
+    qemu_fdt_add_subnode(mc->fdt, imsic_name);
+    qemu_fdt_setprop_string(mc->fdt, imsic_name, "compatible",
+        "riscv,imsics");
+    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "#interrupt-cells",
+        FDT_IMSIC_INT_CELLS);
+    qemu_fdt_setprop(mc->fdt, imsic_name, "interrupt-controller",
+        NULL, 0);
+    qemu_fdt_setprop(mc->fdt, imsic_name, "msi-controller",
+        NULL, 0);
+    qemu_fdt_setprop(mc->fdt, imsic_name, "interrupts-extended",
+        imsic_cells, mc->smp.cpus * sizeof(uint32_t) * 2);
+    qemu_fdt_setprop(mc->fdt, imsic_name, "reg", imsic_regs,
+        riscv_socket_count(mc) * sizeof(uint32_t) * 4);
+    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,num-ids",
+        VIRT_IRQCHIP_NUM_MSIS);
+    qemu_fdt_setprop_cells(mc->fdt, imsic_name, "riscv,ipi-id",
+        VIRT_IRQCHIP_IPI_MSI);
+    if (riscv_socket_count(mc) > 1) {
+        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,hart-index-bits",
+            imsic_num_bits(imsic_max_hart_per_socket));
+        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,group-index-bits",
+            imsic_num_bits(riscv_socket_count(mc)));
+        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,group-index-shift",
+            IMSIC_MMIO_GROUP_MIN_SHIFT);
+    }
+    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "phandle", *msi_m_phandle);
+    g_free(imsic_name);
+
+    /* S-level IMSIC node */
+    for (cpu = 0; cpu < mc->smp.cpus; cpu++) {
+        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
+    }
+    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
+    imsic_max_hart_per_socket = 0;
+    for (socket = 0; socket < riscv_socket_count(mc); socket++) {
+        imsic_addr = memmap[VIRT_IMSIC_S].base +
+                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+        imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
+                     s->soc[socket].num_harts;
+        imsic_regs[socket * 4 + 0] = 0;
+        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
+        imsic_regs[socket * 4 + 2] = 0;
+        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
+        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
+            imsic_max_hart_per_socket = s->soc[socket].num_harts;
+        }
+    }
+    imsic_name = g_strdup_printf("/soc/imsics@%lx",
+        (unsigned long)memmap[VIRT_IMSIC_S].base);
+    qemu_fdt_add_subnode(mc->fdt, imsic_name);
+    qemu_fdt_setprop_string(mc->fdt, imsic_name, "compatible",
+        "riscv,imsics");
+    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "#interrupt-cells",
+        FDT_IMSIC_INT_CELLS);
+    qemu_fdt_setprop(mc->fdt, imsic_name, "interrupt-controller",
+        NULL, 0);
+    qemu_fdt_setprop(mc->fdt, imsic_name, "msi-controller",
+        NULL, 0);
+    qemu_fdt_setprop(mc->fdt, imsic_name, "interrupts-extended",
+        imsic_cells, mc->smp.cpus * sizeof(uint32_t) * 2);
+    qemu_fdt_setprop(mc->fdt, imsic_name, "reg", imsic_regs,
+        riscv_socket_count(mc) * sizeof(uint32_t) * 4);
+    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,num-ids",
+        VIRT_IRQCHIP_NUM_MSIS);
+    qemu_fdt_setprop_cells(mc->fdt, imsic_name, "riscv,ipi-id",
+        VIRT_IRQCHIP_IPI_MSI);
+    if (imsic_guest_bits) {
+        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,guest-index-bits",
+            imsic_guest_bits);
+    }
+    if (riscv_socket_count(mc) > 1) {
+        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,hart-index-bits",
+            imsic_num_bits(imsic_max_hart_per_socket));
+        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,group-index-bits",
+            imsic_num_bits(riscv_socket_count(mc)));
+        qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,group-index-shift",
+            IMSIC_MMIO_GROUP_MIN_SHIFT);
+    }
+    qemu_fdt_setprop_cell(mc->fdt, imsic_name, "phandle", *msi_s_phandle);
+    g_free(imsic_name);
+
+    g_free(imsic_regs);
+    g_free(imsic_cells);
+}
+
+static void create_fdt_socket_aplic(RISCVVirtState *s,
+                                    const MemMapEntry *memmap, int socket,
+                                    uint32_t msi_m_phandle,
+                                    uint32_t msi_s_phandle,
+                                    uint32_t *phandle,
+                                    uint32_t *intc_phandles,
+                                    uint32_t *aplic_phandles)
 {
     int cpu;
     char *aplic_name;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aia(RISCVVirtState *s,
     qemu_fdt_setprop_cell(mc->fdt, aplic_name,
         "#interrupt-cells", FDT_APLIC_INT_CELLS);
     qemu_fdt_setprop(mc->fdt, aplic_name, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
-        aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
+        qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
+            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+    } else {
+        qemu_fdt_setprop_cell(mc->fdt, aplic_name, "msi-parent",
+            msi_m_phandle);
+    }
     qemu_fdt_setprop_cells(mc->fdt, aplic_name, "reg",
         0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
     qemu_fdt_setprop_cell(mc->fdt, aplic_name, "riscv,num-sources",
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aia(RISCVVirtState *s,
     qemu_fdt_setprop_cell(mc->fdt, aplic_name,
         "#interrupt-cells", FDT_APLIC_INT_CELLS);
     qemu_fdt_setprop(mc->fdt, aplic_name, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
-        aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
+        qemu_fdt_setprop(mc->fdt, aplic_name, "interrupts-extended",
+            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+    } else {
+        qemu_fdt_setprop_cell(mc->fdt, aplic_name, "msi-parent",
+            msi_s_phandle);
+    }
     qemu_fdt_setprop_cells(mc->fdt, aplic_name, "reg",
         0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
     qemu_fdt_setprop_cell(mc->fdt, aplic_name, "riscv,num-sources",
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
                                bool is_32_bit, uint32_t *phandle,
                                uint32_t *irq_mmio_phandle,
                                uint32_t *irq_pcie_phandle,
-                               uint32_t *irq_virtio_phandle)
+                               uint32_t *irq_virtio_phandle,
+                               uint32_t *msi_pcie_phandle)
 {
-    int socket;
     char *clust_name;
-    uint32_t *intc_phandles;
+    int socket, phandle_pos;
     MachineState *mc = MACHINE(s);
-    uint32_t xplic_phandles[MAX_NODES];
+    uint32_t msi_m_phandle = 0, msi_s_phandle = 0;
+    uint32_t *intc_phandles, xplic_phandles[MAX_NODES];
 
     qemu_fdt_add_subnode(mc->fdt, "/cpus");
     qemu_fdt_setprop_cell(mc->fdt, "/cpus", "timebase-frequency",
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
     qemu_fdt_setprop_cell(mc->fdt, "/cpus", "#address-cells", 0x1);
     qemu_fdt_add_subnode(mc->fdt, "/cpus/cpu-map");
 
+    intc_phandles = g_new0(uint32_t, mc->smp.cpus);
+
+    phandle_pos = mc->smp.cpus;
     for (socket = (riscv_socket_count(mc) - 1); socket >= 0; socket--) {
+        phandle_pos -= s->soc[socket].num_harts;
+
         clust_name = g_strdup_printf("/cpus/cpu-map/cluster%d", socket);
         qemu_fdt_add_subnode(mc->fdt, clust_name);
 
-        intc_phandles = g_new0(uint32_t, s->soc[socket].num_harts);
-
         create_fdt_socket_cpus(s, socket, clust_name, phandle,
-            is_32_bit, intc_phandles);
+            is_32_bit, &intc_phandles[phandle_pos]);
 
         create_fdt_socket_memory(s, memmap, socket);
 
+        g_free(clust_name);
+
         if (!kvm_enabled()) {
             if (s->have_aclint) {
-                create_fdt_socket_aclint(s, memmap, socket, intc_phandles);
+                create_fdt_socket_aclint(s, memmap, socket,
+                    &intc_phandles[phandle_pos]);
             } else {
-                create_fdt_socket_clint(s, memmap, socket, intc_phandles);
+                create_fdt_socket_clint(s, memmap, socket,
+                    &intc_phandles[phandle_pos]);
             }
         }
+    }
+
+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
+        create_fdt_imsic(s, memmap, phandle, intc_phandles,
+            &msi_m_phandle, &msi_s_phandle);
+        *msi_pcie_phandle = msi_s_phandle;
+    }
+
+    phandle_pos = mc->smp.cpus;
+    for (socket = (riscv_socket_count(mc) - 1); socket >= 0; socket--) {
+        phandle_pos -= s->soc[socket].num_harts;
 
         if (s->aia_type == VIRT_AIA_TYPE_NONE) {
             create_fdt_socket_plic(s, memmap, socket, phandle,
-                intc_phandles, xplic_phandles);
+                &intc_phandles[phandle_pos], xplic_phandles);
         } else {
-            create_fdt_socket_aia(s, memmap, socket, phandle,
-                intc_phandles, xplic_phandles);
+            create_fdt_socket_aplic(s, memmap, socket,
+                msi_m_phandle, msi_s_phandle, phandle,
+                &intc_phandles[phandle_pos], xplic_phandles);
         }
-
-        g_free(intc_phandles);
-        g_free(clust_name);
     }
 
+    g_free(intc_phandles);
+
     for (socket = 0; socket < riscv_socket_count(mc); socket++) {
         if (socket == 0) {
             *irq_mmio_phandle = xplic_phandles[socket];
@@ -XXX,XX +XXX,XX @@ static void create_fdt_virtio(RISCVVirtState *s, const MemMapEntry *memmap,
 }
 
 static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
-                            uint32_t irq_pcie_phandle)
+                            uint32_t irq_pcie_phandle,
+                            uint32_t msi_pcie_phandle)
 {
     char *name;
     MachineState *mc = MACHINE(s);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_pcie(RISCVVirtState *s, const MemMapEntry *memmap,
     qemu_fdt_setprop_cells(mc->fdt, name, "bus-range", 0,
         memmap[VIRT_PCIE_ECAM].size / PCIE_MMCFG_SIZE_MIN - 1);
     qemu_fdt_setprop(mc->fdt, name, "dma-coherent", NULL, 0);
+    if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
+        qemu_fdt_setprop_cell(mc->fdt, name, "msi-parent", msi_pcie_phandle);
+    }
     qemu_fdt_setprop_cells(mc->fdt, name, "reg", 0,
         memmap[VIRT_PCIE_ECAM].base, 0, memmap[VIRT_PCIE_ECAM].size);
     qemu_fdt_setprop_sized_cells(mc->fdt, name, "ranges",
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
                        uint64_t mem_size, const char *cmdline, bool is_32_bit)
 {
     MachineState *mc = MACHINE(s);
-    uint32_t phandle = 1, irq_mmio_phandle = 1;
+    uint32_t phandle = 1, irq_mmio_phandle = 1, msi_pcie_phandle = 1;
     uint32_t irq_pcie_phandle = 1, irq_virtio_phandle = 1;
 
     if (mc->dtb) {
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
     qemu_fdt_setprop_cell(mc->fdt, "/soc", "#address-cells", 0x2);
 
     create_fdt_sockets(s, memmap, is_32_bit, &phandle,
-        &irq_mmio_phandle, &irq_pcie_phandle, &irq_virtio_phandle);
+        &irq_mmio_phandle, &irq_pcie_phandle, &irq_virtio_phandle,
+        &msi_pcie_phandle);
 
     create_fdt_virtio(s, memmap, irq_virtio_phandle);
 
-    create_fdt_pcie(s, memmap, irq_pcie_phandle);
+    create_fdt_pcie(s, memmap, irq_pcie_phandle, msi_pcie_phandle);
 
     create_fdt_reset(s, memmap, &phandle);
 
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_plic(const MemMapEntry *memmap, int socket,
     return ret;
 }
 
-static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type,
+static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
                                     const MemMapEntry *memmap, int socket,
                                     int base_hartid, int hart_count)
 {
+    int i;
+    hwaddr addr;
+    uint32_t guest_bits;
     DeviceState *aplic_m;
+    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
+
+    if (msimode) {
+        /* Per-socket M-level IMSICs */
+        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+        for (i = 0; i < hart_count; i++) {
+            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
+                               base_hartid + i, true, 1,
+                               VIRT_IRQCHIP_NUM_MSIS);
+        }
+
+        /* Per-socket S-level IMSICs */
+        guest_bits = imsic_num_bits(aia_guests + 1);
+        addr = memmap[VIRT_IMSIC_S].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+        for (i = 0; i < hart_count; i++) {
+            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(guest_bits),
+                               base_hartid + i, false, 1 + aia_guests,
+                               VIRT_IRQCHIP_NUM_MSIS);
+        }
+    }
 
     /* Per-socket M-level APLIC */
     aplic_m = riscv_aplic_create(
         memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
         memmap[VIRT_APLIC_M].size,
-        base_hartid, hart_count,
+        (msimode) ? 0 : base_hartid,
+        (msimode) ? 0 : hart_count,
         VIRT_IRQCHIP_NUM_SOURCES,
         VIRT_IRQCHIP_NUM_PRIO_BITS,
-        false, true, NULL);
+        msimode, true, NULL);
 
     if (aplic_m) {
         /* Per-socket S-level APLIC */
         riscv_aplic_create(
             memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
             memmap[VIRT_APLIC_S].size,
-            base_hartid, hart_count,
+            (msimode) ? 0 : base_hartid,
+            (msimode) ? 0 : hart_count,
             VIRT_IRQCHIP_NUM_SOURCES,
             VIRT_IRQCHIP_NUM_PRIO_BITS,
-            false, false, aplic_m);
+            msimode, false, aplic_m);
     }
 
     return aplic_m;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         sysbus_realize(SYS_BUS_DEVICE(&s->soc[i]), &error_abort);
 
         if (!kvm_enabled()) {
-            /* Per-socket CLINT */
-            riscv_aclint_swi_create(
-                memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
-                base_hartid, hart_count, false);
-            riscv_aclint_mtimer_create(
-                memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size +
-                    RISCV_ACLINT_SWI_SIZE,
-                RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
-                RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
-                RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
-
-            /* Per-socket ACLINT SSWI */
             if (s->have_aclint) {
+                if (s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) {
+                    /* Per-socket ACLINT MTIMER */
+                    riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
+                            i * RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
+                        RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
+                        base_hartid, hart_count,
+                        RISCV_ACLINT_DEFAULT_MTIMECMP,
+                        RISCV_ACLINT_DEFAULT_MTIME,
+                        RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
+                } else {
+                    /* Per-socket ACLINT MSWI, MTIMER, and SSWI */
+                    riscv_aclint_swi_create(memmap[VIRT_CLINT].base +
+                            i * memmap[VIRT_CLINT].size,
+                        base_hartid, hart_count, false);
+                    riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
+                            i * memmap[VIRT_CLINT].size +
+                            RISCV_ACLINT_SWI_SIZE,
+                        RISCV_ACLINT_DEFAULT_MTIMER_SIZE,
+                        base_hartid, hart_count,
+                        RISCV_ACLINT_DEFAULT_MTIMECMP,
+                        RISCV_ACLINT_DEFAULT_MTIME,
+                        RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
+                    riscv_aclint_swi_create(memmap[VIRT_ACLINT_SSWI].base +
+                            i * memmap[VIRT_ACLINT_SSWI].size,
+                        base_hartid, hart_count, true);
+                }
+            } else {
+                /* Per-socket SiFive CLINT */
                 riscv_aclint_swi_create(
-                    memmap[VIRT_ACLINT_SSWI].base +
-                        i * memmap[VIRT_ACLINT_SSWI].size,
-                    base_hartid, hart_count, true);
+                    memmap[VIRT_CLINT].base + i * memmap[VIRT_CLINT].size,
+                    base_hartid, hart_count, false);
+                riscv_aclint_mtimer_create(memmap[VIRT_CLINT].base +
+                        i * memmap[VIRT_CLINT].size + RISCV_ACLINT_SWI_SIZE,
+                    RISCV_ACLINT_DEFAULT_MTIMER_SIZE, base_hartid, hart_count,
+                    RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
+                    RISCV_ACLINT_DEFAULT_TIMEBASE_FREQ, true);
             }
         }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
             s->irqchip[i] = virt_create_plic(memmap, i,
                                              base_hartid, hart_count);
         } else {
-            s->irqchip[i] = virt_create_aia(s->aia_type, memmap, i,
-                                            base_hartid, hart_count);
+            s->irqchip[i] = virt_create_aia(s->aia_type, s->aia_guests,
+                                            memmap, i, base_hartid,
+                                            hart_count);
         }
 
         /* Try to use different IRQCHIP instance based device type */
@@ -XXX,XX +XXX,XX @@ static void virt_machine_instance_init(Object *obj)
 {
 }
 
+static char *virt_get_aia_guests(Object *obj, Error **errp)
+{
+    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
+    char val[32];
+
+    sprintf(val, "%d", s->aia_guests);
+    return g_strdup(val);
+}
+
+static void virt_set_aia_guests(Object *obj, const char *val, Error **errp)
+{
+    RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
+
+    s->aia_guests = atoi(val);
+    if (s->aia_guests < 0 || s->aia_guests > VIRT_IRQCHIP_MAX_GUESTS) {
+        error_setg(errp, "Invalid number of AIA IMSIC guests");
+        error_append_hint(errp, "Valid values be between 0 and %d.\n",
+                          VIRT_IRQCHIP_MAX_GUESTS);
+    }
+}
+
 static char *virt_get_aia(Object *obj, Error **errp)
 {
     RISCVVirtState *s = RISCV_VIRT_MACHINE(obj);
@@ -XXX,XX +XXX,XX @@ static char *virt_get_aia(Object *obj, Error **errp)
     case VIRT_AIA_TYPE_APLIC:
         val = "aplic";
         break;
+    case VIRT_AIA_TYPE_APLIC_IMSIC:
+        val = "aplic-imsic";
+        break;
     default:
         val = "none";
         break;
@@ -XXX,XX +XXX,XX @@ static void virt_set_aia(Object *obj, const char *val, Error **errp)
         s->aia_type = VIRT_AIA_TYPE_NONE;
     } else if (!strcmp(val, "aplic")) {
         s->aia_type = VIRT_AIA_TYPE_APLIC;
+    } else if (!strcmp(val, "aplic-imsic")) {
+        s->aia_type = VIRT_AIA_TYPE_APLIC_IMSIC;
     } else {
         error_setg(errp, "Invalid AIA interrupt controller type");
-        error_append_hint(errp, "Valid values are none, and aplic.\n");
+        error_append_hint(errp, "Valid values are none, aplic, and "
+                          "aplic-imsic.\n");
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void virt_set_aclint(Object *obj, bool value, Error **errp)
 
 static void virt_machine_class_init(ObjectClass *oc, void *data)
 {
+    char str[128];
     MachineClass *mc = MACHINE_CLASS(oc);
 
     mc->desc = "RISC-V VirtIO board";
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     object_class_property_set_description(oc, "aia",
                                           "Set type of AIA interrupt "
                                           "conttoller. Valid values are "
-                                          "none, and aplic.");
+                                          "none, aplic, and aplic-imsic.");
+
+    object_class_property_add_str(oc, "aia-guests",
+                                  virt_get_aia_guests,
+                                  virt_set_aia_guests);
+    sprintf(str, "Set number of guest MMIO pages for AIA IMSIC. Valid value "
+                 "should be between 0 and %d.", VIRT_IRQCHIP_MAX_GUESTS);
+    object_class_property_set_description(oc, "aia-guests", str);
 }
 
 static const TypeInfo virt_machine_typeinfo = {
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select SERIAL
     select RISCV_ACLINT
     select RISCV_APLIC
+    select RISCV_IMSIC
     select SIFIVE_PLIC
     select SIFIVE_TEST
     select VIRTIO_MMIO
-- 
2.35.1

From: Anup Patel <anup.patel@wdc.com>

We have two new machine options "aia" and "aia-guests" available
for the RISC-V virt machine so let's document these options.

Signed-off-by: Anup Patel <anup.patel@wdc.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-Id: <20220220085526.808674-5-anup@brainfault.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/virt.rst | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ The following machine-specific options are supported:
   When this option is "on", ACLINT devices will be emulated instead of
   SiFive CLINT. When not specified, this option is assumed to be "off".
 
+- aia=[none|aplic|aplic-imsic]
+
+  This option allows selecting interrupt controller defined by the AIA
+  (advanced interrupt architecture) specification. The "aia=aplic" selects
+  APLIC (advanced platform level interrupt controller) to handle wired
+  interrupts whereas the "aia=aplic-imsic" selects APLIC and IMSIC (incoming
+  message signaled interrupt controller) to handle both wired interrupts and
+  MSIs. When not specified, this option is assumed to be "none" which selects
+  SiFive PLIC to handle wired interrupts.
+
+- aia-guests=nnn
+
+  The number of per-HART VS-level AIA IMSIC pages to be emulated for a guest
+  having AIA IMSIC (i.e. "aia=aplic-imsic" selected). When not specified,
+  the default number of per-HART VS-level AIA IMSIC pages is 0.
+
 Running Linux kernel
 --------------------
 
-- 
2.35.1

From: Anup Patel <anup.patel@wdc.com>

To facilitate software development of RISC-V systems with large number
of HARTs, we increase the maximum number of allowed CPUs to 512 (2^9).

We also add a detailed source level comments about limit defines which
impact the physical address space utilization.

Signed-off-by: Anup Patel <anup.patel@wdc.com>
Signed-off-by: Anup Patel <anup@brainfault.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-Id: <20220220085526.808674-6-anup@brainfault.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h |  2 +-
 hw/riscv/virt.c         | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

This patch updates the SPI_DEVICE, SPI_HOST0, SPI_HOST1
base addresses. Also adds these as unimplemented devices.

The address references can be found [1].

[1] https://github.com/lowRISC/opentitan/blob/6c317992fbd646818b34f2a2dbf44bc850e461e4/hw/top_earlgrey/sw/autogen/top_earlgrey_memory.h#L107

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20220218063839.405082-1-alistair.francis@opensource.wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/opentitan.h |  4 +++-
 hw/riscv/opentitan.c         | 12 +++++++++---
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/include/hw/riscv/opentitan.h b/include/hw/riscv/opentitan.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/opentitan.h
+++ b/include/hw/riscv/opentitan.h
@@ -XXX,XX +XXX,XX @@ enum {
     IBEX_DEV_FLASH,
     IBEX_DEV_FLASH_VIRTUAL,
     IBEX_DEV_UART,
+    IBEX_DEV_SPI_DEVICE,
+    IBEX_DEV_SPI_HOST0,
+    IBEX_DEV_SPI_HOST1,
     IBEX_DEV_GPIO,
-    IBEX_DEV_SPI,
     IBEX_DEV_I2C,
     IBEX_DEV_PATTGEN,
     IBEX_DEV_TIMER,
diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry ibex_memmap[] = {
     [IBEX_DEV_FLASH] =          {  0x20000000,  0x80000 },
     [IBEX_DEV_UART] =           {  0x40000000,  0x1000  },
     [IBEX_DEV_GPIO] =           {  0x40040000,  0x1000  },
-    [IBEX_DEV_SPI] =            {  0x40050000,  0x1000  },
+    [IBEX_DEV_SPI_DEVICE] =     {  0x40050000,  0x1000  },
     [IBEX_DEV_I2C] =            {  0x40080000,  0x1000  },
     [IBEX_DEV_PATTGEN] =        {  0x400e0000,  0x1000  },
     [IBEX_DEV_TIMER] =          {  0x40100000,  0x1000  },
     [IBEX_DEV_SENSOR_CTRL] =    {  0x40110000,  0x1000  },
     [IBEX_DEV_OTP_CTRL] =       {  0x40130000,  0x4000  },
     [IBEX_DEV_USBDEV] =         {  0x40150000,  0x1000  },
+    [IBEX_DEV_SPI_HOST0] =      {  0x40300000,  0x1000  },
+    [IBEX_DEV_SPI_HOST1] =      {  0x40310000,  0x1000  },
     [IBEX_DEV_PWRMGR] =         {  0x40400000,  0x1000  },
     [IBEX_DEV_RSTMGR] =         {  0x40410000,  0x1000  },
     [IBEX_DEV_CLKMGR] =         {  0x40420000,  0x1000  },
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
 
     create_unimplemented_device("riscv.lowrisc.ibex.gpio",
         memmap[IBEX_DEV_GPIO].base, memmap[IBEX_DEV_GPIO].size);
-    create_unimplemented_device("riscv.lowrisc.ibex.spi",
-        memmap[IBEX_DEV_SPI].base, memmap[IBEX_DEV_SPI].size);
+    create_unimplemented_device("riscv.lowrisc.ibex.spi_device",
+        memmap[IBEX_DEV_SPI_DEVICE].base, memmap[IBEX_DEV_SPI_DEVICE].size);
+    create_unimplemented_device("riscv.lowrisc.ibex.spi_host0",
+        memmap[IBEX_DEV_SPI_HOST0].base, memmap[IBEX_DEV_SPI_HOST0].size);
+    create_unimplemented_device("riscv.lowrisc.ibex.spi_host1",
+        memmap[IBEX_DEV_SPI_HOST1].base, memmap[IBEX_DEV_SPI_HOST1].size);
     create_unimplemented_device("riscv.lowrisc.ibex.i2c",
         memmap[IBEX_DEV_I2C].base, memmap[IBEX_DEV_I2C].size);
     create_unimplemented_device("riscv.lowrisc.ibex.pattgen",
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_svinval;
     bool ext_svnapot;
     bool ext_svpbmt;
+    bool ext_zdinx;
     bool ext_zfh;
     bool ext_zfhmin;
+    bool ext_zfinx;
+    bool ext_zhinx;
+    bool ext_zhinxmin;
     bool ext_zve32f;
     bool ext_zve64f;
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
             cpu->cfg.ext_d = true;
         }
 
+        if (cpu->cfg.ext_zdinx || cpu->cfg.ext_zhinx ||
+            cpu->cfg.ext_zhinxmin) {
+            cpu->cfg.ext_zfinx = true;
+        }
+
         /* Set the ISA extensions, checks should have happened above */
         if (cpu->cfg.ext_i) {
             ext |= RVI;
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         if (cpu->cfg.ext_j) {
             ext |= RVJ;
         }
+        if (cpu->cfg.ext_zfinx && ((ext & (RVF | RVD)) || cpu->cfg.ext_zfh ||
+                                   cpu->cfg.ext_zfhmin)) {
+            error_setg(errp,
+                    "'Zfinx' cannot be supported together with 'F', 'D', 'Zfh',"
+                    " 'Zfhmin'");
+            return;
+        }
 
         set_misa(env, env->misa_mxl, ext);
     }
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Co-authored-by: ardxwe <ardxwe@gmail.com>
Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220211043920.28981-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c |  6 +++++-
 target/riscv/csr.c        | 25 ++++++++++++++++++++-----
 target/riscv/translate.c  |  4 ++++
 3 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_vector_enabled(CPURISCVState *env)
 
 void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env)
 {
-    uint64_t mstatus_mask = MSTATUS_MXR | MSTATUS_SUM | MSTATUS_FS |
+    uint64_t mstatus_mask = MSTATUS_MXR | MSTATUS_SUM |
                             MSTATUS_SPP | MSTATUS_SPIE | MSTATUS_SIE |
                             MSTATUS64_UXL | MSTATUS_VS;
+
+    if (riscv_has_ext(env, RVF)) {
+        mstatus_mask |= MSTATUS_FS;
+    }
     bool current_virt = riscv_cpu_virt_enabled(env);
 
     g_assert(riscv_has_ext(env, RVH));
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
 static RISCVException fs(CPURISCVState *env, int csrno)
 {
 #if !defined(CONFIG_USER_ONLY)
-    if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
+    if (!env->debugger && !riscv_cpu_fp_enabled(env) &&
+        !RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 #endif
@@ -XXX,XX +XXX,XX @@ static RISCVException write_fflags(CPURISCVState *env, int csrno,
                                    target_ulong val)
 {
 #if !defined(CONFIG_USER_ONLY)
-    env->mstatus |= MSTATUS_FS;
+    if (riscv_has_ext(env, RVF)) {
+        env->mstatus |= MSTATUS_FS;
+    }
 #endif
     riscv_cpu_set_fflags(env, val & (FSR_AEXC >> FSR_AEXC_SHIFT));
     return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_frm(CPURISCVState *env, int csrno,
                                 target_ulong val)
 {
 #if !defined(CONFIG_USER_ONLY)
-    env->mstatus |= MSTATUS_FS;
+    if (riscv_has_ext(env, RVF)) {
+        env->mstatus |= MSTATUS_FS;
+    }
 #endif
     env->frm = val & (FSR_RD >> FSR_RD_SHIFT);
     return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_fcsr(CPURISCVState *env, int csrno,
                                  target_ulong val)
 {
 #if !defined(CONFIG_USER_ONLY)
-    env->mstatus |= MSTATUS_FS;
+    if (riscv_has_ext(env, RVF)) {
+        env->mstatus |= MSTATUS_FS;
+    }
 #endif
     env->frm = (val & FSR_RD) >> FSR_RD_SHIFT;
     riscv_cpu_set_fflags(env, (val & FSR_AEXC) >> FSR_AEXC_SHIFT);
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
         tlb_flush(env_cpu(env));
     }
     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
-        MSTATUS_SPP | MSTATUS_FS | MSTATUS_MPRV | MSTATUS_SUM |
+        MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
         MSTATUS_TW | MSTATUS_VS;
 
+    if (riscv_has_ext(env, RVF)) {
+        mask |= MSTATUS_FS;
+    }
+
     if (xl != MXL_RV32 || env->debugger) {
         /*
          * RV32: MPV and GVA are not in mstatus. The current plan is to
@@ -XXX,XX +XXX,XX @@ static RISCVException write_misa(CPURISCVState *env, int csrno,
         return RISCV_EXCP_NONE;
     }
 
+    if (!(val & RVF)) {
+        env->mstatus &= ~MSTATUS_FS;
+    }
+
     /* flush translation cache */
     tb_flush(env_cpu(env));
     env->misa_ext = val;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void mark_fs_dirty(DisasContext *ctx)
 {
     TCGv tmp;
 
+    if (!has_ext(ctx, RVF)) {
+        return;
+    }
+
     if (ctx->mstatus_fs != MSTATUS_FS) {
         /* Remember the state change for the rest of the TB. */
         ctx->mstatus_fs = MSTATUS_FS;
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

- update extension check REQUIRE_ZFINX_OR_F
  - update single float point register read/write
  - disable nanbox_s check

Co-authored-by: ardxwe <ardxwe@gmail.com>
Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220211043920.28981-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                   |   2 +-
 target/riscv/internals.h                |  16 +-
 target/riscv/fpu_helper.c               |  89 +++----
 target/riscv/translate.c                |  93 ++++++-
 target/riscv/insn_trans/trans_rvf.c.inc | 314 ++++++++++++++++--------
 5 files changed, 369 insertions(+), 145 deletions(-)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_s_w, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_s_lu, TCG_CALL_NO_RWG, i64, env, tl)
-DEF_HELPER_FLAGS_1(fclass_s, TCG_CALL_NO_RWG_SE, tl, i64)
+DEF_HELPER_FLAGS_2(fclass_s, TCG_CALL_NO_RWG_SE, tl, env, i64)
 
 /* Floating Point - Double Precision */
 DEF_HELPER_FLAGS_3(fadd_d, TCG_CALL_NO_RWG, i64, env, i64, i64)
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -XXX,XX +XXX,XX @@ enum {
     RISCV_FRM_ROD = 8,  /* Round to Odd */
 };
 
-static inline uint64_t nanbox_s(float32 f)
+static inline uint64_t nanbox_s(CPURISCVState *env, float32 f)
 {
-    return f | MAKE_64BIT_MASK(32, 32);
+    /* the value is sign-extended instead of NaN-boxing for zfinx */
+    if (RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+        return (int32_t)f;
+    } else {
+        return f | MAKE_64BIT_MASK(32, 32);
+    }
 }
 
-static inline float32 check_nanbox_s(uint64_t f)
+static inline float32 check_nanbox_s(CPURISCVState *env, uint64_t f)
 {
+    /* Disable NaN-boxing check when enable zfinx */
+    if (RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+        return (uint32_t)f;
+    }
+
     uint64_t mask = MAKE_64BIT_MASK(32, 32);
 
     if (likely((f & mask) == mask)) {
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_fmadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2,
 static uint64_t do_fmadd_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2,
                            uint64_t rs3, int flags)
 {
-    float32 frs1 = check_nanbox_s(rs1);
-    float32 frs2 = check_nanbox_s(rs2);
-    float32 frs3 = check_nanbox_s(rs3);
-    return nanbox_s(float32_muladd(frs1, frs2, frs3, flags, &env->fp_status));
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    float32 frs3 = check_nanbox_s(env, rs3);
+    return nanbox_s(env, float32_muladd(frs1, frs2, frs3, flags,
+                                        &env->fp_status));
 }
 
 uint64_t helper_fmadd_s(CPURISCVState *env, uint64_t frs1, uint64_t frs2,
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fnmadd_h(CPURISCVState *env, uint64_t frs1, uint64_t frs2,
 
 uint64_t helper_fadd_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float32 frs1 = check_nanbox_s(rs1);
-    float32 frs2 = check_nanbox_s(rs2);
-    return nanbox_s(float32_add(frs1, frs2, &env->fp_status));
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return nanbox_s(env, float32_add(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fsub_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float32 frs1 = check_nanbox_s(rs1);
-    float32 frs2 = check_nanbox_s(rs2);
-    return nanbox_s(float32_sub(frs1, frs2, &env->fp_status));
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return nanbox_s(env, float32_sub(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmul_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float32 frs1 = check_nanbox_s(rs1);
-    float32 frs2 = check_nanbox_s(rs2);
-    return nanbox_s(float32_mul(frs1, frs2, &env->fp_status));
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return nanbox_s(env, float32_mul(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fdiv_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float32 frs1 = check_nanbox_s(rs1);
-    float32 frs2 = check_nanbox_s(rs2);
-    return nanbox_s(float32_div(frs1, frs2, &env->fp_status));
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return nanbox_s(env, float32_div(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmin_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float32 frs1 = check_nanbox_s(rs1);
-    float32 frs2 = check_nanbox_s(rs2);
-    return nanbox_s(env->priv_ver < PRIV_VERSION_1_11_0 ?
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return nanbox_s(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
                     float32_minnum(frs1, frs2, &env->fp_status) :
                     float32_minimum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmax_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float32 frs1 = check_nanbox_s(rs1);
-    float32 frs2 = check_nanbox_s(rs2);
-    return nanbox_s(env->priv_ver < PRIV_VERSION_1_11_0 ?
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
+    return nanbox_s(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
                     float32_maxnum(frs1, frs2, &env->fp_status) :
                     float32_maximum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fsqrt_s(CPURISCVState *env, uint64_t rs1)
 {
-    float32 frs1 = check_nanbox_s(rs1);
-    return nanbox_s(float32_sqrt(frs1, &env->fp_status));
+    float32 frs1 = check_nanbox_s(env, rs1);
+    return nanbox_s(env, float32_sqrt(frs1, &env->fp_status));
 }
 
 target_ulong helper_fle_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float32 frs1 = check_nanbox_s(rs1);
-    float32 frs2 = check_nanbox_s(rs2);
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
     return float32_le(frs1, frs2, &env->fp_status);
 }
 
 target_ulong helper_flt_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float32 frs1 = check_nanbox_s(rs1);
-    float32 frs2 = check_nanbox_s(rs2);
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
     return float32_lt(frs1, frs2, &env->fp_status);
 }
 
 target_ulong helper_feq_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float32 frs1 = check_nanbox_s(rs1);
-    float32 frs2 = check_nanbox_s(rs2);
+    float32 frs1 = check_nanbox_s(env, rs1);
+    float32 frs2 = check_nanbox_s(env, rs2);
     return float32_eq_quiet(frs1, frs2, &env->fp_status);
 }
 
 target_ulong helper_fcvt_w_s(CPURISCVState *env, uint64_t rs1)
 {
-    float32 frs1 = check_nanbox_s(rs1);
+    float32 frs1 = check_nanbox_s(env, rs1);
     return float32_to_int32(frs1, &env->fp_status);
 }
 
 target_ulong helper_fcvt_wu_s(CPURISCVState *env, uint64_t rs1)
 {
-    float32 frs1 = check_nanbox_s(rs1);
+    float32 frs1 = check_nanbox_s(env, rs1);
     return (int32_t)float32_to_uint32(frs1, &env->fp_status);
 }
 
 target_ulong helper_fcvt_l_s(CPURISCVState *env, uint64_t rs1)
 {
-    float32 frs1 = check_nanbox_s(rs1);
+    float32 frs1 = check_nanbox_s(env, rs1);
     return float32_to_int64(frs1, &env->fp_status);
 }
 
 target_ulong helper_fcvt_lu_s(CPURISCVState *env, uint64_t rs1)
 {
-    float32 frs1 = check_nanbox_s(rs1);
+    float32 frs1 = check_nanbox_s(env, rs1);
     return float32_to_uint64(frs1, &env->fp_status);
 }
 
 uint64_t helper_fcvt_s_w(CPURISCVState *env, target_ulong rs1)
 {
-    return nanbox_s(int32_to_float32((int32_t)rs1, &env->fp_status));
+    return nanbox_s(env, int32_to_float32((int32_t)rs1, &env->fp_status));
 }
 
 uint64_t helper_fcvt_s_wu(CPURISCVState *env, target_ulong rs1)
 {
-    return nanbox_s(uint32_to_float32((uint32_t)rs1, &env->fp_status));
+    return nanbox_s(env, uint32_to_float32((uint32_t)rs1, &env->fp_status));
 }
 
 uint64_t helper_fcvt_s_l(CPURISCVState *env, target_ulong rs1)
 {
-    return nanbox_s(int64_to_float32(rs1, &env->fp_status));
+    return nanbox_s(env, int64_to_float32(rs1, &env->fp_status));
 }
 
 uint64_t helper_fcvt_s_lu(CPURISCVState *env, target_ulong rs1)
 {
-    return nanbox_s(uint64_to_float32(rs1, &env->fp_status));
+    return nanbox_s(env, uint64_to_float32(rs1, &env->fp_status));
 }
 
-target_ulong helper_fclass_s(uint64_t rs1)
+target_ulong helper_fclass_s(CPURISCVState *env, uint64_t rs1)
 {
-    float32 frs1 = check_nanbox_s(rs1);
+    float32 frs1 = check_nanbox_s(env, rs1);
     return fclass_s(frs1);
 }
 
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fmax_d(CPURISCVState *env, uint64_t frs1, uint64_t frs2)
 
 uint64_t helper_fcvt_s_d(CPURISCVState *env, uint64_t rs1)
 {
-    return nanbox_s(float64_to_float32(rs1, &env->fp_status));
+    return nanbox_s(env, float64_to_float32(rs1, &env->fp_status));
 }
 
 uint64_t helper_fcvt_d_s(CPURISCVState *env, uint64_t rs1)
 {
-    float32 frs1 = check_nanbox_s(rs1);
+    float32 frs1 = check_nanbox_s(env, rs1);
     return float32_to_float64(frs1, &env->fp_status);
 }
 
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fcvt_h_lu(CPURISCVState *env, target_ulong rs1)
 
 uint64_t helper_fcvt_h_s(CPURISCVState *env, uint64_t rs1)
 {
-    float32 frs1 = check_nanbox_s(rs1);
+    float32 frs1 = check_nanbox_s(env, rs1);
     return nanbox_h(float32_to_float16(frs1, true, &env->fp_status));
 }
 
 uint64_t helper_fcvt_s_h(CPURISCVState *env, uint64_t rs1)
 {
     float16 frs1 = check_nanbox_h(rs1);
-    return nanbox_s(float16_to_float32(frs1, true, &env->fp_status));
+    return nanbox_s(env, float16_to_float32(frs1, true, &env->fp_status));
 }
 
 uint64_t helper_fcvt_h_d(CPURISCVState *env, uint64_t rs1)
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     TCGv zero;
     /* Space for 3 operands plus 1 extra for address computation. */
     TCGv temp[4];
+    /* Space for 4 operands(1 dest and <=3 src) for float point computation */
+    TCGv_i64 ftemp[4];
+    uint8_t nftemp;
     /* PointerMasking extension */
     bool pm_mask_enabled;
     bool pm_base_enabled;
@@ -XXX,XX +XXX,XX @@ static void gen_set_gpr128(DisasContext *ctx, int reg_num, TCGv rl, TCGv rh)
     }
 }
 
+static TCGv_i64 ftemp_new(DisasContext *ctx)
+{
+    assert(ctx->nftemp < ARRAY_SIZE(ctx->ftemp));
+    return ctx->ftemp[ctx->nftemp++] = tcg_temp_new_i64();
+}
+
+static TCGv_i64 get_fpr_hs(DisasContext *ctx, int reg_num)
+{
+    if (!ctx->cfg_ptr->ext_zfinx) {
+        return cpu_fpr[reg_num];
+    }
+
+    if (reg_num == 0) {
+        return tcg_constant_i64(0);
+    }
+    switch (get_xl(ctx)) {
+    case MXL_RV32:
+#ifdef TARGET_RISCV32
+    {
+        TCGv_i64 t = ftemp_new(ctx);
+        tcg_gen_ext_i32_i64(t, cpu_gpr[reg_num]);
+        return t;
+    }
+#else
+    /* fall through */
+    case MXL_RV64:
+        return cpu_gpr[reg_num];
+#endif
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static TCGv_i64 dest_fpr(DisasContext *ctx, int reg_num)
+{
+    if (!ctx->cfg_ptr->ext_zfinx) {
+        return cpu_fpr[reg_num];
+    }
+
+    if (reg_num == 0) {
+        return ftemp_new(ctx);
+    }
+
+    switch (get_xl(ctx)) {
+    case MXL_RV32:
+        return ftemp_new(ctx);
+#ifdef TARGET_RISCV64
+    case MXL_RV64:
+        return cpu_gpr[reg_num];
+#endif
+    default:
+        g_assert_not_reached();
+    }
+}
+
+/* assume t is nanboxing (for normal) or sign-extended (for zfinx) */
+static void gen_set_fpr_hs(DisasContext *ctx, int reg_num, TCGv_i64 t)
+{
+    if (!ctx->cfg_ptr->ext_zfinx) {
+        tcg_gen_mov_i64(cpu_fpr[reg_num], t);
+        return;
+    }
+    if (reg_num != 0) {
+        switch (get_xl(ctx)) {
+        case MXL_RV32:
+#ifdef TARGET_RISCV32
+            tcg_gen_extrl_i64_i32(cpu_gpr[reg_num], t);
+            break;
+#else
+        /* fall through */
+        case MXL_RV64:
+            tcg_gen_mov_i64(cpu_gpr[reg_num], t);
+            break;
+#endif
+        default:
+            g_assert_not_reached();
+        }
+    }
+}
+
 static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
 {
     target_ulong next_pc;
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->cs = cs;
     ctx->ntemp = 0;
     memset(ctx->temp, 0, sizeof(ctx->temp));
+    ctx->nftemp = 0;
+    memset(ctx->ftemp, 0, sizeof(ctx->ftemp));
     ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
     ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
     ctx->zero = tcg_constant_tl(0);
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     DisasContext *ctx = container_of(dcbase, DisasContext, base);
     CPURISCVState *env = cpu->env_ptr;
     uint16_t opcode16 = translator_lduw(env, &ctx->base, ctx->base.pc_next);
+    int i;
 
     ctx->ol = ctx->xl;
     decode_opc(env, ctx, opcode16);
     ctx->base.pc_next = ctx->pc_succ_insn;
 
-    for (int i = ctx->ntemp - 1; i >= 0; --i) {
+    for (i = ctx->ntemp - 1; i >= 0; --i) {
         tcg_temp_free(ctx->temp[i]);
         ctx->temp[i] = NULL;
     }
     ctx->ntemp = 0;
+    for (i = ctx->nftemp - 1; i >= 0; --i) {
+        tcg_temp_free_i64(ctx->ftemp[i]);
+        ctx->ftemp[i] = NULL;
+    }
+    ctx->nftemp = 0;
 
     if (ctx->base.is_jmp == DISAS_NEXT) {
         target_ulong page_start;
diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvf.c.inc
+++ b/target/riscv/insn_trans/trans_rvf.c.inc
@@ -XXX,XX +XXX,XX @@
 
 #define REQUIRE_FPU do {\
     if (ctx->mstatus_fs == 0) \
-        return false;                       \
+        if (!ctx->cfg_ptr->ext_zfinx) \
+            return false; \
+} while (0)
+
+#define REQUIRE_ZFINX_OR_F(ctx) do {\
+    if (!ctx->cfg_ptr->ext_zfinx) { \
+        REQUIRE_EXT(ctx, RVF); \
+    } \
 } while (0)
 
 static bool trans_flw(DisasContext *ctx, arg_flw *a)
@@ -XXX,XX +XXX,XX @@ static bool trans_fsw(DisasContext *ctx, arg_fsw *a)
 static bool trans_fmadd_s(DisasContext *ctx, arg_fmadd_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
+
     gen_set_rm(ctx, a->rm);
-    gen_helper_fmadd_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fmadd_s(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmadd_s(DisasContext *ctx, arg_fmadd_s *a)
 static bool trans_fmsub_s(DisasContext *ctx, arg_fmsub_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
+
     gen_set_rm(ctx, a->rm);
-    gen_helper_fmsub_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fmsub_s(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmsub_s(DisasContext *ctx, arg_fmsub_s *a)
 static bool trans_fnmsub_s(DisasContext *ctx, arg_fnmsub_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
+
     gen_set_rm(ctx, a->rm);
-    gen_helper_fnmsub_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fnmsub_s(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fnmsub_s(DisasContext *ctx, arg_fnmsub_s *a)
 static bool trans_fnmadd_s(DisasContext *ctx, arg_fnmadd_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
+
     gen_set_rm(ctx, a->rm);
-    gen_helper_fnmadd_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fnmadd_s(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fnmadd_s(DisasContext *ctx, arg_fnmadd_s *a)
 static bool trans_fadd_s(DisasContext *ctx, arg_fadd_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fadd_s(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_fadd_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fadd_s(DisasContext *ctx, arg_fadd_s *a)
 static bool trans_fsub_s(DisasContext *ctx, arg_fsub_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fsub_s(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_fsub_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsub_s(DisasContext *ctx, arg_fsub_s *a)
 static bool trans_fmul_s(DisasContext *ctx, arg_fmul_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fmul_s(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_fmul_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmul_s(DisasContext *ctx, arg_fmul_s *a)
 static bool trans_fdiv_s(DisasContext *ctx, arg_fdiv_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fdiv_s(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_fdiv_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fdiv_s(DisasContext *ctx, arg_fdiv_s *a)
 static bool trans_fsqrt_s(DisasContext *ctx, arg_fsqrt_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fsqrt_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fsqrt_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsqrt_s(DisasContext *ctx, arg_fsqrt_s *a)
 static bool trans_fsgnj_s(DisasContext *ctx, arg_fsgnj_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     if (a->rs1 == a->rs2) { /* FMOV */
-        gen_check_nanbox_s(cpu_fpr[a->rd], cpu_fpr[a->rs1]);
+        if (!ctx->cfg_ptr->ext_zfinx) {
+            gen_check_nanbox_s(dest, src1);
+        } else {
+            tcg_gen_ext32s_i64(dest, src1);
+        }
     } else { /* FSGNJ */
-        TCGv_i64 rs1 = tcg_temp_new_i64();
-        TCGv_i64 rs2 = tcg_temp_new_i64();
-
-        gen_check_nanbox_s(rs1, cpu_fpr[a->rs1]);
-        gen_check_nanbox_s(rs2, cpu_fpr[a->rs2]);
-
-        /* This formulation retains the nanboxing of rs2. */
-        tcg_gen_deposit_i64(cpu_fpr[a->rd], rs2, rs1, 0, 31);
-        tcg_temp_free_i64(rs1);
-        tcg_temp_free_i64(rs2);
+        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+        if (!ctx->cfg_ptr->ext_zfinx) {
+            TCGv_i64 rs1 = tcg_temp_new_i64();
+            TCGv_i64 rs2 = tcg_temp_new_i64();
+            gen_check_nanbox_s(rs1, src1);
+            gen_check_nanbox_s(rs2, src2);
+
+            /* This formulation retains the nanboxing of rs2 in normal 'F'. */
+            tcg_gen_deposit_i64(dest, rs2, rs1, 0, 31);
+
+            tcg_temp_free_i64(rs1);
+            tcg_temp_free_i64(rs2);
+        } else {
+            tcg_gen_deposit_i64(dest, src2, src1, 0, 31);
+            tcg_gen_ext32s_i64(dest, dest);
+        }
     }
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjn_s(DisasContext *ctx, arg_fsgnjn_s *a)
     TCGv_i64 rs1, rs2, mask;
 
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
-    rs1 = tcg_temp_new_i64();
-    gen_check_nanbox_s(rs1, cpu_fpr[a->rs1]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
+    rs1 = tcg_temp_new_i64();
+    if (!ctx->cfg_ptr->ext_zfinx) {
+        gen_check_nanbox_s(rs1, src1);
+    } else {
+        tcg_gen_mov_i64(rs1, src1);
+    }
     if (a->rs1 == a->rs2) { /* FNEG */
-        tcg_gen_xori_i64(cpu_fpr[a->rd], rs1, MAKE_64BIT_MASK(31, 1));
+        tcg_gen_xori_i64(dest, rs1, MAKE_64BIT_MASK(31, 1));
     } else {
+        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
         rs2 = tcg_temp_new_i64();
-        gen_check_nanbox_s(rs2, cpu_fpr[a->rs2]);
+        if (!ctx->cfg_ptr->ext_zfinx) {
+            gen_check_nanbox_s(rs2, src2);
+        } else {
+            tcg_gen_mov_i64(rs2, src2);
+        }
 
         /*
          * Replace bit 31 in rs1 with inverse in rs2.
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjn_s(DisasContext *ctx, arg_fsgnjn_s *a)
          */
         mask = tcg_constant_i64(~MAKE_64BIT_MASK(31, 1));
         tcg_gen_nor_i64(rs2, rs2, mask);
-        tcg_gen_and_i64(rs1, mask, rs1);
-        tcg_gen_or_i64(cpu_fpr[a->rd], rs1, rs2);
+        tcg_gen_and_i64(dest, mask, rs1);
+        tcg_gen_or_i64(dest, dest, rs2);
 
         tcg_temp_free_i64(rs2);
     }
+    /* signed-extended intead of nanboxing for result if enable zfinx */
+    if (ctx->cfg_ptr->ext_zfinx) {
+        tcg_gen_ext32s_i64(dest, dest);
+    }
+    gen_set_fpr_hs(ctx, a->rd, dest);
     tcg_temp_free_i64(rs1);
-
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjx_s(DisasContext *ctx, arg_fsgnjx_s *a)
     TCGv_i64 rs1, rs2;
 
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
     rs1 = tcg_temp_new_i64();
-    gen_check_nanbox_s(rs1, cpu_fpr[a->rs1]);
+
+    if (!ctx->cfg_ptr->ext_zfinx) {
+        gen_check_nanbox_s(rs1, src1);
+    } else {
+        tcg_gen_mov_i64(rs1, src1);
+    }
 
     if (a->rs1 == a->rs2) { /* FABS */
-        tcg_gen_andi_i64(cpu_fpr[a->rd], rs1, ~MAKE_64BIT_MASK(31, 1));
+        tcg_gen_andi_i64(dest, rs1, ~MAKE_64BIT_MASK(31, 1));
     } else {
+        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
         rs2 = tcg_temp_new_i64();
-        gen_check_nanbox_s(rs2, cpu_fpr[a->rs2]);
+
+        if (!ctx->cfg_ptr->ext_zfinx) {
+            gen_check_nanbox_s(rs2, src2);
+        } else {
+            tcg_gen_mov_i64(rs2, src2);
+        }
 
         /*
          * Xor bit 31 in rs1 with that in rs2.
          * This formulation retains the nanboxing of rs1.
          */
-        tcg_gen_andi_i64(rs2, rs2, MAKE_64BIT_MASK(31, 1));
-        tcg_gen_xor_i64(cpu_fpr[a->rd], rs1, rs2);
+        tcg_gen_andi_i64(dest, rs2, MAKE_64BIT_MASK(31, 1));
+        tcg_gen_xor_i64(dest, rs1, dest);
 
         tcg_temp_free_i64(rs2);
     }
+    /* signed-extended intead of nanboxing for result if enable zfinx */
+    if (ctx->cfg_ptr->ext_zfinx) {
+        tcg_gen_ext32s_i64(dest, dest);
+    }
     tcg_temp_free_i64(rs1);
-
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjx_s(DisasContext *ctx, arg_fsgnjx_s *a)
 static bool trans_fmin_s(DisasContext *ctx, arg_fmin_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fmin_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                      cpu_fpr[a->rs2]);
+    gen_helper_fmin_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmin_s(DisasContext *ctx, arg_fmin_s *a)
 static bool trans_fmax_s(DisasContext *ctx, arg_fmax_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fmax_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                      cpu_fpr[a->rs2]);
+    gen_helper_fmax_s(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmax_s(DisasContext *ctx, arg_fmax_s *a)
 static bool trans_fcvt_w_s(DisasContext *ctx, arg_fcvt_w_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_w_s(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_w_s(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_w_s(DisasContext *ctx, arg_fcvt_w_s *a)
 static bool trans_fcvt_wu_s(DisasContext *ctx, arg_fcvt_wu_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_wu_s(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_wu_s(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_x_w(DisasContext *ctx, arg_fmv_x_w *a)
 {
     /* NOTE: This was FMV.X.S in an earlier version of the ISA spec! */
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
-
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 #if defined(TARGET_RISCV64)
-    tcg_gen_ext32s_tl(dest, cpu_fpr[a->rs1]);
+    tcg_gen_ext32s_tl(dest, src1);
 #else
-    tcg_gen_extrl_i64_i32(dest, cpu_fpr[a->rs1]);
+    tcg_gen_extrl_i64_i32(dest, src1);
 #endif
 
     gen_set_gpr(ctx, a->rd, dest);
@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_x_w(DisasContext *ctx, arg_fmv_x_w *a)
 static bool trans_feq_s(DisasContext *ctx, arg_feq_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_feq_s(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_feq_s(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_feq_s(DisasContext *ctx, arg_feq_s *a)
 static bool trans_flt_s(DisasContext *ctx, arg_flt_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_flt_s(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_flt_s(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_flt_s(DisasContext *ctx, arg_flt_s *a)
 static bool trans_fle_s(DisasContext *ctx, arg_fle_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fle_s(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_fle_s(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fle_s(DisasContext *ctx, arg_fle_s *a)
 static bool trans_fclass_s(DisasContext *ctx, arg_fclass_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
-    gen_helper_fclass_s(dest, cpu_fpr[a->rs1]);
+    gen_helper_fclass_s(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fclass_s(DisasContext *ctx, arg_fclass_s *a)
 static bool trans_fcvt_s_w(DisasContext *ctx, arg_fcvt_s_w *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv src = get_gpr(ctx, a->rs1, EXT_SIGN);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_s_w(cpu_fpr[a->rd], cpu_env, src);
-
+    gen_helper_fcvt_s_w(dest, cpu_env, src);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_w(DisasContext *ctx, arg_fcvt_s_w *a)
 static bool trans_fcvt_s_wu(DisasContext *ctx, arg_fcvt_s_wu *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv src = get_gpr(ctx, a->rs1, EXT_ZERO);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_s_wu(cpu_fpr[a->rd], cpu_env, src);
-
+    gen_helper_fcvt_s_wu(dest, cpu_env, src);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmv_w_x(DisasContext *ctx, arg_fmv_w_x *a)
 {
     /* NOTE: This was FMV.S.X in an earlier version of the ISA spec! */
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv src = get_gpr(ctx, a->rs1, EXT_ZERO);
 
-    tcg_gen_extu_tl_i64(cpu_fpr[a->rd], src);
-    gen_nanbox_s(cpu_fpr[a->rd], cpu_fpr[a->rd]);
-
+    tcg_gen_extu_tl_i64(dest, src);
+    gen_nanbox_s(dest, dest);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_l_s(DisasContext *ctx, arg_fcvt_l_s *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_l_s(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_l_s(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_lu_s(DisasContext *ctx, arg_fcvt_lu_s *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_lu_s(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_lu_s(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_l(DisasContext *ctx, arg_fcvt_s_l *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv src = get_gpr(ctx, a->rs1, EXT_SIGN);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_s_l(cpu_fpr[a->rd], cpu_env, src);
-
+    gen_helper_fcvt_s_l(dest, cpu_env, src);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_lu(DisasContext *ctx, arg_fcvt_s_lu *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVF);
+    REQUIRE_ZFINX_OR_F(ctx);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv src = get_gpr(ctx, a->rs1, EXT_ZERO);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_s_lu(cpu_fpr[a->rd], cpu_env, src);
-
+    gen_helper_fcvt_s_lu(dest, cpu_env, src);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

-- update extension check REQUIRE_ZDINX_OR_D
  -- update double float point register read/write

Co-authored-by: ardxwe <ardxwe@gmail.com>
Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220211043920.28981-5-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c                |  52 +++++
 target/riscv/insn_trans/trans_rvd.c.inc | 285 +++++++++++++++++-------
 2 files changed, 259 insertions(+), 78 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i64 get_fpr_hs(DisasContext *ctx, int reg_num)
     }
 }
 
+static TCGv_i64 get_fpr_d(DisasContext *ctx, int reg_num)
+{
+    if (!ctx->cfg_ptr->ext_zfinx) {
+        return cpu_fpr[reg_num];
+    }
+
+    if (reg_num == 0) {
+        return tcg_constant_i64(0);
+    }
+    switch (get_xl(ctx)) {
+    case MXL_RV32:
+    {
+        TCGv_i64 t = ftemp_new(ctx);
+        tcg_gen_concat_tl_i64(t, cpu_gpr[reg_num], cpu_gpr[reg_num + 1]);
+        return t;
+    }
+#ifdef TARGET_RISCV64
+    case MXL_RV64:
+        return cpu_gpr[reg_num];
+#endif
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static TCGv_i64 dest_fpr(DisasContext *ctx, int reg_num)
 {
     if (!ctx->cfg_ptr->ext_zfinx) {
@@ -XXX,XX +XXX,XX @@ static void gen_set_fpr_hs(DisasContext *ctx, int reg_num, TCGv_i64 t)
     }
 }
 
+static void gen_set_fpr_d(DisasContext *ctx, int reg_num, TCGv_i64 t)
+{
+    if (!ctx->cfg_ptr->ext_zfinx) {
+        tcg_gen_mov_i64(cpu_fpr[reg_num], t);
+        return;
+    }
+
+    if (reg_num != 0) {
+        switch (get_xl(ctx)) {
+        case MXL_RV32:
+#ifdef TARGET_RISCV32
+            tcg_gen_extr_i64_i32(cpu_gpr[reg_num], cpu_gpr[reg_num + 1], t);
+            break;
+#else
+            tcg_gen_ext32s_i64(cpu_gpr[reg_num], t);
+            tcg_gen_sari_i64(cpu_gpr[reg_num + 1], t, 32);
+            break;
+        case MXL_RV64:
+            tcg_gen_mov_i64(cpu_gpr[reg_num], t);
+            break;
+#endif
+        default:
+            g_assert_not_reached();
+        }
+    }
+}
+
 static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
 {
     target_ulong next_pc;
diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvd.c.inc
+++ b/target/riscv/insn_trans/trans_rvd.c.inc
@@ -XXX,XX +XXX,XX @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#define REQUIRE_ZDINX_OR_D(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zdinx) { \
+        REQUIRE_EXT(ctx, RVD); \
+    } \
+} while (0)
+
+#define REQUIRE_EVEN(ctx, reg) do { \
+    if (ctx->cfg_ptr->ext_zdinx && (get_xl(ctx) == MXL_RV32) && \
+        ((reg) & 0x1)) { \
+        return false; \
+    } \
+} while (0)
+
 static bool trans_fld(DisasContext *ctx, arg_fld *a)
 {
     TCGv addr;
@@ -XXX,XX +XXX,XX @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
 static bool trans_fmadd_d(DisasContext *ctx, arg_fmadd_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2 | a->rs3);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
+
     gen_set_rm(ctx, a->rm);
-    gen_helper_fmadd_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fmadd_d(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmadd_d(DisasContext *ctx, arg_fmadd_d *a)
 static bool trans_fmsub_d(DisasContext *ctx, arg_fmsub_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2 | a->rs3);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
+
     gen_set_rm(ctx, a->rm);
-    gen_helper_fmsub_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fmsub_d(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmsub_d(DisasContext *ctx, arg_fmsub_d *a)
 static bool trans_fnmsub_d(DisasContext *ctx, arg_fnmsub_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2 | a->rs3);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
+
     gen_set_rm(ctx, a->rm);
-    gen_helper_fnmsub_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fnmsub_d(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fnmsub_d(DisasContext *ctx, arg_fnmsub_d *a)
 static bool trans_fnmadd_d(DisasContext *ctx, arg_fnmadd_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2 | a->rs3);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_d(ctx, a->rs3);
+
     gen_set_rm(ctx, a->rm);
-    gen_helper_fnmadd_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fnmadd_d(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fnmadd_d(DisasContext *ctx, arg_fnmadd_d *a)
 static bool trans_fadd_d(DisasContext *ctx, arg_fadd_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
 
-    gen_set_rm(ctx, a->rm);
-    gen_helper_fadd_d(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fadd_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fadd_d(DisasContext *ctx, arg_fadd_d *a)
 static bool trans_fsub_d(DisasContext *ctx, arg_fsub_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
 
-    gen_set_rm(ctx, a->rm);
-    gen_helper_fsub_d(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fsub_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsub_d(DisasContext *ctx, arg_fsub_d *a)
 static bool trans_fmul_d(DisasContext *ctx, arg_fmul_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
 
-    gen_set_rm(ctx, a->rm);
-    gen_helper_fmul_d(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fmul_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmul_d(DisasContext *ctx, arg_fmul_d *a)
 static bool trans_fdiv_d(DisasContext *ctx, arg_fdiv_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
 
-    gen_set_rm(ctx, a->rm);
-    gen_helper_fdiv_d(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fdiv_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fdiv_d(DisasContext *ctx, arg_fdiv_d *a)
 static bool trans_fsqrt_d(DisasContext *ctx, arg_fsqrt_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1);
 
-    gen_set_rm(ctx, a->rm);
-    gen_helper_fsqrt_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fsqrt_d(dest, cpu_env, src1);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
 
 static bool trans_fsgnj_d(DisasContext *ctx, arg_fsgnj_d *a)
 {
+    REQUIRE_FPU;
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     if (a->rs1 == a->rs2) { /* FMOV */
-        tcg_gen_mov_i64(cpu_fpr[a->rd], cpu_fpr[a->rs1]);
+        dest = get_fpr_d(ctx, a->rs1);
     } else {
-        tcg_gen_deposit_i64(cpu_fpr[a->rd], cpu_fpr[a->rs2],
-                            cpu_fpr[a->rs1], 0, 63);
+        TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+        TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
+        tcg_gen_deposit_i64(dest, src2, src1, 0, 63);
     }
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnj_d(DisasContext *ctx, arg_fsgnj_d *a)
 static bool trans_fsgnjn_d(DisasContext *ctx, arg_fsgnjn_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+
     if (a->rs1 == a->rs2) { /* FNEG */
-        tcg_gen_xori_i64(cpu_fpr[a->rd], cpu_fpr[a->rs1], INT64_MIN);
+        tcg_gen_xori_i64(dest, src1, INT64_MIN);
     } else {
+        TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
         TCGv_i64 t0 = tcg_temp_new_i64();
-        tcg_gen_not_i64(t0, cpu_fpr[a->rs2]);
-        tcg_gen_deposit_i64(cpu_fpr[a->rd], t0, cpu_fpr[a->rs1], 0, 63);
+        tcg_gen_not_i64(t0, src2);
+        tcg_gen_deposit_i64(dest, t0, src1, 0, 63);
         tcg_temp_free_i64(t0);
     }
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjn_d(DisasContext *ctx, arg_fsgnjn_d *a)
 static bool trans_fsgnjx_d(DisasContext *ctx, arg_fsgnjx_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+
     if (a->rs1 == a->rs2) { /* FABS */
-        tcg_gen_andi_i64(cpu_fpr[a->rd], cpu_fpr[a->rs1], ~INT64_MIN);
+        tcg_gen_andi_i64(dest, src1, ~INT64_MIN);
     } else {
+        TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
         TCGv_i64 t0 = tcg_temp_new_i64();
-        tcg_gen_andi_i64(t0, cpu_fpr[a->rs2], INT64_MIN);
-        tcg_gen_xor_i64(cpu_fpr[a->rd], cpu_fpr[a->rs1], t0);
+        tcg_gen_andi_i64(t0, src2, INT64_MIN);
+        tcg_gen_xor_i64(dest, src1, t0);
         tcg_temp_free_i64(t0);
     }
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjx_d(DisasContext *ctx, arg_fsgnjx_d *a)
 static bool trans_fmin_d(DisasContext *ctx, arg_fmin_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
 
-    gen_helper_fmin_d(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 
+    gen_helper_fmin_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmin_d(DisasContext *ctx, arg_fmin_d *a)
 static bool trans_fmax_d(DisasContext *ctx, arg_fmax_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd | a->rs1 | a->rs2);
 
-    gen_helper_fmax_d(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 
+    gen_helper_fmax_d(dest, cpu_env, src1, src2);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmax_d(DisasContext *ctx, arg_fmax_d *a)
 static bool trans_fcvt_s_d(DisasContext *ctx, arg_fcvt_s_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rs1);
 
-    gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_s_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_s_d(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_d(DisasContext *ctx, arg_fcvt_s_d *a)
 static bool trans_fcvt_d_s(DisasContext *ctx, arg_fcvt_d_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd);
 
-    gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_d_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_d_s(dest, cpu_env, src1);
+    gen_set_fpr_d(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_d_s(DisasContext *ctx, arg_fcvt_d_s *a)
 static bool trans_feq_d(DisasContext *ctx, arg_feq_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rs1 | a->rs2);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 
-    gen_helper_feq_d(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_feq_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_feq_d(DisasContext *ctx, arg_feq_d *a)
 static bool trans_flt_d(DisasContext *ctx, arg_flt_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rs1 | a->rs2);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 
-    gen_helper_flt_d(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_flt_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_flt_d(DisasContext *ctx, arg_flt_d *a)
 static bool trans_fle_d(DisasContext *ctx, arg_fle_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rs1 | a->rs2);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_d(ctx, a->rs2);
 
-    gen_helper_fle_d(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_fle_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fle_d(DisasContext *ctx, arg_fle_d *a)
 static bool trans_fclass_d(DisasContext *ctx, arg_fclass_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rs1);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 
-    gen_helper_fclass_d(dest, cpu_fpr[a->rs1]);
+    gen_helper_fclass_d(dest, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fclass_d(DisasContext *ctx, arg_fclass_d *a)
 static bool trans_fcvt_w_d(DisasContext *ctx, arg_fcvt_w_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rs1);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_w_d(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_w_d(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_w_d(DisasContext *ctx, arg_fcvt_w_d *a)
 static bool trans_fcvt_wu_d(DisasContext *ctx, arg_fcvt_wu_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rs1);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_wu_d(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_wu_d(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_wu_d(DisasContext *ctx, arg_fcvt_wu_d *a)
 static bool trans_fcvt_d_w(DisasContext *ctx, arg_fcvt_d_w *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv src = get_gpr(ctx, a->rs1, EXT_SIGN);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_d_w(cpu_fpr[a->rd], cpu_env, src);
+    gen_helper_fcvt_d_w(dest, cpu_env, src);
+    gen_set_fpr_d(ctx, a->rd, dest);
 
     mark_fs_dirty(ctx);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_d_w(DisasContext *ctx, arg_fcvt_d_w *a)
 static bool trans_fcvt_d_wu(DisasContext *ctx, arg_fcvt_d_wu *a)
 {
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv src = get_gpr(ctx, a->rs1, EXT_ZERO);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_d_wu(cpu_fpr[a->rd], cpu_env, src);
+    gen_helper_fcvt_d_wu(dest, cpu_env, src);
+    gen_set_fpr_d(ctx, a->rd, dest);
 
     mark_fs_dirty(ctx);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_l_d(DisasContext *ctx, arg_fcvt_l_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rs1);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_l_d(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_l_d(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_lu_d(DisasContext *ctx, arg_fcvt_lu_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rs1);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_lu_d(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_lu_d(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_d_l(DisasContext *ctx, arg_fcvt_d_l *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv src = get_gpr(ctx, a->rs1, EXT_SIGN);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_d_l(cpu_fpr[a->rd], cpu_env, src);
+    gen_helper_fcvt_d_l(dest, cpu_env, src);
+    gen_set_fpr_d(ctx, a->rd, dest);
 
     mark_fs_dirty(ctx);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_d_lu(DisasContext *ctx, arg_fcvt_d_lu *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZDINX_OR_D(ctx);
+    REQUIRE_EVEN(ctx, a->rd);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv src = get_gpr(ctx, a->rs1, EXT_ZERO);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_d_lu(cpu_fpr[a->rd], cpu_env, src);
+    gen_helper_fcvt_d_lu(dest, cpu_env, src);
+    gen_set_fpr_d(ctx, a->rd, dest);
 
     mark_fs_dirty(ctx);
     return true;
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

- update extension check REQUIRE_ZHINX_OR_ZFH and REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN
  - update half float point register read/write
  - disable nanbox_h check

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220211043920.28981-6-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                     |   2 +-
 target/riscv/internals.h                  |  16 +-
 target/riscv/fpu_helper.c                 |  89 +++---
 target/riscv/insn_trans/trans_rvzfh.c.inc | 332 +++++++++++++++-------
 4 files changed, 296 insertions(+), 143 deletions(-)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(fcvt_h_w, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_wu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
-DEF_HELPER_FLAGS_1(fclass_h, TCG_CALL_NO_RWG_SE, tl, i64)
+DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
 
 /* Special functions */
 DEF_HELPER_2(csrr, tl, env, int)
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -XXX,XX +XXX,XX @@ static inline float32 check_nanbox_s(CPURISCVState *env, uint64_t f)
     }
 }
 
-static inline uint64_t nanbox_h(float16 f)
+static inline uint64_t nanbox_h(CPURISCVState *env, float16 f)
 {
-    return f | MAKE_64BIT_MASK(16, 48);
+    /* the value is sign-extended instead of NaN-boxing for zfinx */
+    if (RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+        return (int16_t)f;
+    } else {
+        return f | MAKE_64BIT_MASK(16, 48);
+    }
 }
 
-static inline float16 check_nanbox_h(uint64_t f)
+static inline float16 check_nanbox_h(CPURISCVState *env, uint64_t f)
 {
+    /* Disable nanbox check when enable zfinx */
+    if (RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
+        return (uint16_t)f;
+    }
+
     uint64_t mask = MAKE_64BIT_MASK(16, 48);
 
     if (likely((f & mask) == mask)) {
diff --git a/target/riscv/fpu_helper.c b/target/riscv/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/fpu_helper.c
+++ b/target/riscv/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_set_rod_rounding_mode(CPURISCVState *env)
 static uint64_t do_fmadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2,
                            uint64_t rs3, int flags)
 {
-    float16 frs1 = check_nanbox_h(rs1);
-    float16 frs2 = check_nanbox_h(rs2);
-    float16 frs3 = check_nanbox_h(rs3);
-    return nanbox_h(float16_muladd(frs1, frs2, frs3, flags, &env->fp_status));
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    float16 frs3 = check_nanbox_h(env, rs3);
+    return nanbox_h(env, float16_muladd(frs1, frs2, frs3, flags,
+                                        &env->fp_status));
 }
 
 static uint64_t do_fmadd_s(CPURISCVState *env, uint64_t rs1, uint64_t rs2,
@@ -XXX,XX +XXX,XX @@ target_ulong helper_fclass_d(uint64_t frs1)
 
 uint64_t helper_fadd_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float16 frs1 = check_nanbox_h(rs1);
-    float16 frs2 = check_nanbox_h(rs2);
-    return nanbox_h(float16_add(frs1, frs2, &env->fp_status));
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return nanbox_h(env, float16_add(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fsub_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float16 frs1 = check_nanbox_h(rs1);
-    float16 frs2 = check_nanbox_h(rs2);
-    return nanbox_h(float16_sub(frs1, frs2, &env->fp_status));
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return nanbox_h(env, float16_sub(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmul_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float16 frs1 = check_nanbox_h(rs1);
-    float16 frs2 = check_nanbox_h(rs2);
-    return nanbox_h(float16_mul(frs1, frs2, &env->fp_status));
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return nanbox_h(env, float16_mul(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fdiv_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float16 frs1 = check_nanbox_h(rs1);
-    float16 frs2 = check_nanbox_h(rs2);
-    return nanbox_h(float16_div(frs1, frs2, &env->fp_status));
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return nanbox_h(env, float16_div(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmin_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float16 frs1 = check_nanbox_h(rs1);
-    float16 frs2 = check_nanbox_h(rs2);
-    return nanbox_h(env->priv_ver < PRIV_VERSION_1_11_0 ?
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return nanbox_h(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
                     float16_minnum(frs1, frs2, &env->fp_status) :
                     float16_minimum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fmax_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float16 frs1 = check_nanbox_h(rs1);
-    float16 frs2 = check_nanbox_h(rs2);
-    return nanbox_h(env->priv_ver < PRIV_VERSION_1_11_0 ?
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
+    return nanbox_h(env, env->priv_ver < PRIV_VERSION_1_11_0 ?
                     float16_maxnum(frs1, frs2, &env->fp_status) :
                     float16_maximum_number(frs1, frs2, &env->fp_status));
 }
 
 uint64_t helper_fsqrt_h(CPURISCVState *env, uint64_t rs1)
 {
-    float16 frs1 = check_nanbox_h(rs1);
-    return nanbox_h(float16_sqrt(frs1, &env->fp_status));
+    float16 frs1 = check_nanbox_h(env, rs1);
+    return nanbox_h(env, float16_sqrt(frs1, &env->fp_status));
 }
 
 target_ulong helper_fle_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float16 frs1 = check_nanbox_h(rs1);
-    float16 frs2 = check_nanbox_h(rs2);
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
     return float16_le(frs1, frs2, &env->fp_status);
 }
 
 target_ulong helper_flt_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float16 frs1 = check_nanbox_h(rs1);
-    float16 frs2 = check_nanbox_h(rs2);
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
     return float16_lt(frs1, frs2, &env->fp_status);
 }
 
 target_ulong helper_feq_h(CPURISCVState *env, uint64_t rs1, uint64_t rs2)
 {
-    float16 frs1 = check_nanbox_h(rs1);
-    float16 frs2 = check_nanbox_h(rs2);
+    float16 frs1 = check_nanbox_h(env, rs1);
+    float16 frs2 = check_nanbox_h(env, rs2);
     return float16_eq_quiet(frs1, frs2, &env->fp_status);
 }
 
-target_ulong helper_fclass_h(uint64_t rs1)
+target_ulong helper_fclass_h(CPURISCVState *env, uint64_t rs1)
 {
-    float16 frs1 = check_nanbox_h(rs1);
+    float16 frs1 = check_nanbox_h(env, rs1);
     return fclass_h(frs1);
 }
 
 target_ulong helper_fcvt_w_h(CPURISCVState *env, uint64_t rs1)
 {
-    float16 frs1 = check_nanbox_h(rs1);
+    float16 frs1 = check_nanbox_h(env, rs1);
     return float16_to_int32(frs1, &env->fp_status);
 }
 
 target_ulong helper_fcvt_wu_h(CPURISCVState *env, uint64_t rs1)
 {
-    float16 frs1 = check_nanbox_h(rs1);
+    float16 frs1 = check_nanbox_h(env, rs1);
     return (int32_t)float16_to_uint32(frs1, &env->fp_status);
 }
 
 target_ulong helper_fcvt_l_h(CPURISCVState *env, uint64_t rs1)
 {
-    float16 frs1 = check_nanbox_h(rs1);
+    float16 frs1 = check_nanbox_h(env, rs1);
     return float16_to_int64(frs1, &env->fp_status);
 }
 
 target_ulong helper_fcvt_lu_h(CPURISCVState *env, uint64_t rs1)
 {
-    float16 frs1 = check_nanbox_h(rs1);
+    float16 frs1 = check_nanbox_h(env, rs1);
     return float16_to_uint64(frs1, &env->fp_status);
 }
 
 uint64_t helper_fcvt_h_w(CPURISCVState *env, target_ulong rs1)
 {
-    return nanbox_h(int32_to_float16((int32_t)rs1, &env->fp_status));
+    return nanbox_h(env, int32_to_float16((int32_t)rs1, &env->fp_status));
 }
 
 uint64_t helper_fcvt_h_wu(CPURISCVState *env, target_ulong rs1)
 {
-    return nanbox_h(uint32_to_float16((uint32_t)rs1, &env->fp_status));
+    return nanbox_h(env, uint32_to_float16((uint32_t)rs1, &env->fp_status));
 }
 
 uint64_t helper_fcvt_h_l(CPURISCVState *env, target_ulong rs1)
 {
-    return nanbox_h(int64_to_float16(rs1, &env->fp_status));
+    return nanbox_h(env, int64_to_float16(rs1, &env->fp_status));
 }
 
 uint64_t helper_fcvt_h_lu(CPURISCVState *env, target_ulong rs1)
 {
-    return nanbox_h(uint64_to_float16(rs1, &env->fp_status));
+    return nanbox_h(env, uint64_to_float16(rs1, &env->fp_status));
 }
 
 uint64_t helper_fcvt_h_s(CPURISCVState *env, uint64_t rs1)
 {
     float32 frs1 = check_nanbox_s(env, rs1);
-    return nanbox_h(float32_to_float16(frs1, true, &env->fp_status));
+    return nanbox_h(env, float32_to_float16(frs1, true, &env->fp_status));
 }
 
 uint64_t helper_fcvt_s_h(CPURISCVState *env, uint64_t rs1)
 {
-    float16 frs1 = check_nanbox_h(rs1);
+    float16 frs1 = check_nanbox_h(env, rs1);
     return nanbox_s(env, float16_to_float32(frs1, true, &env->fp_status));
 }
 
 uint64_t helper_fcvt_h_d(CPURISCVState *env, uint64_t rs1)
 {
-    return nanbox_h(float64_to_float16(rs1, true, &env->fp_status));
+    return nanbox_h(env, float64_to_float16(rs1, true, &env->fp_status));
 }
 
 uint64_t helper_fcvt_d_h(CPURISCVState *env, uint64_t rs1)
 {
-    float16 frs1 = check_nanbox_h(rs1);
+    float16 frs1 = check_nanbox_h(env, rs1);
     return float16_to_float64(frs1, true, &env->fp_status);
 }
diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzfh.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
@@ -XXX,XX +XXX,XX @@
     }                         \
 } while (0)
 
+#define REQUIRE_ZHINX_OR_ZFH(ctx) do { \
+    if (!ctx->cfg_ptr->ext_zhinx && !ctx->cfg_ptr->ext_zfh) { \
+        return false;                  \
+    }                                  \
+} while (0)
+
 #define REQUIRE_ZFH_OR_ZFHMIN(ctx) do {       \
     if (!(ctx->cfg_ptr->ext_zfh || ctx->cfg_ptr->ext_zfhmin)) { \
         return false;                         \
     }                                         \
 } while (0)
 
+#define REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN(ctx) do { \
+    if (!(ctx->cfg_ptr->ext_zfh || ctx->cfg_ptr->ext_zfhmin ||          \
+          ctx->cfg_ptr->ext_zhinx || ctx->cfg_ptr->ext_zhinxmin)) {     \
+        return false;                                        \
+    }                                                        \
+} while (0)
+
 static bool trans_flh(DisasContext *ctx, arg_flh *a)
 {
     TCGv_i64 dest;
@@ -XXX,XX +XXX,XX @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
 static bool trans_fmadd_h(DisasContext *ctx, arg_fmadd_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fmadd_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fmadd_h(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmadd_h(DisasContext *ctx, arg_fmadd_h *a)
 static bool trans_fmsub_h(DisasContext *ctx, arg_fmsub_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fmsub_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                       cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fmsub_h(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmsub_h(DisasContext *ctx, arg_fmsub_h *a)
 static bool trans_fnmsub_h(DisasContext *ctx, arg_fnmsub_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fnmsub_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fnmsub_h(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fnmsub_h(DisasContext *ctx, arg_fnmsub_h *a)
 static bool trans_fnmadd_h(DisasContext *ctx, arg_fnmadd_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+    TCGv_i64 src3 = get_fpr_hs(ctx, a->rs3);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fnmadd_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                        cpu_fpr[a->rs2], cpu_fpr[a->rs3]);
+    gen_helper_fnmadd_h(dest, cpu_env, src1, src2, src3);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fnmadd_h(DisasContext *ctx, arg_fnmadd_h *a)
 static bool trans_fadd_h(DisasContext *ctx, arg_fadd_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fadd_h(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_fadd_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fadd_h(DisasContext *ctx, arg_fadd_h *a)
 static bool trans_fsub_h(DisasContext *ctx, arg_fsub_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fsub_h(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_fsub_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsub_h(DisasContext *ctx, arg_fsub_h *a)
 static bool trans_fmul_h(DisasContext *ctx, arg_fmul_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fmul_h(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_fmul_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmul_h(DisasContext *ctx, arg_fmul_h *a)
 static bool trans_fdiv_h(DisasContext *ctx, arg_fdiv_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fdiv_h(cpu_fpr[a->rd], cpu_env,
-                      cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_fdiv_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fdiv_h(DisasContext *ctx, arg_fdiv_h *a)
 static bool trans_fsqrt_h(DisasContext *ctx, arg_fsqrt_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fsqrt_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fsqrt_h(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsqrt_h(DisasContext *ctx, arg_fsqrt_h *a)
 static bool trans_fsgnj_h(DisasContext *ctx, arg_fsgnj_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     if (a->rs1 == a->rs2) { /* FMOV */
-        gen_check_nanbox_h(cpu_fpr[a->rd], cpu_fpr[a->rs1]);
+        if (!ctx->cfg_ptr->ext_zfinx) {
+            gen_check_nanbox_h(dest, src1);
+        } else {
+            tcg_gen_ext16s_i64(dest, src1);
+        }
     } else {
-        TCGv_i64 rs1 = tcg_temp_new_i64();
-        TCGv_i64 rs2 = tcg_temp_new_i64();
-
-        gen_check_nanbox_h(rs1, cpu_fpr[a->rs1]);
-        gen_check_nanbox_h(rs2, cpu_fpr[a->rs2]);
-
-        /* This formulation retains the nanboxing of rs2. */
-        tcg_gen_deposit_i64(cpu_fpr[a->rd], rs2, rs1, 0, 15);
-        tcg_temp_free_i64(rs1);
-        tcg_temp_free_i64(rs2);
+        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+        if (!ctx->cfg_ptr->ext_zfinx) {
+            TCGv_i64 rs1 = tcg_temp_new_i64();
+            TCGv_i64 rs2 = tcg_temp_new_i64();
+            gen_check_nanbox_h(rs1, src1);
+            gen_check_nanbox_h(rs2, src2);
+
+            /* This formulation retains the nanboxing of rs2 in normal 'Zfh'. */
+            tcg_gen_deposit_i64(dest, rs2, rs1, 0, 15);
+
+            tcg_temp_free_i64(rs1);
+            tcg_temp_free_i64(rs2);
+        } else {
+            tcg_gen_deposit_i64(dest, src2, src1, 0, 15);
+            tcg_gen_ext16s_i64(dest, dest);
+        }
     }
-
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjn_h(DisasContext *ctx, arg_fsgnjn_h *a)
     TCGv_i64 rs1, rs2, mask;
 
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     rs1 = tcg_temp_new_i64();
-    gen_check_nanbox_h(rs1, cpu_fpr[a->rs1]);
+    if (!ctx->cfg_ptr->ext_zfinx) {
+        gen_check_nanbox_h(rs1, src1);
+    } else {
+        tcg_gen_mov_i64(rs1, src1);
+    }
 
     if (a->rs1 == a->rs2) { /* FNEG */
-        tcg_gen_xori_i64(cpu_fpr[a->rd], rs1, MAKE_64BIT_MASK(15, 1));
+        tcg_gen_xori_i64(dest, rs1, MAKE_64BIT_MASK(15, 1));
     } else {
+        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
         rs2 = tcg_temp_new_i64();
-        gen_check_nanbox_h(rs2, cpu_fpr[a->rs2]);
+
+        if (!ctx->cfg_ptr->ext_zfinx) {
+            gen_check_nanbox_h(rs2, src2);
+        } else {
+            tcg_gen_mov_i64(rs2, src2);
+        }
 
         /*
          * Replace bit 15 in rs1 with inverse in rs2.
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjn_h(DisasContext *ctx, arg_fsgnjn_h *a)
         mask = tcg_const_i64(~MAKE_64BIT_MASK(15, 1));
         tcg_gen_not_i64(rs2, rs2);
         tcg_gen_andc_i64(rs2, rs2, mask);
-        tcg_gen_and_i64(rs1, mask, rs1);
-        tcg_gen_or_i64(cpu_fpr[a->rd], rs1, rs2);
+        tcg_gen_and_i64(dest, mask, rs1);
+        tcg_gen_or_i64(dest, dest, rs2);
 
         tcg_temp_free_i64(mask);
         tcg_temp_free_i64(rs2);
     }
+    /* signed-extended intead of nanboxing for result if enable zfinx */
+    if (ctx->cfg_ptr->ext_zfinx) {
+        tcg_gen_ext16s_i64(dest, dest);
+    }
+    tcg_temp_free_i64(rs1);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjx_h(DisasContext *ctx, arg_fsgnjx_h *a)
     TCGv_i64 rs1, rs2;
 
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     rs1 = tcg_temp_new_i64();
-    gen_check_nanbox_s(rs1, cpu_fpr[a->rs1]);
+    if (!ctx->cfg_ptr->ext_zfinx) {
+        gen_check_nanbox_h(rs1, src1);
+    } else {
+        tcg_gen_mov_i64(rs1, src1);
+    }
 
     if (a->rs1 == a->rs2) { /* FABS */
-        tcg_gen_andi_i64(cpu_fpr[a->rd], rs1, ~MAKE_64BIT_MASK(15, 1));
+        tcg_gen_andi_i64(dest, rs1, ~MAKE_64BIT_MASK(15, 1));
     } else {
+        TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
         rs2 = tcg_temp_new_i64();
-        gen_check_nanbox_s(rs2, cpu_fpr[a->rs2]);
+
+        if (!ctx->cfg_ptr->ext_zfinx) {
+            gen_check_nanbox_h(rs2, src2);
+        } else {
+            tcg_gen_mov_i64(rs2, src2);
+        }
 
         /*
          * Xor bit 15 in rs1 with that in rs2.
          * This formulation retains the nanboxing of rs1.
          */
-        tcg_gen_andi_i64(rs2, rs2, MAKE_64BIT_MASK(15, 1));
-        tcg_gen_xor_i64(cpu_fpr[a->rd], rs1, rs2);
+        tcg_gen_andi_i64(dest, rs2, MAKE_64BIT_MASK(15, 1));
+        tcg_gen_xor_i64(dest, rs1, dest);
 
         tcg_temp_free_i64(rs2);
     }
-
+    /* signed-extended intead of nanboxing for result if enable zfinx */
+    if (ctx->cfg_ptr->ext_zfinx) {
+        tcg_gen_ext16s_i64(dest, dest);
+    }
+    tcg_temp_free_i64(rs1);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fsgnjx_h(DisasContext *ctx, arg_fsgnjx_h *a)
 static bool trans_fmin_h(DisasContext *ctx, arg_fmin_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fmin_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                      cpu_fpr[a->rs2]);
+    gen_helper_fmin_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmin_h(DisasContext *ctx, arg_fmin_h *a)
 static bool trans_fmax_h(DisasContext *ctx, arg_fmax_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
-    gen_helper_fmax_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1],
-                      cpu_fpr[a->rs2]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
+
+    gen_helper_fmax_h(dest, cpu_env, src1, src2);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fmax_h(DisasContext *ctx, arg_fmax_h *a)
 static bool trans_fcvt_s_h(DisasContext *ctx, arg_fcvt_s_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH_OR_ZFHMIN(ctx);
+    REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_s_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_s_h(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
 
     mark_fs_dirty(ctx);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_s_h(DisasContext *ctx, arg_fcvt_s_h *a)
 static bool trans_fcvt_d_h(DisasContext *ctx, arg_fcvt_d_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH_OR_ZFHMIN(ctx);
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN(ctx);
+    REQUIRE_ZDINX_OR_D(ctx);
+
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_d_h(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_d_h(dest, cpu_env, src1);
+    gen_set_fpr_d(ctx, a->rd, dest);
 
     mark_fs_dirty(ctx);
 
-
     return true;
 }
 
 static bool trans_fcvt_h_s(DisasContext *ctx, arg_fcvt_h_s *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH_OR_ZFHMIN(ctx);
+    REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN(ctx);
 
-    gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_h_s(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_h_s(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
 
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_s(DisasContext *ctx, arg_fcvt_h_s *a)
 static bool trans_fcvt_h_d(DisasContext *ctx, arg_fcvt_h_d *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH_OR_ZFHMIN(ctx);
-    REQUIRE_EXT(ctx, RVD);
+    REQUIRE_ZFH_OR_ZFHMIN_OR_ZHINX_OR_ZHINXMIN(ctx);
+    REQUIRE_ZDINX_OR_D(ctx);
 
-    gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_h_d(cpu_fpr[a->rd], cpu_env, cpu_fpr[a->rs1]);
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_d(ctx, a->rs1);
 
+    gen_set_rm(ctx, a->rm);
+    gen_helper_fcvt_h_d(dest, cpu_env, src1);
+    gen_set_fpr_hs(ctx, a->rd, dest);
     mark_fs_dirty(ctx);
 
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_d(DisasContext *ctx, arg_fcvt_h_d *a)
 static bool trans_feq_h(DisasContext *ctx, arg_feq_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_feq_h(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_feq_h(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_feq_h(DisasContext *ctx, arg_feq_h *a)
 static bool trans_flt_h(DisasContext *ctx, arg_flt_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_flt_h(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_flt_h(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
 
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_flt_h(DisasContext *ctx, arg_flt_h *a)
 static bool trans_fle_h(DisasContext *ctx, arg_fle_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+    TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fle_h(dest, cpu_env, cpu_fpr[a->rs1], cpu_fpr[a->rs2]);
+    gen_helper_fle_h(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fle_h(DisasContext *ctx, arg_fle_h *a)
 static bool trans_fclass_h(DisasContext *ctx, arg_fclass_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
-    gen_helper_fclass_h(dest, cpu_fpr[a->rs1]);
+    gen_helper_fclass_h(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fclass_h(DisasContext *ctx, arg_fclass_h *a)
 static bool trans_fcvt_w_h(DisasContext *ctx, arg_fcvt_w_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_w_h(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_w_h(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_w_h(DisasContext *ctx, arg_fcvt_w_h *a)
 static bool trans_fcvt_wu_h(DisasContext *ctx, arg_fcvt_wu_h *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_wu_h(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_wu_h(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_wu_h(DisasContext *ctx, arg_fcvt_wu_h *a)
 static bool trans_fcvt_h_w(DisasContext *ctx, arg_fcvt_h_w *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv t0 = get_gpr(ctx, a->rs1, EXT_SIGN);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_h_w(cpu_fpr[a->rd], cpu_env, t0);
+    gen_helper_fcvt_h_w(dest, cpu_env, t0);
+    gen_set_fpr_hs(ctx, a->rd, dest);
 
     mark_fs_dirty(ctx);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_w(DisasContext *ctx, arg_fcvt_h_w *a)
 static bool trans_fcvt_h_wu(DisasContext *ctx, arg_fcvt_h_wu *a)
 {
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv t0 = get_gpr(ctx, a->rs1, EXT_SIGN);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_h_wu(cpu_fpr[a->rd], cpu_env, t0);
+    gen_helper_fcvt_h_wu(dest, cpu_env, t0);
+    gen_set_fpr_hs(ctx, a->rd, dest);
 
     mark_fs_dirty(ctx);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_l_h(DisasContext *ctx, arg_fcvt_l_h *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_l_h(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_l_h(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_lu_h(DisasContext *ctx, arg_fcvt_lu_h *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
     TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_lu_h(dest, cpu_env, cpu_fpr[a->rs1]);
+    gen_helper_fcvt_lu_h(dest, cpu_env, src1);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_l(DisasContext *ctx, arg_fcvt_h_l *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv t0 = get_gpr(ctx, a->rs1, EXT_SIGN);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_h_l(cpu_fpr[a->rd], cpu_env, t0);
+    gen_helper_fcvt_h_l(dest, cpu_env, t0);
+    gen_set_fpr_hs(ctx, a->rd, dest);
 
     mark_fs_dirty(ctx);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fcvt_h_lu(DisasContext *ctx, arg_fcvt_h_lu *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_FPU;
-    REQUIRE_ZFH(ctx);
+    REQUIRE_ZHINX_OR_ZFH(ctx);
 
+    TCGv_i64 dest = dest_fpr(ctx, a->rd);
     TCGv t0 = get_gpr(ctx, a->rs1, EXT_SIGN);
 
     gen_set_rm(ctx, a->rm);
-    gen_helper_fcvt_h_lu(cpu_fpr[a->rd], cpu_env, t0);
+    gen_helper_fcvt_h_lu(dest, cpu_env, t0);
+    gen_set_fpr_hs(ctx, a->rd, dest);
 
     mark_fs_dirty(ctx);
     return true;
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("zbc", RISCVCPU, cfg.ext_zbc, true),
     DEFINE_PROP_BOOL("zbs", RISCVCPU, cfg.ext_zbs, true),
 
+    DEFINE_PROP_BOOL("zdinx", RISCVCPU, cfg.ext_zdinx, false),
+    DEFINE_PROP_BOOL("zfinx", RISCVCPU, cfg.ext_zfinx, false),
+    DEFINE_PROP_BOOL("zhinx", RISCVCPU, cfg.ext_zhinx, false),
+    DEFINE_PROP_BOOL("zhinxmin", RISCVCPU, cfg.ext_zhinxmin, false),
+
     /* Vendor-specific custom extensions */
     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
 
-- 
2.35.1

The following changes since commit 661c2e1ab29cd9c4d268ae3f44712e8d421c0e56:

scripts/checkpatch: Fix a typo (2025-03-04 09:30:26 +0800)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20250305-1

for you to fetch changes up to 4db19d5b21e058e6eb3474b6be470d1184afaa9e:

target/riscv/kvm: add missing KVM CSRs (2025-03-04 15:42:54 +1000)

----------------------------------------------------------------
Third RISC-V PR for 10.0

* CSR coverity fixes
* Fix unexpected behavior of vector reduction instructions when vl is 0
* Fix incorrect vlen comparison in prop_vlen_set
* Throw debug exception before page fault
* Remove redundant "hart_idx" masking from APLIC
* Add support for Control Transfer Records Ext
* Remove redundant struct members from the IOMMU
* Remove duplicate definitions from the IOMMU
* Fix tick_offset migration for Goldfish RTC
* Add serial alias in virt machine DTB
* Remove Bin Meng from RISC-V maintainers
* Add support for Control Transfer Records Ext
* Log guest errors when reserved bits are set in PTEs
* Add missing Sdtrig disas CSRs
* Correct the hpmevent sscofpmf mask
* Mask upper sscofpmf bits during validation
* Remove warnings about Smdbltrp/Smrnmi being disabled
* Respect mseccfg.RLB bit for TOR mode PMP entry
* Update KVM support to Linux 6.14-rc3
* IOMMU HPM support
* Support Sscofpmf/Svade/Svadu/Smnpm/Ssnpm extensions in KVM
* Add --ignore-family option to binfmt
* Refinement for AIA with KVM acceleration
* Reset time changes for KVM

----------------------------------------------------------------
Alistair Francis (1):
      MAINTAINERS: Remove Bin Meng from RISC-V maintainers

Andrea Bolognani (3):
      binfmt: Shuffle things around
      binfmt: Normalize host CPU architecture
      binfmt: Add --ignore-family option

Atish Patra (2):
      target/riscv: Fix the hpmevent mask
      target/riscv: Mask out upper sscofpmf bits during validation

Clément Léger (1):
      target/riscv: remove warnings about Smdbltrp/Smrnmi being disabled

Daniel Henrique Barboza (22):
      target/riscv/csr.c: fix deadcode in rmw_xireg()
      target/riscv/csr.c: fix 'ret' deadcode in rmw_xireg()
      target/riscv/csr.c: fix deadcode in rmw_xiregi()
      target/riscv/csr.c: fix deadcode in aia_smode32()
      target/riscv/cpu_helper.c: fix bad_shift in riscv_cpu_interrupt()
      target/riscv/debug.c: use wp size = 4 for 32-bit CPUs
      target/riscv: throw debug exception before page fault
      target/riscv: add ssu64xl
      target/riscv: use RVB in RVA22U64
      target/riscv: add profile u_parent and s_parent
      target/riscv: change priv_ver check in validate_profile()
      target/riscv: add RVA23U64 profile
      target/riscv: add RVA23S64 profile
      linux-headers: Update to Linux v6.14-rc3
      target/riscv/cpu.c: create flag for ziccrse
      target/riscv/kvm: add extensions after 6.14-rc3 update
      hw/riscv/riscv-iommu.h: add missing headers
      hw/riscv: add IOMMU HPM trace events
      docs/specs/riscv-iommu.rst: add HPM support info
      target/riscv/cpu: remove unneeded !kvm_enabled() check
      target/riscv/kvm: add kvm_riscv_reset_regs_csr()
      target/riscv/kvm: add missing KVM CSRs

Huang Borong (1):
      hw/intc/riscv_aplic: Remove redundant "hart_idx" masking

Jason Chien (2):
      hw/riscv/riscv-iommu: Remove redundant struct members
      hw/riscv/riscv-iommu-bits: Remove duplicate definitions

Max Chou (2):
      target/riscv: rvv: Fix unexpected behavior of vector reduction instructions when vl is 0
      target/riscv: rvv: Fix incorrect vlen comparison in prop_vlen_set

Quan Zhou (1):
      target/riscv/kvm: Add some exts support

Rajnesh Kanwal (7):
      target/riscv: Remove obsolete sfence.vm instruction
      target/riscv: Add Control Transfer Records CSR definitions.
      target/riscv: Add support for Control Transfer Records extension CSRs.
      target/riscv: Add support to record CTR entries.
      target/riscv: Add CTR sctrclr instruction.
      target/riscv: machine: Add Control Transfer Record state description
      target/riscv: Add support to access ctrsource, ctrtarget, ctrdata regs.

Rob Bradford (3):
      disas/riscv: Fix minor whitespace issues
      disas/riscv: Add missing Sdtrig CSRs
      target/riscv: Respect mseccfg.RLB bit for TOR mode PMP entry

Rodrigo Dias Correa (1):
      goldfish_rtc: Fix tick_offset migration

Tomasz Jeznach (8):
      hw/riscv/riscv-iommu-bits.h: HPM bits
      hw/riscv/riscv-iommu: add riscv-iommu-hpm file
      hw/riscv/riscv-iommu: add riscv_iommu_hpm_incr_ctr()
      hw/riscv/riscv-iommu: instantiate hpm_timer
      hw/riscv/riscv-iommu: add IOCOUNTINH mmio writes
      hw/riscv/riscv-iommu: add IOHPMCYCLES mmio write
      hw/riscv/riscv-iommu: add hpm events mmio write
      hw/riscv/riscv-iommu.c: add RISCV_IOMMU_CAP_HPM cap

Vasilis Liaskovitis (1):
      hw/riscv/virt: Add serial alias in DTB

Yong-Xuan Wang (3):
      hw/intc/imsic: refine the IMSIC realize
      hw/intc/aplic: refine the APLIC realize
      hw/intc/aplic: refine kvm_msicfgaddr

julia (1):
      target/riscv: log guest errors when reserved bits are set in PTEs

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Coverity found a DEADCODE issue in rmw_xireg() claiming that we can't
reach 'RISCV_EXCP_VIRT_INSTRUCTION_FAULT' at the 'done' label:

done:
    if (ret) {
        return (env->virt_enabled && virt) ?
               RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
    }
    return RISCV_EXCP_NONE;

This happens because the 'virt' flag, which is only used by 'done', is
set to 'false' and it will always remain 'false' in any condition where
we'll jump to 'done':

switch (csrno) {
    (...)
    case CSR_VSIREG:
        isel = env->vsiselect;
        virt = true;
        break;
    default:
        goto done;
    };

'virt = true' will never reach 'done' because we have a if/else-if/else
block right before the label that will always return:

if (xiselect_aia_range(isel)) {
        return ...
    } else if (...) {
        return ...
    } else {
        return RISCV_EXCP_ILLEGAL_INST;
    }

All this means that we can preserve the current logic by reducing the
'done' label to:

done:
    if (ret) {
        return RISCV_EXCP_ILLEGAL_INST;
    }
    return RISCV_EXCP_NONE;

The flag 'virt' is now unused. Remove it.

Fix the 'goto done' identation while we're at it.

Resolves: Coverity CID 1590359
Fixes: dc0280723d ("target/riscv: Decouple AIA processing from xiselect and xireg")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250121184847.2109128-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
                                 target_ulong *val, target_ulong new_val,
                                 target_ulong wr_mask)
 {
-    bool virt = false;
     int ret = -EINVAL;
     target_ulong isel;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
         break;
     case CSR_VSIREG:
         isel = env->vsiselect;
-        virt = true;
         break;
     default:
-         goto done;
+        goto done;
     };
 
     /*
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
 
 done:
     if (ret) {
-        return (env->virt_enabled && virt) ?
-               RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
+        return RISCV_EXCP_ILLEGAL_INST;
     }
     return RISCV_EXCP_NONE;
 }
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Coverity found a second DEADCODE issue in rmw_xireg() claiming that we can't
reach 'RISCV_EXCP_NONE' at the 'done' label:

> 2706     done:
 > 2707         if (ret) {
 > 2708             return (env->virt_enabled && virt) ?
 > 2709                    RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
 > 2710         }
 >>>>      CID 1590356:  Control flow issues  (DEADCODE)
 >>>>      Execution cannot reach this statement: "return RISCV_EXCP_NONE;".
 > 2711         return RISCV_EXCP_NONE;

Our label is now reduced after fixing another deadcode in the previous
patch but the problem reported here still remains:

done:
    if (ret) {
        return RISCV_EXCP_ILLEGAL_INST;
    }
    return RISCV_EXCP_NONE;

This happens because 'ret' changes only once at the start of the
function:

ret = smstateen_acc_ok(env, 0, SMSTATEEN0_SVSLCT);
    if (ret != RISCV_EXCP_NONE) {
        return ret;
    }

So it's a guarantee that ret will be RISCV_EXCP_NONE (-1) if we ever
reach the label, i.e. "if (ret)" will always be true, and  the label can
be even further reduced to:

done:
    return RISCV_EXCP_ILLEGAL_INST;

To make a better use of the label, remove the 'else' from the
xiselect_aia_range() chain and let it fall-through to the 'done' label
since they are now both returning RISCV_EXCP_ILLEGAL_INST.

Resolves: Coverity CID 1590356
Fixes: dc0280723d ("target/riscv: Decouple AIA processing from xiselect and xireg")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250121184847.2109128-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
     } else if (riscv_cpu_cfg(env)->ext_smcsrind ||
                riscv_cpu_cfg(env)->ext_sscsrind) {
         return rmw_xireg_csrind(env, csrno, isel, val, new_val, wr_mask);
-    } else {
-        return RISCV_EXCP_ILLEGAL_INST;
     }
 
 done:
-    if (ret) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-    return RISCV_EXCP_NONE;
+    return RISCV_EXCP_ILLEGAL_INST;
 }
 
 static RISCVException rmw_xtopei(CPURISCVState *env, int csrno,
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Coverity found a DEADCODE issue in rmw_xiregi() claiming that we can't
reach 'RISCV_EXCP_VIRT_INSTRUCTION_FAULT' at the 'done' label:

> 2652     done:
 >>>>      CID 1590357:  Control flow issues  (DEADCODE)
 >>>>      Execution cannot reach the expression "RISCV_EXCP_VIRT_INSTRUCTION_FAULT"
     inside this statement: "return (env->virt_enabled &...".
 > 2653         return (env->virt_enabled && virt) ?
 > 2654                 RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;

This happens because 'virt' is being set to 'false' and it will remain
as 'false' in any code path where 'done' will be called. The label can
be safely reduced to:

done:
     return RISCV_EXCP_ILLEGAL_INST;

And that will leave us with the following usage of a 'goto' skipping a
single 'return' to do another single 'return':

} else {
        goto done;
     }

return rmw_xireg_csrind(env, csrno, isel, val, new_val, wr_mask);

done:
     return RISCV_EXCP_ILLEGAL_INST;

Which we will eliminate it and just do 'return RISCV_EXCP_ILLEGAL_INST'
instead.

Resolves: Coverity CID 1590357
Fixes: 5e33a20827 ("target/riscv: Support generic CSR indirect access")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250121184847.2109128-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
 static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
                       target_ulong new_val, target_ulong wr_mask)
 {
-    bool virt = false;
     int ret = -EINVAL;
     target_ulong isel;
 
@@ -XXX,XX +XXX,XX @@ static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
     } else if (CSR_VSIREG <= csrno && csrno <= CSR_VSIREG6 &&
                csrno != CSR_VSIREG4 - 1) {
         isel = env->vsiselect;
-        virt = true;
     } else {
-        goto done;
+        return RISCV_EXCP_ILLEGAL_INST;
     }
 
     return rmw_xireg_csrind(env, csrno, isel, val, new_val, wr_mask);
-
-done:
-    return (env->virt_enabled && virt) ?
-            RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
 }
 
 static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Coverity reported a DEADCODE ticket in this function, as follows:

>>>>      CID 1590358:  Control flow issues  (DEADCODE)
 >>>>      Execution cannot reach this statement: "return ret;".
 > 380             return ret;
 > 381         }

The cause is that the 'if (ret != RISCV_EXCP_NONE)' conditional is
duplicated:

ret = smstateen_acc_ok(env, 0, SMSTATEEN0_AIA);
    if (ret != RISCV_EXCP_NONE) {
        return ret;
    }

if (ret != RISCV_EXCP_NONE) {
        return ret;
    }

Remove the duplication to fix the deadcode.

Resolves: Coverity CID 1590358
Fixes: dbcb6e1ccf ("target/riscv: Enable S*stateen bits for AIA")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250121184847.2109128-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException aia_smode32(CPURISCVState *env, int csrno)
         return ret;
     }
 
-    if (ret != RISCV_EXCP_NONE) {
-        return ret;
-    }
-
     return smode32(env, csrno);
 }
 
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Coverity reported a BAD_SHIFT issue in the following code:

> 2097
 >>>>      CID 1590355:  Integer handling issues  (BAD_SHIFT)
 >>>>      In expression "hdeleg >> cause", right shifting by more than 63
       bits has undefined behavior.  The shift amount, "cause", is at least 64.
 > 2098         vsmode_exc = env->virt_enabled && (((hdeleg >> cause) & 1) || vs_injected);
 > 2099         /*

It is not clear to me how the tool guarantees that '"cause" is at least
64', but indeed there's no guarantees that it would be < 64 in the
'async = true' code path.

A simple fix to avoid a potential UB is to add a 'cause < 64' guard like
'mode' is already doing right before 'vsmode_exc'.

Resolves: Coverity CID 1590355
Fixes: 967760f62c ("target/riscv: Implement Ssdbltrp exception handling")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250121184847.2109128-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
     mode = env->priv <= PRV_S && cause < 64 &&
         (((deleg >> cause) & 1) || s_injected || vs_injected) ? PRV_S : PRV_M;
 
-    vsmode_exc = env->virt_enabled && (((hdeleg >> cause) & 1) || vs_injected);
+    vsmode_exc = env->virt_enabled && cause < 64 &&
+        (((hdeleg >> cause) & 1) || vs_injected);
+
     /*
      * Check double trap condition only if already in S-mode and targeting
      * S-mode
-- 
2.48.1

From: Max Chou <max.chou@sifive.com>

According to the Vector Reduction Operations section in the RISC-V "V"
Vector Extension spec,
"If vl=0, no operation is performed and the destination register is not
updated."

The vd should be updated when vl is larger than 0.

Fixes: fe5c9ab1fc ("target/riscv: vector single-width integer reduction instructions")
Fixes: f714361ed7 ("target/riscv: rvv-1.0: implement vstart CSR")
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250124101452.2519171-1-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
         }                                                 \
         s1 = OP(s1, (TD)s2);                              \
     }                                                     \
-    *((TD *)vd + HD(0)) = s1;                             \
+    if (vl > 0) {                                         \
+        *((TD *)vd + HD(0)) = s1;                         \
+    }                                                     \
     env->vstart = 0;                                      \
     /* set tail elements to 1s */                         \
     vext_set_elems_1s(vd, vta, esz, vlenb);               \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,           \
         }                                                  \
         s1 = OP(s1, (TD)s2, &env->fp_status);              \
     }                                                      \
-    *((TD *)vd + HD(0)) = s1;                              \
+    if (vl > 0) {                                          \
+        *((TD *)vd + HD(0)) = s1;                          \
+    }                                                      \
     env->vstart = 0;                                       \
     /* set tail elements to 1s */                          \
     vext_set_elems_1s(vd, vta, esz, vlenb);                \
-- 
2.48.1

From: Max Chou <max.chou@sifive.com>

In prop_vlen_set function, there is an incorrect comparison between
vlen(bit) and vlenb(byte).
This will cause unexpected error when user applies the `vlen=1024` cpu
option with a vendor predefined cpu type that the default vlen is
1024(vlenb=128).

Fixes: 4f6d036ccc ("target/riscv/cpu.c: remove cpu->cfg.vlen")
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250124090539.2506448-1-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void prop_vlen_set(Object *obj, Visitor *v, const char *name,
                          void *opaque, Error **errp)
 {
     RISCVCPU *cpu = RISCV_CPU(obj);
+    uint16_t cpu_vlen = cpu->cfg.vlenb << 3;
     uint16_t value;
 
     if (!visit_type_uint16(v, name, &value, errp)) {
@@ -XXX,XX +XXX,XX @@ static void prop_vlen_set(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    if (value != cpu->cfg.vlenb && riscv_cpu_is_vendor(obj)) {
+    if (value != cpu_vlen && riscv_cpu_is_vendor(obj)) {
         cpu_set_prop_err(cpu, name, errp);
         error_append_hint(errp, "Current '%s' val: %u\n",
-                          name, cpu->cfg.vlenb << 3);
+                          name, cpu_vlen);
         return;
     }
 
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The mcontrol select bit (19) is always zero, meaning our triggers will
always match virtual addresses. In this condition, if the user does not
specify a size for the trigger, the access size defaults to XLEN.

At this moment we're using def_size = 8 regardless of CPU XLEN. Use
def_size = 4 in case we're running 32 bits.

Fixes: 95799e36c1 ("target/riscv: Add initial support for the Sdtrig extension")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250121170626.1992570-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
     bool enabled = type2_breakpoint_enabled(ctrl);
     CPUState *cs = env_cpu(env);
     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
-    uint32_t size;
+    uint32_t size, def_size;
 
     if (!enabled) {
         return;
@@ -XXX,XX +XXX,XX @@ static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
             cpu_watchpoint_insert(cs, addr, size, flags,
                                   &env->cpu_watchpoint[index]);
         } else {
-            cpu_watchpoint_insert(cs, addr, 8, flags,
+            def_size = riscv_cpu_mxl(env) == MXL_RV64 ? 8 : 4;
+
+            cpu_watchpoint_insert(cs, addr, def_size, flags,
                                   &env->cpu_watchpoint[index]);
         }
     }
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

In the RISC-V privileged ISA section 3.1.15 table 15, it is determined
that a debug exception that is triggered from a load/store has a higher
priority than a possible fault that this access might trigger.

This is not the case ATM as shown in [1]. Adding a breakpoint in an
address that deliberately will fault is causing a load page fault
instead of a debug exception. The reason is that we're throwing in the
page fault as soon as the fault occurs (end of riscv_cpu_tlb_fill(),
raise_mmu_exception()), not allowing the installed watchpoints to
trigger.

Call cpu_check_watchpoint() in the page fault path to search and execute
any watchpoints that might exist for the address, never returning back
to the fault path. If no watchpoints are found cpu_check_watchpoint()
will return and we'll fall-through the regular path to
raise_mmu_exception().

[1] https://gitlab.com/qemu-project/qemu/-/issues/2627

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2627
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250121170626.1992570-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/page-protection.h"
 #include "instmap.h"
 #include "tcg/tcg-op.h"
+#include "hw/core/tcg-cpu-ops.h"
 #include "trace.h"
 #include "semihosting/common-semi.h"
 #include "system/cpu-timers.h"
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     } else if (probe) {
         return false;
     } else {
+        int wp_access = 0;
+
+        if (access_type == MMU_DATA_LOAD) {
+            wp_access |= BP_MEM_READ;
+        } else if (access_type == MMU_DATA_STORE) {
+            wp_access |= BP_MEM_WRITE;
+        }
+
+        /*
+         * If a watchpoint isn't found for 'addr' this will
+         * be a no-op and we'll resume the mmu_exception path.
+         * Otherwise we'll throw a debug exception and execution
+         * will continue elsewhere.
+         */
+        cpu_check_watchpoint(cs, address, size, MEMTXATTRS_UNSPECIFIED,
+                             wp_access, retaddr);
+
         raise_mmu_exception(env, address, access_type, pmp_violation,
                             first_stage_error, two_stage_lookup,
                             two_stage_indirect_error);
-- 
2.48.1

From: Huang Borong <huangborong@bosc.ac.cn>

Remove the redundant masking of "hart_idx", as the same operation is
performed later during address calculation.

This change impacts the "hart_idx" value in the final qemu_log_mask()
call. The original "hart_idx" parameter should be used for logging to
ensure accuracy, rather than the masked value.

Signed-off-by: Huang Borong <huangborong@bosc.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20250115035105.19600-1-huangborong@bosc.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
             APLIC_xMSICFGADDRH_HHXW_MASK;
 
     group_idx = hart_idx >> lhxw;
-    hart_idx &= APLIC_xMSICFGADDR_PPN_LHX_MASK(lhxw);
 
     addr = msicfgaddr;
     addr |= ((uint64_t)(msicfgaddrH & APLIC_xMSICFGADDRH_BAPPN_MASK)) << 32;
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

ssu64xl is defined in RVA22 as:

"sstatus.UXL must be capable of holding the value 2 (i.e., UXLEN=64 must
be supported)."

This is always true in TCG and it's mandatory for RVA23, so claim
support for it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250115184316.2344583-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                |   1 +
 tests/data/acpi/riscv64/virt/RHCT | Bin 390 -> 398 bytes
 2 files changed, 1 insertion(+)

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

From the time we added RVA22U64 until now the spec didn't declare 'RVB'
as a dependency, using zba/zbb/zbs instead. Since then the RVA22 spec
[1] added the following in the 'RVA22U64 Mandatory Extensions' section:

"B Bit-manipulation instructions

Note: The B extension comprises the Zba, Zbb, and Zbs extensions. At the
time of RVA22U64's ratification, the B extension had not yet been
defined, and so RVA22U64 explicitly mandated Zba, Zbb, and Zbs instead.
Mandating B is equivalent."

It is also equivalent to QEMU (see riscv_cpu_validate_b() in
target/riscv/tcg/tcg-cpu.c).

Finally, RVA23U64 [2] directly mentions RVB as a mandatory extension,
not citing zba/zbb/zbs.

To make it clear that RVA23U64 will extend RVA22U64 (i.e. RVA22 is a
parent of RVA23), use RVB in RVA22U64 as well.

(bios-tables-test change: RVB added to riscv,isa)

[1] https://github.com/riscv/riscv-profiles/blob/main/src/profiles.adoc#61-rva22u64-profile
[2] https://github.com/riscv/riscv-profiles/blob/main/src/rva23-profile.adoc#rva23u64-profile

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250115184316.2344583-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                |   2 +-
 tests/data/acpi/riscv64/virt/RHCT | Bin 398 -> 400 bytes
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const PropertyInfo prop_marchid = {
 static RISCVCPUProfile RVA22U64 = {
     .parent = NULL,
     .name = "rva22u64",
-    .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
+    .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVB | RVU,
     .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
     .satp_mode = RISCV_PROFILE_ATTR_UNUSED,
     .ext_offsets = {
diff --git a/tests/data/acpi/riscv64/virt/RHCT b/tests/data/acpi/riscv64/virt/RHCT
index XXXXXXX..XXXXXXX 100644
Binary files a/tests/data/acpi/riscv64/virt/RHCT and b/tests/data/acpi/riscv64/virt/RHCT differ
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The current 'parent' mechanic for profiles allows for one profile to be
a child of a previous/older profile, enabling all its extensions (and
the parent profile itself) and sparing us from tediously listing all
extensions for every profile.

This works fine for u-mode profiles. For s-mode profiles this is not
enough: a s-mode profile extends not only his equivalent u-mode profile
but also the previous s-mode profile. This means, for example, that
RVA23S64 extends both RVA23U64 and RVA22S64.

To fit this usage, rename the existing 'parent' to 'u_parent' and add a
new 's_parent' attribute for profiles. Handle both like we were doing
with the previous 'parent' attribute, i.e. if set, enable it. This
change does nothing for the existing profiles but will make RVA23S64
simpler.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250115184316.2344583-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  3 ++-
 target/riscv/cpu.c         |  6 ++++--
 target/riscv/tcg/tcg-cpu.c | 35 ++++++++++++++++++++++++++---------
 3 files changed, 32 insertions(+), 12 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ const char *riscv_get_misa_ext_description(uint32_t bit);
 #define CPU_CFG_OFFSET(_prop) offsetof(struct RISCVCPUConfig, _prop)
 
 typedef struct riscv_cpu_profile {
-    struct riscv_cpu_profile *parent;
+    struct riscv_cpu_profile *u_parent;
+    struct riscv_cpu_profile *s_parent;
     const char *name;
     uint32_t misa_ext;
     bool enabled;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const PropertyInfo prop_marchid = {
  * doesn't need to be manually enabled by the profile.
  */
 static RISCVCPUProfile RVA22U64 = {
-    .parent = NULL,
+    .u_parent = NULL,
+    .s_parent = NULL,
     .name = "rva22u64",
     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVB | RVU,
     .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22U64 = {
  * The remaining features/extensions comes from RVA22U64.
  */
 static RISCVCPUProfile RVA22S64 = {
-    .parent = &RVA22U64,
+    .u_parent = &RVA22U64,
+    .s_parent = NULL,
     .name = "rva22s64",
     .misa_ext = RVS,
     .priv_spec = PRIV_VERSION_1_12_0,
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static bool riscv_cpu_validate_profile_satp(RISCVCPU *cpu,
 }
 #endif
 
+static void riscv_cpu_check_parent_profile(RISCVCPU *cpu,
+                                           RISCVCPUProfile *profile,
+                                           RISCVCPUProfile *parent)
+{
+    const char *parent_name;
+    bool parent_enabled;
+
+    if (!profile->enabled || !parent) {
+        return;
+    }
+
+    parent_name = parent->name;
+    parent_enabled = object_property_get_bool(OBJECT(cpu), parent_name, NULL);
+    profile->enabled = parent_enabled;
+}
+
 static void riscv_cpu_validate_profile(RISCVCPU *cpu,
                                        RISCVCPUProfile *profile)
 {
     CPURISCVState *env = &cpu->env;
     const char *warn_msg = "Profile %s mandates disabled extension %s";
     bool send_warn = profile->user_set && profile->enabled;
-    bool parent_enabled, profile_impl = true;
+    bool profile_impl = true;
     int i;
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
 
     profile->enabled = profile_impl;
 
-    if (profile->parent != NULL) {
-        parent_enabled = object_property_get_bool(OBJECT(cpu),
-                                                  profile->parent->name,
-                                                  NULL);
-        profile->enabled = profile->enabled && parent_enabled;
-    }
+    riscv_cpu_check_parent_profile(cpu, profile, profile->u_parent);
+    riscv_cpu_check_parent_profile(cpu, profile, profile->s_parent);
 }
 
 static void riscv_cpu_validate_profiles(RISCVCPU *cpu)
@@ -XXX,XX +XXX,XX @@ static void cpu_set_profile(Object *obj, Visitor *v, const char *name,
     profile->user_set = true;
     profile->enabled = value;
 
-    if (profile->parent != NULL) {
-        object_property_set_bool(obj, profile->parent->name,
+    if (profile->u_parent != NULL) {
+        object_property_set_bool(obj, profile->u_parent->name,
+                                 profile->enabled, NULL);
+    }
+
+    if (profile->s_parent != NULL) {
+        object_property_set_bool(obj, profile->s_parent->name,
                                  profile->enabled, NULL);
     }
 
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The S profiles do a priv_ver check during validation to see if the
running priv_ver is compatible with it. This check is done by comparing
if the running priv_ver is equal to the priv_ver the profile specifies.

There is an universe where we added RVA23S64 support based on both
RVA23U64 and RVA22S64 and this error is being thrown:

qemu-system-riscv64: warning: Profile rva22s64 requires
    priv spec v1.12.0, but priv ver v1.13.0 was set

We're enabling RVA22S64 (priv_ver 1.12) as a dependency of RVA23S64
(priv_ver 1.13) and complaining to users about what we did ourselves.

There's no drawback in allowing a profile to run in an env that has a
priv_ver newer than it's required by it. So, like Hiro Nakamura saves
the future by changing the past, change the priv_ver check now to allow
profiles to run in a newer priv_ver. This universe will have one less
warning to deal with.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250115184316.2344583-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_validate_profile(RISCVCPU *cpu,
 #endif
 
     if (profile->priv_spec != RISCV_PROFILE_ATTR_UNUSED &&
-        profile->priv_spec != env->priv_ver) {
+        profile->priv_spec > env->priv_ver) {
         profile_impl = false;
 
         if (send_warn) {
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Add RVA23U64 as described in [1]. Add it as a child of RVA22U64 since
all RVA22U64 mandatory extensions are also present in RVA23U64. What's
left then is to list the mandatory extensions that are RVA23 only.

A new "rva23u64" CPU is also added.

[1] https://github.com/riscv/riscv-profiles/blob/main/src/rva23-profile.adoc

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250115184316.2344583-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h |  1 +
 target/riscv/cpu.c     | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_RV64E            RISCV_CPU_TYPE_NAME("rv64e")
 #define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
 #define TYPE_RISCV_CPU_RVA22S64         RISCV_CPU_TYPE_NAME("rva22s64")
+#define TYPE_RISCV_CPU_RVA23U64         RISCV_CPU_TYPE_NAME("rva23u64")
 #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
 #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
 #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA22S64 = {
     }
 };
 
+/*
+ * All mandatory extensions from RVA22U64 are present
+ * in RVA23U64 so set RVA22 as a parent. We need to
+ * declare just the newly added mandatory extensions.
+ */
+static RISCVCPUProfile RVA23U64 = {
+    .u_parent = &RVA22U64,
+    .s_parent = NULL,
+    .name = "rva23u64",
+    .misa_ext = RVV,
+    .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
+    .satp_mode = RISCV_PROFILE_ATTR_UNUSED,
+    .ext_offsets = {
+        CPU_CFG_OFFSET(ext_zvfhmin), CPU_CFG_OFFSET(ext_zvbb),
+        CPU_CFG_OFFSET(ext_zvkt), CPU_CFG_OFFSET(ext_zihintntl),
+        CPU_CFG_OFFSET(ext_zicond), CPU_CFG_OFFSET(ext_zimop),
+        CPU_CFG_OFFSET(ext_zcmop), CPU_CFG_OFFSET(ext_zcb),
+        CPU_CFG_OFFSET(ext_zfa), CPU_CFG_OFFSET(ext_zawrs),
+        CPU_CFG_OFFSET(ext_supm),
+
+        RISCV_PROFILE_EXT_LIST_END
+    }
+};
+
 RISCVCPUProfile *riscv_profiles[] = {
     &RVA22U64,
     &RVA22S64,
+    &RVA23U64,
     NULL,
 };
 
@@ -XXX,XX +XXX,XX @@ static void rva22s64_profile_cpu_init(Object *obj)
 
     RVA22S64.enabled = true;
 }
+
+static void rva23u64_profile_cpu_init(Object *obj)
+{
+    rv64i_bare_cpu_init(obj);
+
+    RVA23U64.enabled = true;
+}
 #endif
 
 static const gchar *riscv_gdb_arch_name(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64E,        MXL_RV64,  rv64e_bare_cpu_init),
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  MXL_RV64,  rva22u64_profile_cpu_init),
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  MXL_RV64,  rva22s64_profile_cpu_init),
+    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23U64,  MXL_RV64,  rva23u64_profile_cpu_init),
 #endif /* TARGET_RISCV64 */
 };
 
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Add RVA23S64 as described in [1]. This profile inherits all mandatory
extensions of RVA23U64 and RVA22S64, making it a child of both profiles.

A new "rva23s64" profile CPU is also added. This is the generated
riscv,isa for it (taken via -M dumpdtb):

rv64imafdcbvh_zic64b_zicbom_zicbop_zicboz_ziccamoa_ziccif_zicclsm_
ziccrse_zicond_zicntr_zicsr_zifencei_zihintntl_zihintpause_zihpm_zimop_
zmmul_za64rs_zaamo_zalrsc_zawrs_zfa_zfhmin_zca_zcb_zcd_zcmop_zba_zbb_zbs_
zkt_zvbb_zve32f_zve32x_zve64f_zve64d_zve64x_zvfhmin_zvkb_zvkt_shcounterenw_
sha_shgatpa_shtvala_shvsatpa_shvstvala_shvstvecd_smnpm_smstateen_ssccptr_
sscofpmf_sscounterenw_ssnpm_ssstateen_sstc_sstvala_sstvecd_ssu64xl_
supm_svade_svinval_svnapot_svpbmt

[1] https://github.com/riscv/riscv-profiles/blob/main/src/rva23-profile.adoc

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250115184316.2344583-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu-qom.h |  1 +
 target/riscv/cpu.c     | 39 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/target/riscv/cpu-qom.h b/target/riscv/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu-qom.h
+++ b/target/riscv/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_RISCV_CPU_RVA22U64         RISCV_CPU_TYPE_NAME("rva22u64")
 #define TYPE_RISCV_CPU_RVA22S64         RISCV_CPU_TYPE_NAME("rva22s64")
 #define TYPE_RISCV_CPU_RVA23U64         RISCV_CPU_TYPE_NAME("rva23u64")
+#define TYPE_RISCV_CPU_RVA23S64         RISCV_CPU_TYPE_NAME("rva23s64")
 #define TYPE_RISCV_CPU_IBEX             RISCV_CPU_TYPE_NAME("lowrisc-ibex")
 #define TYPE_RISCV_CPU_SHAKTI_C         RISCV_CPU_TYPE_NAME("shakti-c")
 #define TYPE_RISCV_CPU_SIFIVE_E31       RISCV_CPU_TYPE_NAME("sifive-e31")
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static RISCVCPUProfile RVA23U64 = {
     }
 };
 
+/*
+ * As with RVA23U64, RVA23S64 also defines 'named features'.
+ *
+ * Cache related features that we consider enabled since we don't
+ * implement cache: Ssccptr
+ *
+ * Other named features that we already implement: Sstvecd, Sstvala,
+ * Sscounterenw, Ssu64xl
+ *
+ * The remaining features/extensions comes from RVA23S64.
+ */
+static RISCVCPUProfile RVA23S64 = {
+    .u_parent = &RVA23U64,
+    .s_parent = &RVA22S64,
+    .name = "rva23s64",
+    .misa_ext = RVS,
+    .priv_spec = PRIV_VERSION_1_13_0,
+    .satp_mode = VM_1_10_SV39,
+    .ext_offsets = {
+        /* New in RVA23S64 */
+        CPU_CFG_OFFSET(ext_svnapot), CPU_CFG_OFFSET(ext_sstc),
+        CPU_CFG_OFFSET(ext_sscofpmf), CPU_CFG_OFFSET(ext_ssnpm),
+
+        /* Named features: Sha */
+        CPU_CFG_OFFSET(ext_sha),
+
+        RISCV_PROFILE_EXT_LIST_END
+    }
+};
+
 RISCVCPUProfile *riscv_profiles[] = {
     &RVA22U64,
     &RVA22S64,
     &RVA23U64,
+    &RVA23S64,
     NULL,
 };
 
@@ -XXX,XX +XXX,XX @@ static void rva23u64_profile_cpu_init(Object *obj)
 
     RVA23U64.enabled = true;
 }
+
+static void rva23s64_profile_cpu_init(Object *obj)
+{
+    rv64i_bare_cpu_init(obj);
+
+    RVA23S64.enabled = true;
+}
 #endif
 
 static const gchar *riscv_gdb_arch_name(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  MXL_RV64,  rva22u64_profile_cpu_init),
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  MXL_RV64,  rva22s64_profile_cpu_init),
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23U64,  MXL_RV64,  rva23u64_profile_cpu_init),
+    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23S64,  MXL_RV64,  rva23s64_profile_cpu_init),
 #endif /* TARGET_RISCV64 */
 };
 
-- 
2.48.1

From: Jason Chien <jason.chien@sifive.com>

Initially, the IOMMU would create a thread, but this thread was removed in
the merged version. The struct members for thread control should have been
removed as well, but they were not removed in commit 0c54acb8243
("hw/riscv: add RISC-V IOMMU base emulation").

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250115141730.30858-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu.h | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.h
+++ b/hw/riscv/riscv-iommu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
     /* interrupt notifier */
     void (*notify)(RISCVIOMMUState *iommu, unsigned vector);
 
-    /* IOMMU State Machine */
-    QemuThread core_proc; /* Background processing thread */
-    QemuCond core_cond;   /* Background processing wake up signal */
-    unsigned core_exec;   /* Processing thread execution actions */
-
     /* IOMMU target address space */
     AddressSpace *target_as;
     MemoryRegion *target_mr;
-- 
2.48.1

From: Jason Chien <jason.chien@sifive.com>

The header contains duplicate macro definitions.
This commit eliminates the duplicate part.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250115141730.30858-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-bits.h | 22 ++++++----------------
 1 file changed, 6 insertions(+), 16 deletions(-)

From: Rodrigo Dias Correa <r@drigo.nl>

Instead of migrating the raw tick_offset, goldfish_rtc migrates a
recalculated value based on QEMU_CLOCK_VIRTUAL. As QEMU_CLOCK_VIRTUAL
stands still across a save-and-restore cycle, the guest RTC becomes out
of sync with the host RTC when the VM is restored.

As described in the bug description, it looks like this calculation was
copied from pl031 RTC, which had its tick_offset migration fixed by
Commit 032cfe6a79c8 ("pl031: Correctly migrate state when using -rtc
clock=host").

Migrate the tick_offset directly, adding it as a version-dependent field
to VMState. Keep the old behavior when migrating from previous versions.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2033
Signed-off-by: Rodrigo Dias Correa <r@drigo.nl>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250114212150.228241-1-r@drigo.nl>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/rtc/goldfish_rtc.c | 43 +++++++++++++------------------------------
 1 file changed, 13 insertions(+), 30 deletions(-)

diff --git a/hw/rtc/goldfish_rtc.c b/hw/rtc/goldfish_rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/goldfish_rtc.c
+++ b/hw/rtc/goldfish_rtc.c
@@ -XXX,XX +XXX,XX @@ static void goldfish_rtc_write(void *opaque, hwaddr offset,
     trace_goldfish_rtc_write(offset, value);
 }
 
-static int goldfish_rtc_pre_save(void *opaque)
-{
-    uint64_t delta;
-    GoldfishRTCState *s = opaque;
-
-    /*
-     * We want to migrate this offset, which sounds straightforward.
-     * Unfortunately, we cannot directly pass tick_offset because
-     * rtc_clock on destination Host might not be same source Host.
-     *
-     * To tackle, this we pass tick_offset relative to vm_clock from
-     * source Host and make it relative to rtc_clock at destination Host.
-     */
-    delta = qemu_clock_get_ns(rtc_clock) -
-            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-    s->tick_offset_vmstate = s->tick_offset + delta;
-
-    return 0;
-}
-
 static int goldfish_rtc_post_load(void *opaque, int version_id)
 {
-    uint64_t delta;
     GoldfishRTCState *s = opaque;
 
-    /*
-     * We extract tick_offset from tick_offset_vmstate by doing
-     * reverse math compared to pre_save() function.
-     */
-    delta = qemu_clock_get_ns(rtc_clock) -
-            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-    s->tick_offset = s->tick_offset_vmstate - delta;
+    if (version_id < 3) {
+        /*
+         * Previous versions didn't migrate tick_offset directly. Instead, they
+         * migrated tick_offset_vmstate, which is a recalculation based on
+         * QEMU_CLOCK_VIRTUAL. We use tick_offset_vmstate when migrating from
+         * older versions.
+         */
+        uint64_t delta = qemu_clock_get_ns(rtc_clock) -
+                 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        s->tick_offset = s->tick_offset_vmstate - delta;
+    }
 
     goldfish_rtc_set_alarm(s);
 
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps goldfish_rtc_ops[2] = {
 
 static const VMStateDescription goldfish_rtc_vmstate = {
     .name = TYPE_GOLDFISH_RTC,
-    .version_id = 2,
-    .pre_save = goldfish_rtc_pre_save,
+    .version_id = 3,
     .post_load = goldfish_rtc_post_load,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT64(tick_offset_vmstate, GoldfishRTCState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription goldfish_rtc_vmstate = {
         VMSTATE_UINT32(irq_pending, GoldfishRTCState),
         VMSTATE_UINT32(irq_enabled, GoldfishRTCState),
         VMSTATE_UINT32(time_high, GoldfishRTCState),
+        VMSTATE_UINT64_V(tick_offset, GoldfishRTCState, 3),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.48.1

From: Vasilis Liaskovitis <vliaskovitis@suse.com>

Add an "aliases" node with a "serial0" entry for the single UART
in the riscv virt machine.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2774
Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250116161007.39710-1-vliaskovitis@suse.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_uart(RISCVVirtState *s, const MemMapEntry *memmap,
     }
 
     qemu_fdt_setprop_string(ms->fdt, "/chosen", "stdout-path", name);
+    qemu_fdt_setprop_string(ms->fdt, "/aliases", "serial0", name);
 }
 
 static void create_fdt_rtc(RISCVVirtState *s, const MemMapEntry *memmap,
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap)
     qemu_fdt_setprop(ms->fdt, "/chosen", "rng-seed",
                      rng_seed, sizeof(rng_seed));
 
+    qemu_fdt_add_subnode(ms->fdt, "/aliases");
+
     create_fdt_flash(s, memmap);
     create_fdt_fw_cfg(s, memmap);
     create_fdt_pmu(s);
-- 
2.48.1

From: Alistair Francis <alistair23@gmail.com>

Bin Meng has been a long time contributor and maintainer for QEMU RISC-V
and has been very beneficial to the RISC-V ecosystem.

Unfortunately his email has started to bounce so this patch is removing
them from MAINTAINERS. If in the future Bin Meng wants to return we will
happily re-add them.

Note that I'm not removing Bin Meng as a "SD (Secure Card)" maintainer.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250128060546.1374394-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 MAINTAINERS | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_ppc_74xx.py
 RISC-V TCG CPUs
 M: Palmer Dabbelt <palmer@dabbelt.com>
 M: Alistair Francis <alistair.francis@wdc.com>
-M: Bin Meng <bmeng.cn@gmail.com>
 R: Weiwei Li <liwei1518@gmail.com>
 R: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 R: Liu Zhiwei <zhiwei_liu@linux.alibaba.com>
@@ -XXX,XX +XXX,XX @@ F: include/hw/riscv/opentitan.h
 F: include/hw/*/ibex_*.h
 
 Microchip PolarFire SoC Icicle Kit
-M: Bin Meng <bmeng.cn@gmail.com>
 L: qemu-riscv@nongnu.org
 S: Supported
 F: docs/system/riscv/microchip-icicle-kit.rst
@@ -XXX,XX +XXX,XX @@ F: include/hw/char/shakti_uart.h
 
 SiFive Machines
 M: Alistair Francis <Alistair.Francis@wdc.com>
-M: Bin Meng <bmeng.cn@gmail.com>
 M: Palmer Dabbelt <palmer@dabbelt.com>
 L: qemu-riscv@nongnu.org
 S: Supported
@@ -XXX,XX +XXX,XX @@ S: Orphan
 F: hw/i386/amd_iommu.?
 
 OpenSBI Firmware
-M: Bin Meng <bmeng.cn@gmail.com>
+L: qemu-riscv@nongnu.org
 S: Supported
 F: pc-bios/opensbi-*
 F: .gitlab-ci.d/opensbi.yml
-- 
2.48.1

From: Rajnesh Kanwal <rkanwal@rivosinc.com>

Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Jason Chien <jason.chien@sifive.com>
Message-ID: <20250205-b4-ctr_upstream_v6-v6-1-439d8e06c8ef@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode                     | 1 -
 target/riscv/insn_trans/trans_privileged.c.inc | 5 -----
 2 files changed, 6 deletions(-)

diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ sret        0001000    00010 00000 000 00000 1110011
 mret        0011000    00010 00000 000 00000 1110011
 wfi         0001000    00101 00000 000 00000 1110011
 sfence_vma  0001001    ..... ..... 000 00000 1110011 @sfence_vma
-sfence_vm   0001000    00100 ..... 000 00000 1110011 @sfence_vm
 
 # *** NMI ***
 mnret       0111000    00010 00000 000 00000 1110011
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_sfence_vma(DisasContext *ctx, arg_sfence_vma *a)
 #endif
     return false;
 }
-
-static bool trans_sfence_vm(DisasContext *ctx, arg_sfence_vm *a)
-{
-    return false;
-}
-- 
2.48.1

From: Rajnesh Kanwal <rkanwal@rivosinc.com>

The Control Transfer Records (CTR) extension provides a method to
record a limited branch history in register-accessible internal chip
storage.

This extension is similar to Arch LBR in x86 and BRBE in ARM.
The Extension has been stable and the latest release can be found here
https://github.com/riscv/riscv-control-transfer-records/releases/tag/v1.0_rc5

Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250205-b4-ctr_upstream_v6-v6-2-439d8e06c8ef@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h | 145 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 145 insertions(+)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define CSR_SIEH            0x114
 #define CSR_SIPH            0x154
 
+/* Machine-Level Control transfer records CSRs */
+#define CSR_MCTRCTL         0x34e
+
+/* Supervisor-Level Control transfer records CSRs */
+#define CSR_SCTRCTL         0x14e
+#define CSR_SCTRSTATUS      0x14f
+#define CSR_SCTRDEPTH       0x15f
+
+/* VS-Level Control transfer records CSRs */
+#define CSR_VSCTRCTL        0x24e
+
 /* Hpervisor CSRs */
 #define CSR_HSTATUS         0x600
 #define CSR_HEDELEG         0x602
@@ -XXX,XX +XXX,XX @@
 #define SMSTATEEN0_CS       (1ULL << 0)
 #define SMSTATEEN0_FCSR     (1ULL << 1)
 #define SMSTATEEN0_JVT      (1ULL << 2)
+#define SMSTATEEN0_CTR      (1ULL << 54)
 #define SMSTATEEN0_P1P13    (1ULL << 56)
 #define SMSTATEEN0_HSCONTXT (1ULL << 57)
 #define SMSTATEEN0_IMSIC    (1ULL << 58)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
 #define HENVCFGH_STCE                       MENVCFGH_STCE
 
+/* Offsets for every pair of control bits per each priv level */
+#define XS_OFFSET    0ULL
+#define U_OFFSET     2ULL
+#define S_OFFSET     5ULL
+#define M_OFFSET     8ULL
+
+#define PM_XS_BITS   (EXT_STATUS_MASK << XS_OFFSET)
+#define U_PM_ENABLE  (PM_ENABLE  << U_OFFSET)
+#define U_PM_CURRENT (PM_CURRENT << U_OFFSET)
+#define U_PM_INSN    (PM_INSN    << U_OFFSET)
+#define S_PM_ENABLE  (PM_ENABLE  << S_OFFSET)
+#define S_PM_CURRENT (PM_CURRENT << S_OFFSET)
+#define S_PM_INSN    (PM_INSN    << S_OFFSET)
+#define M_PM_ENABLE  (PM_ENABLE  << M_OFFSET)
+#define M_PM_CURRENT (PM_CURRENT << M_OFFSET)
+#define M_PM_INSN    (PM_INSN    << M_OFFSET)
+
+/* mmte CSR bits */
+#define MMTE_PM_XS_BITS     PM_XS_BITS
+#define MMTE_U_PM_ENABLE    U_PM_ENABLE
+#define MMTE_U_PM_CURRENT   U_PM_CURRENT
+#define MMTE_U_PM_INSN      U_PM_INSN
+#define MMTE_S_PM_ENABLE    S_PM_ENABLE
+#define MMTE_S_PM_CURRENT   S_PM_CURRENT
+#define MMTE_S_PM_INSN      S_PM_INSN
+#define MMTE_M_PM_ENABLE    M_PM_ENABLE
+#define MMTE_M_PM_CURRENT   M_PM_CURRENT
+#define MMTE_M_PM_INSN      M_PM_INSN
+#define MMTE_MASK    (MMTE_U_PM_ENABLE | MMTE_U_PM_CURRENT | MMTE_U_PM_INSN | \
+                      MMTE_S_PM_ENABLE | MMTE_S_PM_CURRENT | MMTE_S_PM_INSN | \
+                      MMTE_M_PM_ENABLE | MMTE_M_PM_CURRENT | MMTE_M_PM_INSN | \
+                      MMTE_PM_XS_BITS)
+
+/* (v)smte CSR bits */
+#define SMTE_PM_XS_BITS     PM_XS_BITS
+#define SMTE_U_PM_ENABLE    U_PM_ENABLE
+#define SMTE_U_PM_CURRENT   U_PM_CURRENT
+#define SMTE_U_PM_INSN      U_PM_INSN
+#define SMTE_S_PM_ENABLE    S_PM_ENABLE
+#define SMTE_S_PM_CURRENT   S_PM_CURRENT
+#define SMTE_S_PM_INSN      S_PM_INSN
+#define SMTE_MASK    (SMTE_U_PM_ENABLE | SMTE_U_PM_CURRENT | SMTE_U_PM_INSN | \
+                      SMTE_S_PM_ENABLE | SMTE_S_PM_CURRENT | SMTE_S_PM_INSN | \
+                      SMTE_PM_XS_BITS)
+
+/* umte CSR bits */
+#define UMTE_U_PM_ENABLE    U_PM_ENABLE
+#define UMTE_U_PM_CURRENT   U_PM_CURRENT
+#define UMTE_U_PM_INSN      U_PM_INSN
+#define UMTE_MASK     (UMTE_U_PM_ENABLE | MMTE_U_PM_CURRENT | UMTE_U_PM_INSN)
+
+/* CTR control register commom fields */
+#define XCTRCTL_U              BIT_ULL(0)
+#define XCTRCTL_S              BIT_ULL(1)
+#define XCTRCTL_RASEMU         BIT_ULL(7)
+#define XCTRCTL_STE            BIT_ULL(8)
+#define XCTRCTL_BPFRZ          BIT_ULL(11)
+#define XCTRCTL_LCOFIFRZ       BIT_ULL(12)
+#define XCTRCTL_EXCINH         BIT_ULL(33)
+#define XCTRCTL_INTRINH        BIT_ULL(34)
+#define XCTRCTL_TRETINH        BIT_ULL(35)
+#define XCTRCTL_NTBREN         BIT_ULL(36)
+#define XCTRCTL_TKBRINH        BIT_ULL(37)
+#define XCTRCTL_INDCALLINH     BIT_ULL(40)
+#define XCTRCTL_DIRCALLINH     BIT_ULL(41)
+#define XCTRCTL_INDJMPINH      BIT_ULL(42)
+#define XCTRCTL_DIRJMPINH      BIT_ULL(43)
+#define XCTRCTL_CORSWAPINH     BIT_ULL(44)
+#define XCTRCTL_RETINH         BIT_ULL(45)
+#define XCTRCTL_INDLJMPINH     BIT_ULL(46)
+#define XCTRCTL_DIRLJMPINH     BIT_ULL(47)
+
+#define XCTRCTL_MASK (XCTRCTL_U | XCTRCTL_S | XCTRCTL_RASEMU |                \
+                      XCTRCTL_STE | XCTRCTL_BPFRZ | XCTRCTL_LCOFIFRZ |        \
+                      XCTRCTL_EXCINH | XCTRCTL_INTRINH | XCTRCTL_TRETINH |    \
+                      XCTRCTL_NTBREN | XCTRCTL_TKBRINH | XCTRCTL_INDCALLINH | \
+                      XCTRCTL_DIRCALLINH | XCTRCTL_INDJMPINH |                \
+                      XCTRCTL_DIRJMPINH | XCTRCTL_CORSWAPINH |                \
+                      XCTRCTL_RETINH | XCTRCTL_INDLJMPINH | XCTRCTL_DIRLJMPINH)
+
+#define XCTRCTL_INH_START         32U
+
+/* CTR mctrctl bits */
+#define MCTRCTL_M                 BIT_ULL(2)
+#define MCTRCTL_MTE               BIT_ULL(9)
+
+#define MCTRCTL_MASK              (XCTRCTL_MASK | MCTRCTL_M | MCTRCTL_MTE)
+#define SCTRCTL_MASK              XCTRCTL_MASK
+#define VSCTRCTL_MASK             XCTRCTL_MASK
+
+/* sctrstatus CSR bits. */
+#define SCTRSTATUS_WRPTR_MASK       0xFF
+#define SCTRSTATUS_FROZEN           BIT(31)
+#define SCTRSTATUS_MASK             (SCTRSTATUS_WRPTR_MASK | SCTRSTATUS_FROZEN)
+
+/* sctrdepth CSR bits. */
+#define SCTRDEPTH_MASK              0x7
+#define SCTRDEPTH_MIN               0U  /* 16 Entries. */
+#define SCTRDEPTH_MAX               4U  /* 256 Entries. */
+
+#define CTR_ENTRIES_FIRST           0x200
+#define CTR_ENTRIES_LAST            0x2ff
+
+#define CTRSOURCE_VALID             BIT(0)
+#define CTRTARGET_MISP              BIT(0)
+
+#define CTRDATA_TYPE_MASK           0xF
+#define CTRDATA_CCV                 BIT(15)
+#define CTRDATA_CCM_MASK            0xFFF0000
+#define CTRDATA_CCE_MASK            0xF0000000
+
+#define CTRDATA_MASK            (CTRDATA_TYPE_MASK | CTRDATA_CCV |  \
+                                 CTRDATA_CCM_MASK | CTRDATA_CCE_MASK)
+
+typedef enum CTRType {
+    CTRDATA_TYPE_NONE                   = 0,
+    CTRDATA_TYPE_EXCEPTION              = 1,
+    CTRDATA_TYPE_INTERRUPT              = 2,
+    CTRDATA_TYPE_EXCEP_INT_RET          = 3,
+    CTRDATA_TYPE_NONTAKEN_BRANCH        = 4,
+    CTRDATA_TYPE_TAKEN_BRANCH           = 5,
+    CTRDATA_TYPE_RESERVED_0             = 6,
+    CTRDATA_TYPE_RESERVED_1             = 7,
+    CTRDATA_TYPE_INDIRECT_CALL          = 8,
+    CTRDATA_TYPE_DIRECT_CALL            = 9,
+    CTRDATA_TYPE_INDIRECT_JUMP          = 10,
+    CTRDATA_TYPE_DIRECT_JUMP            = 11,
+    CTRDATA_TYPE_CO_ROUTINE_SWAP        = 12,
+    CTRDATA_TYPE_RETURN                 = 13,
+    CTRDATA_TYPE_OTHER_INDIRECT_JUMP    = 14,
+    CTRDATA_TYPE_OTHER_DIRECT_JUMP      = 15,
+} CTRType;
+
 /* MISELECT, SISELECT, and VSISELECT bits (AIA) */
 #define ISELECT_IPRIO0                     0x30
 #define ISELECT_IPRIO15                    0x3f
-- 
2.48.1

From: Rajnesh Kanwal <rkanwal@rivosinc.com>

This commit adds support for [m|s|vs]ctrcontrol, sctrstatus and
sctrdepth CSRs handling.

Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250205-b4-ctr_upstream_v6-v6-3-439d8e06c8ef@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h     |   5 ++
 target/riscv/cpu_cfg.h |   2 +
 target/riscv/csr.c     | 144 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 151 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     target_ulong mcause;
     target_ulong mtval;  /* since: priv-1.10.0 */
 
+    uint64_t mctrctl;
+    uint32_t sctrdepth;
+    uint32_t sctrstatus;
+    uint64_t vsctrctl;
+
     /* Machine and Supervisor interrupt priorities */
     uint8_t miprio[64];
     uint8_t siprio[64];
diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zvfhmin;
     bool ext_smaia;
     bool ext_ssaia;
+    bool ext_smctr;
+    bool ext_ssctr;
     bool ext_sscofpmf;
     bool ext_smepmp;
     bool ext_smrnmi;
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException hgatp(CPURISCVState *env, int csrno)
     return hmode(env, csrno);
 }
 
+/*
+ * M-mode:
+ * Without ext_smctr raise illegal inst excep.
+ * Otherwise everything is accessible to m-mode.
+ *
+ * S-mode:
+ * Without ext_ssctr or mstateen.ctr raise illegal inst excep.
+ * Otherwise everything other than mctrctl is accessible.
+ *
+ * VS-mode:
+ * Without ext_ssctr or mstateen.ctr raise illegal inst excep.
+ * Without hstateen.ctr raise virtual illegal inst excep.
+ * Otherwise allow sctrctl (vsctrctl), sctrstatus, 0x200-0x2ff entry range.
+ * Always raise illegal instruction exception for sctrdepth.
+ */
+static RISCVException ctr_mmode(CPURISCVState *env, int csrno)
+{
+    /* Check if smctr-ext is present */
+    if (riscv_cpu_cfg(env)->ext_smctr) {
+        return RISCV_EXCP_NONE;
+    }
+
+    return RISCV_EXCP_ILLEGAL_INST;
+}
+
+static RISCVException ctr_smode(CPURISCVState *env, int csrno)
+{
+    const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
+
+    if (!cfg->ext_smctr && !cfg->ext_ssctr) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    RISCVException ret = smstateen_acc_ok(env, 0, SMSTATEEN0_CTR);
+    if (ret == RISCV_EXCP_NONE && csrno == CSR_SCTRDEPTH &&
+        env->virt_enabled) {
+        return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+    }
+
+    return ret;
+}
+
 static RISCVException aia_hmode(CPURISCVState *env, int csrno)
 {
     int ret;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
         wr_mask |= (SMSTATEEN0_AIA | SMSTATEEN0_IMSIC);
     }
 
+    if (riscv_cpu_cfg(env)->ext_ssctr) {
+        wr_mask |= SMSTATEEN0_CTR;
+    }
+
     return write_mstateen(env, csrno, wr_mask, new_val);
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
         wr_mask |= SMSTATEEN0_P1P13;
     }
 
+    if (riscv_cpu_cfg(env)->ext_ssctr) {
+        wr_mask |= SMSTATEEN0_CTR;
+    }
+
     return write_mstateenh(env, csrno, wr_mask, new_val);
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
         wr_mask |= (SMSTATEEN0_AIA | SMSTATEEN0_IMSIC);
     }
 
+    if (riscv_cpu_cfg(env)->ext_ssctr) {
+        wr_mask |= SMSTATEEN0_CTR;
+    }
+
     return write_hstateen(env, csrno, wr_mask, new_val);
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
+    if (riscv_cpu_cfg(env)->ext_ssctr) {
+        wr_mask |= SMSTATEEN0_CTR;
+    }
+
     return write_hstateenh(env, csrno, wr_mask, new_val);
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_satp(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+static RISCVException rmw_sctrdepth(CPURISCVState *env, int csrno,
+                                    target_ulong *ret_val,
+                                    target_ulong new_val, target_ulong wr_mask)
+{
+    uint64_t mask = wr_mask & SCTRDEPTH_MASK;
+
+    if (ret_val) {
+        *ret_val = env->sctrdepth;
+    }
+
+    env->sctrdepth = (env->sctrdepth & ~mask) | (new_val & mask);
+
+    /* Correct depth. */
+    if (mask) {
+        uint64_t depth = get_field(env->sctrdepth, SCTRDEPTH_MASK);
+
+        if (depth > SCTRDEPTH_MAX) {
+            depth = SCTRDEPTH_MAX;
+            env->sctrdepth = set_field(env->sctrdepth, SCTRDEPTH_MASK, depth);
+        }
+
+        /* Update sctrstatus.WRPTR with a legal value */
+        depth = 16 << depth;
+        env->sctrstatus =
+            env->sctrstatus & (~SCTRSTATUS_WRPTR_MASK | (depth - 1));
+    }
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException rmw_sctrstatus(CPURISCVState *env, int csrno,
+                                     target_ulong *ret_val,
+                                     target_ulong new_val, target_ulong wr_mask)
+{
+    uint32_t depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
+    uint32_t mask = wr_mask & SCTRSTATUS_MASK;
+
+    if (ret_val) {
+        *ret_val = env->sctrstatus;
+    }
+
+    env->sctrstatus = (env->sctrstatus & ~mask) | (new_val & mask);
+
+    /* Update sctrstatus.WRPTR with a legal value */
+    env->sctrstatus = env->sctrstatus & (~SCTRSTATUS_WRPTR_MASK | (depth - 1));
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException rmw_xctrctl(CPURISCVState *env, int csrno,
+                                    target_ulong *ret_val,
+                                    target_ulong new_val, target_ulong wr_mask)
+{
+    uint64_t csr_mask, mask = wr_mask;
+    uint64_t *ctl_ptr = &env->mctrctl;
+
+    if (csrno == CSR_MCTRCTL) {
+        csr_mask = MCTRCTL_MASK;
+    } else if (csrno == CSR_SCTRCTL && !env->virt_enabled) {
+        csr_mask = SCTRCTL_MASK;
+    } else {
+        /*
+         * This is for csrno == CSR_SCTRCTL and env->virt_enabled == true
+         * or csrno == CSR_VSCTRCTL.
+         */
+        csr_mask = VSCTRCTL_MASK;
+        ctl_ptr = &env->vsctrctl;
+    }
+
+    mask &= csr_mask;
+
+    if (ret_val) {
+        *ret_val = *ctl_ptr & csr_mask;
+    }
+
+    *ctl_ptr = (*ctl_ptr & ~mask) | (new_val & mask);
+
+    return RISCV_EXCP_NONE;
+}
+
 static RISCVException read_vstopi(CPURISCVState *env, int csrno,
                                   target_ulong *val)
 {
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_TINFO]     =  { "tinfo",    debug, read_tinfo,    write_ignore   },
     [CSR_MCONTEXT]  =  { "mcontext", debug, read_mcontext, write_mcontext },
 
+    [CSR_MCTRCTL]    = { "mctrctl",    ctr_mmode,  NULL, NULL, rmw_xctrctl    },
+    [CSR_SCTRCTL]    = { "sctrctl",    ctr_smode,  NULL, NULL, rmw_xctrctl    },
+    [CSR_VSCTRCTL]   = { "vsctrctl",   ctr_smode,  NULL, NULL, rmw_xctrctl    },
+    [CSR_SCTRDEPTH]  = { "sctrdepth",  ctr_smode,  NULL, NULL, rmw_sctrdepth  },
+    [CSR_SCTRSTATUS] = { "sctrstatus", ctr_smode,  NULL, NULL, rmw_sctrstatus },
+
     /* Performance Counters */
     [CSR_HPMCOUNTER3]    = { "hpmcounter3",    ctr,    read_hpmcounter },
     [CSR_HPMCOUNTER4]    = { "hpmcounter4",    ctr,    read_hpmcounter },
-- 
2.48.1

From: Rajnesh Kanwal <rkanwal@rivosinc.com>

This commit adds logic to records CTR entries of different types
and adds required hooks in TCG and interrupt/Exception logic to
record events.

This commit also adds support to invoke freeze CTR logic for breakpoint
exceptions and counter overflow interrupts.

Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250205-b4-ctr_upstream_v6-v6-4-439d8e06c8ef@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                            |   7 +
 target/riscv/helper.h                         |   1 +
 target/riscv/cpu_helper.c                     | 259 ++++++++++++++++++
 target/riscv/op_helper.c                      |  19 ++
 target/riscv/translate.c                      |  46 ++++
 .../riscv/insn_trans/trans_privileged.c.inc   |   2 +
 target/riscv/insn_trans/trans_rvi.c.inc       |  75 +++++
 target/riscv/insn_trans/trans_rvzce.c.inc     |  21 ++
 8 files changed, 430 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     uint32_t sctrstatus;
     uint64_t vsctrctl;
 
+    uint64_t ctr_src[16 << SCTRDEPTH_MAX];
+    uint64_t ctr_dst[16 << SCTRDEPTH_MAX];
+    uint64_t ctr_data[16 << SCTRDEPTH_MAX];
+
     /* Machine and Supervisor interrupt priorities */
     uint8_t miprio[64];
     uint8_t siprio[64];
@@ -XXX,XX +XXX,XX @@ RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit);
 
 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv, bool virt_en);
 
+void riscv_ctr_add_entry(CPURISCVState *env, target_long src, target_long dst,
+    enum CTRType type, target_ulong prev_priv, bool prev_virt);
+
 void riscv_translate_init(void);
 void riscv_translate_code(CPUState *cs, TranslationBlock *tb,
                           int *max_insns, vaddr pc, void *host_pc);
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(wfi, void, env)
 DEF_HELPER_1(wrs_nto, void, env)
 DEF_HELPER_1(tlb_flush, void, env)
 DEF_HELPER_1(tlb_flush_all, void, env)
+DEF_HELPER_4(ctr_add_entry, void, env, tl, tl, tl)
 /* Native Debug */
 DEF_HELPER_1(itrigger_match, void, env)
 #endif
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_aia_ireg_rmw_fn(CPURISCVState *env, uint32_t priv,
     }
 }
 
+static void riscv_ctr_freeze(CPURISCVState *env, uint64_t freeze_mask,
+                             bool virt)
+{
+    uint64_t ctl = virt ? env->vsctrctl : env->mctrctl;
+
+    assert((freeze_mask & (~(XCTRCTL_BPFRZ | XCTRCTL_LCOFIFRZ))) == 0);
+
+    if (ctl & freeze_mask) {
+        env->sctrstatus |= SCTRSTATUS_FROZEN;
+    }
+}
+
+static uint64_t riscv_ctr_priv_to_mask(target_ulong priv, bool virt)
+{
+    switch (priv) {
+    case PRV_M:
+        return MCTRCTL_M;
+    case PRV_S:
+        if (virt) {
+            return XCTRCTL_S;
+        }
+        return XCTRCTL_S;
+    case PRV_U:
+        if (virt) {
+            return XCTRCTL_U;
+        }
+        return XCTRCTL_U;
+    }
+
+    g_assert_not_reached();
+}
+
+static uint64_t riscv_ctr_get_control(CPURISCVState *env, target_long priv,
+                                      bool virt)
+{
+    switch (priv) {
+    case PRV_M:
+        return env->mctrctl;
+    case PRV_S:
+    case PRV_U:
+        if (virt) {
+            return env->vsctrctl;
+        }
+        return env->mctrctl;
+    }
+
+    g_assert_not_reached();
+}
+
+/*
+ * This function assumes that src privilege and target privilege are not same
+ * and src privilege is less than target privilege. This includes the virtual
+ * state as well.
+ */
+static bool riscv_ctr_check_xte(CPURISCVState *env, target_long src_prv,
+                                bool src_virt)
+{
+    target_long tgt_prv = env->priv;
+    bool res = true;
+
+    /*
+     * VS and U mode are same in terms of xTE bits required to record an
+     * external trap. See 6.1.2. External Traps, table 8 External Trap Enable
+     * Requirements. This changes VS to U to simplify the logic a bit.
+     */
+    if (src_virt && src_prv == PRV_S) {
+        src_prv = PRV_U;
+    } else if (env->virt_enabled && tgt_prv == PRV_S) {
+        tgt_prv = PRV_U;
+    }
+
+    /* VU mode is an outlier here. */
+    if (src_virt && src_prv == PRV_U) {
+        res &= !!(env->vsctrctl & XCTRCTL_STE);
+    }
+
+    switch (src_prv) {
+    case PRV_U:
+        if (tgt_prv == PRV_U) {
+            break;
+        }
+        res &= !!(env->mctrctl & XCTRCTL_STE);
+        /* fall-through */
+    case PRV_S:
+        if (tgt_prv == PRV_S) {
+            break;
+        }
+        res &= !!(env->mctrctl & MCTRCTL_MTE);
+        /* fall-through */
+    case PRV_M:
+        break;
+    }
+
+    return res;
+}
+
+/*
+ * Special cases for traps and trap returns:
+ *
+ * 1- Traps, and trap returns, between enabled modes are recorded as normal.
+ * 2- Traps from an inhibited mode to an enabled mode, and trap returns from an
+ * enabled mode back to an inhibited mode, are partially recorded.  In such
+ * cases, the PC from the inhibited mode (source PC for traps, and target PC
+ * for trap returns) is 0.
+ *
+ * 3- Trap returns from an inhibited mode to an enabled mode are not recorded.
+ * Traps from an enabled mode to an inhibited mode, known as external traps,
+ * receive special handling.
+ * By default external traps are not recorded, but a handshake mechanism exists
+ * to allow partial recording.  Software running in the target mode of the trap
+ * can opt-in to allowing CTR to record traps into that mode even when the mode
+ * is inhibited.  The MTE, STE, and VSTE bits allow M-mode, S-mode, and VS-mode,
+ * respectively, to opt-in. When an External Trap occurs, and xTE=1, such that
+ * x is the target privilege mode of the trap, will CTR record the trap. In such
+ * cases, the target PC is 0.
+ */
+/*
+ * CTR arrays are implemented as circular buffers and new entry is stored at
+ * sctrstatus.WRPTR, but they are presented to software as moving circular
+ * buffers. Which means, software get's the illusion that whenever a new entry
+ * is added the whole buffer is moved by one place and the new entry is added at
+ * the start keeping new entry at idx 0 and older ones follow.
+ *
+ * Depth = 16.
+ *
+ * buffer [0] [1] [2] [3] [4] [5] [6] [7] [8] [9] [A] [B] [C] [D] [E] [F]
+ * WRPTR                                   W
+ * entry   7   6   5   4   3   2   1   0   F   E   D   C   B   A   9   8
+ *
+ * When a new entry is added:
+ * buffer [0] [1] [2] [3] [4] [5] [6] [7] [8] [9] [A] [B] [C] [D] [E] [F]
+ * WRPTR                                       W
+ * entry   8   7   6   5   4   3   2   1   0   F   E   D   C   B   A   9
+ *
+ * entry here denotes the logical entry number that software can access
+ * using ctrsource, ctrtarget and ctrdata registers. So xiselect 0x200
+ * will return entry 0 i-e buffer[8] and 0x201 will return entry 1 i-e
+ * buffer[7]. Here is how we convert entry to buffer idx.
+ *
+ *    entry = isel - CTR_ENTRIES_FIRST;
+ *    idx = (sctrstatus.WRPTR - entry - 1) & (depth - 1);
+ */
+void riscv_ctr_add_entry(CPURISCVState *env, target_long src, target_long dst,
+    enum CTRType type, target_ulong src_priv, bool src_virt)
+{
+    bool tgt_virt = env->virt_enabled;
+    uint64_t src_mask = riscv_ctr_priv_to_mask(src_priv, src_virt);
+    uint64_t tgt_mask = riscv_ctr_priv_to_mask(env->priv, tgt_virt);
+    uint64_t src_ctrl = riscv_ctr_get_control(env, src_priv, src_virt);
+    uint64_t tgt_ctrl = riscv_ctr_get_control(env, env->priv, tgt_virt);
+    uint64_t depth, head;
+    bool ext_trap = false;
+
+    /*
+     * Return immediately if both target and src recording is disabled or if
+     * CTR is in frozen state.
+     */
+    if ((!(src_ctrl & src_mask) && !(tgt_ctrl & tgt_mask)) ||
+        env->sctrstatus & SCTRSTATUS_FROZEN) {
+        return;
+    }
+
+    /*
+     * With RAS Emul enabled, only allow Indirect, direct calls, Function
+     * returns and Co-routine swap types.
+     */
+    if (tgt_ctrl & XCTRCTL_RASEMU &&
+        type != CTRDATA_TYPE_INDIRECT_CALL &&
+        type != CTRDATA_TYPE_DIRECT_CALL &&
+        type != CTRDATA_TYPE_RETURN &&
+        type != CTRDATA_TYPE_CO_ROUTINE_SWAP) {
+        return;
+    }
+
+    if (type == CTRDATA_TYPE_EXCEPTION || type == CTRDATA_TYPE_INTERRUPT) {
+        /* Case 2 for traps. */
+        if (!(src_ctrl & src_mask)) {
+            src = 0;
+        } else if (!(tgt_ctrl & tgt_mask)) {
+            /* Check if target priv-mode has allowed external trap recording. */
+            if (!riscv_ctr_check_xte(env, src_priv, src_virt)) {
+                return;
+            }
+
+            ext_trap = true;
+            dst = 0;
+        }
+    } else if (type == CTRDATA_TYPE_EXCEP_INT_RET) {
+        /*
+         * Case 3 for trap returns.  Trap returns from inhibited mode are not
+         * recorded.
+         */
+        if (!(src_ctrl & src_mask)) {
+            return;
+        }
+
+        /* Case 2 for trap returns. */
+        if (!(tgt_ctrl & tgt_mask)) {
+            dst = 0;
+        }
+    }
+
+    /* Ignore filters in case of RASEMU mode or External trap. */
+    if (!(tgt_ctrl & XCTRCTL_RASEMU) && !ext_trap) {
+        /*
+         * Check if the specific type is inhibited. Not taken branch filter is
+         * an enable bit and needs to be checked separatly.
+         */
+        bool check = tgt_ctrl & BIT_ULL(type + XCTRCTL_INH_START);
+        if ((type == CTRDATA_TYPE_NONTAKEN_BRANCH && !check) ||
+            (type != CTRDATA_TYPE_NONTAKEN_BRANCH && check)) {
+            return;
+        }
+    }
+
+    head = get_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK);
+
+    depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
+    if (tgt_ctrl & XCTRCTL_RASEMU && type == CTRDATA_TYPE_RETURN) {
+        head = (head - 1) & (depth - 1);
+
+        env->ctr_src[head] &= ~CTRSOURCE_VALID;
+        env->sctrstatus =
+            set_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK, head);
+        return;
+    }
+
+    /* In case of Co-routine SWAP we overwrite latest entry. */
+    if (tgt_ctrl & XCTRCTL_RASEMU && type == CTRDATA_TYPE_CO_ROUTINE_SWAP) {
+        head = (head - 1) & (depth - 1);
+    }
+
+    env->ctr_src[head] = src | CTRSOURCE_VALID;
+    env->ctr_dst[head] = dst & ~CTRTARGET_MISP;
+    env->ctr_data[head] = set_field(0, CTRDATA_TYPE_MASK, type);
+
+    head = (head + 1) & (depth - 1);
+
+    env->sctrstatus = set_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK, head);
+}
+
 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv, bool virt_en)
 {
     g_assert(newpriv <= PRV_M && newpriv != PRV_RESERVED);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         !(env->mip & (1ULL << cause));
     bool smode_double_trap = false;
     uint64_t hdeleg = async ? env->hideleg : env->hedeleg;
+    const bool prev_virt = env->virt_enabled;
+    const target_ulong prev_priv = env->priv;
     target_ulong tval = 0;
     target_ulong tinst = 0;
     target_ulong htval = 0;
     target_ulong mtval2 = 0;
+    target_ulong src;
     int sxlen = 0;
     int mxlen = 16 << riscv_cpu_mxl(env);
     bool nnmi_excep = false;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         env->pc = (env->stvec >> 2 << 2) +
                   ((async && (env->stvec & 3) == 1) ? cause * 4 : 0);
         riscv_cpu_set_mode(env, PRV_S, virt);
+
+        src = env->sepc;
     } else {
         /*
          * If the hart encounters an exception while executing in M-mode
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
                       ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
         }
         riscv_cpu_set_mode(env, PRV_M, virt);
+        src = env->mepc;
+    }
+
+    if (riscv_cpu_cfg(env)->ext_smctr || riscv_cpu_cfg(env)->ext_ssctr) {
+        if (async && cause == IRQ_PMU_OVF) {
+            riscv_ctr_freeze(env, XCTRCTL_LCOFIFRZ, virt);
+        } else if (!async && cause == RISCV_EXCP_BREAKPOINT) {
+            riscv_ctr_freeze(env, XCTRCTL_BPFRZ, virt);
+        }
+
+        riscv_ctr_add_entry(env, src, env->pc,
+                        async ? CTRDATA_TYPE_INTERRUPT : CTRDATA_TYPE_EXCEPTION,
+                        prev_priv, prev_virt);
     }
 
     /*
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
 {
     uint64_t mstatus;
     target_ulong prev_priv, prev_virt = env->virt_enabled;
+    const target_ulong src_priv = env->priv;
+    const bool src_virt = env->virt_enabled;
 
     if (!(env->priv >= PRV_S)) {
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
     }
     env->mstatus = set_field(env->mstatus, MSTATUS_SPELP, 0);
 
+    if (riscv_cpu_cfg(env)->ext_smctr || riscv_cpu_cfg(env)->ext_ssctr) {
+        riscv_ctr_add_entry(env, env->pc, retpc, CTRDATA_TYPE_EXCEP_INT_RET,
+                            src_priv, src_virt);
+    }
+
     return retpc;
 }
 
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
     }
     env->mstatus = set_field(env->mstatus, MSTATUS_MPELP, 0);
 
+    if (riscv_cpu_cfg(env)->ext_smctr || riscv_cpu_cfg(env)->ext_ssctr) {
+        riscv_ctr_add_entry(env, env->pc, retpc, CTRDATA_TYPE_EXCEP_INT_RET,
+                            PRV_M, false);
+    }
+
     return retpc;
 }
 
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mnret(CPURISCVState *env)
     return retpc;
 }
 
+void helper_ctr_add_entry(CPURISCVState *env, target_ulong src,
+                          target_ulong dest, target_ulong type)
+{
+    riscv_ctr_add_entry(env, src, dest, (enum CTRType)type,
+                        env->priv, env->virt_enabled);
+}
+
 void helper_wfi(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_set_fpr_d(DisasContext *ctx, int reg_num, TCGv_i64 t)
     }
 }
 
+#ifndef CONFIG_USER_ONLY
+/*
+ * Direct calls
+ * - jal x1;
+ * - jal x5;
+ * - c.jal.
+ * - cm.jalt.
+ *
+ * Direct jumps
+ * - jal x0;
+ * - c.j;
+ * - cm.jt.
+ *
+ * Other direct jumps
+ * - jal rd where rd != x1 and rd != x5 and rd != x0;
+ */
+static void gen_ctr_jal(DisasContext *ctx, int rd, target_ulong imm)
+{
+    TCGv dest = tcg_temp_new();
+    TCGv src = tcg_temp_new();
+    TCGv type;
+
+    /*
+     * If rd is x1 or x5 link registers, treat this as direct call otherwise
+     * its a direct jump.
+     */
+    if (rd == 1 || rd == 5) {
+        type = tcg_constant_tl(CTRDATA_TYPE_DIRECT_CALL);
+    } else if (rd == 0) {
+        type = tcg_constant_tl(CTRDATA_TYPE_DIRECT_JUMP);
+    } else {
+        type = tcg_constant_tl(CTRDATA_TYPE_OTHER_DIRECT_JUMP);
+    }
+
+    gen_pc_plus_diff(dest, ctx, imm);
+    gen_pc_plus_diff(src, ctx, 0);
+    gen_helper_ctr_add_entry(tcg_env, src, dest, type);
+}
+#endif
+
 static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
 {
     TCGv succ_pc = dest_gpr(ctx, rd);
@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
         }
     }
 
+#ifndef CONFIG_USER_ONLY
+    if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
+        gen_ctr_jal(ctx, rd, imm);
+    }
+#endif
+
     gen_pc_plus_diff(succ_pc, ctx, ctx->cur_insn_len);
     gen_set_gpr(ctx, rd, succ_pc);
 
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
     if (has_ext(ctx, RVS)) {
         decode_save_opc(ctx, 0);
         translator_io_start(&ctx->base);
+        gen_update_pc(ctx, 0);
         gen_helper_sret(cpu_pc, tcg_env);
         exit_tb(ctx); /* no chaining */
         ctx->base.is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
 #ifndef CONFIG_USER_ONLY
     decode_save_opc(ctx, 0);
     translator_io_start(&ctx->base);
+    gen_update_pc(ctx, 0);
     gen_helper_mret(cpu_pc, tcg_env);
     exit_tb(ctx); /* no chaining */
     ctx->base.is_jmp = DISAS_NORETURN;
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_jal(DisasContext *ctx, arg_jal *a)
     return true;
 }
 
+#ifndef CONFIG_USER_ONLY
+/*
+ * Indirect calls
+ * - jalr x1, rs where rs != x5;
+ * - jalr x5, rs where rs != x1;
+ * - c.jalr rs1 where rs1 != x5;
+ *
+ * Indirect jumps
+ * - jalr x0, rs where rs != x1 and rs != x5;
+ * - c.jr rs1 where rs1 != x1 and rs1 != x5.
+ *
+ * Returns
+ * - jalr rd, rs where (rs == x1 or rs == x5) and rd != x1 and rd != x5;
+ * - c.jr rs1 where rs1 == x1 or rs1 == x5.
+ *
+ * Co-routine swap
+ * - jalr x1, x5;
+ * - jalr x5, x1;
+ * - c.jalr x5.
+ *
+ * Other indirect jumps
+ * - jalr rd, rs where rs != x1, rs != x5, rd != x0, rd != x1 and rd != x5.
+ */
+static void gen_ctr_jalr(DisasContext *ctx, arg_jalr *a, TCGv dest)
+{
+    TCGv src = tcg_temp_new();
+    TCGv type;
+
+    if ((a->rd == 1 && a->rs1 != 5) || (a->rd == 5 && a->rs1 != 1)) {
+        type = tcg_constant_tl(CTRDATA_TYPE_INDIRECT_CALL);
+    } else if (a->rd == 0 && a->rs1 != 1 && a->rs1 != 5) {
+        type = tcg_constant_tl(CTRDATA_TYPE_INDIRECT_JUMP);
+    } else if ((a->rs1 == 1 || a->rs1 == 5) && (a->rd != 1 && a->rd != 5)) {
+        type = tcg_constant_tl(CTRDATA_TYPE_RETURN);
+    } else if ((a->rs1 == 1 && a->rd == 5) || (a->rs1 == 5 && a->rd == 1)) {
+        type = tcg_constant_tl(CTRDATA_TYPE_CO_ROUTINE_SWAP);
+    } else {
+        type = tcg_constant_tl(CTRDATA_TYPE_OTHER_INDIRECT_JUMP);
+    }
+
+    gen_pc_plus_diff(src, ctx, 0);
+    gen_helper_ctr_add_entry(tcg_env, src, dest, type);
+}
+#endif
+
 static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
 {
     TCGLabel *misaligned = NULL;
@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
     gen_pc_plus_diff(succ_pc, ctx, ctx->cur_insn_len);
     gen_set_gpr(ctx, a->rd, succ_pc);
 
+#ifndef CONFIG_USER_ONLY
+    if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
+        gen_ctr_jalr(ctx, a, target_pc);
+    }
+#endif
+
     tcg_gen_mov_tl(cpu_pc, target_pc);
     if (ctx->fcfi_enabled) {
         /*
@@ -XXX,XX +XXX,XX @@ static bool gen_branch(DisasContext *ctx, arg_b *a, TCGCond cond)
     } else {
         tcg_gen_brcond_tl(cond, src1, src2, l);
     }
+
+#ifndef CONFIG_USER_ONLY
+    if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
+        TCGv type = tcg_constant_tl(CTRDATA_TYPE_NONTAKEN_BRANCH);
+        TCGv dest = tcg_temp_new();
+        TCGv src = tcg_temp_new();
+
+        gen_pc_plus_diff(src, ctx, 0);
+        gen_pc_plus_diff(dest, ctx, ctx->cur_insn_len);
+        gen_helper_ctr_add_entry(tcg_env, src, dest, type);
+    }
+#endif
+
     gen_goto_tb(ctx, 1, ctx->cur_insn_len);
     ctx->pc_save = orig_pc_save;
 
@@ -XXX,XX +XXX,XX @@ static bool gen_branch(DisasContext *ctx, arg_b *a, TCGCond cond)
         gen_pc_plus_diff(target_pc, ctx, a->imm);
         gen_exception_inst_addr_mis(ctx, target_pc);
     } else {
+#ifndef CONFIG_USER_ONLY
+        if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
+            TCGv type = tcg_constant_tl(CTRDATA_TYPE_TAKEN_BRANCH);
+            TCGv dest = tcg_temp_new();
+            TCGv src = tcg_temp_new();
+
+            gen_pc_plus_diff(src, ctx, 0);
+            gen_pc_plus_diff(dest, ctx, a->imm);
+            gen_helper_ctr_add_entry(tcg_env, src, dest, type);
+        }
+#endif
         gen_goto_tb(ctx, 0, a->imm);
     }
     ctx->pc_save = -1;
diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzce.c.inc
+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
@@ -XXX,XX +XXX,XX @@ static bool gen_pop(DisasContext *ctx, arg_cmpp *a, bool ret, bool ret_val)
 
     if (ret) {
         TCGv ret_addr = get_gpr(ctx, xRA, EXT_SIGN);
+#ifndef CONFIG_USER_ONLY
+        if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
+            TCGv type = tcg_constant_tl(CTRDATA_TYPE_RETURN);
+            TCGv src = tcg_temp_new();
+            gen_pc_plus_diff(src, ctx, 0);
+            gen_helper_ctr_add_entry(tcg_env, src, ret_addr, type);
+        }
+#endif
         tcg_gen_mov_tl(cpu_pc, ret_addr);
         tcg_gen_lookup_and_goto_ptr();
         ctx->base.is_jmp = DISAS_NORETURN;
@@ -XXX,XX +XXX,XX @@ static bool trans_cm_jalt(DisasContext *ctx, arg_cm_jalt *a)
         gen_set_gpr(ctx, xRA, succ_pc);
     }
 
+#ifndef CONFIG_USER_ONLY
+    if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
+        if (a->index >= 32) {
+            TCGv type = tcg_constant_tl(CTRDATA_TYPE_DIRECT_CALL);
+            gen_helper_ctr_add_entry(tcg_env, cpu_pc, addr, type);
+        } else {
+            TCGv type = tcg_constant_tl(CTRDATA_TYPE_DIRECT_JUMP);
+            gen_helper_ctr_add_entry(tcg_env, cpu_pc, addr, type);
+        }
+    }
+#endif
+
+
     tcg_gen_mov_tl(cpu_pc, addr);
 
     tcg_gen_lookup_and_goto_ptr();
-- 
2.48.1

From: Rajnesh Kanwal <rkanwal@rivosinc.com>

CTR extension adds a new instruction sctrclr to quickly
clear the recorded entries buffer.

Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250205-b4-ctr_upstream_v6-v6-5-439d8e06c8ef@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                            |  1 +
 target/riscv/helper.h                         |  1 +
 target/riscv/insn32.decode                    |  1 +
 target/riscv/cpu_helper.c                     |  7 +++++
 target/riscv/op_helper.c                      | 29 +++++++++++++++++++
 .../riscv/insn_trans/trans_privileged.c.inc   | 11 +++++++
 6 files changed, 50 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv, bool virt_en);
 
 void riscv_ctr_add_entry(CPURISCVState *env, target_long src, target_long dst,
     enum CTRType type, target_ulong prev_priv, bool prev_virt);
+void riscv_ctr_clear(CPURISCVState *env);
 
 void riscv_translate_init(void);
 void riscv_translate_code(CPUState *cs, TranslationBlock *tb,
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
 DEF_HELPER_1(sret, tl, env)
 DEF_HELPER_1(mret, tl, env)
 DEF_HELPER_1(mnret, tl, env)
+DEF_HELPER_1(ctr_clear, void, env)
 DEF_HELPER_1(wfi, void, env)
 DEF_HELPER_1(wrs_nto, void, env)
 DEF_HELPER_1(tlb_flush, void, env)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 # *** Privileged Instructions ***
 ecall       000000000000     00000 000 00000 1110011
 ebreak      000000000001     00000 000 00000 1110011
+sctrclr     000100000100     00000 000 00000 1110011
 uret        0000000    00010 00000 000 00000 1110011
 sret        0001000    00010 00000 000 00000 1110011
 mret        0011000    00010 00000 000 00000 1110011
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void riscv_ctr_freeze(CPURISCVState *env, uint64_t freeze_mask,
     }
 }
 
+void riscv_ctr_clear(CPURISCVState *env)
+{
+    memset(env->ctr_src, 0x0, sizeof(env->ctr_src));
+    memset(env->ctr_dst, 0x0, sizeof(env->ctr_dst));
+    memset(env->ctr_data, 0x0, sizeof(env->ctr_data));
+}
+
 static uint64_t riscv_ctr_priv_to_mask(target_ulong priv, bool virt)
 {
     switch (priv) {
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_ctr_add_entry(CPURISCVState *env, target_ulong src,
                         env->priv, env->virt_enabled);
 }
 
+void helper_ctr_clear(CPURISCVState *env)
+{
+    /*
+     * It's safe to call smstateen_acc_ok() for umode access regardless of the
+     * state of bit 54 (CTR bit in case of m/hstateen) of sstateen. If the bit
+     * is zero, smstateen_acc_ok() will return the correct exception code and
+     * if it's one, smstateen_acc_ok() will return RISCV_EXCP_NONE. In that
+     * scenario the U-mode check below will handle that case.
+     */
+    RISCVException ret = smstateen_acc_ok(env, 0, SMSTATEEN0_CTR);
+    if (ret != RISCV_EXCP_NONE) {
+        riscv_raise_exception(env, ret, GETPC());
+    }
+
+    if (env->priv == PRV_U) {
+        /*
+         * One corner case is when sctrclr is executed from VU-mode and
+         * mstateen.CTR = 0, in which case we are supposed to raise
+         * RISCV_EXCP_ILLEGAL_INST. This case is already handled in
+         * smstateen_acc_ok().
+         */
+        uint32_t excep = env->virt_enabled ? RISCV_EXCP_VIRT_INSTRUCTION_FAULT :
+            RISCV_EXCP_ILLEGAL_INST;
+        riscv_raise_exception(env, excep, GETPC());
+    }
+
+    riscv_ctr_clear(env);
+}
+
 void helper_wfi(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
     return true;
 }
 
+static bool trans_sctrclr(DisasContext *ctx, arg_sctrclr *a)
+{
+#ifndef CONFIG_USER_ONLY
+    if (ctx->cfg_ptr->ext_smctr || ctx->cfg_ptr->ext_ssctr) {
+        gen_helper_ctr_clear(tcg_env);
+        return true;
+    }
+#endif
+    return false;
+}
+
 static bool trans_uret(DisasContext *ctx, arg_uret *a)
 {
     return false;
-- 
2.48.1

From: Rajnesh Kanwal <rkanwal@rivosinc.com>

Add a subsection to machine.c to migrate CTR CSR state

Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250205-b4-ctr_upstream_v6-v6-6-439d8e06c8ef@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/machine.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_envcfg = {
     }
 };
 
+static bool ctr_needed(void *opaque)
+{
+    RISCVCPU *cpu = opaque;
+
+    return cpu->cfg.ext_smctr || cpu->cfg.ext_ssctr;
+}
+
+static const VMStateDescription vmstate_ctr = {
+    .name = "cpu/ctr",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = ctr_needed,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT64(env.mctrctl, RISCVCPU),
+        VMSTATE_UINT32(env.sctrdepth, RISCVCPU),
+        VMSTATE_UINT32(env.sctrstatus, RISCVCPU),
+        VMSTATE_UINT64(env.vsctrctl, RISCVCPU),
+        VMSTATE_UINT64_ARRAY(env.ctr_src, RISCVCPU, 16 << SCTRDEPTH_MAX),
+        VMSTATE_UINT64_ARRAY(env.ctr_dst, RISCVCPU, 16 << SCTRDEPTH_MAX),
+        VMSTATE_UINT64_ARRAY(env.ctr_data, RISCVCPU, 16 << SCTRDEPTH_MAX),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static bool pmu_needed(void *opaque)
 {
     RISCVCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
         &vmstate_jvt,
         &vmstate_elp,
         &vmstate_ssp,
+        &vmstate_ctr,
         NULL
     }
 };
-- 
2.48.1

From: julia <midnight@trainwit.ch>

For instance, QEMUs newer than b6ecc63c569bb88c0fcadf79fb92bf4b88aefea8
would silently treat this akin to an unmapped page (as required by the
RISC-V spec, admittedly). However, not all hardware platforms do (e.g.
CVA6) which leads to an apparent QEMU bug.

Instead, log a guest error so that in future, incorrectly set up page
tables can be debugged without bisecting QEMU.

Signed-off-by: julia <midnight@trainwit.ch>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250203061852.2931556-1-midnight@trainwit.ch>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
             ppn = pte >> PTE_PPN_SHIFT;
         } else {
             if (pte & PTE_RESERVED) {
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: reserved bits set in PTE: "
+                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                              __func__, pte_addr, pte);
                 return TRANSLATE_FAIL;
             }
 
             if (!pbmte && (pte & PTE_PBMT)) {
+                /* Reserved without Svpbmt. */
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits set in PTE, "
+                              "and Svpbmt extension is disabled: "
+                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                              __func__, pte_addr, pte);
                 return TRANSLATE_FAIL;
             }
 
             if (!riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
+                /* Reserved without Svnapot extension */
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: N bit set in PTE, "
+                              "and Svnapot extension is disabled: "
+                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                              __func__, pte_addr, pte);
                 return TRANSLATE_FAIL;
             }
 
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
             /* Invalid PTE */
             return TRANSLATE_FAIL;
         }
+
         if (pte & (PTE_R | PTE_W | PTE_X)) {
             goto leaf;
         }
 
-        /* Inner PTE, continue walking */
         if (pte & (PTE_D | PTE_A | PTE_U | PTE_ATTR)) {
+            /* D, A, and U bits are reserved in non-leaf/inner PTEs */
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: D, A, or U bits set in non-leaf PTE: "
+                          "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                          __func__, pte_addr, pte);
             return TRANSLATE_FAIL;
         }
+        /* Inner PTE, continue walking */
         base = ppn << PGSHIFT;
     }
 
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
  leaf:
     if (ppn & ((1ULL << ptshift) - 1)) {
         /* Misaligned PPN */
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: PPN bits in PTE is misaligned: "
+                      "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                      __func__, pte_addr, pte);
         return TRANSLATE_FAIL;
     }
     if (!pbmte && (pte & PTE_PBMT)) {
         /* Reserved without Svpbmt. */
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits set in PTE, "
+                      "and Svpbmt extension is disabled: "
+                      "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                      __func__, pte_addr, pte);
         return TRANSLATE_FAIL;
     }
 
-- 
2.48.1

From: Rob Bradford <rbradford@rivosinc.com>

Some extra spaces made into into the RISC-V opcode data table.

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250206153410.236636-2-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
     { "aes32esi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
     { "aes32dsmi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
     { "aes32dsi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
-    { "aes64ks1i", rv_codec_k_rnum,  rv_fmt_rd_rs1_rnum, NULL, 0, 0, 0 },
+    { "aes64ks1i", rv_codec_k_rnum, rv_fmt_rd_rs1_rnum, NULL, 0, 0, 0 },
     { "aes64ks2", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
     { "aes64im", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
     { "aes64esm", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data rvi_opcode_data[] = {
     { "mop.rr.5", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
     { "mop.rr.6", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
     { "mop.rr.7", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-    { "c.mop.1",  rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
-    { "c.mop.3",  rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
-    { "c.mop.5",  rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
-    { "c.mop.7",  rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
-    { "c.mop.9",  rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "c.mop.1", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "c.mop.3", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "c.mop.5", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "c.mop.7", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
+    { "c.mop.9", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
     { "c.mop.11", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
     { "c.mop.13", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
     { "c.mop.15", rv_codec_ci_none, rv_fmt_none, NULL, 0, 0, 0 },
-- 
2.48.1

From: Rob Bradford <rbradford@rivosinc.com>

This reflects the latest frozen version of the RISC-V Debug
specification (1.0.0-rc4) which includes the Sdtrig extension.

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250206153410.236636-3-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
     case 0x07a1: return "tdata1";
     case 0x07a2: return "tdata2";
     case 0x07a3: return "tdata3";
+    case 0x07a4: return "tinfo";
     case 0x07b0: return "dcsr";
     case 0x07b1: return "dpc";
-    case 0x07b2: return "dscratch";
+    case 0x07b2: return "dscratch0";
+    case 0x07b3: return "dscratch1";
     case 0x0b00: return "mcycle";
     case 0x0b01: return "mtime";
     case 0x0b02: return "minstret";
-- 
2.48.1

From: Atish Patra <atishp@rivosinc.com>

As per the latest privilege specification v1.13[1], the sscofpmf
only reserves first 8 bits of hpmeventX. Update the corresponding
masks accordingly.

[1]https://github.com/riscv/riscv-isa-manual/issues/1578

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250206-pmu_minor_fixes-v2-1-1bb0f4aeb8b4@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum CTRType {
                                             MHPMEVENTH_BIT_VSINH | \
                                             MHPMEVENTH_BIT_VUINH)
 
-#define MHPMEVENT_SSCOF_MASK               _ULL(0xFFFF000000000000)
-#define MHPMEVENT_IDX_MASK                 0xFFFFF
-#define MHPMEVENT_SSCOF_RESVD              16
+#define MHPMEVENT_SSCOF_MASK               MAKE_64BIT_MASK(63, 56)
+#define MHPMEVENT_IDX_MASK                 (~MHPMEVENT_SSCOF_MASK)
 
 /* RISC-V-specific interrupt pending bits. */
 #define CPU_INTERRUPT_RNMI                 CPU_INTERRUPT_TGT_EXT_0
-- 
2.48.1

From: Atish Patra <atishp@rivosinc.com>

As per the ISA definition, the upper 8 bits in hpmevent are defined
by Sscofpmf for privilege mode filtering and overflow bits while the
lower 56 bits are desginated for platform specific hpmevent values.
For the reset case, mhpmevent value should have zero in lower 56 bits.
Software may set the OF bit to indicate disable interrupt.

Ensure that correct value is checked after masking while clearing the
event encodings.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20250206-pmu_minor_fixes-v2-2-1bb0f4aeb8b4@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@ int riscv_pmu_update_event_map(CPURISCVState *env, uint64_t value,
      * Expected mhpmevent value is zero for reset case. Remove the current
      * mapping.
      */
-    if (!value) {
+    if (!(value & MHPMEVENT_IDX_MASK)) {
         g_hash_table_foreach_remove(cpu->pmu_event_ctr_map,
                                     pmu_remove_event_map,
                                     GUINT_TO_POINTER(ctr_idx));
-- 
2.48.1

From: Clément Léger <cleger@rivosinc.com>

As raised by Richard Henderson, these warnings are displayed in user
only as well. Since they aren't really useful for the end-user, remove
them and add a "TODO" note in the leading comments.

Signed-off-by: Clément Léger <cleger@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250213145640.117275-1-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
     }
 
     /*
-     * ext_smrnmi requires OpenSBI changes that our current
+     * TODO: ext_smrnmi requires OpenSBI changes that our current
      * image does not have. Disable it for now.
      */
     if (cpu->cfg.ext_smrnmi) {
         isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_smrnmi), false);
-        qemu_log("Smrnmi is disabled in the 'max' type CPU\n");
     }
 
     /*
-     * ext_smdbltrp requires the firmware to clear MSTATUS.MDT on startup to
-     * avoid generating a double trap. OpenSBI does not currently support it,
+     * TODO: ext_smdbltrp requires the firmware to clear MSTATUS.MDT on startup
+     * to avoid generating a double trap. OpenSBI does not currently support it,
      * disable it for now.
      */
     if (cpu->cfg.ext_smdbltrp) {
         isa_ext_update_enabled(cpu, CPU_CFG_OFFSET(ext_smdbltrp), false);
-        qemu_log("Smdbltrp is disabled in the 'max' type CPU\n");
     }
 }
 
-- 
2.48.1

From: Rajnesh Kanwal <rkanwal@rivosinc.com>

CTR entries are accessed using ctrsource, ctrtarget and ctrdata
registers using smcsrind/sscsrind extension. This commits extends
the csrind extension to support CTR registers.

ctrsource is accessible through xireg CSR, ctrtarget is accessible
through xireg1 and ctrdata is accessible through xireg2 CSR.

CTR supports maximum depth of 256 entries which are accessed using
xiselect range 0x200 to 0x2ff.

This commits also adds properties to enable CTR extension. CTR can be
enabled using smctr=true and ssctr=true now.

Signed-off-by: Rajnesh Kanwal <rkanwal@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250212-b4-ctr_upstream_v6-v7-1-4e8159ea33bf@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c         |  26 ++++++-
 target/riscv/csr.c         | 150 ++++++++++++++++++++++++++++++++++++-
 target/riscv/tcg/tcg-cpu.c |  11 +++
 3 files changed, 185 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(ssu64xl, PRIV_VERSION_1_12_0, has_priv_1_12),
     ISA_EXT_DATA_ENTRY(supm, PRIV_VERSION_1_13_0, ext_supm),
     ISA_EXT_DATA_ENTRY(svade, PRIV_VERSION_1_11_0, ext_svade),
+    ISA_EXT_DATA_ENTRY(smctr, PRIV_VERSION_1_12_0, ext_smctr),
+    ISA_EXT_DATA_ENTRY(ssctr, PRIV_VERSION_1_12_0, ext_ssctr),
     ISA_EXT_DATA_ENTRY(svadu, PRIV_VERSION_1_12_0, ext_svadu),
     ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
     ISA_EXT_DATA_ENTRY(svnapot, PRIV_VERSION_1_12_0, ext_svnapot),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     MULTI_EXT_CFG_BOOL("smcdeleg", ext_smcdeleg, false),
     MULTI_EXT_CFG_BOOL("sscsrind", ext_sscsrind, false),
     MULTI_EXT_CFG_BOOL("ssccfg", ext_ssccfg, false),
+    MULTI_EXT_CFG_BOOL("smctr", ext_smctr, false),
+    MULTI_EXT_CFG_BOOL("ssctr", ext_ssctr, false),
     MULTI_EXT_CFG_BOOL("zifencei", ext_zifencei, true),
     MULTI_EXT_CFG_BOOL("zicfilp", ext_zicfilp, false),
     MULTI_EXT_CFG_BOOL("zicfiss", ext_zicfiss, false),
@@ -XXX,XX +XXX,XX @@ static RISCVCPUImpliedExtsRule SSPM_IMPLIED = {
     },
 };
 
+static RISCVCPUImpliedExtsRule SMCTR_IMPLIED = {
+    .ext = CPU_CFG_OFFSET(ext_smctr),
+    .implied_misa_exts = RVS,
+    .implied_multi_exts = {
+        CPU_CFG_OFFSET(ext_sscsrind),
+
+        RISCV_IMPLIED_EXTS_RULE_END
+    },
+};
+
+static RISCVCPUImpliedExtsRule SSCTR_IMPLIED = {
+    .ext = CPU_CFG_OFFSET(ext_ssctr),
+    .implied_misa_exts = RVS,
+    .implied_multi_exts = {
+        CPU_CFG_OFFSET(ext_sscsrind),
+
+        RISCV_IMPLIED_EXTS_RULE_END
+    },
+};
+
 RISCVCPUImpliedExtsRule *riscv_misa_ext_implied_rules[] = {
     &RVA_IMPLIED, &RVD_IMPLIED, &RVF_IMPLIED,
     &RVM_IMPLIED, &RVV_IMPLIED, NULL
@@ -XXX,XX +XXX,XX @@ RISCVCPUImpliedExtsRule *riscv_multi_ext_implied_rules[] = {
     &ZVFH_IMPLIED, &ZVFHMIN_IMPLIED, &ZVKN_IMPLIED,
     &ZVKNC_IMPLIED, &ZVKNG_IMPLIED, &ZVKNHB_IMPLIED,
     &ZVKS_IMPLIED,  &ZVKSC_IMPLIED, &ZVKSG_IMPLIED, &SSCFG_IMPLIED,
-    &SUPM_IMPLIED, &SSPM_IMPLIED,
+    &SUPM_IMPLIED, &SSPM_IMPLIED, &SMCTR_IMPLIED, &SSCTR_IMPLIED,
     NULL
 };
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static bool xiselect_cd_range(target_ulong isel)
     return (ISELECT_CD_FIRST <= isel && isel <= ISELECT_CD_LAST);
 }
 
+static bool xiselect_ctr_range(int csrno, target_ulong isel)
+{
+    /* MIREG-MIREG6 for the range 0x200-0x2ff are not used by CTR. */
+    return CTR_ENTRIES_FIRST <= isel && isel <= CTR_ENTRIES_LAST &&
+           csrno < CSR_MIREG;
+}
+
 static int rmw_iprio(target_ulong xlen,
                      target_ulong iselect, uint8_t *iprio,
                      target_ulong *val, target_ulong new_val,
@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
     return 0;
 }
 
+static int rmw_ctrsource(CPURISCVState *env, int isel, target_ulong *val,
+                          target_ulong new_val, target_ulong wr_mask)
+{
+    /*
+     * CTR arrays are treated as circular buffers and TOS always points to next
+     * empty slot, keeping TOS - 1 always pointing to latest entry. Given entry
+     * 0 is always the latest one, traversal is a bit different here. See the
+     * below example.
+     *
+     * Depth = 16.
+     *
+     * idx    [0] [1] [2] [3] [4] [5] [6] [7] [8] [9] [A] [B] [C] [D] [E] [F]
+     * TOS                                 H
+     * entry   6   5   4   3   2   1   0   F   E   D   C   B   A   9   8   7
+     */
+    const uint64_t entry = isel - CTR_ENTRIES_FIRST;
+    const uint64_t depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
+    uint64_t idx;
+
+    /* Entry greater than depth-1 is read-only zero */
+    if (entry >= depth) {
+        if (val) {
+            *val = 0;
+        }
+        return 0;
+    }
+
+    idx = get_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK);
+    idx = (idx - entry - 1) & (depth - 1);
+
+    if (val) {
+        *val = env->ctr_src[idx];
+    }
+
+    env->ctr_src[idx] = (env->ctr_src[idx] & ~wr_mask) | (new_val & wr_mask);
+
+    return 0;
+}
+
+static int rmw_ctrtarget(CPURISCVState *env, int isel, target_ulong *val,
+                          target_ulong new_val, target_ulong wr_mask)
+{
+    /*
+     * CTR arrays are treated as circular buffers and TOS always points to next
+     * empty slot, keeping TOS - 1 always pointing to latest entry. Given entry
+     * 0 is always the latest one, traversal is a bit different here. See the
+     * below example.
+     *
+     * Depth = 16.
+     *
+     * idx    [0] [1] [2] [3] [4] [5] [6] [7] [8] [9] [A] [B] [C] [D] [E] [F]
+     * head                                H
+     * entry   6   5   4   3   2   1   0   F   E   D   C   B   A   9   8   7
+     */
+    const uint64_t entry = isel - CTR_ENTRIES_FIRST;
+    const uint64_t depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
+    uint64_t idx;
+
+    /* Entry greater than depth-1 is read-only zero */
+    if (entry >= depth) {
+        if (val) {
+            *val = 0;
+        }
+        return 0;
+    }
+
+    idx = get_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK);
+    idx = (idx - entry - 1) & (depth - 1);
+
+    if (val) {
+        *val = env->ctr_dst[idx];
+    }
+
+    env->ctr_dst[idx] = (env->ctr_dst[idx] & ~wr_mask) | (new_val & wr_mask);
+
+    return 0;
+}
+
+static int rmw_ctrdata(CPURISCVState *env, int isel, target_ulong *val,
+                        target_ulong new_val, target_ulong wr_mask)
+{
+    /*
+     * CTR arrays are treated as circular buffers and TOS always points to next
+     * empty slot, keeping TOS - 1 always pointing to latest entry. Given entry
+     * 0 is always the latest one, traversal is a bit different here. See the
+     * below example.
+     *
+     * Depth = 16.
+     *
+     * idx    [0] [1] [2] [3] [4] [5] [6] [7] [8] [9] [A] [B] [C] [D] [E] [F]
+     * head                                H
+     * entry   6   5   4   3   2   1   0   F   E   D   C   B   A   9   8   7
+     */
+    const uint64_t entry = isel - CTR_ENTRIES_FIRST;
+    const uint64_t mask = wr_mask & CTRDATA_MASK;
+    const uint64_t depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
+    uint64_t idx;
+
+    /* Entry greater than depth-1 is read-only zero */
+    if (entry >= depth) {
+        if (val) {
+            *val = 0;
+        }
+        return 0;
+    }
+
+    idx = get_field(env->sctrstatus, SCTRSTATUS_WRPTR_MASK);
+    idx = (idx - entry - 1) & (depth - 1);
+
+    if (val) {
+        *val = env->ctr_data[idx];
+    }
+
+    env->ctr_data[idx] = (env->ctr_data[idx] & ~mask) | (new_val & mask);
+
+    return 0;
+}
+
 static RISCVException rmw_xireg_aia(CPURISCVState *env, int csrno,
                          target_ulong isel, target_ulong *val,
                          target_ulong new_val, target_ulong wr_mask)
@@ -XXX,XX +XXX,XX @@ done:
     return ret;
 }
 
+static int rmw_xireg_ctr(CPURISCVState *env, int csrno,
+                        target_ulong isel, target_ulong *val,
+                        target_ulong new_val, target_ulong wr_mask)
+{
+    if (!riscv_cpu_cfg(env)->ext_smctr && !riscv_cpu_cfg(env)->ext_ssctr) {
+        return -EINVAL;
+    }
+
+    if (csrno == CSR_SIREG || csrno == CSR_VSIREG) {
+        return rmw_ctrsource(env, isel, val, new_val, wr_mask);
+    } else if (csrno == CSR_SIREG2 || csrno == CSR_VSIREG2) {
+        return rmw_ctrtarget(env, isel, val, new_val, wr_mask);
+    } else if (csrno == CSR_SIREG3 || csrno == CSR_VSIREG3) {
+        return rmw_ctrdata(env, isel, val, new_val, wr_mask);
+    } else if (val) {
+        *val = 0;
+    }
+
+    return 0;
+}
+
 /*
  * rmw_xireg_csrind: Perform indirect access to xireg and xireg2-xireg6
  *
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
                               target_ulong isel, target_ulong *val,
                               target_ulong new_val, target_ulong wr_mask)
 {
-    int ret = -EINVAL;
     bool virt = csrno == CSR_VSIREG ? true : false;
+    int ret = -EINVAL;
 
     if (xiselect_cd_range(isel)) {
         ret = rmw_xireg_cd(env, csrno, isel, val, new_val, wr_mask);
+    } else if (xiselect_ctr_range(csrno, isel)) {
+        ret = rmw_xireg_ctr(env, csrno, isel, val, new_val, wr_mask);
     } else {
         /*
          * As per the specification, access to unimplented region is undefined
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    if ((cpu->cfg.ext_smctr || cpu->cfg.ext_ssctr) &&
+        (!riscv_has_ext(env, RVS) || !cpu->cfg.ext_sscsrind)) {
+        if (cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_smctr)) ||
+            cpu_cfg_ext_is_user_set(CPU_CFG_OFFSET(ext_ssctr))) {
+            error_setg(errp, "Smctr and Ssctr require S-mode and Sscsrind");
+            return;
+        }
+        cpu->cfg.ext_smctr = false;
+        cpu->cfg.ext_ssctr = false;
+    }
+
     /*
      * Disable isa extensions based on priv spec after we
      * validated and set everything we need.
-- 
2.48.1

From: Rob Bradford <rbradford@rivosinc.com>

When running in TOR mode (Top of Range) the next PMP entry controls
whether the entry is locked. However simply checking if the PMP_LOCK bit
is set is not sufficient with the Smepmp extension which now provides a
bit (mseccfg.RLB (Rule Lock Bypass)) to disregard the lock bits. In
order to respect this bit use the convenience pmp_is_locked() function
rather than directly checking PMP_LOCK since this function checks
mseccfg.RLB.

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250210153713.343626-1-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
             uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg;
             is_next_cfg_tor = PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg);
 
-            if (pmp_cfg & PMP_LOCK && is_next_cfg_tor) {
+            if (pmp_is_locked(env, addr_index + 1) && is_next_cfg_tor) {
                 qemu_log_mask(LOG_GUEST_ERROR,
                               "ignoring pmpaddr write - pmpcfg + 1 locked\n");
                 return;
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Update headers to retrieve the latest KVM caps for RISC-V.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250221153758.652078-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/standard-headers/linux/ethtool.h      |  4 +
 include/standard-headers/linux/fuse.h         | 76 ++++++++++++++++++-
 .../linux/input-event-codes.h                 |  1 +
 include/standard-headers/linux/pci_regs.h     | 16 ++--
 include/standard-headers/linux/virtio_pci.h   | 14 ++++
 linux-headers/asm-arm64/kvm.h                 |  3 -
 linux-headers/asm-loongarch/kvm_para.h        |  1 +
 linux-headers/asm-riscv/kvm.h                 |  7 +-
 linux-headers/asm-x86/kvm.h                   |  1 +
 linux-headers/linux/iommufd.h                 | 35 ++++++---
 linux-headers/linux/kvm.h                     |  8 +-
 linux-headers/linux/stddef.h                  | 13 +++-
 linux-headers/linux/vduse.h                   |  2 +-
 13 files changed, 146 insertions(+), 35 deletions(-)

diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/ethtool.h
+++ b/include/standard-headers/linux/ethtool.h
@@ -XXX,XX +XXX,XX @@ enum ethtool_link_ext_substate_module {
  * @ETH_SS_STATS_ETH_MAC: names of IEEE 802.3 MAC statistics
  * @ETH_SS_STATS_ETH_CTRL: names of IEEE 802.3 MAC Control statistics
  * @ETH_SS_STATS_RMON: names of RMON statistics
+ * @ETH_SS_STATS_PHY: names of PHY(dev) statistics
+ * @ETH_SS_TS_FLAGS: hardware timestamping flags
  *
  * @ETH_SS_COUNT: number of defined string sets
  */
@@ -XXX,XX +XXX,XX @@ enum ethtool_stringset {
 	ETH_SS_STATS_ETH_MAC,
 	ETH_SS_STATS_ETH_CTRL,
 	ETH_SS_STATS_RMON,
+	ETH_SS_STATS_PHY,
+	ETH_SS_TS_FLAGS,
 
 	/* add new constants above here */
 	ETH_SS_COUNT
diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/fuse.h
+++ b/include/standard-headers/linux/fuse.h
@@ -XXX,XX +XXX,XX @@
  *
  *  7.41
  *  - add FUSE_ALLOW_IDMAP
+ *  7.42
+ *  - Add FUSE_OVER_IO_URING and all other io-uring related flags and data
+ *    structures:
+ *    - struct fuse_uring_ent_in_out
+ *    - struct fuse_uring_req_header
+ *    - struct fuse_uring_cmd_req
+ *    - FUSE_URING_IN_OUT_HEADER_SZ
+ *    - FUSE_URING_OP_IN_OUT_SZ
+ *    - enum fuse_uring_cmd
  */
 
 #ifndef _LINUX_FUSE_H
@@ -XXX,XX +XXX,XX @@
 #define FUSE_KERNEL_VERSION 7
 
 /** Minor version number of this interface */
-#define FUSE_KERNEL_MINOR_VERSION 41
+#define FUSE_KERNEL_MINOR_VERSION 42
 
 /** The node ID of the root inode */
 #define FUSE_ROOT_ID 1
@@ -XXX,XX +XXX,XX @@ struct fuse_file_lock {
  * FUSE_HAS_RESEND: kernel supports resending pending requests, and the high bit
  *		    of the request ID indicates resend requests
  * FUSE_ALLOW_IDMAP: allow creation of idmapped mounts
+ * FUSE_OVER_IO_URING: Indicate that client supports io-uring
  */
 #define FUSE_ASYNC_READ		(1 << 0)
 #define FUSE_POSIX_LOCKS	(1 << 1)
@@ -XXX,XX +XXX,XX @@ struct fuse_file_lock {
 /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */
 #define FUSE_DIRECT_IO_RELAX	FUSE_DIRECT_IO_ALLOW_MMAP
 #define FUSE_ALLOW_IDMAP	(1ULL << 40)
+#define FUSE_OVER_IO_URING	(1ULL << 41)
 
 /**
  * CUSE INIT request/reply flags
@@ -XXX,XX +XXX,XX @@ struct fuse_supp_groups {
 	uint32_t	groups[];
 };
 
+/**
+ * Size of the ring buffer header
+ */
+#define FUSE_URING_IN_OUT_HEADER_SZ 128
+#define FUSE_URING_OP_IN_OUT_SZ 128
+
+/* Used as part of the fuse_uring_req_header */
+struct fuse_uring_ent_in_out {
+	uint64_t flags;
+
+	/*
+	 * commit ID to be used in a reply to a ring request (see also
+	 * struct fuse_uring_cmd_req)
+	 */
+	uint64_t commit_id;
+
+	/* size of user payload buffer */
+	uint32_t payload_sz;
+	uint32_t padding;
+
+	uint64_t reserved;
+};
+
+/**
+ * Header for all fuse-io-uring requests
+ */
+struct fuse_uring_req_header {
+	/* struct fuse_in_header / struct fuse_out_header */
+	char in_out[FUSE_URING_IN_OUT_HEADER_SZ];
+
+	/* per op code header */
+	char op_in[FUSE_URING_OP_IN_OUT_SZ];
+
+	struct fuse_uring_ent_in_out ring_ent_in_out;
+};
+
+/**
+ * sqe commands to the kernel
+ */
+enum fuse_uring_cmd {
+	FUSE_IO_URING_CMD_INVALID = 0,
+
+	/* register the request buffer and fetch a fuse request */
+	FUSE_IO_URING_CMD_REGISTER = 1,
+
+	/* commit fuse request result and fetch next request */
+	FUSE_IO_URING_CMD_COMMIT_AND_FETCH = 2,
+};
+
+/**
+ * In the 80B command area of the SQE.
+ */
+struct fuse_uring_cmd_req {
+	uint64_t flags;
+
+	/* entry identifier for commits */
+	uint64_t commit_id;
+
+	/* queue the command is for (queue index) */
+	uint16_t qid;
+	uint8_t padding[6];
+};
+
 #endif /* _LINUX_FUSE_H */
diff --git a/include/standard-headers/linux/input-event-codes.h b/include/standard-headers/linux/input-event-codes.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/input-event-codes.h
+++ b/include/standard-headers/linux/input-event-codes.h
@@ -XXX,XX +XXX,XX @@
 #define KEY_NOTIFICATION_CENTER	0x1bc	/* Show/hide the notification center */
 #define KEY_PICKUP_PHONE	0x1bd	/* Answer incoming call */
 #define KEY_HANGUP_PHONE	0x1be	/* Decline incoming call */
+#define KEY_LINK_PHONE		0x1bf   /* AL Phone Syncing */
 
 #define KEY_DEL_EOL		0x1c0
 #define KEY_DEL_EOS		0x1c1
diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/pci_regs.h
+++ b/include/standard-headers/linux/pci_regs.h
@@ -XXX,XX +XXX,XX @@
 #define  PCI_EXP_DEVSTA_TRPND	0x0020	/* Transactions Pending */
 #define PCI_CAP_EXP_RC_ENDPOINT_SIZEOF_V1	12	/* v1 endpoints without link end here */
 #define PCI_EXP_LNKCAP		0x0c	/* Link Capabilities */
-#define  PCI_EXP_LNKCAP_SLS	0x0000000f /* Supported Link Speeds */
+#define  PCI_EXP_LNKCAP_SLS	0x0000000f /* Max Link Speed (prior to PCIe r3.0: Supported Link Speeds) */
 #define  PCI_EXP_LNKCAP_SLS_2_5GB 0x00000001 /* LNKCAP2 SLS Vector bit 0 */
 #define  PCI_EXP_LNKCAP_SLS_5_0GB 0x00000002 /* LNKCAP2 SLS Vector bit 1 */
 #define  PCI_EXP_LNKCAP_SLS_8_0GB 0x00000003 /* LNKCAP2 SLS Vector bit 2 */
@@ -XXX,XX +XXX,XX @@
 #define  PCI_EXP_DEVCAP2_OBFF_MSG	0x00040000 /* New message signaling */
 #define  PCI_EXP_DEVCAP2_OBFF_WAKE	0x00080000 /* Re-use WAKE# for OBFF */
 #define  PCI_EXP_DEVCAP2_EE_PREFIX	0x00200000 /* End-End TLP Prefix */
+#define  PCI_EXP_DEVCAP2_EE_PREFIX_MAX	0x00c00000 /* Max End-End TLP Prefixes */
 #define PCI_EXP_DEVCTL2		0x28	/* Device Control 2 */
 #define  PCI_EXP_DEVCTL2_COMP_TIMEOUT	0x000f	/* Completion Timeout Value */
 #define  PCI_EXP_DEVCTL2_COMP_TMOUT_DIS	0x0010	/* Completion Timeout Disable */
@@ -XXX,XX +XXX,XX @@
 	/* Same bits as above */
 #define PCI_ERR_CAP		0x18	/* Advanced Error Capabilities & Ctrl*/
 #define  PCI_ERR_CAP_FEP(x)	((x) & 0x1f)	/* First Error Pointer */
-#define  PCI_ERR_CAP_ECRC_GENC	0x00000020	/* ECRC Generation Capable */
-#define  PCI_ERR_CAP_ECRC_GENE	0x00000040	/* ECRC Generation Enable */
-#define  PCI_ERR_CAP_ECRC_CHKC	0x00000080	/* ECRC Check Capable */
-#define  PCI_ERR_CAP_ECRC_CHKE	0x00000100	/* ECRC Check Enable */
+#define  PCI_ERR_CAP_ECRC_GENC		0x00000020 /* ECRC Generation Capable */
+#define  PCI_ERR_CAP_ECRC_GENE		0x00000040 /* ECRC Generation Enable */
+#define  PCI_ERR_CAP_ECRC_CHKC		0x00000080 /* ECRC Check Capable */
+#define  PCI_ERR_CAP_ECRC_CHKE		0x00000100 /* ECRC Check Enable */
+#define  PCI_ERR_CAP_PREFIX_LOG_PRESENT	0x00000800 /* TLP Prefix Log Present */
 #define PCI_ERR_HEADER_LOG	0x1c	/* Header Log Register (16 bytes) */
 #define PCI_ERR_ROOT_COMMAND	0x2c	/* Root Error Command */
 #define  PCI_ERR_ROOT_CMD_COR_EN	0x00000001 /* Correctable Err Reporting Enable */
@@ -XXX,XX +XXX,XX @@
 #define  PCI_ERR_ROOT_FATAL_RCV		0x00000040 /* Fatal Received */
 #define  PCI_ERR_ROOT_AER_IRQ		0xf8000000 /* Advanced Error Interrupt Message Number */
 #define PCI_ERR_ROOT_ERR_SRC	0x34	/* Error Source Identification */
+#define PCI_ERR_PREFIX_LOG	0x38	/* TLP Prefix LOG Register (up to 16 bytes) */
 
 /* Virtual Channel */
 #define PCI_VC_PORT_CAP1	0x04
@@ -XXX,XX +XXX,XX @@
 #define PCI_ACS_CTRL		0x06	/* ACS Control Register */
 #define PCI_ACS_EGRESS_CTL_V	0x08	/* ACS Egress Control Vector */
 
-#define PCI_VSEC_HDR		4	/* extended cap - vendor-specific */
-#define  PCI_VSEC_HDR_LEN_SHIFT	20	/* shift for length field */
-
 /* SATA capability */
 #define PCI_SATA_REGS		4	/* SATA REGs specifier */
 #define  PCI_SATA_REGS_MASK	0xF	/* location - BAR#/inline */
diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_pci.h
+++ b/include/standard-headers/linux/virtio_pci.h
@@ -XXX,XX +XXX,XX @@
 #define VIRTIO_PCI_CAP_PCI_CFG		5
 /* Additional shared memory capability */
 #define VIRTIO_PCI_CAP_SHARED_MEMORY_CFG 8
+/* PCI vendor data configuration */
+#define VIRTIO_PCI_CAP_VENDOR_CFG	9
 
 /* This is the PCI capability header: */
 struct virtio_pci_cap {
@@ -XXX,XX +XXX,XX @@ struct virtio_pci_cap {
 	uint32_t length;		/* Length of the structure, in bytes. */
 };
 
+/* This is the PCI vendor data capability header: */
+struct virtio_pci_vndr_data {
+	uint8_t cap_vndr;		/* Generic PCI field: PCI_CAP_ID_VNDR */
+	uint8_t cap_next;		/* Generic PCI field: next ptr. */
+	uint8_t cap_len;		/* Generic PCI field: capability length */
+	uint8_t cfg_type;		/* Identifies the structure. */
+	uint16_t vendor_id;	/* Identifies the vendor-specific format. */
+	/* For Vendor Definition */
+	/* Pads structure to a multiple of 4 bytes */
+	/* Reads must not have side effects */
+};
+
 struct virtio_pci_cap64 {
 	struct virtio_pci_cap cap;
 	uint32_t offset_hi;             /* Most sig 32 bits of offset */
diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-arm64/kvm.h
+++ b/linux-headers/asm-arm64/kvm.h
@@ -XXX,XX +XXX,XX @@
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
 #define KVM_DIRTY_LOG_PAGE_OFFSET 64
 
-#define KVM_REG_SIZE(id)						\
-	(1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
-
 struct kvm_regs {
 	struct user_pt_regs regs;	/* sp = sp_el0 */
 
diff --git a/linux-headers/asm-loongarch/kvm_para.h b/linux-headers/asm-loongarch/kvm_para.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-loongarch/kvm_para.h
+++ b/linux-headers/asm-loongarch/kvm_para.h
@@ -XXX,XX +XXX,XX @@
 #define  KVM_FEATURE_STEAL_TIME		2
 /* BIT 24 - 31 are features configurable by user space vmm */
 #define  KVM_FEATURE_VIRT_EXTIOI	24
+#define  KVM_FEATURE_USER_HCALL		25
 
 #endif /* _ASM_KVM_PARA_H */
diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-riscv/kvm.h
+++ b/linux-headers/asm-riscv/kvm.h
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_ISA_EXT_ID {
 	KVM_RISCV_ISA_EXT_SSNPM,
 	KVM_RISCV_ISA_EXT_SVADE,
 	KVM_RISCV_ISA_EXT_SVADU,
+	KVM_RISCV_ISA_EXT_SVVPTC,
+	KVM_RISCV_ISA_EXT_ZABHA,
+	KVM_RISCV_ISA_EXT_ZICCRSE,
 	KVM_RISCV_ISA_EXT_MAX,
 };
 
@@ -XXX,XX +XXX,XX @@ enum KVM_RISCV_SBI_EXT_ID {
 	KVM_RISCV_SBI_EXT_VENDOR,
 	KVM_RISCV_SBI_EXT_DBCN,
 	KVM_RISCV_SBI_EXT_STA,
+	KVM_RISCV_SBI_EXT_SUSP,
 	KVM_RISCV_SBI_EXT_MAX,
 };
 
@@ -XXX,XX +XXX,XX @@ struct kvm_riscv_sbi_sta {
 #define KVM_RISCV_TIMER_STATE_OFF	0
 #define KVM_RISCV_TIMER_STATE_ON	1
 
-#define KVM_REG_SIZE(id)		\
-	(1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
-
 /* If you need to interpret the index values, here is the key: */
 #define KVM_REG_RISCV_TYPE_MASK		0x00000000FF000000
 #define KVM_REG_RISCV_TYPE_SHIFT	24
diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/kvm.h
+++ b/linux-headers/asm-x86/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_hyperv_eventfd {
 #define KVM_X86_SEV_VM		2
 #define KVM_X86_SEV_ES_VM	3
 #define KVM_X86_SNP_VM		4
+#define KVM_X86_TDX_VM		5
 
 #endif /* _ASM_X86_KVM_H */
diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/iommufd.h
+++ b/linux-headers/linux/iommufd.h
@@ -XXX,XX +XXX,XX @@ struct iommu_ioas_unmap {
  *                       ioctl(IOMMU_OPTION_HUGE_PAGES)
  * @IOMMU_OPTION_RLIMIT_MODE:
  *    Change how RLIMIT_MEMLOCK accounting works. The caller must have privilege
- *    to invoke this. Value 0 (default) is user based accouting, 1 uses process
+ *    to invoke this. Value 0 (default) is user based accounting, 1 uses process
  *    based accounting. Global option, object_id must be 0
  * @IOMMU_OPTION_HUGE_PAGES:
  *    Value 1 (default) allows contiguous pages to be combined when generating
@@ -XXX,XX +XXX,XX @@ struct iommu_vfio_ioas {
  * @IOMMU_HWPT_ALLOC_PASID: Requests a domain that can be used with PASID. The
  *                          domain can be attached to any PASID on the device.
  *                          Any domain attached to the non-PASID part of the
- *                          device must also be flaged, otherwise attaching a
+ *                          device must also be flagged, otherwise attaching a
  *                          PASID will blocked.
  *                          If IOMMU does not support PASID it will return
  *                          error (-EOPNOTSUPP).
@@ -XXX,XX +XXX,XX @@ struct iommu_hw_info_vtd {
  * For the details of @idr, @iidr and @aidr, please refer to the chapters
  * from 6.3.1 to 6.3.6 in the SMMUv3 Spec.
  *
- * User space should read the underlying ARM SMMUv3 hardware information for
- * the list of supported features.
+ * This reports the raw HW capability, and not all bits are meaningful to be
+ * read by userspace. Only the following fields should be used:
  *
- * Note that these values reflect the raw HW capability, without any insight if
- * any required kernel driver support is present. Bits may be set indicating the
- * HW has functionality that is lacking kernel software support, such as BTM. If
- * a VMM is using this information to construct emulated copies of these
- * registers it should only forward bits that it knows it can support.
+ * idr[0]: ST_LEVEL, TERM_MODEL, STALL_MODEL, TTENDIAN , CD2L, ASID16, TTF
+ * idr[1]: SIDSIZE, SSIDSIZE
+ * idr[3]: BBML, RIL
+ * idr[5]: VAX, GRAN64K, GRAN16K, GRAN4K
  *
- * In future, presence of required kernel support will be indicated in flags.
+ * - S1P should be assumed to be true if a NESTED HWPT can be created
+ * - VFIO/iommufd only support platforms with COHACC, it should be assumed to be
+ *   true.
+ * - ATS is a per-device property. If the VMM describes any devices as ATS
+ *   capable in ACPI/DT it should set the corresponding idr.
+ *
+ * This list may expand in future (eg E0PD, AIE, PBHA, D128, DS etc). It is
+ * important that VMMs do not read bits outside the list to allow for
+ * compatibility with future kernels. Several features in the SMMUv3
+ * architecture are not currently supported by the kernel for nesting: HTTU,
+ * BTM, MPAM and others.
  */
 struct iommu_hw_info_arm_smmuv3 {
 	__u32 flags;
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_vtd_s1_invalidate {
 };
 
 /**
- * struct iommu_viommu_arm_smmuv3_invalidate - ARM SMMUv3 cahce invalidation
+ * struct iommu_viommu_arm_smmuv3_invalidate - ARM SMMUv3 cache invalidation
  *         (IOMMU_VIOMMU_INVALIDATE_DATA_ARM_SMMUV3)
  * @cmd: 128-bit cache invalidation command that runs in SMMU CMDQ.
  *       Must be little-endian.
@@ -XXX,XX +XXX,XX @@ enum iommu_hwpt_pgfault_perm {
  * @pasid: Process Address Space ID
  * @grpid: Page Request Group Index
  * @perm: Combination of enum iommu_hwpt_pgfault_perm
+ * @__reserved: Must be 0.
  * @addr: Fault address
  * @length: a hint of how much data the requestor is expecting to fetch. For
  *          example, if the PRI initiator knows it is going to do a 10MB
@@ -XXX,XX +XXX,XX @@ struct iommu_hwpt_pgfault {
 	__u32 pasid;
 	__u32 grpid;
 	__u32 perm;
-	__u64 addr;
+	__u32 __reserved;
+	__aligned_u64 addr;
 	__u32 length;
 	__u32 cookie;
 };
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_ioeventfd {
 #define KVM_X86_DISABLE_EXITS_HLT            (1 << 1)
 #define KVM_X86_DISABLE_EXITS_PAUSE          (1 << 2)
 #define KVM_X86_DISABLE_EXITS_CSTATE         (1 << 3)
-#define KVM_X86_DISABLE_VALID_EXITS          (KVM_X86_DISABLE_EXITS_MWAIT | \
-                                              KVM_X86_DISABLE_EXITS_HLT | \
-                                              KVM_X86_DISABLE_EXITS_PAUSE | \
-                                              KVM_X86_DISABLE_EXITS_CSTATE)
 
 /* for KVM_ENABLE_CAP */
 struct kvm_enable_cap {
@@ -XXX,XX +XXX,XX @@ struct kvm_dirty_tlb {
 
 #define KVM_REG_SIZE_SHIFT	52
 #define KVM_REG_SIZE_MASK	0x00f0000000000000ULL
+
+#define KVM_REG_SIZE(id)		\
+	(1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
+
 #define KVM_REG_SIZE_U8		0x0000000000000000ULL
 #define KVM_REG_SIZE_U16	0x0010000000000000ULL
 #define KVM_REG_SIZE_U32	0x0020000000000000ULL
diff --git a/linux-headers/linux/stddef.h b/linux-headers/linux/stddef.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/stddef.h
+++ b/linux-headers/linux/stddef.h
@@ -XXX,XX +XXX,XX @@
 #define __always_inline __inline__
 #endif
 
+/* Not all C++ standards support type declarations inside an anonymous union */
+#ifndef __cplusplus
+#define __struct_group_tag(TAG)		TAG
+#else
+#define __struct_group_tag(TAG)
+#endif
+
 /**
  * __struct_group() - Create a mirrored named and anonyomous struct
  *
@@ -XXX,XX +XXX,XX @@
  * and size: one anonymous and one named. The former's members can be used
  * normally without sub-struct naming, and the latter can be used to
  * reason about the start, end, and size of the group of struct members.
- * The named struct can also be explicitly tagged for layer reuse, as well
- * as both having struct attributes appended.
+ * The named struct can also be explicitly tagged for layer reuse (C only),
+ * as well as both having struct attributes appended.
  */
 #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
 	union { \
 		struct { MEMBERS } ATTRS; \
-		struct TAG { MEMBERS } ATTRS NAME; \
+		struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \
 	} ATTRS
 
 #ifdef __cplusplus
diff --git a/linux-headers/linux/vduse.h b/linux-headers/linux/vduse.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/vduse.h
+++ b/linux-headers/linux/vduse.h
@@ -XXX,XX +XXX,XX @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
 #ifndef _VDUSE_H_
 #define _VDUSE_H_
 
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

At this moment ziccrse is a TCG always enabled named feature for
priv_ver > 1.11 that has no exclusive flag. In the next patch we'll make
the KVM driver turn ziccrse off if the extension isn't available in the
host, and we'll need an ext_ziccrse flag in the CPU state for that.

Create an exclusive flag for it like we do with other named features.
As with any named features we already have, it won't be exposed to
users.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20250221153758.652078-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h     | 3 +++
 target/riscv/cpu.c         | 3 ++-
 target/riscv/tcg/tcg-cpu.c | 2 ++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool has_priv_1_12;
     bool has_priv_1_11;
 
+    /* Always enabled for TCG if has_priv_1_11 */
+    bool ext_ziccrse;
+
     /* Vendor-specific custom extensions */
     bool ext_xtheadba;
     bool ext_xtheadbb;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(ziccamoa, PRIV_VERSION_1_11_0, has_priv_1_11),
     ISA_EXT_DATA_ENTRY(ziccif, PRIV_VERSION_1_11_0, has_priv_1_11),
     ISA_EXT_DATA_ENTRY(zicclsm, PRIV_VERSION_1_11_0, has_priv_1_11),
-    ISA_EXT_DATA_ENTRY(ziccrse, PRIV_VERSION_1_11_0, has_priv_1_11),
+    ISA_EXT_DATA_ENTRY(ziccrse, PRIV_VERSION_1_11_0, ext_ziccrse),
     ISA_EXT_DATA_ENTRY(zicfilp, PRIV_VERSION_1_12_0, ext_zicfilp),
     ISA_EXT_DATA_ENTRY(zicfiss, PRIV_VERSION_1_13_0, ext_zicfiss),
     ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
     MULTI_EXT_CFG_BOOL("zic64b", ext_zic64b, true),
     MULTI_EXT_CFG_BOOL("ssstateen", ext_ssstateen, true),
     MULTI_EXT_CFG_BOOL("sha", ext_sha, true),
+    MULTI_EXT_CFG_BOOL("ziccrse", ext_ziccrse, true),
 
     { },
 };
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_update_named_features(RISCVCPU *cpu)
 
     cpu->cfg.ext_sha = riscv_has_ext(&cpu->env, RVH) &&
                        cpu->cfg.ext_ssstateen;
+
+    cpu->cfg.ext_ziccrse = cpu->cfg.has_priv_1_11;
 }
 
 static void riscv_cpu_validate_g(RISCVCPU *cpu)
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Expose ziccrse, zabha and svvptc.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20250221153758.652078-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_misa_ext(RISCVCPU *cpu, CPUState *cs)
 static KVMCPUConfig kvm_multi_ext_cfgs[] = {
     KVM_EXT_CFG("zicbom", ext_zicbom, KVM_RISCV_ISA_EXT_ZICBOM),
     KVM_EXT_CFG("zicboz", ext_zicboz, KVM_RISCV_ISA_EXT_ZICBOZ),
+    KVM_EXT_CFG("ziccrse", ext_ziccrse, KVM_RISCV_ISA_EXT_ZICCRSE),
     KVM_EXT_CFG("zicntr", ext_zicntr, KVM_RISCV_ISA_EXT_ZICNTR),
     KVM_EXT_CFG("zicond", ext_zicond, KVM_RISCV_ISA_EXT_ZICOND),
     KVM_EXT_CFG("zicsr", ext_zicsr, KVM_RISCV_ISA_EXT_ZICSR),
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
     KVM_EXT_CFG("zihpm", ext_zihpm, KVM_RISCV_ISA_EXT_ZIHPM),
     KVM_EXT_CFG("zimop", ext_zimop, KVM_RISCV_ISA_EXT_ZIMOP),
     KVM_EXT_CFG("zcmop", ext_zcmop, KVM_RISCV_ISA_EXT_ZCMOP),
+    KVM_EXT_CFG("zabha", ext_zabha, KVM_RISCV_ISA_EXT_ZABHA),
     KVM_EXT_CFG("zacas", ext_zacas, KVM_RISCV_ISA_EXT_ZACAS),
     KVM_EXT_CFG("zawrs", ext_zawrs, KVM_RISCV_ISA_EXT_ZAWRS),
     KVM_EXT_CFG("zfa", ext_zfa, KVM_RISCV_ISA_EXT_ZFA),
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
     KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
     KVM_EXT_CFG("svnapot", ext_svnapot, KVM_RISCV_ISA_EXT_SVNAPOT),
     KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
+    KVM_EXT_CFG("svvptc", ext_svvptc, KVM_RISCV_ISA_EXT_SVVPTC),
 };
 
 static void *kvmconfig_get_cfg_addr(RISCVCPU *cpu, KVMCPUConfig *kvmcfg)
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

This header is incomplete, i.e. it is using definitions that are being
supplied by the .c files that are including it.

Adding this header into a fresh .c file will result in errors:

/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:30:17: error: field ‘parent_obj’ has incomplete type
   30 |     DeviceState parent_obj;
      |                 ^~~~~~~~~~
/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:50:5: error: unknown type name ‘dma_addr_t’; did you mean ‘in_addr_t’?
   50 |     dma_addr_t cq_addr;   /* Command queue base physical address */
      |     ^~~~~~~~~~
      |     in_addr_t
(...)
/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:62:5: error: unknown type name ‘QemuThread’; did you mean ‘GThread’?
   62 |     QemuThread core_proc; /* Background processing thread */
      |     ^~~~~~~~~~
      |     GThread
/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:63:5: error: unknown type name ‘QemuCond’
   63 |     QemuCond core_cond;   /* Background processing wake up signal */
      |     ^~~~~~~~
/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:71:18: error: field ‘trap_as’ has incomplete type
   71 |     AddressSpace trap_as;
      |                  ^~~~~~~
/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:72:18: error: field ‘trap_mr’ has incomplete type
   72 |     MemoryRegion trap_mr;
      |                  ^~~~~~~
/home/danielhb/work/qemu/hw/riscv/riscv-iommu.h:80:18: error: field ‘regs_mr’ has incomplete type
   80 |     MemoryRegion regs_mr;
      |                  ^~~~~~~

Fix it by adding the missing headers for these definitions.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250224190826.1858473-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.h
+++ b/hw/riscv/riscv-iommu.h
@@ -XXX,XX +XXX,XX @@
 #define HW_RISCV_IOMMU_STATE_H
 
 #include "qom/object.h"
+#include "hw/qdev-properties.h"
+#include "system/dma.h"
 #include "hw/riscv/iommu.h"
 #include "hw/riscv/riscv-iommu-bits.h"
 
-- 
2.48.1

From: Tomasz Jeznach <tjeznach@rivosinc.com>

Add the relevant HPM (High Performance Monitor) bits that we'll be using
in the next patches.

diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-bits.h
+++ b/hw/riscv/riscv-iommu-bits.h
@@ -XXX,XX +XXX,XX @@ struct riscv_iommu_pq_record {
 #define RISCV_IOMMU_CAP_ATS             BIT_ULL(25)
 #define RISCV_IOMMU_CAP_T2GPA           BIT_ULL(26)
 #define RISCV_IOMMU_CAP_IGS             GENMASK_ULL(29, 28)
+#define RISCV_IOMMU_CAP_HPM             BIT_ULL(30)
 #define RISCV_IOMMU_CAP_DBG             BIT_ULL(31)
 #define RISCV_IOMMU_CAP_PAS             GENMASK_ULL(37, 32)
 #define RISCV_IOMMU_CAP_PD8             BIT_ULL(38)
@@ -XXX,XX +XXX,XX @@ enum {
     RISCV_IOMMU_INTR_COUNT
 };
 
+#define RISCV_IOMMU_IOCOUNT_NUM         31
+
+/* 5.19 Performance monitoring counter overflow status (32bits) */
+#define RISCV_IOMMU_REG_IOCOUNTOVF      0x0058
+#define RISCV_IOMMU_IOCOUNTOVF_CY       BIT(0)
+
+/* 5.20 Performance monitoring counter inhibits (32bits) */
+#define RISCV_IOMMU_REG_IOCOUNTINH      0x005C
+#define RISCV_IOMMU_IOCOUNTINH_CY       BIT(0)
+
+/* 5.21 Performance monitoring cycles counter (64bits) */
+#define RISCV_IOMMU_REG_IOHPMCYCLES     0x0060
+#define RISCV_IOMMU_IOHPMCYCLES_COUNTER GENMASK_ULL(62, 0)
+#define RISCV_IOMMU_IOHPMCYCLES_OVF     BIT_ULL(63)
+
+/* 5.22 Performance monitoring event counters (31 * 64bits) */
+#define RISCV_IOMMU_REG_IOHPMCTR_BASE   0x0068
+#define RISCV_IOMMU_REG_IOHPMCTR(_n)    \
+    (RISCV_IOMMU_REG_IOHPMCTR_BASE + (_n * 0x8))
+
+/* 5.23 Performance monitoring event selectors (31 * 64bits) */
+#define RISCV_IOMMU_REG_IOHPMEVT_BASE   0x0160
+#define RISCV_IOMMU_REG_IOHPMEVT(_n)    \
+    (RISCV_IOMMU_REG_IOHPMEVT_BASE + (_n * 0x8))
+#define RISCV_IOMMU_IOHPMEVT_EVENT_ID   GENMASK_ULL(14, 0)
+#define RISCV_IOMMU_IOHPMEVT_DMASK      BIT_ULL(15)
+#define RISCV_IOMMU_IOHPMEVT_PID_PSCID  GENMASK_ULL(35, 16)
+#define RISCV_IOMMU_IOHPMEVT_DID_GSCID  GENMASK_ULL(59, 36)
+#define RISCV_IOMMU_IOHPMEVT_PV_PSCV    BIT_ULL(60)
+#define RISCV_IOMMU_IOHPMEVT_DV_GSCV    BIT_ULL(61)
+#define RISCV_IOMMU_IOHPMEVT_IDT        BIT_ULL(62)
+#define RISCV_IOMMU_IOHPMEVT_OF         BIT_ULL(63)
+
+enum RISCV_IOMMU_HPMEVENT_id {
+    RISCV_IOMMU_HPMEVENT_INVALID    = 0,
+    RISCV_IOMMU_HPMEVENT_URQ        = 1,
+    RISCV_IOMMU_HPMEVENT_TRQ        = 2,
+    RISCV_IOMMU_HPMEVENT_ATS_RQ     = 3,
+    RISCV_IOMMU_HPMEVENT_TLB_MISS   = 4,
+    RISCV_IOMMU_HPMEVENT_DD_WALK    = 5,
+    RISCV_IOMMU_HPMEVENT_PD_WALK    = 6,
+    RISCV_IOMMU_HPMEVENT_S_VS_WALKS = 7,
+    RISCV_IOMMU_HPMEVENT_G_WALKS    = 8,
+    RISCV_IOMMU_HPMEVENT_MAX        = 9
+};
+
 /* 5.24 Translation request IOVA (64bits) */
 #define RISCV_IOMMU_REG_TR_REQ_IOVA     0x0258
 
-- 
2.48.1

From: Tomasz Jeznach <tjeznach@rivosinc.com>

The HPM (Hardware Performance Monitor) support consists of almost 7
hundred lines that would be put on top of the base riscv-iommu
emulation.

To avoid clogging riscv-iommu.c, add a separated riscv-iommu-hpm file
that will contain HPM specific code.

We'll start by adding riscv_iommu_hpmcycle_read(), a helper that will be
called during the riscv_iommu_mmio_read() callback.

This change will have no effect on the existing emulation since we're
not declaring HPM feature support.

Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250224190826.1858473-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-hpm.h | 27 +++++++++++++++++++
 hw/riscv/riscv-iommu.h     |  4 +++
 hw/riscv/riscv-iommu-hpm.c | 54 ++++++++++++++++++++++++++++++++++++++
 hw/riscv/riscv-iommu.c     | 24 ++++++++++++++++-
 hw/riscv/meson.build       |  3 ++-
 5 files changed, 110 insertions(+), 2 deletions(-)
 create mode 100644 hw/riscv/riscv-iommu-hpm.h
 create mode 100644 hw/riscv/riscv-iommu-hpm.c

diff --git a/hw/riscv/riscv-iommu-hpm.h b/hw/riscv/riscv-iommu-hpm.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/riscv/riscv-iommu-hpm.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V IOMMU - Hardware Performance Monitor (HPM) helpers
+ *
+ * Copyright (C) 2022-2023 Rivos Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_RISCV_IOMMU_HPM_H
+#define HW_RISCV_IOMMU_HPM_H
+
+#include "qom/object.h"
+#include "hw/riscv/riscv-iommu.h"
+
+uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s);
+
+#endif
diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.h
+++ b/hw/riscv/riscv-iommu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
 
     QLIST_ENTRY(RISCVIOMMUState) iommus;
     QLIST_HEAD(, RISCVIOMMUSpace) spaces;
+
+    /* HPM cycle counter */
+    uint64_t hpmcycle_val;      /* Current value of cycle register */
+    uint64_t hpmcycle_prev;     /* Saved value of QEMU_CLOCK_VIRTUAL clock */
 };
 
 void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, PCIBus *bus,
diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/riscv/riscv-iommu-hpm.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V IOMMU - Hardware Performance Monitor (HPM) helpers
+ *
+ * Copyright (C) 2022-2023 Rivos Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "cpu_bits.h"
+#include "riscv-iommu-hpm.h"
+#include "riscv-iommu.h"
+#include "riscv-iommu-bits.h"
+#include "trace.h"
+
+/* For now we assume IOMMU HPM frequency to be 1GHz so 1-cycle is of 1-ns. */
+static inline uint64_t get_cycles(void)
+{
+    return qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+}
+
+uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s)
+{
+    const uint64_t cycle = riscv_iommu_reg_get64(
+        s, RISCV_IOMMU_REG_IOHPMCYCLES);
+    const uint32_t inhibit = riscv_iommu_reg_get32(
+        s, RISCV_IOMMU_REG_IOCOUNTINH);
+    const uint64_t ctr_prev = s->hpmcycle_prev;
+    const uint64_t ctr_val = s->hpmcycle_val;
+
+    if (get_field(inhibit, RISCV_IOMMU_IOCOUNTINH_CY)) {
+        /*
+         * Counter should not increment if inhibit bit is set. We can't really
+         * stop the QEMU_CLOCK_VIRTUAL, so we just return the last updated
+         * counter value to indicate that counter was not incremented.
+         */
+        return (ctr_val & RISCV_IOMMU_IOHPMCYCLES_COUNTER) |
+               (cycle & RISCV_IOMMU_IOHPMCYCLES_OVF);
+    }
+
+    return (ctr_val + get_cycles() - ctr_prev) |
+        (cycle & RISCV_IOMMU_IOHPMCYCLES_OVF);
+}
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu_bits.h"
 #include "riscv-iommu.h"
 #include "riscv-iommu-bits.h"
+#include "riscv-iommu-hpm.h"
 #include "trace.h"
 
 #define LIMIT_CACHE_CTX               (1U << 7)
@@ -XXX,XX +XXX,XX @@ static MemTxResult riscv_iommu_mmio_read(void *opaque, hwaddr addr,
         return MEMTX_ACCESS_ERROR;
     }
 
-    ptr = &s->regs_rw[addr];
+    /* Compute cycle register value. */
+    if ((addr & ~7) == RISCV_IOMMU_REG_IOHPMCYCLES) {
+        val = riscv_iommu_hpmcycle_read(s);
+        ptr = (uint8_t *)&val + (addr & 7);
+    } else if ((addr & ~3) == RISCV_IOMMU_REG_IOCOUNTOVF) {
+        /*
+         * Software can read RISCV_IOMMU_REG_IOCOUNTOVF before timer
+         * callback completes. In which case CY_OF bit in
+         * RISCV_IOMMU_IOHPMCYCLES_OVF would be 0. Here we take the
+         * CY_OF bit state from RISCV_IOMMU_REG_IOHPMCYCLES register as
+         * it's not dependent over the timer callback and is computed
+         * from cycle overflow.
+         */
+        val = ldq_le_p(&s->regs_rw[addr]);
+        val |= (riscv_iommu_hpmcycle_read(s) & RISCV_IOMMU_IOHPMCYCLES_OVF)
+                   ? RISCV_IOMMU_IOCOUNTOVF_CY
+                   : 0;
+        ptr = (uint8_t *)&val + (addr & 3);
+    } else {
+        ptr = &s->regs_rw[addr];
+    }
+
     val = ldn_le_p(ptr, size);
 
     *data = val;
diff --git a/hw/riscv/meson.build b/hw/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/meson.build
+++ b/hw/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(when: 'CONFIG_SIFIVE_U', if_true: files('sifive_u.c'))
 riscv_ss.add(when: 'CONFIG_SPIKE', if_true: files('spike.c'))
 riscv_ss.add(when: 'CONFIG_MICROCHIP_PFSOC', if_true: files('microchip_pfsoc.c'))
 riscv_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
-riscv_ss.add(when: 'CONFIG_RISCV_IOMMU', if_true: files('riscv-iommu.c', 'riscv-iommu-pci.c', 'riscv-iommu-sys.c'))
+riscv_ss.add(when: 'CONFIG_RISCV_IOMMU', if_true: files(
+	'riscv-iommu.c', 'riscv-iommu-pci.c', 'riscv-iommu-sys.c', 'riscv-iommu-hpm.c'))
 riscv_ss.add(when: 'CONFIG_MICROBLAZE_V', if_true: files('microblaze-v-generic.c'))
 
 hw_arch += {'riscv': riscv_ss}
-- 
2.48.1

From: Tomasz Jeznach <tjeznach@rivosinc.com>

This function will increment a specific counter, generating an interrupt
when an overflow occurs.

Some extra changes in riscv-iommu.c  were required to add this new
helper in riscv-iommu-hpm.c:

- RISCVIOMMUContext was moved to riscv-iommu.h, making it visible in
  riscv-iommu-hpm.c;

- riscv_iommu_notify() is now public.

No behavior change is made since HPM support is not being advertised
yet.

Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250224190826.1858473-5-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-hpm.h |   2 +
 hw/riscv/riscv-iommu.h     |  18 ++++++
 hw/riscv/riscv-iommu-hpm.c | 114 +++++++++++++++++++++++++++++++++++++
 hw/riscv/riscv-iommu.c     |  43 +++++++++-----
 4 files changed, 162 insertions(+), 15 deletions(-)

diff --git a/hw/riscv/riscv-iommu-hpm.h b/hw/riscv/riscv-iommu-hpm.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-hpm.h
+++ b/hw/riscv/riscv-iommu-hpm.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/riscv-iommu.h"
 
 uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s);
+void riscv_iommu_hpm_incr_ctr(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
+                              unsigned event_id);
 
 #endif
diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.h
+++ b/hw/riscv/riscv-iommu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
     /* HPM cycle counter */
     uint64_t hpmcycle_val;      /* Current value of cycle register */
     uint64_t hpmcycle_prev;     /* Saved value of QEMU_CLOCK_VIRTUAL clock */
+
+    /* HPM event counters */
+    GHashTable *hpm_event_ctr_map; /* Mapping of events to counters */
 };
 
 void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, PCIBus *bus,
          Error **errp);
 void riscv_iommu_set_cap_igs(RISCVIOMMUState *s, riscv_iommu_igs_mode mode);
 void riscv_iommu_reset(RISCVIOMMUState *s);
+void riscv_iommu_notify(RISCVIOMMUState *s, int vec_type);
+
+typedef struct RISCVIOMMUContext RISCVIOMMUContext;
+/* Device translation context state. */
+struct RISCVIOMMUContext {
+    uint64_t devid:24;          /* Requester Id, AKA device_id */
+    uint64_t process_id:20;     /* Process ID. PASID for PCIe */
+    uint64_t tc;                /* Translation Control */
+    uint64_t ta;                /* Translation Attributes */
+    uint64_t satp;              /* S-Stage address translation and protection */
+    uint64_t gatp;              /* G-Stage address translation and protection */
+    uint64_t msi_addr_mask;     /* MSI filtering - address mask */
+    uint64_t msi_addr_pattern;  /* MSI filtering - address pattern */
+    uint64_t msiptp;            /* MSI redirection page table pointer */
+};
 
 /* private helpers */
 
diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-hpm.c
+++ b/hw/riscv/riscv-iommu-hpm.c
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s)
     return (ctr_val + get_cycles() - ctr_prev) |
         (cycle & RISCV_IOMMU_IOHPMCYCLES_OVF);
 }
+
+static void hpm_incr_ctr(RISCVIOMMUState *s, uint32_t ctr_idx)
+{
+    const uint32_t off = ctr_idx << 3;
+    uint64_t cntr_val;
+
+    cntr_val = ldq_le_p(&s->regs_rw[RISCV_IOMMU_REG_IOHPMCTR_BASE + off]);
+    stq_le_p(&s->regs_rw[RISCV_IOMMU_REG_IOHPMCTR_BASE + off], cntr_val + 1);
+
+    /* Handle the overflow scenario. */
+    if (cntr_val == UINT64_MAX) {
+        /*
+         * Generate interrupt only if OF bit is clear. +1 to offset the cycle
+         * register OF bit.
+         */
+        const uint32_t ovf =
+            riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_IOCOUNTOVF,
+                                  BIT(ctr_idx + 1), 0);
+        if (!get_field(ovf, BIT(ctr_idx + 1))) {
+            riscv_iommu_reg_mod64(s,
+                                  RISCV_IOMMU_REG_IOHPMEVT_BASE + off,
+                                  RISCV_IOMMU_IOHPMEVT_OF,
+                                  0);
+            riscv_iommu_notify(s, RISCV_IOMMU_INTR_PM);
+        }
+    }
+}
+
+void riscv_iommu_hpm_incr_ctr(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
+                              unsigned event_id)
+{
+    const uint32_t inhibit = riscv_iommu_reg_get32(
+        s, RISCV_IOMMU_REG_IOCOUNTINH);
+    uint32_t did_gscid;
+    uint32_t pid_pscid;
+    uint32_t ctr_idx;
+    gpointer value;
+    uint32_t ctrs;
+    uint64_t evt;
+
+    if (!(s->cap & RISCV_IOMMU_CAP_HPM)) {
+        return;
+    }
+
+    value = g_hash_table_lookup(s->hpm_event_ctr_map,
+                                GUINT_TO_POINTER(event_id));
+    if (value == NULL) {
+        return;
+    }
+
+    for (ctrs = GPOINTER_TO_UINT(value); ctrs != 0; ctrs &= ctrs - 1) {
+        ctr_idx = ctz32(ctrs);
+        if (get_field(inhibit, BIT(ctr_idx + 1))) {
+            continue;
+        }
+
+        evt = riscv_iommu_reg_get64(s,
+            RISCV_IOMMU_REG_IOHPMEVT_BASE + (ctr_idx << 3));
+
+        /*
+         * It's quite possible that event ID has been changed in counter
+         * but hashtable hasn't been updated yet. We don't want to increment
+         * counter for the old event ID.
+         */
+        if (event_id != get_field(evt, RISCV_IOMMU_IOHPMEVT_EVENT_ID)) {
+            continue;
+        }
+
+        if (get_field(evt, RISCV_IOMMU_IOHPMEVT_IDT)) {
+            did_gscid = get_field(ctx->gatp, RISCV_IOMMU_DC_IOHGATP_GSCID);
+            pid_pscid = get_field(ctx->ta, RISCV_IOMMU_DC_TA_PSCID);
+        } else {
+            did_gscid = ctx->devid;
+            pid_pscid = ctx->process_id;
+        }
+
+        if (get_field(evt, RISCV_IOMMU_IOHPMEVT_PV_PSCV)) {
+            /*
+             * If the transaction does not have a valid process_id, counter
+             * increments if device_id matches DID_GSCID. If the transaction
+             * has a valid process_id, counter increments if device_id
+             * matches DID_GSCID and process_id matches PID_PSCID. See
+             * IOMMU Specification, Chapter 5.23. Performance-monitoring
+             * event selector.
+             */
+            if (ctx->process_id &&
+                get_field(evt, RISCV_IOMMU_IOHPMEVT_PID_PSCID) != pid_pscid) {
+                continue;
+            }
+        }
+
+        if (get_field(evt, RISCV_IOMMU_IOHPMEVT_DV_GSCV)) {
+            uint32_t mask = ~0;
+
+            if (get_field(evt, RISCV_IOMMU_IOHPMEVT_DMASK)) {
+                /*
+                 * 1001 1011   mask = GSCID
+                 * 0000 0111   mask = mask ^ (mask + 1)
+                 * 1111 1000   mask = ~mask;
+                 */
+                mask = get_field(evt, RISCV_IOMMU_IOHPMEVT_DID_GSCID);
+                mask = mask ^ (mask + 1);
+                mask = ~mask;
+            }
+
+            if ((get_field(evt, RISCV_IOMMU_IOHPMEVT_DID_GSCID) & mask) !=
+                (did_gscid & mask)) {
+                continue;
+            }
+        }
+
+        hpm_incr_ctr(s, ctr_idx);
+    }
+}
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@
 #define PPN_PHYS(ppn)                 ((ppn) << TARGET_PAGE_BITS)
 #define PPN_DOWN(phy)                 ((phy) >> TARGET_PAGE_BITS)
 
-typedef struct RISCVIOMMUContext RISCVIOMMUContext;
 typedef struct RISCVIOMMUEntry RISCVIOMMUEntry;
 
 /* Device assigned I/O address space */
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUSpace {
     QLIST_ENTRY(RISCVIOMMUSpace) list;
 };
 
-/* Device translation context state. */
-struct RISCVIOMMUContext {
-    uint64_t devid:24;          /* Requester Id, AKA device_id */
-    uint64_t process_id:20;     /* Process ID. PASID for PCIe */
-    uint64_t tc;                /* Translation Control */
-    uint64_t ta;                /* Translation Attributes */
-    uint64_t satp;              /* S-Stage address translation and protection */
-    uint64_t gatp;              /* G-Stage address translation and protection */
-    uint64_t msi_addr_mask;     /* MSI filtering - address mask */
-    uint64_t msi_addr_pattern;  /* MSI filtering - address pattern */
-    uint64_t msiptp;            /* MSI redirection page table pointer */
-};
-
 typedef enum RISCVIOMMUTransTag {
     RISCV_IOMMU_TRANS_TAG_BY,  /* Bypass */
     RISCV_IOMMU_TRANS_TAG_SS,  /* Single Stage */
@@ -XXX,XX +XXX,XX @@ static uint8_t riscv_iommu_get_icvec_vector(uint32_t icvec, uint32_t vec_type)
     }
 }
 
-static void riscv_iommu_notify(RISCVIOMMUState *s, int vec_type)
+void riscv_iommu_notify(RISCVIOMMUState *s, int vec_type)
 {
     uint32_t ipsr, icvec, vector;
 
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
             }
         }
 
+
+        if (pass == S_STAGE) {
+            riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_S_VS_WALKS);
+        } else {
+            riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_G_WALKS);
+        }
+
         /* Read page table entry */
         if (sc[pass].ptesize == 4) {
             uint32_t pte32 = 0;
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
 
     /* Device directory tree walk */
     for (; depth-- > 0; ) {
+        riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_DD_WALK);
         /*
          * Select device id index bits based on device directory tree level
          * and device context format.
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
         addr = PPN_PHYS(get_field(de, RISCV_IOMMU_DDTE_PPN));
     }
 
+    riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_DD_WALK);
+
     /* index into device context entry page */
     addr |= (ctx->devid * dc_len) & ~TARGET_PAGE_MASK;
 
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
     }
 
     for (depth = mode - RISCV_IOMMU_DC_FSC_PDTP_MODE_PD8; depth-- > 0; ) {
+        riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_PD_WALK);
+
         /*
          * Select process id index bits based on process directory tree
          * level. See IOMMU Specification, 2.2. Process-Directory-Table.
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
         addr = PPN_PHYS(get_field(de, RISCV_IOMMU_PC_FSC_PPN));
     }
 
+    riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_PD_WALK);
+
     /* Leaf entry in PDT */
     addr |= (ctx->process_id << 4) & ~TARGET_PAGE_MASK;
     if (dma_memory_read(s->target_as, addr, &dc.ta, sizeof(uint64_t) * 2,
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
     GHashTable *iot_cache;
     int fault;
 
+    riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_URQ);
+
     iot_cache = g_hash_table_ref(s->iot_cache);
     /*
      * TC[32] is reserved for custom extensions, used here to temporarily
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
 
     /* Check for ATS request. */
     if (iotlb->perm == IOMMU_NONE) {
+        riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_ATS_RQ);
         /* Check if ATS is disabled. */
         if (!(ctx->tc & RISCV_IOMMU_DC_TC_EN_ATS)) {
             enable_pri = false;
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_translate(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
         goto done;
     }
 
+    riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_TLB_MISS);
+
     /* Translate using device directory / page table information. */
     fault = riscv_iommu_spa_fetch(s, ctx, iotlb);
 
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->trap_mr, OBJECT(dev), &riscv_iommu_trap_ops, s,
             "riscv-iommu-trap", ~0ULL);
     address_space_init(&s->trap_as, &s->trap_mr, "riscv-iommu-trap-as");
+
+    if (s->cap & RISCV_IOMMU_CAP_HPM) {
+        s->hpm_event_ctr_map = g_hash_table_new(g_direct_hash, g_direct_equal);
+    }
 }
 
 static void riscv_iommu_unrealize(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_unrealize(DeviceState *dev)
 
     g_hash_table_unref(s->iot_cache);
     g_hash_table_unref(s->ctx_cache);
+
+    if (s->cap & RISCV_IOMMU_CAP_HPM) {
+        g_hash_table_unref(s->hpm_event_ctr_map);
+    }
 }
 
 void riscv_iommu_reset(RISCVIOMMUState *s)
-- 
2.48.1

From: Tomasz Jeznach <tjeznach@rivosinc.com>

The next HPM related changes requires the HPM overflow timer to be
initialized by the riscv-iommu base emulation.

Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250224190826.1858473-6-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-hpm.h |  1 +
 hw/riscv/riscv-iommu.h     |  2 ++
 hw/riscv/riscv-iommu-hpm.c | 36 ++++++++++++++++++++++++++++++++++++
 hw/riscv/riscv-iommu.c     |  3 +++
 4 files changed, 42 insertions(+)

From: Tomasz Jeznach <tjeznach@rivosinc.com>

RISCV_IOMMU_REG_IOCOUNTINH is done by riscv_iommu_process_iocntinh_cy(),
which is called during riscv_iommu_mmio_write() callback via a new
riscv_iommu_pricess_hpm_writes() helper.

Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250224190826.1858473-7-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-hpm.h |  1 +
 hw/riscv/riscv-iommu-hpm.c | 60 ++++++++++++++++++++++++++++++++++++++
 hw/riscv/riscv-iommu.c     | 38 ++++++++++++++++++++++++
 3 files changed, 99 insertions(+)

From: Tomasz Jeznach <tjeznach@rivosinc.com>

RISCV_IOMMU_REG_IOHPMCYCLES writes are done by
riscv_iommu_process_hpmcycle_write(), called by the mmio write callback
via riscv_iommu_process_hpm_writes().

Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250224190826.1858473-8-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-hpm.h |  1 +
 hw/riscv/riscv-iommu-hpm.c | 19 +++++++++++++++++++
 hw/riscv/riscv-iommu.c     |  2 +-
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/hw/riscv/riscv-iommu-hpm.h b/hw/riscv/riscv-iommu-hpm.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-hpm.h
+++ b/hw/riscv/riscv-iommu-hpm.h
@@ -XXX,XX +XXX,XX @@ void riscv_iommu_hpm_incr_ctr(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
                               unsigned event_id);
 void riscv_iommu_hpm_timer_cb(void *priv);
 void riscv_iommu_process_iocntinh_cy(RISCVIOMMUState *s, bool prev_cy_inh);
+void riscv_iommu_process_hpmcycle_write(RISCVIOMMUState *s);
 
 #endif
diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-hpm.c
+++ b/hw/riscv/riscv-iommu-hpm.c
@@ -XXX,XX +XXX,XX @@ void riscv_iommu_process_iocntinh_cy(RISCVIOMMUState *s, bool prev_cy_inh)
         timer_del(s->hpm_timer);
     }
 }
+
+void riscv_iommu_process_hpmcycle_write(RISCVIOMMUState *s)
+{
+    const uint64_t val = riscv_iommu_reg_get64(s, RISCV_IOMMU_REG_IOHPMCYCLES);
+    const uint32_t ovf = riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_IOCOUNTOVF);
+
+    /*
+     * Clear OF bit in IOCNTOVF if it's being cleared in IOHPMCYCLES register.
+     */
+    if (get_field(ovf, RISCV_IOMMU_IOCOUNTOVF_CY) &&
+        !get_field(val, RISCV_IOMMU_IOHPMCYCLES_OVF)) {
+        riscv_iommu_reg_mod32(s, RISCV_IOMMU_REG_IOCOUNTOVF, 0,
+            RISCV_IOMMU_IOCOUNTOVF_CY);
+    }
+
+    s->hpmcycle_val = val & ~RISCV_IOMMU_IOHPMCYCLES_OVF;
+    s->hpmcycle_prev = get_cycles();
+    hpm_setup_timer(s, s->hpmcycle_val);
+}
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_process_hpm_writes(RISCVIOMMUState *s,
 
     case RISCV_IOMMU_REG_IOHPMCYCLES:
     case RISCV_IOMMU_REG_IOHPMCYCLES + 4:
-        /* not yet implemented */
+        riscv_iommu_process_hpmcycle_write(s);
         break;
 
     case RISCV_IOMMU_REG_IOHPMEVT_BASE ...
-- 
2.48.1

From: Tomasz Jeznach <tjeznach@rivosinc.com>

To support hpm events mmio writes, done via
riscv_iommu_process_hpmevt_write(), we're also adding the 'hpm-counters'
IOMMU property that are used to determine the amount of counters
available in the IOMMU.

Note that everything we did so far didn't change any IOMMU behavior
because we're still not advertising HPM capability to software. This
will be done in the next patch.

Signed-off-by: Tomasz Jeznach <tjeznach@rivosinc.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250224190826.1858473-9-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-hpm.h |  1 +
 hw/riscv/riscv-iommu.h     |  1 +
 hw/riscv/riscv-iommu-hpm.c | 88 ++++++++++++++++++++++++++++++++++++++
 hw/riscv/riscv-iommu.c     |  4 +-
 4 files changed, 93 insertions(+), 1 deletion(-)

diff --git a/hw/riscv/riscv-iommu-hpm.h b/hw/riscv/riscv-iommu-hpm.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-hpm.h
+++ b/hw/riscv/riscv-iommu-hpm.h
@@ -XXX,XX +XXX,XX @@ void riscv_iommu_hpm_incr_ctr(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
 void riscv_iommu_hpm_timer_cb(void *priv);
 void riscv_iommu_process_iocntinh_cy(RISCVIOMMUState *s, bool prev_cy_inh);
 void riscv_iommu_process_hpmcycle_write(RISCVIOMMUState *s);
+void riscv_iommu_process_hpmevt_write(RISCVIOMMUState *s, uint32_t evt_reg);
 
 #endif
diff --git a/hw/riscv/riscv-iommu.h b/hw/riscv/riscv-iommu.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.h
+++ b/hw/riscv/riscv-iommu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVIOMMUState {
 
     /* HPM event counters */
     GHashTable *hpm_event_ctr_map; /* Mapping of events to counters */
+    uint8_t hpm_cntrs;
 };
 
 void riscv_iommu_pci_setup_iommu(RISCVIOMMUState *iommu, PCIBus *bus,
diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-hpm.c
+++ b/hw/riscv/riscv-iommu-hpm.c
@@ -XXX,XX +XXX,XX @@ void riscv_iommu_process_hpmcycle_write(RISCVIOMMUState *s)
     s->hpmcycle_prev = get_cycles();
     hpm_setup_timer(s, s->hpmcycle_val);
 }
+
+static inline bool check_valid_event_id(unsigned event_id)
+{
+    return event_id > RISCV_IOMMU_HPMEVENT_INVALID &&
+           event_id < RISCV_IOMMU_HPMEVENT_MAX;
+}
+
+static gboolean hpm_event_equal(gpointer key, gpointer value, gpointer udata)
+{
+    uint32_t *pair = udata;
+
+    if (GPOINTER_TO_UINT(value) & (1 << pair[0])) {
+        pair[1] = GPOINTER_TO_UINT(key);
+        return true;
+    }
+
+    return false;
+}
+
+/* Caller must check ctr_idx against hpm_ctrs to see if its supported or not. */
+static void update_event_map(RISCVIOMMUState *s, uint64_t value,
+                             uint32_t ctr_idx)
+{
+    unsigned event_id = get_field(value, RISCV_IOMMU_IOHPMEVT_EVENT_ID);
+    uint32_t pair[2] = { ctr_idx, RISCV_IOMMU_HPMEVENT_INVALID };
+    uint32_t new_value = 1 << ctr_idx;
+    gpointer data;
+
+    /*
+     * If EventID field is RISCV_IOMMU_HPMEVENT_INVALID
+     * remove the current mapping.
+     */
+    if (event_id == RISCV_IOMMU_HPMEVENT_INVALID) {
+        data = g_hash_table_find(s->hpm_event_ctr_map, hpm_event_equal, pair);
+
+        new_value = GPOINTER_TO_UINT(data) & ~(new_value);
+        if (new_value != 0) {
+            g_hash_table_replace(s->hpm_event_ctr_map,
+                                 GUINT_TO_POINTER(pair[1]),
+                                 GUINT_TO_POINTER(new_value));
+        } else {
+            g_hash_table_remove(s->hpm_event_ctr_map,
+                                GUINT_TO_POINTER(pair[1]));
+        }
+
+        return;
+    }
+
+    /* Update the counter mask if the event is already enabled. */
+    if (g_hash_table_lookup_extended(s->hpm_event_ctr_map,
+                                     GUINT_TO_POINTER(event_id),
+                                     NULL,
+                                     &data)) {
+        new_value |= GPOINTER_TO_UINT(data);
+    }
+
+    g_hash_table_insert(s->hpm_event_ctr_map,
+                        GUINT_TO_POINTER(event_id),
+                        GUINT_TO_POINTER(new_value));
+}
+
+void riscv_iommu_process_hpmevt_write(RISCVIOMMUState *s, uint32_t evt_reg)
+{
+    const uint32_t ctr_idx = (evt_reg - RISCV_IOMMU_REG_IOHPMEVT_BASE) >> 3;
+    const uint32_t ovf = riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_IOCOUNTOVF);
+    uint64_t val = riscv_iommu_reg_get64(s, evt_reg);
+
+    if (ctr_idx >= s->hpm_cntrs) {
+        return;
+    }
+
+    /* Clear OF bit in IOCNTOVF if it's being cleared in IOHPMEVT register. */
+    if (get_field(ovf, BIT(ctr_idx + 1)) &&
+        !get_field(val, RISCV_IOMMU_IOHPMEVT_OF)) {
+        /* +1 to offset CYCLE register OF bit. */
+        riscv_iommu_reg_mod32(
+            s, RISCV_IOMMU_REG_IOCOUNTOVF, 0, BIT(ctr_idx + 1));
+    }
+
+    if (!check_valid_event_id(get_field(val, RISCV_IOMMU_IOHPMEVT_EVENT_ID))) {
+        /* Reset EventID (WARL) field to invalid. */
+        val = set_field(val, RISCV_IOMMU_IOHPMEVT_EVENT_ID,
+            RISCV_IOMMU_HPMEVENT_INVALID);
+        riscv_iommu_reg_set64(s, evt_reg, val);
+    }
+
+    update_event_map(s, val, ctr_idx);
+}
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_process_hpm_writes(RISCVIOMMUState *s,
 
     case RISCV_IOMMU_REG_IOHPMEVT_BASE ...
         RISCV_IOMMU_REG_IOHPMEVT(RISCV_IOMMU_IOCOUNT_NUM) + 4:
-        /* not yet implemented */
+        riscv_iommu_process_hpmevt_write(s, regb & ~7);
         break;
     }
 }
@@ -XXX,XX +XXX,XX @@ static const Property riscv_iommu_properties[] = {
     DEFINE_PROP_BOOL("g-stage", RISCVIOMMUState, enable_g_stage, TRUE),
     DEFINE_PROP_LINK("downstream-mr", RISCVIOMMUState, target_mr,
         TYPE_MEMORY_REGION, MemoryRegion *),
+    DEFINE_PROP_UINT8("hpm-counters", RISCVIOMMUState, hpm_cntrs,
+                      RISCV_IOMMU_IOCOUNT_NUM),
 };
 
 static void riscv_iommu_class_init(ObjectClass *klass, void* data)
-- 
2.48.1

From: Tomasz Jeznach <tjeznach@rivosinc.com>

Now that we have every piece in place we can advertise CAP_HTM to
software, allowing any HPM aware driver to make use of the counters.

HPM is enabled/disabled via the 'hpm-counters' attribute. Default value
is 31, max value is also 31. Setting it to zero will disable HPM
support.

diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
                   RISCV_IOMMU_CAP_SV48X4 | RISCV_IOMMU_CAP_SV57X4;
     }
 
+    if (s->hpm_cntrs > 0) {
+        /* Clip number of HPM counters to maximum supported (31). */
+        if (s->hpm_cntrs > RISCV_IOMMU_IOCOUNT_NUM) {
+            s->hpm_cntrs = RISCV_IOMMU_IOCOUNT_NUM;
+        }
+        /* Enable hardware performance monitor interface */
+        s->cap |= RISCV_IOMMU_CAP_HPM;
+    }
+
     /* Out-of-reset translation mode: OFF (DMA disabled) BARE (passthrough) */
     s->ddtp = set_field(0, RISCV_IOMMU_DDTP_MODE, s->enable_off ?
                         RISCV_IOMMU_DDTP_MODE_OFF : RISCV_IOMMU_DDTP_MODE_BARE);
@@ -XXX,XX +XXX,XX @@ static void riscv_iommu_realize(DeviceState *dev, Error **errp)
             RISCV_IOMMU_TR_REQ_CTL_GO_BUSY);
     }
 
+    /* If HPM registers are enabled. */
+    if (s->cap & RISCV_IOMMU_CAP_HPM) {
+        /* +1 for cycle counter bit. */
+        stl_le_p(&s->regs_ro[RISCV_IOMMU_REG_IOCOUNTINH],
+                 ~((2 << s->hpm_cntrs) - 1));
+        stq_le_p(&s->regs_ro[RISCV_IOMMU_REG_IOHPMCYCLES], 0);
+        memset(&s->regs_ro[RISCV_IOMMU_REG_IOHPMCTR_BASE],
+               0x00, s->hpm_cntrs * 8);
+        memset(&s->regs_ro[RISCV_IOMMU_REG_IOHPMEVT_BASE],
+               0x00, s->hpm_cntrs * 8);
+    }
+
     /* Memory region for downstream access, if specified. */
     if (s->target_mr) {
         s->target_as = g_new0(AddressSpace, 1);
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Add a handful of trace events to allow for an easier time debugging the
HPM feature.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250224190826.1858473-11-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-hpm.c | 10 ++++++++++
 hw/riscv/trace-events      |  5 +++++
 2 files changed, 15 insertions(+)

diff --git a/hw/riscv/riscv-iommu-hpm.c b/hw/riscv/riscv-iommu-hpm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-hpm.c
+++ b/hw/riscv/riscv-iommu-hpm.c
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_iommu_hpmcycle_read(RISCVIOMMUState *s)
     const uint64_t ctr_prev = s->hpmcycle_prev;
     const uint64_t ctr_val = s->hpmcycle_val;
 
+    trace_riscv_iommu_hpm_read(cycle, inhibit, ctr_prev, ctr_val);
+
     if (get_field(inhibit, RISCV_IOMMU_IOCOUNTINH_CY)) {
         /*
          * Counter should not increment if inhibit bit is set. We can't really
@@ -XXX,XX +XXX,XX @@ static void hpm_incr_ctr(RISCVIOMMUState *s, uint32_t ctr_idx)
     cntr_val = ldq_le_p(&s->regs_rw[RISCV_IOMMU_REG_IOHPMCTR_BASE + off]);
     stq_le_p(&s->regs_rw[RISCV_IOMMU_REG_IOHPMCTR_BASE + off], cntr_val + 1);
 
+    trace_riscv_iommu_hpm_incr_ctr(cntr_val);
+
     /* Handle the overflow scenario. */
     if (cntr_val == UINT64_MAX) {
         /*
@@ -XXX,XX +XXX,XX @@ void riscv_iommu_process_iocntinh_cy(RISCVIOMMUState *s, bool prev_cy_inh)
         return;
     }
 
+    trace_riscv_iommu_hpm_iocntinh_cy(prev_cy_inh);
+
     if (!(inhibit & RISCV_IOMMU_IOCOUNTINH_CY)) {
         /*
          * Cycle counter is enabled. Just start the timer again and update
@@ -XXX,XX +XXX,XX @@ void riscv_iommu_process_hpmcycle_write(RISCVIOMMUState *s)
     const uint64_t val = riscv_iommu_reg_get64(s, RISCV_IOMMU_REG_IOHPMCYCLES);
     const uint32_t ovf = riscv_iommu_reg_get32(s, RISCV_IOMMU_REG_IOCOUNTOVF);
 
+    trace_riscv_iommu_hpm_cycle_write(ovf, val);
+
     /*
      * Clear OF bit in IOCNTOVF if it's being cleared in IOHPMCYCLES register.
      */
@@ -XXX,XX +XXX,XX @@ void riscv_iommu_process_hpmevt_write(RISCVIOMMUState *s, uint32_t evt_reg)
         return;
     }
 
+    trace_riscv_iommu_hpm_evt_write(ctr_idx, ovf, val);
+
     /* Clear OF bit in IOCNTOVF if it's being cleared in IOHPMEVT register. */
     if (get_field(ovf, BIT(ctr_idx + 1)) &&
         !get_field(val, RISCV_IOMMU_IOHPMEVT_OF)) {
diff --git a/hw/riscv/trace-events b/hw/riscv/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/trace-events
+++ b/hw/riscv/trace-events
@@ -XXX,XX +XXX,XX @@ riscv_iommu_sys_irq_sent(uint32_t vector) "IRQ sent to vector %u"
 riscv_iommu_sys_msi_sent(uint32_t vector, uint64_t msi_addr, uint32_t msi_data, uint32_t result) "MSI sent to vector %u msi_addr 0x%"PRIx64" msi_data 0x%x result %u"
 riscv_iommu_sys_reset_hold(int reset_type) "reset type %d"
 riscv_iommu_pci_reset_hold(int reset_type) "reset type %d"
+riscv_iommu_hpm_read(uint64_t cycle, uint32_t inhibit, uint64_t ctr_prev, uint64_t ctr_val) "cycle 0x%"PRIx64" inhibit 0x%x ctr_prev 0x%"PRIx64" ctr_val 0x%"PRIx64
+riscv_iommu_hpm_incr_ctr(uint64_t cntr_val) "cntr_val 0x%"PRIx64
+riscv_iommu_hpm_iocntinh_cy(bool prev_cy_inh) "prev_cy_inh %d"
+riscv_iommu_hpm_cycle_write(uint32_t ovf, uint64_t val) "ovf 0x%x val 0x%"PRIx64
+riscv_iommu_hpm_evt_write(uint32_t ctr_idx, uint32_t ovf, uint64_t val) "ctr_idx 0x%x ovf 0x%x val 0x%"PRIx64
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250224190826.1858473-12-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/specs/riscv-iommu.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/specs/riscv-iommu.rst b/docs/specs/riscv-iommu.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/specs/riscv-iommu.rst
+++ b/docs/specs/riscv-iommu.rst
@@ -XXX,XX +XXX,XX @@ Several options are available to control the capabilities of the device, namely:
 - "off" (Out-of-reset translation mode: 'on' for DMA disabled, 'off' for 'BARE' (passthrough))
 - "s-stage": enable s-stage support
 - "g-stage": enable g-stage support
+- "hpm-counters": number of hardware performance counters available. Maximum value is 31.
+  Default value is 31. Use 0 (zero) to disable HPM support
 
 riscv-iommu-sys device
 ----------------------
-- 
2.48.1

From: Quan Zhou <zhouquan@iscas.ac.cn>

When the Sscofpmf/Svade/Svadu/Smnpm/Ssnpm exts is available
expose it to the guest so that guest can use it.

Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <303616ccad2b5309768157b50d93b3e89fecc9cb.1740371468.git.zhouquan@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_multi_ext_cfgs[] = {
     KVM_EXT_CFG("zvksed", ext_zvksed, KVM_RISCV_ISA_EXT_ZVKSED),
     KVM_EXT_CFG("zvksh", ext_zvksh, KVM_RISCV_ISA_EXT_ZVKSH),
     KVM_EXT_CFG("zvkt", ext_zvkt, KVM_RISCV_ISA_EXT_ZVKT),
+    KVM_EXT_CFG("smnpm", ext_smnpm, KVM_RISCV_ISA_EXT_SMNPM),
     KVM_EXT_CFG("smstateen", ext_smstateen, KVM_RISCV_ISA_EXT_SMSTATEEN),
     KVM_EXT_CFG("ssaia", ext_ssaia, KVM_RISCV_ISA_EXT_SSAIA),
+    KVM_EXT_CFG("sscofpmf", ext_sscofpmf, KVM_RISCV_ISA_EXT_SSCOFPMF),
+    KVM_EXT_CFG("ssnpm", ext_ssnpm, KVM_RISCV_ISA_EXT_SSNPM),
     KVM_EXT_CFG("sstc", ext_sstc, KVM_RISCV_ISA_EXT_SSTC),
+    KVM_EXT_CFG("svade", ext_svade, KVM_RISCV_ISA_EXT_SVADE),
+    KVM_EXT_CFG("svadu", ext_svadu, KVM_RISCV_ISA_EXT_SVADU),
     KVM_EXT_CFG("svinval", ext_svinval, KVM_RISCV_ISA_EXT_SVINVAL),
     KVM_EXT_CFG("svnapot", ext_svnapot, KVM_RISCV_ISA_EXT_SVNAPOT),
     KVM_EXT_CFG("svpbmt", ext_svpbmt, KVM_RISCV_ISA_EXT_SVPBMT),
-- 
2.48.1

From: Andrea Bolognani <abologna@redhat.com>

This should make no difference from the functional point of
view and it's just preparation for upcoming changes.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-ID: <20250127182924.103510-2-abologna@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 scripts/qemu-binfmt-conf.sh | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
index XXXXXXX..XXXXXXX 100755
--- a/scripts/qemu-binfmt-conf.sh
+++ b/scripts/qemu-binfmt-conf.sh
@@ -XXX,XX +XXX,XX @@ qemu_set_binfmts() {
         mask=$(eval echo \$${cpu}_mask)
         family=$(eval echo \$${cpu}_family)
 
+        target="$cpu"
+        if [ "$cpu" = "i486" ] ; then
+            target="i386"
+        fi
+
+        qemu="$QEMU_PATH/qemu-$target$QEMU_SUFFIX"
+
         if [ "$magic" = "" ] || [ "$mask" = "" ] || [ "$family" = "" ] ; then
             echo "INTERNAL ERROR: unknown cpu $cpu" 1>&2
             continue
         fi
 
-        qemu="$QEMU_PATH/qemu-$cpu"
-        if [ "$cpu" = "i486" ] ; then
-            qemu="$QEMU_PATH/qemu-i386"
+        if [ "$host_family" = "$family" ] ; then
+            continue
         fi
 
-        qemu="$qemu$QEMU_SUFFIX"
-        if [ "$host_family" != "$family" ] ; then
-            $BINFMT_SET
-        fi
+        $BINFMT_SET
     done
 }
 
-- 
2.48.1

From: Andrea Bolognani <abologna@redhat.com>

Right now information regarding the family each CPU type belongs
to is recorded in two places: the large data table at the top of
the script, and the qemu_host_family() function.

We can make things better by mapping host CPU architecture to
QEMU target in the few cases where the two don't already match
and then using the data table to look up the family, same as
we're already doing for the guest CPU architecture.

Being able to reason in terms of QEMU target regardless of
whether we're looking at the host or guest CPU architecture will
come in handy to implement upcoming changes.

A couple of entries are dropped in the process: BePC and Power
Macintosh. I'm quite certain neither of those have ever been
reported as CPU architectures by Linux. I believe many more of
the entries that are carried forward could be dropped as well,
but I don't have the same level of confidence there so I
decided to play it safe just in case.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-ID: <20250127182924.103510-3-abologna@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 scripts/qemu-binfmt-conf.sh | 44 +++++++++++++++++++++----------------
 1 file changed, 25 insertions(+), 19 deletions(-)

diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
index XXXXXXX..XXXXXXX 100755
--- a/scripts/qemu-binfmt-conf.sh
+++ b/scripts/qemu-binfmt-conf.sh
@@ -XXX,XX +XXX,XX @@ loongarch64_magic='\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x
 loongarch64_mask='\xff\xff\xff\xff\xff\xff\xff\xfc\x00\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'
 loongarch64_family=loongarch
 
-qemu_get_family() {
-    cpu=${HOST_ARCH:-$(uname -m)}
+# Converts the name of a host CPU architecture to the corresponding QEMU
+# target.
+#
+# FIXME: This can probably be simplified a lot by dropping most entries.
+#        Remember that the script is only used on Linux, so we only need to
+#        handle the strings Linux uses to report the host CPU architecture.
+qemu_normalize() {
+    cpu="$1"
     case "$cpu" in
-    amd64|i386|i486|i586|i686|i86pc|BePC|x86_64)
+    i[3-6]86)
         echo "i386"
         ;;
-    mips*)
-        echo "mips"
+    amd64)
+        echo "x86_64"
         ;;
-    "Power Macintosh"|ppc64|powerpc|ppc)
+    powerpc)
         echo "ppc"
         ;;
-    ppc64el|ppc64le)
-        echo "ppcle"
+    ppc64el)
+        echo "ppc64le"
         ;;
-    arm|armel|armhf|arm64|armv[4-9]*l|aarch64)
+    armel|armhf|armv[4-9]*l)
         echo "arm"
         ;;
-    armeb|armv[4-9]*b|aarch64_be)
+    armv[4-9]*b)
         echo "armeb"
         ;;
-    sparc*)
-        echo "sparc"
-        ;;
-    riscv*)
-        echo "riscv"
-        ;;
-    loongarch*)
-        echo "loongarch"
+    arm64)
+        echo "aarch64"
         ;;
     *)
         echo "$cpu"
@@ -XXX,XX +XXX,XX @@ EOF
 
 qemu_set_binfmts() {
     # probe cpu type
-    host_family=$(qemu_get_family)
+    host_cpu=$(qemu_normalize ${HOST_ARCH:-$(uname -m)})
+    host_family=$(eval echo \$${host_cpu}_family)
+
+    if [ "$host_family" = "" ] ; then
+        echo "INTERNAL ERROR: unknown host cpu $host_cpu" 1>&2
+        exit 1
+    fi
 
     # register the interpreter for each cpu except for the native one
 
-- 
2.48.1

From: Andrea Bolognani <abologna@redhat.com>

Until now, the script has worked under the assumption that a
host CPU can run binaries targeting any CPU in the same family.
That's a fair enough assumption when it comes to running i386
binaries on x86_64, but it doesn't quite apply in the general
case.

For example, while riscv64 CPUs could theoretically run riscv32
applications natively, in practice there exist few (if any?)
CPUs that implement the necessary silicon; moreover, even if you
had one such CPU, your host OS would most likely not have
enabled the necessary kernel bits.

This new option gives distro packagers the ability to opt out of
the assumption, likely on a per-architecture basis, and make
things work out of the box for a larger fraction of their user
base.

As an interesting side effect, this makes it possible to enable
execution of 64-bit binaries on 32-bit CPUs of the same family,
which is a perfectly valid use case that apparently hadn't been
considered until now.

Link: https://src.fedoraproject.org/rpms/qemu/pull-request/72
Thanks: David Abdurachmanov <davidlt@rivosinc.com>
Thanks: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-ID: <20250127182924.103510-4-abologna@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 scripts/qemu-binfmt-conf.sh | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
index XXXXXXX..XXXXXXX 100755
--- a/scripts/qemu-binfmt-conf.sh
+++ b/scripts/qemu-binfmt-conf.sh
@@ -XXX,XX +XXX,XX @@ Usage: qemu-binfmt-conf.sh [--qemu-path PATH][--debian][--systemd CPU]
        --persistent:    if yes, the interpreter is loaded when binfmt is
                         configured and remains in memory. All future uses
                         are cloned from the open file.
+       --ignore-family: if yes, it is assumed that the host CPU (e.g. riscv64)
+                        can't natively run programs targeting a CPU that is
+                        part of the same family (e.g. riscv32).
        --preserve-argv0 preserve argv[0]
 
     To import templates with update-binfmts, use :
@@ -XXX,XX +XXX,XX @@ qemu_set_binfmts() {
         fi
 
         if [ "$host_family" = "$family" ] ; then
-            continue
+            # When --ignore-family is used, we have to generate rules even
+            # for targets that are in the same family as the host CPU. The
+            # only exception is of course when the CPU types exactly match
+            if [ "$target" = "$host_cpu" ] || [ "$IGNORE_FAMILY" = "no" ] ; then
+                continue
+            fi
         fi
 
         $BINFMT_SET
@@ -XXX,XX +XXX,XX @@ CREDENTIAL=no
 PERSISTENT=no
 PRESERVE_ARG0=no
 QEMU_SUFFIX=""
+IGNORE_FAMILY=no
 
 _longopts="debian,systemd:,qemu-path:,qemu-suffix:,exportdir:,help,credential:,\
-persistent:,preserve-argv0:"
-options=$(getopt -o ds:Q:S:e:hc:p:g:F: -l ${_longopts} -- "$@")
+persistent:,preserve-argv0:,ignore-family:"
+options=$(getopt -o ds:Q:S:e:hc:p:g:F:i: -l ${_longopts} -- "$@")
 eval set -- "$options"
 
 while true ; do
@@ -XXX,XX +XXX,XX @@ while true ; do
         shift
         PRESERVE_ARG0="$1"
         ;;
+    -i|--ignore-family)
+        shift
+        IGNORE_FAMILY="$1"
+        ;;
     *)
         break
         ;;
-- 
2.48.1

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

When the IMSIC is emulated in the kernel, the GPIO output lines to CPUs
and aia_ireg_rmw_fn setting can be remove. In this case the IMSIC
trigger CPU interrupts by KVM APIs, and the RMW of IREG is handled in
kernel.

This patch also move the code that claim the CPU interrupts to the
beginning of IMSIC realization. This can avoid the unnecessary resource
allocation before checking failed.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250224025722.3999-2-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_imsic.c | 47 ++++++++++++++++++++++++-------------------
 1 file changed, 26 insertions(+), 21 deletions(-)

diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
     CPUState *cpu = cpu_by_arch_id(imsic->hartid);
     CPURISCVState *env = cpu ? cpu_env(cpu) : NULL;
 
+    /* Claim the CPU interrupt to be triggered by this IMSIC */
+    if (riscv_cpu_claim_interrupts(rcpu,
+            (imsic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
+        error_setg(errp, "%s already claimed",
+                   (imsic->mmode) ? "MEIP" : "SEIP");
+        return;
+    }
+
     if (!kvm_irqchip_in_kernel()) {
+        /* Create output IRQ lines */
+        imsic->external_irqs = g_malloc(sizeof(qemu_irq) * imsic->num_pages);
+        qdev_init_gpio_out(dev, imsic->external_irqs, imsic->num_pages);
+
         imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
         imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
         imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
                           IMSIC_MMIO_SIZE(imsic->num_pages));
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &imsic->mmio);
 
-    /* Claim the CPU interrupt to be triggered by this IMSIC */
-    if (riscv_cpu_claim_interrupts(rcpu,
-            (imsic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
-        error_setg(errp, "%s already claimed",
-                   (imsic->mmode) ? "MEIP" : "SEIP");
-        return;
-    }
-
-    /* Create output IRQ lines */
-    imsic->external_irqs = g_malloc(sizeof(qemu_irq) * imsic->num_pages);
-    qdev_init_gpio_out(dev, imsic->external_irqs, imsic->num_pages);
-
     /* Force select AIA feature and setup CSR read-modify-write callback */
     if (env) {
         if (!imsic->mmode) {
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
         } else {
             rcpu->cfg.ext_smaia = true;
         }
-        riscv_cpu_set_aia_ireg_rmw_fn(env, (imsic->mmode) ? PRV_M : PRV_S,
-                                      riscv_imsic_rmw, imsic);
+
+        if (!kvm_irqchip_in_kernel()) {
+            riscv_cpu_set_aia_ireg_rmw_fn(env, (imsic->mmode) ? PRV_M : PRV_S,
+                                          riscv_imsic_rmw, imsic);
+        }
     }
 
     msi_nonbroken = true;
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_imsic_create(hwaddr addr, uint32_t hartid, bool mmode,
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 
-    for (i = 0; i < num_pages; i++) {
-        if (!i) {
-            qdev_connect_gpio_out_named(dev, NULL, i,
-                                        qdev_get_gpio_in(DEVICE(cpu),
+    if (!kvm_irqchip_in_kernel()) {
+        for (i = 0; i < num_pages; i++) {
+            if (!i) {
+                qdev_connect_gpio_out_named(dev, NULL, i,
+                                            qdev_get_gpio_in(DEVICE(cpu),
                                             (mmode) ? IRQ_M_EXT : IRQ_S_EXT));
-        } else {
-            qdev_connect_gpio_out_named(dev, NULL, i,
-                                        qdev_get_gpio_in(DEVICE(cpu),
+            } else {
+                qdev_connect_gpio_out_named(dev, NULL, i,
+                                            qdev_get_gpio_in(DEVICE(cpu),
                                             IRQ_LOCAL_MAX + i - 1));
+            }
         }
     }
 
-- 
2.48.1

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

When the APLIC is emulated in the kernel, the GPIO output lines to CPUs
can be remove. In this case the APLIC trigger CPU interrupts by KVM APIs.

This patch also move the code that claim the CPU interrupts to the
beginning of APLIC realization. This can avoid the unnecessary resource
allocation before checking failed.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250224025722.3999-3-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 49 +++++++++++++++++++++++--------------------
 1 file changed, 26 insertions(+), 23 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
     RISCVAPLICState *aplic = RISCV_APLIC(dev);
 
     if (riscv_use_emulated_aplic(aplic->msimode)) {
+        /* Create output IRQ lines for non-MSI mode */
+        if (!aplic->msimode) {
+            /* Claim the CPU interrupt to be triggered by this APLIC */
+            for (i = 0; i < aplic->num_harts; i++) {
+                RISCVCPU *cpu;
+
+                cpu = RISCV_CPU(cpu_by_arch_id(aplic->hartid_base + i));
+                if (riscv_cpu_claim_interrupts(cpu,
+                    (aplic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
+                    error_report("%s already claimed",
+                                 (aplic->mmode) ? "MEIP" : "SEIP");
+                    exit(1);
+                }
+            }
+
+            aplic->external_irqs = g_malloc(sizeof(qemu_irq) *
+                                            aplic->num_harts);
+            qdev_init_gpio_out(dev, aplic->external_irqs, aplic->num_harts);
+        }
+
         aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
         aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
         aplic->state = g_new0(uint32_t, aplic->num_irqs);
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
         }
     }
 
-    /* Create output IRQ lines for non-MSI mode */
-    if (!aplic->msimode) {
-        aplic->external_irqs = g_malloc(sizeof(qemu_irq) * aplic->num_harts);
-        qdev_init_gpio_out(dev, aplic->external_irqs, aplic->num_harts);
-
-        /* Claim the CPU interrupt to be triggered by this APLIC */
-        for (i = 0; i < aplic->num_harts; i++) {
-            RISCVCPU *cpu = RISCV_CPU(cpu_by_arch_id(aplic->hartid_base + i));
-            if (riscv_cpu_claim_interrupts(cpu,
-                (aplic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
-                error_report("%s already claimed",
-                             (aplic->mmode) ? "MEIP" : "SEIP");
-                exit(1);
-            }
-        }
-    }
-
     msi_nonbroken = true;
 }
 
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
 
     if (riscv_use_emulated_aplic(msimode)) {
         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
-    }
 
-    if (!msimode) {
-        for (i = 0; i < num_harts; i++) {
-            CPUState *cpu = cpu_by_arch_id(hartid_base + i);
+        if (!msimode) {
+            for (i = 0; i < num_harts; i++) {
+                CPUState *cpu = cpu_by_arch_id(hartid_base + i);
 
-            qdev_connect_gpio_out_named(dev, NULL, i,
-                                        qdev_get_gpio_in(DEVICE(cpu),
+                qdev_connect_gpio_out_named(dev, NULL, i,
+                                            qdev_get_gpio_in(DEVICE(cpu),
                                             (mmode) ? IRQ_M_EXT : IRQ_S_EXT));
+            }
         }
     }
 
-- 
2.48.1

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

Let kvm_msicfgaddr use the same format with mmsicfgaddr and smsicfgaddr.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250224025722.3999-4-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@ void riscv_aplic_set_kvm_msicfgaddr(RISCVAPLICState *aplic, hwaddr addr)
 {
 #ifdef CONFIG_KVM
     if (riscv_use_emulated_aplic(aplic->msimode)) {
+        addr >>= APLIC_xMSICFGADDR_PPN_SHIFT;
         aplic->kvm_msicfgaddr = extract64(addr, 0, 32);
-        aplic->kvm_msicfgaddrH = extract64(addr, 32, 32);
+        aplic->kvm_msicfgaddrH = extract64(addr, 32, 32) &
+                                 APLIC_xMSICFGADDRH_VALID_MASK;
     }
 #endif
 }
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
         }
     }
 
-    if (aplic->mmode) {
-        msicfgaddr = aplic_m->mmsicfgaddr;
-        msicfgaddrH = aplic_m->mmsicfgaddrH;
+    if (aplic->kvm_splitmode) {
+        msicfgaddr = aplic->kvm_msicfgaddr;
+        msicfgaddrH = ((uint64_t)aplic->kvm_msicfgaddrH << 32);
     } else {
-        msicfgaddr = aplic_m->smsicfgaddr;
-        msicfgaddrH = aplic_m->smsicfgaddrH;
+        if (aplic->mmode) {
+            msicfgaddr = aplic_m->mmsicfgaddr;
+            msicfgaddrH = aplic_m->mmsicfgaddrH;
+        } else {
+            msicfgaddr = aplic_m->smsicfgaddr;
+            msicfgaddrH = aplic_m->smsicfgaddrH;
+        }
     }
 
     lhxs = (msicfgaddrH >> APLIC_xMSICFGADDRH_LHXS_SHIFT) &
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
     addr |= (uint64_t)(guest_idx & APLIC_xMSICFGADDR_PPN_HART(lhxs));
     addr <<= APLIC_xMSICFGADDR_PPN_SHIFT;
 
-    if (aplic->kvm_splitmode) {
-        addr |= aplic->kvm_msicfgaddr;
-        addr |= ((uint64_t)aplic->kvm_msicfgaddrH << 32);
-    }
-
     address_space_stl_le(&address_space_memory, addr,
                          eiid, MEMTXATTRS_UNSPECIFIED, &result);
     if (result != MEMTX_OK) {
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're setting reset vals for KVM csrs during kvm_riscv_reset_vcpu(), but
in no particular order and missing some of them (like env->mstatus).

Create a helper to do that, unclogging reset_vcpu(), and initialize
env->mstatus as well. Keep the regs in the same order they appear in
struct kvm_riscv_csr from the KVM UAPI, similar to what
kvm_riscv_(get|put)_regs_csr are doing. This will make a bit easier to
add new KVM CSRs and to verify which values we're writing back to KVM
during vcpu reset.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250224123120.1644186-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_core(CPUState *cs)
     return ret;
 }
 
+static void kvm_riscv_reset_regs_csr(CPURISCVState *env)
+{
+    env->mstatus = 0;
+    env->mie = 0;
+    env->stvec = 0;
+    env->sscratch = 0;
+    env->sepc = 0;
+    env->scause = 0;
+    env->stval = 0;
+    env->mip = 0;
+    env->satp = 0;
+}
+
 static int kvm_riscv_get_regs_csr(CPUState *cs)
 {
     CPURISCVState *env = &RISCV_CPU(cs)->env;
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
     env->pc = cpu->env.kernel_addr;
     env->gpr[10] = kvm_arch_vcpu_id(CPU(cpu)); /* a0 */
     env->gpr[11] = cpu->env.fdt_addr;          /* a1 */
-    env->satp = 0;
-    env->mie = 0;
-    env->stvec = 0;
-    env->sscratch = 0;
-    env->sepc = 0;
-    env->scause = 0;
-    env->stval = 0;
-    env->mip = 0;
+
+    kvm_riscv_reset_regs_csr(env);
 }
 
 void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level)
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're missing scounteren and senvcfg CSRs, both already present in the
KVM UAPI.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250224123120.1644186-4-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_reset_regs_csr(CPURISCVState *env)
     env->stval = 0;
     env->mip = 0;
     env->satp = 0;
+    env->scounteren = 0;
+    env->senvcfg = 0;
 }
 
 static int kvm_riscv_get_regs_csr(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_get_regs_csr(CPUState *cs)
     KVM_RISCV_GET_CSR(cs, env, stval, env->stval);
     KVM_RISCV_GET_CSR(cs, env, sip, env->mip);
     KVM_RISCV_GET_CSR(cs, env, satp, env->satp);
+    KVM_RISCV_GET_CSR(cs, env, scounteren, env->scounteren);
+    KVM_RISCV_GET_CSR(cs, env, senvcfg, env->senvcfg);
 
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_put_regs_csr(CPUState *cs)
     KVM_RISCV_SET_CSR(cs, env, stval, env->stval);
     KVM_RISCV_SET_CSR(cs, env, sip, env->mip);
     KVM_RISCV_SET_CSR(cs, env, satp, env->satp);
+    KVM_RISCV_SET_CSR(cs, env, scounteren, env->scounteren);
+    KVM_RISCV_SET_CSR(cs, env, senvcfg, env->senvcfg);
 
     return 0;
 }
-- 
2.48.1