Series comparison

-[PULL 00/25] riscv-to-apply queue
+[PULL 00/10] riscv-to-apply queue
-From: Alistair Francis <alistair.francis@wdc.com>
+The following changes since commit 1dae461a913f9da88df05de6e2020d3134356f2e:
-The following changes since commit f22833602095b05733bceaddeb20f3edfced3c07:
+  Update version for v10.0.0-rc0 release (2025-03-18 10:18:14 -0400)
   Merge tag 'pull-target-arm-20220428' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2022-04-28 08:34:17 -0700)
 are available in the Git repository at:
-  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20220429
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20250319
-for you to fetch changes up to 325b7c4e7582c229d28c47123c3b986ed948eb84:
+for you to fetch changes up to ffe4db11f8aed79c7ec7d3ebd92674a1cfab4fe7:
-  hw/riscv: Enable TPM backends (2022-04-29 10:48:48 +1000)
+  target/riscv: Add check for 16-bit aligned PC for different priv versions. (2025-03-19 17:11:46 +1000)
 ----------------------------------------------------------------
-Second RISC-V PR for QEMU 7.1
+Fourth RISC-V PR for 10.0
- * Improve device tree generation
+* Fix broken emulation link
- * Support configuarable marchid, mvendorid, mipid CSR values
+* Optimize the memory probing for vector fault-only-first loads
- * Add support for the Zbkb, Zbkc, Zbkx, Zknd/Zkne, Zknh, Zksed/Zksh and Zkr extensions
+* Fix access permission checks for CSR_SSP
- * Fix incorrect PTE merge in walk_pte
+* Fixes a bug against `ssamoswap` behavior in M-mode
- * Add TPM support to the virt board
+* Fix IOMMU process directory table walk
 * Fix OVERFLOW_BEFORE_WIDEN in rmw_sctrdepth()
 * Enhance VSTART and VL checks for vector instructions
 * Fix handling of cpu mask in riscv_hwprobe syscall
 * Add check for 16-bit aligned PC for different priv versions
 ----------------------------------------------------------------
-Alistair Francis (6):
+Chao Liu (2):
-      hw/riscv: virt: Add a machine done notifier
+      target/riscv: refactor VSTART_CHECK_EARLY_EXIT() to accept vl as a parameter
-      hw/core: Move the ARM sysbus-fdt to core
+      target/riscv: fix handling of nop for vstart >= vl in some vector instruction
       hw/riscv: virt: Create a platform bus
       hw/riscv: virt: Add support for generating platform FDT entries
       hw/riscv: virt: Add device plug support
       hw/riscv: Enable TPM backends
-Bin Meng (2):
+Daniel Henrique Barboza (1):
-      hw/riscv: spike: Add '/chosen/stdout-path' in device tree unconditionally
+      target/riscv/csr.c: fix OVERFLOW_BEFORE_WIDEN in rmw_sctrdepth()
       hw/riscv: Don't add empty bootargs to device tree
-Frank Chang (1):
+Deepak Gupta (2):
-      target/riscv: Support configuarable marchid, mvendorid, mipid CSR values
+      target/riscv: fix access permission checks for CSR_SSP
       target/riscv: fixes a bug against `ssamoswap` behavior in M-mode
-Ralf Ramsauer (1):
+Jason Chien (1):
-      target/riscv: Fix incorrect PTE merge in walk_pte
+      hw/riscv/riscv-iommu: Fix process directory table walk
-Weiwei Li (15):
+Paolo Savini (1):
-      target/riscv: rvk: add cfg properties for zbk* and zk*
+      optimize the memory probing for vector fault-only-first loads.
       target/riscv: rvk: add support for zbkb extension
       target/riscv: rvk: add support for zbkc extension
       target/riscv: rvk: add support for zbkx extension
       crypto: move sm4_sbox from target/arm
       target/riscv: rvk: add support for zknd/zkne extension in RV32
       target/riscv: rvk: add support for zkne/zknd extension in RV64
       target/riscv: rvk: add support for sha256 related instructions in zknh extension
       target/riscv: rvk: add support for sha512 related instructions for RV32 in zknh extension
       target/riscv: rvk: add support for sha512 related instructions for RV64 in zknh extension
       target/riscv: rvk: add support for zksed/zksh extension
       target/riscv: rvk: add CSR support for Zkr
       disas/riscv.c: rvk: add disas support for Zbk* and Zk* instructions
       target/riscv: rvk: expose zbk* and zk* properties
       target/riscv: add scalar crypto related extenstion strings to isa_string
- docs/system/riscv/virt.rst              |  20 ++
+Richard Henderson (1):
- include/crypto/sm4.h                    |   6 +
+      linux-user/riscv: Fix handling of cpu mask in riscv_hwprobe syscall
- include/hw/{arm => core}/sysbus-fdt.h   |   0
- include/hw/riscv/virt.h                 |   8 +-
+Santiago Monserrat Campanello (1):
- target/riscv/cpu.h                      |  17 ++
+      docs/about/emulation: Fix broken link
- target/riscv/cpu_bits.h                 |   9 +
- target/riscv/helper.h                   |  22 ++
+Yu-Ming Chang (1):
- target/riscv/pmp.h                      |   8 +-
+      target/riscv: Add check for 16-bit aligned PC for different priv versions.
- target/riscv/insn32.decode              |  97 ++++++--
- crypto/sm4.c                            |  49 ++++
+ docs/about/emulation.rst                      |   2 +-
- disas/riscv.c                           | 173 +++++++++++++-
+ hw/riscv/riscv-iommu-bits.h                   |   6 +-
- hw/arm/virt.c                           |   2 +-
+ target/riscv/cpu.h                            |  12 ++
- hw/arm/xlnx-versal-virt.c               |   1 -
+ target/riscv/vector_internals.h               |  12 +-
- hw/{arm => core}/sysbus-fdt.c           |   2 +-
+ hw/riscv/riscv-iommu.c                        |   4 +-
- hw/riscv/microchip_pfsoc.c              |   2 +-
+ linux-user/syscall.c                          |  55 ++++----
- hw/riscv/sifive_u.c                     |   2 +-
+ target/riscv/csr.c                            |   7 +-
- hw/riscv/spike.c                        |   7 +-
+ target/riscv/op_helper.c                      |   8 +-
- hw/riscv/virt.c                         | 319 +++++++++++++++++---------
+ target/riscv/translate.c                      |   4 +-
- target/arm/crypto_helper.c              |  36 +--
+ target/riscv/vcrypto_helper.c                 |  32 ++---
- target/riscv/bitmanip_helper.c          |  80 +++++++
+ target/riscv/vector_helper.c                  | 186 ++++++++++++++------------
- target/riscv/cpu.c                      |  58 +++++
+ target/riscv/vector_internals.c               |   4 +-
- target/riscv/crypto_helper.c            | 302 ++++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvi.c.inc       |   8 +-
- target/riscv/csr.c                      | 118 +++++++++-
+ target/riscv/insn_trans/trans_rvzicfiss.c.inc |  17 +++
- target/riscv/monitor.c                  |  11 +-
+files changed, 214 insertions(+), 143 deletions(-)
  target/riscv/op_helper.c                |   9 +
  target/riscv/translate.c                |   8 +
  target/riscv/insn_trans/trans_rvb.c.inc | 116 ++++++++--
  target/riscv/insn_trans/trans_rvk.c.inc | 391 ++++++++++++++++++++++++++++++++
  crypto/meson.build                      |   1 +
  hw/arm/meson.build                      |   1 -
  hw/core/meson.build                     |   1 +
  hw/riscv/Kconfig                        |   2 +
  target/riscv/meson.build                |   3 +-
 files changed, 1682 insertions(+), 199 deletions(-)
  create mode 100644 include/crypto/sm4.h
  rename include/hw/{arm => core}/sysbus-fdt.h (100%)
  create mode 100644 crypto/sm4.c
  rename hw/{arm => core}/sysbus-fdt.c (99%)
  create mode 100644 target/riscv/crypto_helper.c
  create mode 100644 target/riscv/insn_trans/trans_rvk.c.inc

-[PULL 01/25] hw/riscv: spike: Add '/chosen/stdout-path' in device tree unconditionally
+Deleted patch
-From: Bin Meng <bin.meng@windriver.com>
-At present the adding '/chosen/stdout-path' property in device tree
-is determined by whether a kernel command line is provided, which is
-wrong. It should be added unconditionally.
-Fixes: 8d8897accb1c ("hw/riscv: spike: Allow using binary firmware as bios")
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220421055629.1177285-1-bmeng.cn@gmail.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/spike.c | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/spike.c
-+++ b/hw/riscv/spike.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
-     riscv_socket_fdt_write_distance_matrix(mc, fdt);
-+    qemu_fdt_add_subnode(fdt, "/chosen");
-+    qemu_fdt_setprop_string(fdt, "/chosen", "stdout-path", "/htif");
-+
-     if (cmdline) {
--        qemu_fdt_add_subnode(fdt, "/chosen");
-         qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", cmdline);
--        qemu_fdt_setprop_string(fdt, "/chosen", "stdout-path", "/htif");
-     }
- }
---
-.35.1

-[PULL 02/25] hw/riscv: Don't add empty bootargs to device tree
+Deleted patch
-From: Bin Meng <bin.meng@windriver.com>
-Commit 7c28f4da20e5 ("RISC-V: Don't add NULL bootargs to device-tree")
-tried to avoid adding *NULL* bootargs to device tree, but unfortunately
-the changes were entirely useless, due to MachineState::kernel_cmdline
-can't be NULL at all as the default value is given as an empty string.
-(see hw/core/machine.c::machine_initfn()).
-Note the wording of *NULL* bootargs is wrong. It can't be NULL otherwise
-a segfault had already been observed by dereferencing the NULL pointer.
-It should be worded as *empty" bootargs.
-Fixes: 7c28f4da20e5 ("RISC-V: Don't add NULL bootargs to device-tree")
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220421055629.1177285-2-bmeng.cn@gmail.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/microchip_pfsoc.c | 2 +-
- hw/riscv/sifive_u.c        | 2 +-
- hw/riscv/spike.c           | 2 +-
- hw/riscv/virt.c            | 2 +-
-files changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/microchip_pfsoc.c
-+++ b/hw/riscv/microchip_pfsoc.c
-@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
-                                   "linux,initrd-end", end);
-         }
--        if (machine->kernel_cmdline) {
-+        if (machine->kernel_cmdline && *machine->kernel_cmdline) {
-             qemu_fdt_setprop_string(machine->fdt, "/chosen",
-                                     "bootargs", machine->kernel_cmdline);
-         }
-diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_u.c
-+++ b/hw/riscv/sifive_u.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
-     g_free(nodename);
- update_bootargs:
--    if (cmdline) {
-+    if (cmdline && *cmdline) {
-         qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", cmdline);
-     }
- }
-diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/spike.c
-+++ b/hw/riscv/spike.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
-     qemu_fdt_add_subnode(fdt, "/chosen");
-     qemu_fdt_setprop_string(fdt, "/chosen", "stdout-path", "/htif");
--    if (cmdline) {
-+    if (cmdline && *cmdline) {
-         qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", cmdline);
-     }
- }
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
-+++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
-     create_fdt_flash(s, memmap);
- update_bootargs:
--    if (cmdline) {
-+    if (cmdline && *cmdline) {
-         qemu_fdt_setprop_string(mc->fdt, "/chosen", "bootargs", cmdline);
-     }
- }
---
-.35.1

-[PULL 25/25] hw/riscv: Enable TPM backends
+[PULL 01/10] docs/about/emulation: Fix broken link
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Santiago Monserrat Campanello <santimonserr@gmail.com>
-Imply the TPM sysbus devices. This allows users to add TPM devices to
+semihosting link to risc-v changed
 the RISC-V virt board.
-This was tested by first creating an emulated TPM device:
+Signed-off-by: Santiago Monserrat Campanello <santimonserr@gmail.com>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2717
-    swtpm socket --tpm2 -t -d --tpmstate dir=/tmp/tpm \
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-        --ctrl type=unixio,path=swtpm-sock
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-ID: <20250305102632.91376-1-santimonserr@gmail.com>
 Then launching QEMU with:
     -chardev socket,id=chrtpm,path=swtpm-sock \
     -tpmdev emulator,id=tpm0,chardev=chrtpm \
     -device tpm-tis-device,tpmdev=tpm0
 The TPM device can be seen in the memory tree and the generated device
 tree.
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/942
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
 Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
 Message-Id: <20220427234146.1130752-7-alistair.francis@opensource.wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- docs/system/riscv/virt.rst | 20 ++++++++++++++++++++
+ docs/about/emulation.rst | 2 +-
- hw/riscv/virt.c            |  4 ++++
+file changed, 1 insertion(+), 1 deletion(-)
  hw/riscv/Kconfig           |  1 +
 files changed, 25 insertions(+)
-diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
+diff --git a/docs/about/emulation.rst b/docs/about/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/riscv/virt.rst
+--- a/docs/about/emulation.rst
-+++ b/docs/system/riscv/virt.rst
++++ b/docs/about/emulation.rst
-@@ -XXX,XX +XXX,XX @@ The minimal QEMU commands to run U-Boot SPL are:
+@@ -XXX,XX +XXX,XX @@ for that architecture.
- To test 32-bit U-Boot images, switch to use qemu-riscv32_smode_defconfig and
+     - Unified Hosting Interface (MD01069)
- riscv32_spl_defconfig builds, and replace ``qemu-system-riscv64`` with
+   * - RISC-V
- ``qemu-system-riscv32`` in the command lines above to boot the 32-bit U-Boot.
+     - System and User-mode
-+
+-    - https://github.com/riscv/riscv-semihosting-spec/blob/main/riscv-semihosting-spec.adoc
-+Enabling TPM
++    - https://github.com/riscv-non-isa/riscv-semihosting/blob/main/riscv-semihosting.adoc
-+------------
+   * - Xtensa
-+
+     - System
-+A TPM device can be connected to the virt board by following the steps below.
+     - Tensilica ISS SIMCALL
 +
 +First launch the TPM emulator
 +
 +    swtpm socket --tpm2 -t -d --tpmstate dir=/tmp/tpm \
 +        --ctrl type=unixio,path=swtpm-sock
 +
 +Then launch QEMU with:
 +
 +    ...
 +    -chardev socket,id=chrtpm,path=swtpm-sock \
 +    -tpmdev emulator,id=tpm0,chardev=chrtpm \
 +    -device tpm-tis-device,tpmdev=tpm0
 +
 +The TPM device can be seen in the memory tree and the generated device
 +tree and should be accessible from the guest software.
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/device_tree.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
 +#include "sysemu/tpm.h"
  #include "hw/pci/pci.h"
  #include "hw/pci-host/gpex.h"
  #include "hw/display/ramfb.h"
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
      hc->plug = virt_machine_device_plug_cb;
      machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
 +#ifdef CONFIG_TPM
 +    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
 +#endif
      object_class_property_add_bool(oc, "aclint", virt_get_aclint,
                                     virt_set_aclint);
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      imply PCI_DEVICES
      imply VIRTIO_VGA
      imply TEST_DEVICES
 +    imply TPM_TIS_SYSBUS
      select RISCV_NUMA
      select GOLDFISH_RTC
      select MSI_NONBROKEN
 --
-.35.1
+.48.1

-[PULL 10/25] target/riscv: rvk: add support for zkne/zknd extension in RV64
+[PULL 02/10] optimize the memory probing for vector fault-only-first loads.
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Paolo Savini <paolo.savini@embecosm.com>
- - add aes64dsm, aes64ds, aes64im, aes64es, aes64esm, aes64ks2, aes64ks1i instructions
+Fault-only-first loads in the RISC-V vector extension need to update
 the vl with the element index that causes an exception.
 In order to ensure this the emulation of this instruction used to probe the
 memory covered by the load operation with a loop that iterated over each element
 so that when a flag was raised it was possible to set the vl to the
 corresponding element index.
 This loop was executed every time whether an exception happened or not.
-Co-authored-by: Ruibo Lu <luruibo2000@163.com>
+This commit removes the per element memory probing from the main execution path
-Co-authored-by: Zewen Ye <lustrew@foxmail.com>
+and adds a broad memory probing first. If this probing raises any flag that is
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+not a watchpoint flag (that per standard is allowed by this instruction) we
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+proceed with the per element probing to find the index of the element causing
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+the exception and set vl to such index.
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423023510.30794-8-liweiwei@iscas.ac.cn>
+Signed-off-by: Paolo Savini <paolo.savini@embecosm.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20250221155320.59159-2-paolo.savini@embecosm.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/helper.h                   |   8 ++
+ target/riscv/vector_helper.c | 103 ++++++++++++++++++++---------------
- target/riscv/insn32.decode              |  12 ++
+file changed, 58 insertions(+), 45 deletions(-)
  target/riscv/crypto_helper.c            | 169 ++++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvk.c.inc |  54 ++++++++
 files changed, 243 insertions(+)
-diff --git a/target/riscv/helper.h b/target/riscv/helper.h
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/helper.h
+--- a/target/riscv/vector_helper.c
-+++ b/target/riscv/helper.h
++++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(aes32esmi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base, CPURISCVState *env,
- DEF_HELPER_FLAGS_3(aes32esi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+     uint32_t esz = 1 << log2_esz;
- DEF_HELPER_FLAGS_3(aes32dsmi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+     uint32_t msize = nf * esz;
- DEF_HELPER_FLAGS_3(aes32dsi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+     uint32_t vma = vext_vma(desc);
-+
+-    target_ulong addr, offset, remain, page_split, elems;
-+DEF_HELPER_FLAGS_2(aes64esm, TCG_CALL_NO_RWG_SE, tl, tl, tl)
++    target_ulong addr, addr_probe, addr_i, offset, remain, page_split, elems;
-+DEF_HELPER_FLAGS_2(aes64es, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+     int mmu_index = riscv_env_mmu_index(env, false);
-+DEF_HELPER_FLAGS_2(aes64ds, TCG_CALL_NO_RWG_SE, tl, tl, tl)
++    int flags;
-+DEF_HELPER_FLAGS_2(aes64dsm, TCG_CALL_NO_RWG_SE, tl, tl, tl)
++    void *host;
-+DEF_HELPER_FLAGS_2(aes64ks2, TCG_CALL_NO_RWG_SE, tl, tl, tl)
-+DEF_HELPER_FLAGS_2(aes64ks1i, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+     VSTART_CHECK_EARLY_EXIT(env);
-+DEF_HELPER_FLAGS_1(aes64im, TCG_CALL_NO_RWG_SE, tl, tl)
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+-    /* probe every access */
-index XXXXXXX..XXXXXXX 100644
+-    for (i = env->vstart; i < env->vl; i++) {
---- a/target/riscv/insn32.decode
+-        if (!vm && !vext_elem_mask(v0, i)) {
-+++ b/target/riscv/insn32.decode
+-            continue;
-@@ -XXX,XX +XXX,XX @@
+-        }
- %imm_j    31:s1 12:8 20:1 21:10  !function=ex_shift_1
+-        addr = adjust_addr(env, base + i * (nf << log2_esz));
- %imm_u    12:s20                 !function=ex_shift_12
+-        if (i == 0) {
- %imm_bs   30:2                   !function=ex_shift_3
+-            /* Allow fault on first element. */
-+%imm_rnum 20:4
+-            probe_pages(env, addr, nf << log2_esz, ra, MMU_DATA_LOAD);
+-        } else {
- # Argument sets:
+-            remain = nf << log2_esz;
- &empty
+-            while (remain > 0) {
-@@ -XXX,XX +XXX,XX @@
+-                void *host;
- @sfence_vm  ....... ..... .....   ... ..... ....... %rs1
+-                int flags;
+-
- @k_aes   .. ..... ..... .....  ... ..... ....... &k_aes  shamt=%imm_bs   %rs2 %rs1 %rd
+-                offset = -(addr | TARGET_PAGE_MASK);
-+@i_aes   .. ..... ..... .....  ... ..... ....... &i      imm=%imm_rnum        %rs1 %rd
+-
+-                /* Probe nonfault on subsequent elements. */
- # Formats 64:
+-                flags = probe_access_flags(env, addr, offset, MMU_DATA_LOAD,
- @sh5     .......  ..... .....  ... ..... ....... &shift  shamt=%sh5      %rs1 %rd
+-                                           mmu_index, true, &host, 0);
-@@ -XXX,XX +XXX,XX @@ hinval_gvma       0110011 ..... ..... 000 00000 1110011 @hfence_gvma
+-
- # *** RV32 Zknd Standard Extension ***
+-                /*
- aes32dsmi   .. 10111 ..... ..... 000 ..... 0110011 @k_aes
+-                 * Stop if invalid (unmapped) or mmio (transaction may fail).
- aes32dsi    .. 10101 ..... ..... 000 ..... 0110011 @k_aes
+-                 * Do not stop if watchpoint, as the spec says that
-+# *** RV64 Zknd Standard Extension ***
+-                 * first-fault should continue to access the same
-+aes64dsm    00 11111 ..... ..... 000 ..... 0110011 @r
+-                 * elements regardless of any watchpoint.
-+aes64ds     00 11101 ..... ..... 000 ..... 0110011 @r
+-                 */
-+aes64im     00 11000 00000 ..... 001 ..... 0010011 @r2
+-                if (flags & ~TLB_WATCHPOINT) {
- # *** RV32 Zkne Standard Extension ***
+-                    vl = i;
- aes32esmi   .. 10011 ..... ..... 000 ..... 0110011 @k_aes
+-                    goto ProbeSuccess;
- aes32esi    .. 10001 ..... ..... 000 ..... 0110011 @k_aes
+-                }
-+# *** RV64 Zkne Standard Extension ***
+-                if (remain <= offset) {
-+aes64es     00 11001 ..... ..... 000 ..... 0110011 @r
+-                    break;
-+aes64esm    00 11011 ..... ..... 000 ..... 0110011 @r
++    addr = base + ((env->vstart * nf) << log2_esz);
-+# *** RV64 Zkne/zknd Standard Extension ***
++    page_split = -(addr | TARGET_PAGE_MASK);
-+aes64ks2    01 11111 ..... ..... 000 ..... 0110011 @r
++    /* Get number of elements */
-+aes64ks1i   00 11000 1.... ..... 001 ..... 0010011 @i_aes
++    elems = page_split / msize;
-diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
++    if (unlikely(env->vstart + elems >= env->vl)) {
-index XXXXXXX..XXXXXXX 100644
++        elems = env->vl - env->vstart;
 --- a/target/riscv/crypto_helper.c
 +++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2,
  {
      return aes32_operation(shamt, rs1, rs2, false, false);
  }
 +
 +#define BY(X, I) ((X >> (8 * I)) & 0xFF)
 +
 +#define AES_SHIFROWS_LO(RS1, RS2) ( \
 +    (((RS1 >> 24) & 0xFF) << 56) | (((RS2 >> 48) & 0xFF) << 48) | \
 +    (((RS2 >> 8) & 0xFF) << 40) | (((RS1 >> 32) & 0xFF) << 32) | \
 +    (((RS2 >> 56) & 0xFF) << 24) | (((RS2 >> 16) & 0xFF) << 16) | \
 +    (((RS1 >> 40) & 0xFF) << 8) | (((RS1 >> 0) & 0xFF) << 0))
 +
 +#define AES_INVSHIFROWS_LO(RS1, RS2) ( \
 +    (((RS2 >> 24) & 0xFF) << 56) | (((RS2 >> 48) & 0xFF) << 48) | \
 +    (((RS1 >> 8) & 0xFF) << 40) | (((RS1 >> 32) & 0xFF) << 32) | \
 +    (((RS1 >> 56) & 0xFF) << 24) | (((RS2 >> 16) & 0xFF) << 16) | \
 +    (((RS2 >> 40) & 0xFF) << 8) | (((RS1 >> 0) & 0xFF) << 0))
 +
 +#define AES_MIXBYTE(COL, B0, B1, B2, B3) ( \
 +    BY(COL, B3) ^ BY(COL, B2) ^ AES_GFMUL(BY(COL, B1), 3) ^ \
 +    AES_GFMUL(BY(COL, B0), 2))
 +
 +#define AES_MIXCOLUMN(COL) ( \
 +    AES_MIXBYTE(COL, 3, 0, 1, 2) << 24 | \
 +    AES_MIXBYTE(COL, 2, 3, 0, 1) << 16 | \
 +    AES_MIXBYTE(COL, 1, 2, 3, 0) << 8 | AES_MIXBYTE(COL, 0, 1, 2, 3) << 0)
 +
 +#define AES_INVMIXBYTE(COL, B0, B1, B2, B3) ( \
 +    AES_GFMUL(BY(COL, B3), 0x9) ^ AES_GFMUL(BY(COL, B2), 0xd) ^ \
 +    AES_GFMUL(BY(COL, B1), 0xb) ^ AES_GFMUL(BY(COL, B0), 0xe))
 +
 +#define AES_INVMIXCOLUMN(COL) ( \
 +    AES_INVMIXBYTE(COL, 3, 0, 1, 2) << 24 | \
 +    AES_INVMIXBYTE(COL, 2, 3, 0, 1) << 16 | \
 +    AES_INVMIXBYTE(COL, 1, 2, 3, 0) << 8 | \
 +    AES_INVMIXBYTE(COL, 0, 1, 2, 3) << 0)
 +
 +static inline target_ulong aes64_operation(target_ulong rs1, target_ulong rs2,
 +                                           bool enc, bool mix)
 +{
 +    uint64_t RS1 = rs1;
 +    uint64_t RS2 = rs2;
 +    uint64_t result;
 +    uint64_t temp;
 +    uint32_t col_0;
 +    uint32_t col_1;
 +
 +    if (enc) {
 +        temp = AES_SHIFROWS_LO(RS1, RS2);
 +        temp = (((uint64_t)AES_sbox[(temp >> 0) & 0xFF] << 0) |
 +                ((uint64_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
 +                ((uint64_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
 +                ((uint64_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
 +                ((uint64_t)AES_sbox[(temp >> 32) & 0xFF] << 32) |
 +                ((uint64_t)AES_sbox[(temp >> 40) & 0xFF] << 40) |
 +                ((uint64_t)AES_sbox[(temp >> 48) & 0xFF] << 48) |
 +                ((uint64_t)AES_sbox[(temp >> 56) & 0xFF] << 56));
 +        if (mix) {
 +            col_0 = temp & 0xFFFFFFFF;
 +            col_1 = temp >> 32;
 +
 +            col_0 = AES_MIXCOLUMN(col_0);
 +            col_1 = AES_MIXCOLUMN(col_1);
 +
 +            result = ((uint64_t)col_1 << 32) | col_0;
 +        } else {
 +            result = temp;
 +        }
 +    } else {
 +        temp = AES_INVSHIFROWS_LO(RS1, RS2);
 +        temp = (((uint64_t)AES_isbox[(temp >> 0) & 0xFF] << 0) |
 +                ((uint64_t)AES_isbox[(temp >> 8) & 0xFF] << 8) |
 +                ((uint64_t)AES_isbox[(temp >> 16) & 0xFF] << 16) |
 +                ((uint64_t)AES_isbox[(temp >> 24) & 0xFF] << 24) |
 +                ((uint64_t)AES_isbox[(temp >> 32) & 0xFF] << 32) |
 +                ((uint64_t)AES_isbox[(temp >> 40) & 0xFF] << 40) |
 +                ((uint64_t)AES_isbox[(temp >> 48) & 0xFF] << 48) |
 +                ((uint64_t)AES_isbox[(temp >> 56) & 0xFF] << 56));
 +        if (mix) {
 +            col_0 = temp & 0xFFFFFFFF;
 +            col_1 = temp >> 32;
 +
 +            col_0 = AES_INVMIXCOLUMN(col_0);
 +            col_1 = AES_INVMIXCOLUMN(col_1);
 +
 +            result = ((uint64_t)col_1 << 32) | col_0;
 +        } else {
 +            result = temp;
 +        }
 +    }
 +
-+    return result;
++    /* Check page permission/pmp/watchpoint/etc. */
-+}
++    flags = probe_access_flags(env, adjust_addr(env, addr), elems * msize,
 +                               MMU_DATA_LOAD, mmu_index, true, &host, ra);
 +
-+target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2)
++    /* If we are crossing a page check also the second page. */
-+{
++    if (env->vl > elems) {
-+    return aes64_operation(rs1, rs2, true, true);
++        addr_probe = addr + (elems << log2_esz);
-+}
++        flags |= probe_access_flags(env, adjust_addr(env, addr_probe),
-+
++                                    elems * msize, MMU_DATA_LOAD, mmu_index,
-+target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2)
++                                    true, &host, ra);
 +{
 +    return aes64_operation(rs1, rs2, true, false);
 +}
 +
 +target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2)
 +{
 +    return aes64_operation(rs1, rs2, false, false);
 +}
 +
 +target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2)
 +{
 +    return aes64_operation(rs1, rs2, false, true);
 +}
 +
 +target_ulong HELPER(aes64ks2)(target_ulong rs1, target_ulong rs2)
 +{
 +    uint64_t RS1 = rs1;
 +    uint64_t RS2 = rs2;
 +    uint32_t rs1_hi = RS1 >> 32;
 +    uint32_t rs2_lo = RS2;
 +    uint32_t rs2_hi = RS2 >> 32;
 +
 +    uint32_t r_lo = (rs1_hi ^ rs2_lo);
 +    uint32_t r_hi = (rs1_hi ^ rs2_lo ^ rs2_hi);
 +    target_ulong result = ((uint64_t)r_hi << 32) | r_lo;
 +
 +    return result;
 +}
 +
 +target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
 +{
 +    uint64_t RS1 = rs1;
 +    static const uint8_t round_consts[10] = {
 +        0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36
 +    };
 +
 +    uint8_t enc_rnum = rnum;
 +    uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
 +    uint8_t rcon_ = 0;
 +    target_ulong result;
 +
 +    if (enc_rnum != 0xA) {
 +        temp = ror32(temp, 8); /* Rotate right by 8 */
 +        rcon_ = round_consts[enc_rnum];
 +    }
 +
-+    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
++    if (flags & ~TLB_WATCHPOINT) {
-+           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
++        /* probe every access */
-+           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
++        for (i = env->vstart; i < env->vl; i++) {
-+           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
++            if (!vm && !vext_elem_mask(v0, i)) {
 +                continue;
 +            }
 +            addr_i = adjust_addr(env, base + i * (nf << log2_esz));
 +            if (i == 0) {
 +                /* Allow fault on first element. */
 +                probe_pages(env, addr_i, nf << log2_esz, ra, MMU_DATA_LOAD);
 +            } else {
 +                remain = nf << log2_esz;
 +                while (remain > 0) {
 +                    offset = -(addr_i | TARGET_PAGE_MASK);
 +
-+    temp ^= rcon_;
++                    /* Probe nonfault on subsequent elements. */
 +                    flags = probe_access_flags(env, addr_i, offset,
 +                                               MMU_DATA_LOAD, mmu_index, true,
 +                                               &host, 0);
 +
-+    result = ((uint64_t)temp << 32) | temp;
++                    /*
-+
++                     * Stop if invalid (unmapped) or mmio (transaction may
-+    return result;
++                     * fail). Do not stop if watchpoint, as the spec says that
-+}
++                     * first-fault should continue to access the same
-+
++                     * elements regardless of any watchpoint.
-+target_ulong HELPER(aes64im)(target_ulong rs1)
++                     */
-+{
++                    if (flags & ~TLB_WATCHPOINT) {
-+    uint64_t RS1 = rs1;
++                        vl = i;
-+    uint32_t col_0 = RS1 & 0xFFFFFFFF;
++                        goto ProbeSuccess;
-+    uint32_t col_1 = RS1 >> 32;
++                    }
-+    target_ulong result;
++                    if (remain <= offset) {
-+
++                        break;
-+    col_0 = AES_INVMIXCOLUMN(col_0);
++                    }
-+    col_1 = AES_INVMIXCOLUMN(col_1);
++                    remain -= offset;
-+
++                    addr_i = adjust_addr(env, addr_i + offset);
-+    result = ((uint64_t)col_1 << 32) | col_0;
+                 }
-+
+-                remain -= offset;
-+    return result;
+-                addr = adjust_addr(env, addr + offset);
-+}
+             }
- #undef sext32_xlen
+         }
-diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/insn_trans/trans_rvk.c.inc
+     }
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ ProbeSuccess:
---- a/target/riscv/insn_trans/trans_rvk.c.inc
-+++ b/target/riscv/insn_trans/trans_rvk.c.inc
+     if (env->vstart < env->vl) {
-@@ -XXX,XX +XXX,XX @@ static bool trans_aes32dsi(DisasContext *ctx, arg_aes32dsi *a)
+         if (vm) {
-     REQUIRE_ZKND(ctx);
+-            /* Calculate the page range of first page */
-     return gen_aes32_sm4(ctx, a, gen_helper_aes32dsi);
+-            addr = base + ((env->vstart * nf) << log2_esz);
- }
+-            page_split = -(addr | TARGET_PAGE_MASK);
-+
+-            /* Get number of elements */
-+static bool trans_aes64es(DisasContext *ctx, arg_aes64es *a)
+-            elems = page_split / msize;
-+{
+-            if (unlikely(env->vstart + elems >= env->vl)) {
-+    REQUIRE_64BIT(ctx);
+-                elems = env->vl - env->vstart;
-+    REQUIRE_ZKNE(ctx);
+-            }
-+    return gen_arith(ctx, a, EXT_NONE, gen_helper_aes64es, NULL);
+-
-+}
+             /* Load/store elements in the first page */
-+
+             if (likely(elems)) {
-+static bool trans_aes64esm(DisasContext *ctx, arg_aes64esm *a)
+                 vext_page_ldst_us(env, vd, addr, elems, nf, max_elems,
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_ZKNE(ctx);
 +    return gen_arith(ctx, a, EXT_NONE, gen_helper_aes64esm, NULL);
 +}
 +
 +static bool trans_aes64ds(DisasContext *ctx, arg_aes64ds *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_ZKND(ctx);
 +    return gen_arith(ctx, a, EXT_NONE, gen_helper_aes64ds, NULL);
 +}
 +
 +static bool trans_aes64dsm(DisasContext *ctx, arg_aes64dsm *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_ZKND(ctx);
 +    return gen_arith(ctx, a, EXT_NONE, gen_helper_aes64dsm, NULL);
 +}
 +
 +static bool trans_aes64ks2(DisasContext *ctx, arg_aes64ks2 *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zknd, zkne);
 +    return gen_arith(ctx, a, EXT_NONE, gen_helper_aes64ks2, NULL);
 +}
 +
 +static bool trans_aes64ks1i(DisasContext *ctx, arg_aes64ks1i *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zknd, zkne);
 +
 +    if (a->imm > 0xA) {
 +        return false;
 +    }
 +
 +    return gen_arith_imm_tl(ctx, a, EXT_NONE, gen_helper_aes64ks1i, NULL);
 +}
 +
 +static bool trans_aes64im(DisasContext *ctx, arg_aes64im *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_ZKND(ctx);
 +    return gen_unary(ctx, a, EXT_NONE, gen_helper_aes64im);
 +}
 --
-.35.1
+.48.1

-[PULL 22/25] hw/riscv: virt: Create a platform bus
+[PULL 03/10] target/riscv: fix access permission checks for CSR_SSP
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Deepak Gupta <debug@rivosinc.com>
-Create a platform bus to allow dynamic devices to be connected. This is
+Commit:8205bc1 ("target/riscv: introduce ssp and enabling controls for
-based on the ARM implementation.
+zicfiss") introduced CSR_SSP but it mis-interpreted the spec on access
 to CSR_SSP in M-mode. Gated to CSR_SSP is not gated via `xSSE`. But
 rather rules clearly specified in section "22.2.1. Shadow Stack Pointer
 (ssp) CSR access contr" in the priv spec.
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Fixes: 8205bc127a83 ("target/riscv: introduce ssp and enabling controls
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
+for zicfiss". Thanks to Adam Zabrocki for bringing this to attention.
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-Id: <20220427234146.1130752-4-alistair.francis@opensource.wdc.com>
+Reported-by: Adam Zabrocki <azabrocki@nvidia.com>
 Signed-off-by: Deepak Gupta <debug@rivosinc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20250306064636.452396-1-debug@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h |  7 ++++-
+ target/riscv/csr.c | 5 +++++
- hw/riscv/virt.c         | 68 +++++++++++++++++++++++++++++------------
+file changed, 5 insertions(+)
  hw/riscv/Kconfig        |  1 +
 files changed, 56 insertions(+), 20 deletions(-)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
+--- a/target/riscv/csr.c
-+++ b/include/hw/riscv/virt.h
++++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
+@@ -XXX,XX +XXX,XX @@ static RISCVException cfi_ss(CPURISCVState *env, int csrno)
+         return RISCV_EXCP_ILLEGAL_INST;
-     /*< public >*/
+     }
-     Notifier machine_done;
-+    DeviceState *platform_bus_dev;
++    /* If ext implemented, M-mode always have access to SSP CSR */
-     RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
++    if (env->priv == PRV_M) {
-     DeviceState *irqchip[VIRT_SOCKETS_MAX];
++        return RISCV_EXCP_NONE;
      PFlashCFI01 *flash[2];
@@ -XXX,XX +XXX,XX @@ enum {
      VIRT_DRAM,
      VIRT_PCIE_MMIO,
      VIRT_PCIE_PIO,
 +    VIRT_PLATFORM_BUS,
      VIRT_PCIE_ECAM
  };
@@ -XXX,XX +XXX,XX @@ enum {
      VIRTIO_IRQ = 1, /* 1 to 8 */
      VIRTIO_COUNT = 8,
      PCIE_IRQ = 0x20, /* 32 to 35 */
 -    VIRTIO_NDEV = 0x35 /* Arbitrary maximum number of interrupts */
 +    VIRT_PLATFORM_BUS_IRQ = 64, /* 64 to 96 */
 +    VIRTIO_NDEV = 96 /* Arbitrary maximum number of interrupts */
  };
 +#define VIRT_PLATFORM_BUS_NUM_IRQS 32
 +
  #define VIRT_IRQCHIP_IPI_MSI 1
  #define VIRT_IRQCHIP_NUM_MSIS 255
  #define VIRT_IRQCHIP_NUM_SOURCES VIRTIO_NDEV
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/intc/riscv_imsic.h"
  #include "hw/intc/sifive_plic.h"
  #include "hw/misc/sifive_test.h"
 +#include "hw/platform-bus.h"
  #include "chardev/char.h"
  #include "sysemu/device_tree.h"
  #include "sysemu/sysemu.h"
@@ -XXX,XX +XXX,XX @@
  #endif
  static const MemMapEntry virt_memmap[] = {
 -    [VIRT_DEBUG] =       {        0x0,         0x100 },
 -    [VIRT_MROM] =        {     0x1000,        0xf000 },
 -    [VIRT_TEST] =        {   0x100000,        0x1000 },
 -    [VIRT_RTC] =         {   0x101000,        0x1000 },
 -    [VIRT_CLINT] =       {  0x2000000,       0x10000 },
 -    [VIRT_ACLINT_SSWI] = {  0x2F00000,        0x4000 },
 -    [VIRT_PCIE_PIO] =    {  0x3000000,       0x10000 },
 -    [VIRT_PLIC] =        {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
 -    [VIRT_APLIC_M] =     {  0xc000000, APLIC_SIZE(VIRT_CPUS_MAX) },
 -    [VIRT_APLIC_S] =     {  0xd000000, APLIC_SIZE(VIRT_CPUS_MAX) },
 -    [VIRT_UART0] =       { 0x10000000,         0x100 },
 -    [VIRT_VIRTIO] =      { 0x10001000,        0x1000 },
 -    [VIRT_FW_CFG] =      { 0x10100000,          0x18 },
 -    [VIRT_FLASH] =       { 0x20000000,     0x4000000 },
 -    [VIRT_IMSIC_M] =     { 0x24000000, VIRT_IMSIC_MAX_SIZE },
 -    [VIRT_IMSIC_S] =     { 0x28000000, VIRT_IMSIC_MAX_SIZE },
 -    [VIRT_PCIE_ECAM] =   { 0x30000000,    0x10000000 },
 -    [VIRT_PCIE_MMIO] =   { 0x40000000,    0x40000000 },
 -    [VIRT_DRAM] =        { 0x80000000,           0x0 },
 +    [VIRT_DEBUG] =        {        0x0,         0x100 },
 +    [VIRT_MROM] =         {     0x1000,        0xf000 },
 +    [VIRT_TEST] =         {   0x100000,        0x1000 },
 +    [VIRT_RTC] =          {   0x101000,        0x1000 },
 +    [VIRT_CLINT] =        {  0x2000000,       0x10000 },
 +    [VIRT_ACLINT_SSWI] =  {  0x2F00000,        0x4000 },
 +    [VIRT_PCIE_PIO] =     {  0x3000000,       0x10000 },
 +    [VIRT_PLATFORM_BUS] = {  0x4000000,     0x2000000 },
 +    [VIRT_PLIC] =         {  0xc000000, VIRT_PLIC_SIZE(VIRT_CPUS_MAX * 2) },
 +    [VIRT_APLIC_M] =      {  0xc000000, APLIC_SIZE(VIRT_CPUS_MAX) },
 +    [VIRT_APLIC_S] =      {  0xd000000, APLIC_SIZE(VIRT_CPUS_MAX) },
 +    [VIRT_UART0] =        { 0x10000000,         0x100 },
 +    [VIRT_VIRTIO] =       { 0x10001000,        0x1000 },
 +    [VIRT_FW_CFG] =       { 0x10100000,          0x18 },
 +    [VIRT_FLASH] =        { 0x20000000,     0x4000000 },
 +    [VIRT_IMSIC_M] =      { 0x24000000, VIRT_IMSIC_MAX_SIZE },
 +    [VIRT_IMSIC_S] =      { 0x28000000, VIRT_IMSIC_MAX_SIZE },
 +    [VIRT_PCIE_ECAM] =    { 0x30000000,    0x10000000 },
 +    [VIRT_PCIE_MMIO] =    { 0x40000000,    0x40000000 },
 +    [VIRT_DRAM] =         { 0x80000000,           0x0 },
  };
  /* PCIe high mmio is fixed for RV32 */
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
      return aplic_m;
  }
 +static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
 +{
 +    DeviceState *dev;
 +    SysBusDevice *sysbus;
 +    const MemMapEntry *memmap = virt_memmap;
 +    int i;
 +    MemoryRegion *sysmem = get_system_memory();
 +
 +    dev = qdev_new(TYPE_PLATFORM_BUS_DEVICE);
 +    dev->id = g_strdup(TYPE_PLATFORM_BUS_DEVICE);
 +    qdev_prop_set_uint32(dev, "num_irqs", VIRT_PLATFORM_BUS_NUM_IRQS);
 +    qdev_prop_set_uint32(dev, "mmio_size", memmap[VIRT_PLATFORM_BUS].size);
 +    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 +    s->platform_bus_dev = dev;
 +
 +    sysbus = SYS_BUS_DEVICE(dev);
 +    for (i = 0; i < VIRT_PLATFORM_BUS_NUM_IRQS; i++) {
 +        int irq = VIRT_PLATFORM_BUS_IRQ + i;
 +        sysbus_connect_irq(sysbus, i, qdev_get_gpio_in(irqchip, irq));
 +    }
 +
-+    memory_region_add_subregion(sysmem,
+     /* if bcfi not active for current env, access to csr is illegal */
-+                                memmap[VIRT_PLATFORM_BUS].base,
+     if (!cpu_get_bcfien(env)) {
-+                                sysbus_mmio_get_region(sysbus, 0));
+ #if !defined(CONFIG_USER_ONLY)
 +}
 +
  static void virt_machine_done(Notifier *notifier, void *data)
  {
      RISCVVirtState *s = container_of(notifier, RISCVVirtState,
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                     memmap[VIRT_PCIE_PIO].base,
                     DEVICE(pcie_irqchip));
 +    create_platform_bus(s, DEVICE(mmio_irqchip));
 +
      serial_mm_init(system_memory, memmap[VIRT_UART0].base,
 , qdev_get_gpio_in(DEVICE(mmio_irqchip), UART0_IRQ), 399193,
          serial_hd(0), DEVICE_LITTLE_ENDIAN);
 diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/Kconfig
 +++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      select SIFIVE_TEST
      select VIRTIO_MMIO
      select FW_CFG_DMA
 +    select PLATFORM_BUS
  config SIFIVE_E
      bool
 --
-.35.1
+.48.1

-[PULL 05/25] target/riscv: rvk: add support for zbkb extension
+[PULL 04/10] target/riscv: fixes a bug against `ssamoswap` behavior in M-mode
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Deepak Gupta <debug@rivosinc.com>
- - reuse partial instructions of zbb extension, update extension check for them
+Commit f06bfe3dc38c ("target/riscv: implement zicfiss instructions") adds
- - add brev8, pack, packh, packw, unzip, zip instructions
+`ssamoswap` instruction. `ssamoswap` takes the code-point from existing
 reserved encoding (and not a zimop like other shadow stack instructions).
 If shadow stack is not enabled (via xenvcfg.SSE) and effective priv is
 less than M then `ssamoswap` must result in an illegal instruction
 exception. However if effective priv is M, then `ssamoswap` results in
 store/AMO access fault. See Section "22.2.3. Shadow Stack Memory
 Protection" of priv spec.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Fixes: f06bfe3dc38c ("target/riscv: implement zicfiss instructions")
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reported-by: Ved Shanbhogue <ved@rivosinc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Deepak Gupta <debug@rivosinc.com>
-Message-Id: <20220423023510.30794-3-liweiwei@iscas.ac.cn>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20250306064636.452396-2-debug@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/helper.h                   |  3 +
+ target/riscv/insn_trans/trans_rvzicfiss.c.inc | 17 +++++++++++++++++
- target/riscv/insn32.decode              | 45 +++++++-----
+file changed, 17 insertions(+)
  target/riscv/bitmanip_helper.c          | 53 ++++++++++++++
  target/riscv/translate.c                |  7 ++
  target/riscv/insn_trans/trans_rvb.c.inc | 94 +++++++++++++++++++++----
 files changed, 174 insertions(+), 28 deletions(-)
-diff --git a/target/riscv/helper.h b/target/riscv/helper.h
+diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/helper.h
+--- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
-+++ b/target/riscv/helper.h
++++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
+@@ -XXX,XX +XXX,XX @@
- /* Bitmanip */
+  * You should have received a copy of the GNU General Public License along with
- DEF_HELPER_FLAGS_2(clmul, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+  * this program.  If not, see <http://www.gnu.org/licenses/>.
- DEF_HELPER_FLAGS_2(clmulr, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+  */
 +DEF_HELPER_FLAGS_1(brev8, TCG_CALL_NO_RWG_SE, tl, tl)
 +DEF_HELPER_FLAGS_1(unzip, TCG_CALL_NO_RWG_SE, tl, tl)
 +DEF_HELPER_FLAGS_1(zip, TCG_CALL_NO_RWG_SE, tl, tl)
  /* Floating Point - Half Precision */
  DEF_HELPER_FLAGS_3(fadd_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ sh2add_uw  0010000 .......... 100 ..... 0111011 @r
  sh3add_uw  0010000 .......... 110 ..... 0111011 @r
  slli_uw    00001 ............ 001 ..... 0011011 @sh
 -# *** RV32 Zbb Standard Extension ***
 +# *** RV32 Zbb/Zbkb Standard Extension ***
  andn       0100000 .......... 111 ..... 0110011 @r
 +rol        0110000 .......... 001 ..... 0110011 @r
 +ror        0110000 .......... 101 ..... 0110011 @r
 +rori       01100 ............ 101 ..... 0010011 @sh
 +# The encoding for rev8 differs between RV32 and RV64.
 +# rev8_32 denotes the RV32 variant.
 +rev8_32    011010 011000 ..... 101 ..... 0010011 @r2
 +# The encoding for zext.h differs between RV32 and RV64.
 +# zext_h_32 denotes the RV32 variant.
 +{
 +  zext_h_32  0000100 00000 ..... 100 ..... 0110011 @r2
 +  pack       0000100 ..... ..... 100 ..... 0110011 @r
 +}
 +xnor       0100000 .......... 100 ..... 0110011 @r
 +# *** RV32 extra Zbb Standard Extension ***
  clz        011000 000000 ..... 001 ..... 0010011 @r2
  cpop       011000 000010 ..... 001 ..... 0010011 @r2
  ctz        011000 000001 ..... 001 ..... 0010011 @r2
@@ -XXX,XX +XXX,XX @@ min        0000101 .......... 100 ..... 0110011 @r
  minu       0000101 .......... 101 ..... 0110011 @r
  orc_b      001010 000111 ..... 101 ..... 0010011 @r2
  orn        0100000 .......... 110 ..... 0110011 @r
 -# The encoding for rev8 differs between RV32 and RV64.
 -# rev8_32 denotes the RV32 variant.
 -rev8_32    011010 011000 ..... 101 ..... 0010011 @r2
 -rol        0110000 .......... 001 ..... 0110011 @r
 -ror        0110000 .......... 101 ..... 0110011 @r
 -rori       01100 ............ 101 ..... 0010011 @sh
  sext_b     011000 000100 ..... 001 ..... 0010011 @r2
  sext_h     011000 000101 ..... 001 ..... 0010011 @r2
 -xnor       0100000 .......... 100 ..... 0110011 @r
 -# The encoding for zext.h differs between RV32 and RV64.
 -# zext_h_32 denotes the RV32 variant.
 -zext_h_32  0000100 00000 ..... 100 ..... 0110011 @r2
 +# *** RV32 extra Zbkb Standard Extension ***
 +brev8      0110100 00111 ..... 101 ..... 0010011 @r2  #grevi
 +packh      0000100  .......... 111 ..... 0110011 @r
 +unzip      0000100 01111 ..... 101 ..... 0010011 @r2  #unshfl
 +zip        0000100 01111 ..... 001 ..... 0010011 @r2  #shfl
 -# *** RV64 Zbb Standard Extension (in addition to RV32 Zbb) ***
 -clzw       0110000 00000 ..... 001 ..... 0011011 @r2
 -ctzw       0110000 00001 ..... 001 ..... 0011011 @r2
 -cpopw      0110000 00010 ..... 001 ..... 0011011 @r2
 +# *** RV64 Zbb/Zbkb Standard Extension (in addition to RV32 Zbb/Zbkb) ***
  # The encoding for rev8 differs between RV32 and RV64.
  # When executing on RV64, the encoding used in RV32 is an illegal
  # instruction, so we use different handler functions to differentiate.
@@ -XXX,XX +XXX,XX @@ rorw       0110000 .......... 101 ..... 0111011 @r
  # The encoding for zext.h differs between RV32 and RV64.
  # When executing on RV64, the encoding used in RV32 is an illegal
  # instruction, so we use different handler functions to differentiate.
 -zext_h_64  0000100 00000 ..... 100 ..... 0111011 @r2
 +{
 +  zext_h_64  0000100 00000 ..... 100 ..... 0111011 @r2
 +  packw      0000100 ..... ..... 100 ..... 0111011 @r
 +}
 +# *** RV64 extra Zbb Standard Extension (in addition to RV32 Zbb) ***
 +clzw       0110000 00000 ..... 001 ..... 0011011 @r2
 +ctzw       0110000 00001 ..... 001 ..... 0011011 @r2
 +cpopw      0110000 00010 ..... 001 ..... 0011011 @r2
  # *** RV32 Zbc Standard Extension ***
  clmul      0000101 .......... 001 ..... 0110011 @r
 diff --git a/target/riscv/bitmanip_helper.c b/target/riscv/bitmanip_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/bitmanip_helper.c
 +++ b/target/riscv/bitmanip_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(clmulr)(target_ulong rs1, target_ulong rs2)
      return result;
  }
 +
-+static inline target_ulong do_swap(target_ulong x, uint64_t mask, int shift)
++#define REQUIRE_ZICFISS(ctx) do {        \
-+{
++    if (!ctx->cfg_ptr->ext_zicfiss) {    \
-+    return ((x & mask) << shift) | ((x & ~mask) >> shift);
++        return false;                    \
-+}
++    }                                    \
 +
 +target_ulong HELPER(brev8)(target_ulong rs1)
 +{
 +    target_ulong x = rs1;
 +
 +    x = do_swap(x, 0x5555555555555555ull, 1);
 +    x = do_swap(x, 0x3333333333333333ull, 2);
 +    x = do_swap(x, 0x0f0f0f0f0f0f0f0full, 4);
 +    return x;
 +}
 +
 +static const uint64_t shuf_masks[] = {
 +    dup_const(MO_8, 0x44),
 +    dup_const(MO_8, 0x30),
 +    dup_const(MO_16, 0x0f00),
 +    dup_const(MO_32, 0xff0000)
 +};
 +
 +static inline target_ulong do_shuf_stage(target_ulong src, uint64_t maskL,
 +                                         uint64_t maskR, int shift)
 +{
 +    target_ulong x = src & ~(maskL | maskR);
 +
 +    x |= ((src << shift) & maskL) | ((src >> shift) & maskR);
 +    return x;
 +}
 +
 +target_ulong HELPER(unzip)(target_ulong rs1)
 +{
 +    target_ulong x = rs1;
 +
 +    x = do_shuf_stage(x, shuf_masks[0], shuf_masks[0] >> 1, 1);
 +    x = do_shuf_stage(x, shuf_masks[1], shuf_masks[1] >> 2, 2);
 +    x = do_shuf_stage(x, shuf_masks[2], shuf_masks[2] >> 4, 4);
 +    x = do_shuf_stage(x, shuf_masks[3], shuf_masks[3] >> 8, 8);
 +    return x;
 +}
 +
 +target_ulong HELPER(zip)(target_ulong rs1)
 +{
 +    target_ulong x = rs1;
 +
 +    x = do_shuf_stage(x, shuf_masks[3], shuf_masks[3] >> 8, 8);
 +    x = do_shuf_stage(x, shuf_masks[2], shuf_masks[2] >> 4, 4);
 +    x = do_shuf_stage(x, shuf_masks[1], shuf_masks[1] >> 2, 2);
 +    x = do_shuf_stage(x, shuf_masks[0], shuf_masks[0] >> 1, 1);
 +    return x;
 +}
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ EX_SH(12)
      }                                  \
  } while (0)
 +#define REQUIRE_EITHER_EXT(ctx, A, B) do {       \
 +    if (!ctx->cfg_ptr->ext_##A &&      \
 +        !ctx->cfg_ptr->ext_##B) {      \
 +        return false;                            \
 +    }                                            \
 +} while (0)
 +
- static int ex_rvc_register(DisasContext *ctx, int reg)
+ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
  {
-     return 8 + reg;
+     if (!ctx->bcfi_enabled) {
-diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
+@@ -XXX,XX +XXX,XX @@ static bool trans_ssrdp(DisasContext *ctx, arg_ssrdp *a)
-index XXXXXXX..XXXXXXX 100644
+ static bool trans_ssamoswap_w(DisasContext *ctx, arg_amoswap_w *a)
---- a/target/riscv/insn_trans/trans_rvb.c.inc
+ {
-+++ b/target/riscv/insn_trans/trans_rvb.c.inc
+     REQUIRE_A_OR_ZAAMO(ctx);
-@@ -XXX,XX +XXX,XX @@
++    REQUIRE_ZICFISS(ctx);
- /*
++    if (ctx->priv == PRV_M) {
-- * RISC-V translation routines for the Zb[abcs] Standard Extension.
++        generate_exception(ctx, RISCV_EXCP_STORE_AMO_ACCESS_FAULT);
-+ * RISC-V translation routines for the Zb[abcs] and Zbk[bcx] Standard Extension.
++    }
   *
   * Copyright (c) 2020 Kito Cheng, kito.cheng@sifive.com
   * Copyright (c) 2020 Frank Chang, frank.chang@sifive.com
@@ -XXX,XX +XXX,XX @@
      }                                            \
  } while (0)
 +#define REQUIRE_ZBKB(ctx) do {                   \
 +    if (!ctx->cfg_ptr->ext_zbkb) {               \
 +        return false;                            \
 +    }                                            \
 +} while (0)
 +
- static void gen_clz(TCGv ret, TCGv arg1)
+     if (!ctx->bcfi_enabled) {
- {
+         return false;
-     tcg_gen_clzi_tl(ret, arg1, TARGET_LONG_BITS);
+     }
-@@ -XXX,XX +XXX,XX @@ static bool trans_cpop(DisasContext *ctx, arg_cpop *a)
+@@ -XXX,XX +XXX,XX @@ static bool trans_ssamoswap_d(DisasContext *ctx, arg_amoswap_w *a)
  static bool trans_andn(DisasContext *ctx, arg_andn *a)
  {
 -    REQUIRE_ZBB(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
      return gen_logic(ctx, a, tcg_gen_andc_tl);
  }
  static bool trans_orn(DisasContext *ctx, arg_orn *a)
  {
 -    REQUIRE_ZBB(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
      return gen_logic(ctx, a, tcg_gen_orc_tl);
  }
  static bool trans_xnor(DisasContext *ctx, arg_xnor *a)
  {
 -    REQUIRE_ZBB(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
      return gen_logic(ctx, a, tcg_gen_eqv_tl);
  }
@@ -XXX,XX +XXX,XX @@ static void gen_rorw(TCGv ret, TCGv arg1, TCGv arg2)
  static bool trans_ror(DisasContext *ctx, arg_ror *a)
  {
 -    REQUIRE_ZBB(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
      return gen_shift_per_ol(ctx, a, EXT_NONE, tcg_gen_rotr_tl, gen_rorw, NULL);
  }
@@ -XXX,XX +XXX,XX @@ static void gen_roriw(TCGv ret, TCGv arg1, target_long shamt)
  static bool trans_rori(DisasContext *ctx, arg_rori *a)
  {
 -    REQUIRE_ZBB(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
      return gen_shift_imm_fn_per_ol(ctx, a, EXT_NONE,
                                     tcg_gen_rotri_tl, gen_roriw, NULL);
  }
@@ -XXX,XX +XXX,XX @@ static void gen_rolw(TCGv ret, TCGv arg1, TCGv arg2)
  static bool trans_rol(DisasContext *ctx, arg_rol *a)
  {
 -    REQUIRE_ZBB(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
      return gen_shift_per_ol(ctx, a, EXT_NONE, tcg_gen_rotl_tl, gen_rolw, NULL);
  }
@@ -XXX,XX +XXX,XX @@ static void gen_rev8_32(TCGv ret, TCGv src1)
  static bool trans_rev8_32(DisasContext *ctx, arg_rev8_32 *a)
  {
      REQUIRE_32BIT(ctx);
 -    REQUIRE_ZBB(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
      return gen_unary(ctx, a, EXT_NONE, gen_rev8_32);
  }
  static bool trans_rev8_64(DisasContext *ctx, arg_rev8_64 *a)
  {
      REQUIRE_64BIT(ctx);
--    REQUIRE_ZBB(ctx);
+     REQUIRE_A_OR_ZAAMO(ctx);
-+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
++    REQUIRE_ZICFISS(ctx);
-     return gen_unary(ctx, a, EXT_NONE, tcg_gen_bswap_tl);
++    if (ctx->priv == PRV_M) {
- }
++        generate_exception(ctx, RISCV_EXCP_STORE_AMO_ACCESS_FAULT);
++    }
@@ -XXX,XX +XXX,XX @@ static bool trans_cpopw(DisasContext *ctx, arg_cpopw *a)
  static bool trans_rorw(DisasContext *ctx, arg_rorw *a)
  {
      REQUIRE_64BIT(ctx);
 -    REQUIRE_ZBB(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
      ctx->ol = MXL_RV32;
      return gen_shift(ctx, a, EXT_NONE, gen_rorw, NULL);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_rorw(DisasContext *ctx, arg_rorw *a)
  static bool trans_roriw(DisasContext *ctx, arg_roriw *a)
  {
      REQUIRE_64BIT(ctx);
 -    REQUIRE_ZBB(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
      ctx->ol = MXL_RV32;
      return gen_shift_imm_fn(ctx, a, EXT_NONE, gen_roriw, NULL);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_roriw(DisasContext *ctx, arg_roriw *a)
  static bool trans_rolw(DisasContext *ctx, arg_rolw *a)
  {
      REQUIRE_64BIT(ctx);
 -    REQUIRE_ZBB(ctx);
 +    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
      ctx->ol = MXL_RV32;
      return gen_shift(ctx, a, EXT_NONE, gen_rolw, NULL);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_clmulr(DisasContext *ctx, arg_clmulh *a)
      REQUIRE_ZBC(ctx);
      return gen_arith(ctx, a, EXT_NONE, gen_helper_clmulr, NULL);
  }
 +
-+static void gen_pack(TCGv ret, TCGv src1, TCGv src2)
+     if (!ctx->bcfi_enabled) {
-+{
+         return false;
-+    tcg_gen_deposit_tl(ret, src1, src2,
+     }
 +                       TARGET_LONG_BITS / 2,
 +                       TARGET_LONG_BITS / 2);
 +}
 +
 +static void gen_packh(TCGv ret, TCGv src1, TCGv src2)
 +{
 +    TCGv t = tcg_temp_new();
 +
 +    tcg_gen_ext8u_tl(t, src2);
 +    tcg_gen_deposit_tl(ret, src1, t, 8, TARGET_LONG_BITS - 8);
 +    tcg_temp_free(t);
 +}
 +
 +static void gen_packw(TCGv ret, TCGv src1, TCGv src2)
 +{
 +    TCGv t = tcg_temp_new();
 +
 +    tcg_gen_ext16s_tl(t, src2);
 +    tcg_gen_deposit_tl(ret, src1, t, 16, TARGET_LONG_BITS - 16);
 +    tcg_temp_free(t);
 +}
 +
 +static bool trans_brev8(DisasContext *ctx, arg_brev8 *a)
 +{
 +    REQUIRE_ZBKB(ctx);
 +    return gen_unary(ctx, a, EXT_NONE, gen_helper_brev8);
 +}
 +
 +static bool trans_pack(DisasContext *ctx, arg_pack *a)
 +{
 +    REQUIRE_ZBKB(ctx);
 +    return gen_arith(ctx, a, EXT_NONE, gen_pack, NULL);
 +}
 +
 +static bool trans_packh(DisasContext *ctx, arg_packh *a)
 +{
 +    REQUIRE_ZBKB(ctx);
 +    return gen_arith(ctx, a, EXT_NONE, gen_packh, NULL);
 +}
 +
 +static bool trans_packw(DisasContext *ctx, arg_packw *a)
 +{
 +    REQUIRE_64BIT(ctx);
 +    REQUIRE_ZBKB(ctx);
 +    return gen_arith(ctx, a, EXT_NONE, gen_packw, NULL);
 +}
 +
 +static bool trans_unzip(DisasContext *ctx, arg_unzip *a)
 +{
 +    REQUIRE_32BIT(ctx);
 +    REQUIRE_ZBKB(ctx);
 +    return gen_unary(ctx, a, EXT_NONE, gen_helper_unzip);
 +}
 +
 +static bool trans_zip(DisasContext *ctx, arg_zip *a)
 +{
 +    REQUIRE_32BIT(ctx);
 +    REQUIRE_ZBKB(ctx);
 +    return gen_unary(ctx, a, EXT_NONE, gen_helper_zip);
 +}
 --
-.35.1
+.48.1

-[PULL 24/25] hw/riscv: virt: Add device plug support
+[PULL 05/10] hw/riscv/riscv-iommu: Fix process directory table walk
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Jason Chien <jason.chien@sifive.com>
-Add support for plugging in devices, this was tested with the TPM
+The PPN field in a non-leaf PDT entry is positioned differently from that
-device.
+in a leaf PDT entry. The original implementation incorrectly used the leaf
 entry's PPN mask to extract the PPN from a non-leaf entry, leading to an
 erroneous page table walk.
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+This commit introduces new macros to properly define the fields for
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
+non-leaf PDT entries and corrects the page table walk.
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-Id: <20220427234146.1130752-6-alistair.francis@opensource.wdc.com>
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <20250301173751.9446-1-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 35 +++++++++++++++++++++++++++++++++++
+ hw/riscv/riscv-iommu-bits.h | 6 +++++-
-file changed, 35 insertions(+)
+ hw/riscv/riscv-iommu.c      | 4 ++--
 files changed, 7 insertions(+), 3 deletions(-)
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
+diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
+--- a/hw/riscv/riscv-iommu-bits.h
-+++ b/hw/riscv/virt.c
++++ b/hw/riscv/riscv-iommu-bits.h
-@@ -XXX,XX +XXX,XX @@ static void virt_set_aclint(Object *obj, bool value, Error **errp)
+@@ -XXX,XX +XXX,XX @@ enum riscv_iommu_fq_causes {
-     s->have_aclint = value;
+ #define RISCV_IOMMU_DC_MSIPTP_MODE_OFF  0
- }
+ #define RISCV_IOMMU_DC_MSIPTP_MODE_FLAT 1
-+static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
++/* 2.2 Process Directory Table */
-+                                                        DeviceState *dev)
++#define RISCV_IOMMU_PDTE_VALID          BIT_ULL(0)
-+{
++#define RISCV_IOMMU_PDTE_PPN            RISCV_IOMMU_PPN_FIELD
 +    MachineClass *mc = MACHINE_GET_CLASS(machine);
 +
-+    if (device_is_dynamic_sysbus(mc, dev)) {
+ /* Translation attributes fields */
-+        return HOTPLUG_HANDLER(machine);
+ #define RISCV_IOMMU_PC_TA_V             BIT_ULL(0)
-+    }
+ #define RISCV_IOMMU_PC_TA_RESERVED      GENMASK_ULL(63, 32)
-+    return NULL;
-+}
+ /* First stage context fields */
-+
+-#define RISCV_IOMMU_PC_FSC_PPN          GENMASK_ULL(43, 0)
-+static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
++#define RISCV_IOMMU_PC_FSC_PPN          RISCV_IOMMU_ATP_PPN_FIELD
-+                                        DeviceState *dev, Error **errp)
+ #define RISCV_IOMMU_PC_FSC_RESERVED     GENMASK_ULL(59, 44)
-+{
-+    RISCVVirtState *s = RISCV_VIRT_MACHINE(hotplug_dev);
+ enum riscv_iommu_fq_ttypes {
-+
+diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
-+    if (s->platform_bus_dev) {
+index XXXXXXX..XXXXXXX 100644
-+        MachineClass *mc = MACHINE_GET_CLASS(s);
+--- a/hw/riscv/riscv-iommu.c
-+
++++ b/hw/riscv/riscv-iommu.c
-+        if (device_is_dynamic_sysbus(mc, dev)) {
+@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
-+            platform_bus_link_device(PLATFORM_BUS_DEVICE(s->platform_bus_dev),
+             return RISCV_IOMMU_FQ_CAUSE_PDT_LOAD_FAULT;
-+                                     SYS_BUS_DEVICE(dev));
+         }
-+        }
+         le64_to_cpus(&de);
-+    }
+-        if (!(de & RISCV_IOMMU_PC_TA_V)) {
-+}
++        if (!(de & RISCV_IOMMU_PDTE_VALID)) {
-+
+             return RISCV_IOMMU_FQ_CAUSE_PDT_INVALID;
- static void virt_machine_class_init(ObjectClass *oc, void *data)
+         }
- {
+-        addr = PPN_PHYS(get_field(de, RISCV_IOMMU_PC_FSC_PPN));
-     char str[128];
++        addr = PPN_PHYS(get_field(de, RISCV_IOMMU_PDTE_PPN));
-     MachineClass *mc = MACHINE_CLASS(oc);
+     }
-+    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
+     riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_PD_WALK);
      mc->desc = "RISC-V VirtIO board";
      mc->init = virt_machine_init;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
      mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
      mc->numa_mem_supported = true;
      mc->default_ram_id = "riscv_virt_board.ram";
 +    assert(!mc->get_hotplug_handler);
 +    mc->get_hotplug_handler = virt_machine_get_hotplug_handler;
 +
 +    hc->plug = virt_machine_device_plug_cb;
      machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo virt_machine_typeinfo = {
      .class_init = virt_machine_class_init,
      .instance_init = virt_machine_instance_init,
      .instance_size = sizeof(RISCVVirtState),
 +    .interfaces = (InterfaceInfo[]) {
 +         { TYPE_HOTPLUG_HANDLER },
 +         { }
 +    },
  };
  static void virt_machine_init_register_types(void)
 --
-.35.1
+.48.1

-[PULL 03/25] target/riscv: Support configuarable marchid, mvendorid, mipid CSR values
+[PULL 06/10] target/riscv/csr.c: fix OVERFLOW_BEFORE_WIDEN in rmw_sctrdepth()
-From: Frank Chang <frank.chang@sifive.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Allow user to set core's marchid, mvendorid, mipid CSRs through
+Coverity found the following issue:
 -cpu command line option.
-The default values of marchid and mipid are built with QEMU's version
+  >>>     CID 1593156:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
-numbers.
+  >>>     Potentially overflowing expression "0x10 << depth" with type
   "int" (32 bits, signed) is evaluated using 32-bit arithmetic, and then
   used in a context that expects an expression of type "uint64_t" (64
   bits, unsigned).
 depth = 16 << depth;
-Signed-off-by: Frank Chang <frank.chang@sifive.com>
+Fix it by forcing the expression to be 64 bits wide by using '16ULL'.
-Reviewed-by: Jim Shu <jim.shu@sifive.com>
 Resolves: Coverity CID 1593156
 Fixes: c48bd18eae ("target/riscv: Add support for Control Transfer Records extension CSRs.")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Message-ID: <20250307124602.1905754-1-dbarboza@ventanamicro.com>
 Message-Id: <20220422040436.2233-1-frank.chang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h |  4 ++++
+ target/riscv/csr.c | 2 +-
- target/riscv/cpu.c |  9 +++++++++
+file changed, 1 insertion(+), 1 deletion(-)
  target/riscv/csr.c | 38 ++++++++++++++++++++++++++++++++++----
 files changed, 47 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_zve32f;
-     bool ext_zve64f;
-+    uint32_t mvendorid;
-+    uint64_t marchid;
-+    uint64_t mipid;
-+
-     /* Vendor-specific custom extensions */
-     bool ext_XVentanaCondOps;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
- /* RISC-V CPU definitions */
-+#define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
-+                             (QEMU_VERSION_MINOR << 8)  | \
-+                             (QEMU_VERSION_MICRO))
-+#define RISCV_CPU_MIPID     RISCV_CPU_MARCHID
-+
- static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
- struct isa_ext_data {
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
-     DEFINE_PROP_UINT16("vlen", RISCVCPU, cfg.vlen, 128),
-     DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
-+    DEFINE_PROP_UINT32("mvendorid", RISCVCPU, cfg.mvendorid, 0),
-+    DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
-+    DEFINE_PROP_UINT64("mipid", RISCVCPU, cfg.mipid, RISCV_CPU_MIPID),
-+
-     DEFINE_PROP_BOOL("svinval", RISCVCPU, cfg.ext_svinval, false),
-     DEFINE_PROP_BOOL("svnapot", RISCVCPU, cfg.ext_svnapot, false),
-     DEFINE_PROP_BOOL("svpbmt", RISCVCPU, cfg.ext_svpbmt, false),
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_ignore(CPURISCVState *env, int csrno,
+@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_sctrdepth(CPURISCVState *env, int csrno,
-     return RISCV_EXCP_NONE;
+         }
- }
+         /* Update sctrstatus.WRPTR with a legal value */
-+static RISCVException read_mvendorid(CPURISCVState *env, int csrno,
+-        depth = 16 << depth;
-+                                     target_ulong *val)
++        depth = 16ULL << depth;
-+{
+         env->sctrstatus =
-+    CPUState *cs = env_cpu(env);
+             env->sctrstatus & (~SCTRSTATUS_WRPTR_MASK | (depth - 1));
-+    RISCVCPU *cpu = RISCV_CPU(cs);
+     }
 +
 +    *val = cpu->cfg.mvendorid;
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static RISCVException read_marchid(CPURISCVState *env, int csrno,
 +                                   target_ulong *val)
 +{
 +    CPUState *cs = env_cpu(env);
 +    RISCVCPU *cpu = RISCV_CPU(cs);
 +
 +    *val = cpu->cfg.marchid;
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static RISCVException read_mipid(CPURISCVState *env, int csrno,
 +                                 target_ulong *val)
 +{
 +    CPUState *cs = env_cpu(env);
 +    RISCVCPU *cpu = RISCV_CPU(cs);
 +
 +    *val = cpu->cfg.mipid;
 +    return RISCV_EXCP_NONE;
 +}
 +
  static RISCVException read_mhartid(CPURISCVState *env, int csrno,
                                     target_ulong *val)
  {
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_MINSTRETH] = { "minstreth", any32, read_instreth },
      /* Machine Information Registers */
 -    [CSR_MVENDORID] = { "mvendorid", any,   read_zero    },
 -    [CSR_MARCHID]   = { "marchid",   any,   read_zero    },
 -    [CSR_MIMPID]    = { "mimpid",    any,   read_zero    },
 -    [CSR_MHARTID]   = { "mhartid",   any,   read_mhartid },
 +    [CSR_MVENDORID] = { "mvendorid", any,   read_mvendorid },
 +    [CSR_MARCHID]   = { "marchid",   any,   read_marchid   },
 +    [CSR_MIMPID]    = { "mimpid",    any,   read_mipid     },
 +    [CSR_MHARTID]   = { "mhartid",   any,   read_mhartid   },
      [CSR_MCONFIGPTR]  = { "mconfigptr", any,   read_zero,
                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
 --
-.35.1
+.48.1

-[PULL 04/25] target/riscv: rvk: add cfg properties for zbk* and zk*
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423023510.30794-2-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.h | 13 +++++++++++++
- target/riscv/cpu.c | 23 +++++++++++++++++++++++
-files changed, 36 insertions(+)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_zba;
-     bool ext_zbb;
-     bool ext_zbc;
-+    bool ext_zbkb;
-+    bool ext_zbkc;
-+    bool ext_zbkx;
-     bool ext_zbs;
-+    bool ext_zk;
-+    bool ext_zkn;
-+    bool ext_zknd;
-+    bool ext_zkne;
-+    bool ext_zknh;
-+    bool ext_zkr;
-+    bool ext_zks;
-+    bool ext_zksed;
-+    bool ext_zksh;
-+    bool ext_zkt;
-     bool ext_counters;
-     bool ext_ifencei;
-     bool ext_icsr;
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-             cpu->cfg.ext_zfinx = true;
-         }
-+        if (cpu->cfg.ext_zk) {
-+            cpu->cfg.ext_zkn = true;
-+            cpu->cfg.ext_zkr = true;
-+            cpu->cfg.ext_zkt = true;
-+        }
-+
-+        if (cpu->cfg.ext_zkn) {
-+            cpu->cfg.ext_zbkb = true;
-+            cpu->cfg.ext_zbkc = true;
-+            cpu->cfg.ext_zbkx = true;
-+            cpu->cfg.ext_zkne = true;
-+            cpu->cfg.ext_zknd = true;
-+            cpu->cfg.ext_zknh = true;
-+        }
-+
-+        if (cpu->cfg.ext_zks) {
-+            cpu->cfg.ext_zbkb = true;
-+            cpu->cfg.ext_zbkc = true;
-+            cpu->cfg.ext_zbkx = true;
-+            cpu->cfg.ext_zksed = true;
-+            cpu->cfg.ext_zksh = true;
-+        }
-+
-         /* Set the ISA extensions, checks should have happened above */
-         if (cpu->cfg.ext_i) {
-             ext |= RVI;
---
-.35.1

-[PULL 06/25] target/riscv: rvk: add support for zbkc extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
- - reuse partial instructions of zbc extension, update extension check for them
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20220423023510.30794-4-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn32.decode              | 3 ++-
- target/riscv/insn_trans/trans_rvb.c.inc | 4 ++--
-files changed, 4 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn32.decode
-+++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ clzw       0110000 00000 ..... 001 ..... 0011011 @r2
- ctzw       0110000 00001 ..... 001 ..... 0011011 @r2
- cpopw      0110000 00010 ..... 001 ..... 0011011 @r2
--# *** RV32 Zbc Standard Extension ***
-+# *** RV32 Zbc/Zbkc Standard Extension ***
- clmul      0000101 .......... 001 ..... 0110011 @r
- clmulh     0000101 .......... 011 ..... 0110011 @r
-+# *** RV32 extra Zbc Standard Extension ***
- clmulr     0000101 .......... 010 ..... 0110011 @r
- # *** RV32 Zbs Standard Extension ***
-diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvb.c.inc
-+++ b/target/riscv/insn_trans/trans_rvb.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_slli_uw(DisasContext *ctx, arg_slli_uw *a)
- static bool trans_clmul(DisasContext *ctx, arg_clmul *a)
- {
--    REQUIRE_ZBC(ctx);
-+    REQUIRE_EITHER_EXT(ctx, zbc, zbkc);
-     return gen_arith(ctx, a, EXT_NONE, gen_helper_clmul, NULL);
- }
-@@ -XXX,XX +XXX,XX @@ static void gen_clmulh(TCGv dst, TCGv src1, TCGv src2)
- static bool trans_clmulh(DisasContext *ctx, arg_clmulr *a)
- {
--    REQUIRE_ZBC(ctx);
-+    REQUIRE_EITHER_EXT(ctx, zbc, zbkc);
-     return gen_arith(ctx, a, EXT_NONE, gen_clmulh, NULL);
- }
---
-.35.1

-[PULL 07/25] target/riscv: rvk: add support for zbkx extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
- - add xperm4 and xperm8 instructions
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423023510.30794-5-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/helper.h                   |  2 ++
- target/riscv/insn32.decode              |  4 ++++
- target/riscv/bitmanip_helper.c          | 27 +++++++++++++++++++++++++
- target/riscv/insn_trans/trans_rvb.c.inc | 18 +++++++++++++++++
-files changed, 51 insertions(+)
-diff --git a/target/riscv/helper.h b/target/riscv/helper.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/helper.h
-+++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(clmulr, TCG_CALL_NO_RWG_SE, tl, tl, tl)
- DEF_HELPER_FLAGS_1(brev8, TCG_CALL_NO_RWG_SE, tl, tl)
- DEF_HELPER_FLAGS_1(unzip, TCG_CALL_NO_RWG_SE, tl, tl)
- DEF_HELPER_FLAGS_1(zip, TCG_CALL_NO_RWG_SE, tl, tl)
-+DEF_HELPER_FLAGS_2(xperm4, TCG_CALL_NO_RWG_SE, tl, tl, tl)
-+DEF_HELPER_FLAGS_2(xperm8, TCG_CALL_NO_RWG_SE, tl, tl, tl)
- /* Floating Point - Half Precision */
- DEF_HELPER_FLAGS_3(fadd_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn32.decode
-+++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ clmulh     0000101 .......... 011 ..... 0110011 @r
- # *** RV32 extra Zbc Standard Extension ***
- clmulr     0000101 .......... 010 ..... 0110011 @r
-+# *** RV32 Zbkx Standard Extension ***
-+xperm4     0010100 .......... 010 ..... 0110011 @r
-+xperm8     0010100 .......... 100 ..... 0110011 @r
-+
- # *** RV32 Zbs Standard Extension ***
- bclr       0100100 .......... 001 ..... 0110011 @r
- bclri      01001. ........... 001 ..... 0010011 @sh
-diff --git a/target/riscv/bitmanip_helper.c b/target/riscv/bitmanip_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/bitmanip_helper.c
-+++ b/target/riscv/bitmanip_helper.c
-@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(zip)(target_ulong rs1)
-     x = do_shuf_stage(x, shuf_masks[0], shuf_masks[0] >> 1, 1);
-     return x;
- }
-+
-+static inline target_ulong do_xperm(target_ulong rs1, target_ulong rs2,
-+                                    uint32_t sz_log2)
-+{
-+    target_ulong r = 0;
-+    target_ulong sz = 1LL << sz_log2;
-+    target_ulong mask = (1LL << sz) - 1;
-+    target_ulong pos;
-+
-+    for (int i = 0; i < TARGET_LONG_BITS; i += sz) {
-+        pos = ((rs2 >> i) & mask) << sz_log2;
-+        if (pos < sizeof(target_ulong) * 8) {
-+            r |= ((rs1 >> pos) & mask) << i;
-+        }
-+    }
-+    return r;
-+}
-+
-+target_ulong HELPER(xperm4)(target_ulong rs1, target_ulong rs2)
-+{
-+    return do_xperm(rs1, rs2, 2);
-+}
-+
-+target_ulong HELPER(xperm8)(target_ulong rs1, target_ulong rs2)
-+{
-+    return do_xperm(rs1, rs2, 3);
-+}
-diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvb.c.inc
-+++ b/target/riscv/insn_trans/trans_rvb.c.inc
-@@ -XXX,XX +XXX,XX @@
-     }                                            \
- } while (0)
-+#define REQUIRE_ZBKX(ctx) do {                   \
-+    if (!ctx->cfg_ptr->ext_zbkx) {               \
-+        return false;                            \
-+    }                                            \
-+} while (0)
-+
- static void gen_clz(TCGv ret, TCGv arg1)
- {
-     tcg_gen_clzi_tl(ret, arg1, TARGET_LONG_BITS);
-@@ -XXX,XX +XXX,XX @@ static bool trans_zip(DisasContext *ctx, arg_zip *a)
-     REQUIRE_ZBKB(ctx);
-     return gen_unary(ctx, a, EXT_NONE, gen_helper_zip);
- }
-+
-+static bool trans_xperm4(DisasContext *ctx, arg_xperm4 *a)
-+{
-+    REQUIRE_ZBKX(ctx);
-+    return gen_arith(ctx, a, EXT_NONE, gen_helper_xperm4, NULL);
-+}
-+
-+static bool trans_xperm8(DisasContext *ctx, arg_xperm8 *a)
-+{
-+    REQUIRE_ZBKX(ctx);
-+    return gen_arith(ctx, a, EXT_NONE, gen_helper_xperm8, NULL);
-+}
---
-.35.1

-[PULL 08/25] crypto: move sm4_sbox from target/arm
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-   - share it between target/arm and target/riscv
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20220423023510.30794-6-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/crypto/sm4.h       |  6 +++++
- crypto/sm4.c               | 49 ++++++++++++++++++++++++++++++++++++++
- target/arm/crypto_helper.c | 36 +---------------------------
- crypto/meson.build         |  1 +
-files changed, 57 insertions(+), 35 deletions(-)
- create mode 100644 include/crypto/sm4.h
- create mode 100644 crypto/sm4.c
-diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/crypto/sm4.h
-@@ -XXX,XX +XXX,XX @@
-+#ifndef QEMU_SM4_H
-+#define QEMU_SM4_H
-+
-+extern const uint8_t sm4_sbox[256];
-+
-+#endif
-diff --git a/crypto/sm4.c b/crypto/sm4.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/crypto/sm4.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU crypto sm4 support
-+ *
-+ * Copyright (C) 2013 - 2018 Linaro Ltd <ard.biesheuvel@linaro.org>
-+ *
-+ * This library is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU Lesser General Public
-+ * License as published by the Free Software Foundation; either
-+ * version 2.1 of the License, or (at your option) any later version.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "crypto/sm4.h"
-+
-+uint8_t const sm4_sbox[] = {
-+    0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7,
-+    0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,
-+    0x2b, 0x67, 0x9a, 0x76, 0x2a, 0xbe, 0x04, 0xc3,
-+    0xaa, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
-+    0x9c, 0x42, 0x50, 0xf4, 0x91, 0xef, 0x98, 0x7a,
-+    0x33, 0x54, 0x0b, 0x43, 0xed, 0xcf, 0xac, 0x62,
-+    0xe4, 0xb3, 0x1c, 0xa9, 0xc9, 0x08, 0xe8, 0x95,
-+    0x80, 0xdf, 0x94, 0xfa, 0x75, 0x8f, 0x3f, 0xa6,
-+    0x47, 0x07, 0xa7, 0xfc, 0xf3, 0x73, 0x17, 0xba,
-+    0x83, 0x59, 0x3c, 0x19, 0xe6, 0x85, 0x4f, 0xa8,
-+    0x68, 0x6b, 0x81, 0xb2, 0x71, 0x64, 0xda, 0x8b,
-+    0xf8, 0xeb, 0x0f, 0x4b, 0x70, 0x56, 0x9d, 0x35,
-+    0x1e, 0x24, 0x0e, 0x5e, 0x63, 0x58, 0xd1, 0xa2,
-+    0x25, 0x22, 0x7c, 0x3b, 0x01, 0x21, 0x78, 0x87,
-+    0xd4, 0x00, 0x46, 0x57, 0x9f, 0xd3, 0x27, 0x52,
-+    0x4c, 0x36, 0x02, 0xe7, 0xa0, 0xc4, 0xc8, 0x9e,
-+    0xea, 0xbf, 0x8a, 0xd2, 0x40, 0xc7, 0x38, 0xb5,
-+    0xa3, 0xf7, 0xf2, 0xce, 0xf9, 0x61, 0x15, 0xa1,
-+    0xe0, 0xae, 0x5d, 0xa4, 0x9b, 0x34, 0x1a, 0x55,
-+    0xad, 0x93, 0x32, 0x30, 0xf5, 0x8c, 0xb1, 0xe3,
-+    0x1d, 0xf6, 0xe2, 0x2e, 0x82, 0x66, 0xca, 0x60,
-+    0xc0, 0x29, 0x23, 0xab, 0x0d, 0x53, 0x4e, 0x6f,
-+    0xd5, 0xdb, 0x37, 0x45, 0xde, 0xfd, 0x8e, 0x2f,
-+    0x03, 0xff, 0x6a, 0x72, 0x6d, 0x6c, 0x5b, 0x51,
-+    0x8d, 0x1b, 0xaf, 0x92, 0xbb, 0xdd, 0xbc, 0x7f,
-+    0x11, 0xd9, 0x5c, 0x41, 0x1f, 0x10, 0x5a, 0xd8,
-+    0x0a, 0xc1, 0x31, 0x88, 0xa5, 0xcd, 0x7b, 0xbd,
-+    0x2d, 0x74, 0xd0, 0x12, 0xb8, 0xe5, 0xb4, 0xb0,
-+    0x89, 0x69, 0x97, 0x4a, 0x0c, 0x96, 0x77, 0x7e,
-+    0x65, 0xb9, 0xf1, 0x09, 0xc5, 0x6e, 0xc6, 0x84,
-+    0x18, 0xf0, 0x7d, 0xec, 0x3a, 0xdc, 0x4d, 0x20,
-+    0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
-+};
-+
-diff --git a/target/arm/crypto_helper.c b/target/arm/crypto_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/crypto_helper.c
-+++ b/target/arm/crypto_helper.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/helper-proto.h"
- #include "tcg/tcg-gvec-desc.h"
- #include "crypto/aes.h"
-+#include "crypto/sm4.h"
- #include "vec_internal.h"
- union CRYPTO_STATE {
-@@ -XXX,XX +XXX,XX @@ DO_SM3TT(crypto_sm3tt2b, 3)
- #undef DO_SM3TT
--static uint8_t const sm4_sbox[] = {
--    0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7,
--    0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,
--    0x2b, 0x67, 0x9a, 0x76, 0x2a, 0xbe, 0x04, 0xc3,
--    0xaa, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
--    0x9c, 0x42, 0x50, 0xf4, 0x91, 0xef, 0x98, 0x7a,
--    0x33, 0x54, 0x0b, 0x43, 0xed, 0xcf, 0xac, 0x62,
--    0xe4, 0xb3, 0x1c, 0xa9, 0xc9, 0x08, 0xe8, 0x95,
--    0x80, 0xdf, 0x94, 0xfa, 0x75, 0x8f, 0x3f, 0xa6,
--    0x47, 0x07, 0xa7, 0xfc, 0xf3, 0x73, 0x17, 0xba,
--    0x83, 0x59, 0x3c, 0x19, 0xe6, 0x85, 0x4f, 0xa8,
--    0x68, 0x6b, 0x81, 0xb2, 0x71, 0x64, 0xda, 0x8b,
--    0xf8, 0xeb, 0x0f, 0x4b, 0x70, 0x56, 0x9d, 0x35,
--    0x1e, 0x24, 0x0e, 0x5e, 0x63, 0x58, 0xd1, 0xa2,
--    0x25, 0x22, 0x7c, 0x3b, 0x01, 0x21, 0x78, 0x87,
--    0xd4, 0x00, 0x46, 0x57, 0x9f, 0xd3, 0x27, 0x52,
--    0x4c, 0x36, 0x02, 0xe7, 0xa0, 0xc4, 0xc8, 0x9e,
--    0xea, 0xbf, 0x8a, 0xd2, 0x40, 0xc7, 0x38, 0xb5,
--    0xa3, 0xf7, 0xf2, 0xce, 0xf9, 0x61, 0x15, 0xa1,
--    0xe0, 0xae, 0x5d, 0xa4, 0x9b, 0x34, 0x1a, 0x55,
--    0xad, 0x93, 0x32, 0x30, 0xf5, 0x8c, 0xb1, 0xe3,
--    0x1d, 0xf6, 0xe2, 0x2e, 0x82, 0x66, 0xca, 0x60,
--    0xc0, 0x29, 0x23, 0xab, 0x0d, 0x53, 0x4e, 0x6f,
--    0xd5, 0xdb, 0x37, 0x45, 0xde, 0xfd, 0x8e, 0x2f,
--    0x03, 0xff, 0x6a, 0x72, 0x6d, 0x6c, 0x5b, 0x51,
--    0x8d, 0x1b, 0xaf, 0x92, 0xbb, 0xdd, 0xbc, 0x7f,
--    0x11, 0xd9, 0x5c, 0x41, 0x1f, 0x10, 0x5a, 0xd8,
--    0x0a, 0xc1, 0x31, 0x88, 0xa5, 0xcd, 0x7b, 0xbd,
--    0x2d, 0x74, 0xd0, 0x12, 0xb8, 0xe5, 0xb4, 0xb0,
--    0x89, 0x69, 0x97, 0x4a, 0x0c, 0x96, 0x77, 0x7e,
--    0x65, 0xb9, 0xf1, 0x09, 0xc5, 0x6e, 0xc6, 0x84,
--    0x18, 0xf0, 0x7d, 0xec, 0x3a, 0xdc, 0x4d, 0x20,
--    0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
--};
--
- static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
- {
-     union CRYPTO_STATE d = { .l = { rn[0], rn[1] } };
-diff --git a/crypto/meson.build b/crypto/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/crypto/meson.build
-+++ b/crypto/meson.build
-@@ -XXX,XX +XXX,XX @@ if have_afalg
- endif
- crypto_ss.add(when: gnutls, if_true: files('tls-cipher-suites.c'))
-+util_ss.add(files('sm4.c'))
- util_ss.add(files('aes.c'))
- util_ss.add(files('init.c'))
- if gnutls.found()
---
-.35.1

-[PULL 09/25] target/riscv: rvk: add support for zknd/zkne extension in RV32
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
- - add aes32esmi, aes32esi, aes32dsmi and aes32dsi instructions
-Co-authored-by: Zewen Ye <lustrew@foxmail.com>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423023510.30794-7-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/helper.h                   |   6 ++
- target/riscv/insn32.decode              |  11 +++
- target/riscv/crypto_helper.c            | 105 ++++++++++++++++++++++++
- target/riscv/translate.c                |   1 +
- target/riscv/insn_trans/trans_rvk.c.inc |  71 ++++++++++++++++
- target/riscv/meson.build                |   3 +-
-files changed, 196 insertions(+), 1 deletion(-)
- create mode 100644 target/riscv/crypto_helper.c
- create mode 100644 target/riscv/insn_trans/trans_rvk.c.inc
-diff --git a/target/riscv/helper.h b/target/riscv/helper.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/helper.h
-+++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(divu_i128, tl, env, tl, tl, tl, tl)
- DEF_HELPER_5(divs_i128, tl, env, tl, tl, tl, tl)
- DEF_HELPER_5(remu_i128, tl, env, tl, tl, tl, tl)
- DEF_HELPER_5(rems_i128, tl, env, tl, tl, tl, tl)
-+
-+/* Crypto functions */
-+DEF_HELPER_FLAGS_3(aes32esmi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
-+DEF_HELPER_FLAGS_3(aes32esi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
-+DEF_HELPER_FLAGS_3(aes32dsmi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
-+DEF_HELPER_FLAGS_3(aes32dsi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn32.decode
-+++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@
- %imm_b    31:s1 7:1 25:6 8:4     !function=ex_shift_1
- %imm_j    31:s1 12:8 20:1 21:10  !function=ex_shift_1
- %imm_u    12:s20                 !function=ex_shift_12
-+%imm_bs   30:2                   !function=ex_shift_3
- # Argument sets:
- &empty
-@@ -XXX,XX +XXX,XX @@
- &rmr       vm rd rs2
- &r2nfvm    vm rd rs1 nf
- &rnfvm     vm rd rs1 rs2 nf
-+&k_aes     shamt rs2 rs1 rd
- # Formats 32:
- @r       .......   ..... ..... ... ..... ....... &r                %rs2 %rs1 %rd
-@@ -XXX,XX +XXX,XX @@
- @sfence_vma ....... ..... .....   ... ..... ....... %rs2 %rs1
- @sfence_vm  ....... ..... .....   ... ..... ....... %rs1
-+@k_aes   .. ..... ..... .....  ... ..... ....... &k_aes  shamt=%imm_bs   %rs2 %rs1 %rd
-+
- # Formats 64:
- @sh5     .......  ..... .....  ... ..... ....... &shift  shamt=%sh5      %rs1 %rd
-@@ -XXX,XX +XXX,XX @@ sfence_w_inval    0001100 00000 00000 000 00000 1110011
- sfence_inval_ir   0001100 00001 00000 000 00000 1110011
- hinval_vvma       0010011 ..... ..... 000 00000 1110011 @hfence_vvma
- hinval_gvma       0110011 ..... ..... 000 00000 1110011 @hfence_gvma
-+
-+# *** RV32 Zknd Standard Extension ***
-+aes32dsmi   .. 10111 ..... ..... 000 ..... 0110011 @k_aes
-+aes32dsi    .. 10101 ..... ..... 000 ..... 0110011 @k_aes
-+# *** RV32 Zkne Standard Extension ***
-+aes32esmi   .. 10011 ..... ..... 000 ..... 0110011 @k_aes
-+aes32esi    .. 10001 ..... ..... 000 ..... 0110011 @k_aes
-diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/target/riscv/crypto_helper.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * RISC-V Crypto Emulation Helpers for QEMU.
-+ *
-+ * Copyright (c) 2021 Ruibo Lu, luruibo2000@163.com
-+ * Copyright (c) 2021 Zewen Ye, lustrew@foxmail.com
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms and conditions of the GNU General Public License,
-+ * version 2 or later, as published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-+ * more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along with
-+ * this program.  If not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "cpu.h"
-+#include "exec/exec-all.h"
-+#include "exec/helper-proto.h"
-+#include "crypto/aes.h"
-+#include "crypto/sm4.h"
-+
-+#define AES_XTIME(a) \
-+    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
-+
-+#define AES_GFMUL(a, b) (( \
-+    (((b) & 0x1) ? (a) : 0) ^ \
-+    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
-+    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
-+    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
-+
-+static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
-+{
-+    uint32_t u;
-+
-+    if (fwd) {
-+        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
-+            (AES_GFMUL(x, 2) << 0);
-+    } else {
-+        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
-+            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
-+    }
-+    return u;
-+}
-+
-+#define sext32_xlen(x) (target_ulong)(int32_t)(x)
-+
-+static inline target_ulong aes32_operation(target_ulong shamt,
-+                                           target_ulong rs1, target_ulong rs2,
-+                                           bool enc, bool mix)
-+{
-+    uint8_t si = rs2 >> shamt;
-+    uint8_t so;
-+    uint32_t mixed;
-+    target_ulong res;
-+
-+    if (enc) {
-+        so = AES_sbox[si];
-+        if (mix) {
-+            mixed = aes_mixcolumn_byte(so, true);
-+        } else {
-+            mixed = so;
-+        }
-+    } else {
-+        so = AES_isbox[si];
-+        if (mix) {
-+            mixed = aes_mixcolumn_byte(so, false);
-+        } else {
-+            mixed = so;
-+        }
-+    }
-+    mixed = rol32(mixed, shamt);
-+    res = rs1 ^ mixed;
-+
-+    return sext32_xlen(res);
-+}
-+
-+target_ulong HELPER(aes32esmi)(target_ulong rs1, target_ulong rs2,
-+                               target_ulong shamt)
-+{
-+    return aes32_operation(shamt, rs1, rs2, true, true);
-+}
-+
-+target_ulong HELPER(aes32esi)(target_ulong rs1, target_ulong rs2,
-+                              target_ulong shamt)
-+{
-+    return aes32_operation(shamt, rs1, rs2, true, false);
-+}
-+
-+target_ulong HELPER(aes32dsmi)(target_ulong rs1, target_ulong rs2,
-+                               target_ulong shamt)
-+{
-+    return aes32_operation(shamt, rs1, rs2, false, true);
-+}
-+
-+target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2,
-+                              target_ulong shamt)
-+{
-+    return aes32_operation(shamt, rs1, rs2, false, false);
-+}
-+#undef sext32_xlen
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
-+++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
- #include "insn_trans/trans_rvv.c.inc"
- #include "insn_trans/trans_rvb.c.inc"
- #include "insn_trans/trans_rvzfh.c.inc"
-+#include "insn_trans/trans_rvk.c.inc"
- #include "insn_trans/trans_privileged.c.inc"
- #include "insn_trans/trans_svinval.c.inc"
- #include "insn_trans/trans_xventanacondops.c.inc"
-diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/insn_trans/trans_rvk.c.inc
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/target/riscv/insn_trans/trans_rvk.c.inc
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * RISC-V translation routines for the Zk[nd,ne,nh,sed,sh] Standard Extension.
-+ *
-+ * Copyright (c) 2021 Ruibo Lu, luruibo2000@163.com
-+ * Copyright (c) 2021 Zewen Ye, lustrew@foxmail.com
-+ *
-+ * This program is free software; you can redistribute it and/or modify it
-+ * under the terms and conditions of the GNU General Public License,
-+ * version 2 or later, as published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-+ * more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along with
-+ * this program.  If not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#define REQUIRE_ZKND(ctx) do {                  \
-+    if (!ctx->cfg_ptr->ext_zknd) {              \
-+        return false;                           \
-+    }                                           \
-+} while (0)
-+
-+#define REQUIRE_ZKNE(ctx) do {                  \
-+    if (!ctx->cfg_ptr->ext_zkne) {              \
-+        return false;                           \
-+    }                                           \
-+} while (0)
-+
-+static bool gen_aes32_sm4(DisasContext *ctx, arg_k_aes *a,
-+                          void (*func)(TCGv, TCGv, TCGv, TCGv))
-+{
-+    TCGv shamt = tcg_constant_tl(a->shamt);
-+    TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
-+    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
-+
-+    func(dest, src1, src2, shamt);
-+    gen_set_gpr(ctx, a->rd, dest);
-+    return true;
-+}
-+
-+static bool trans_aes32esmi(DisasContext *ctx, arg_aes32esmi *a)
-+{
-+    REQUIRE_32BIT(ctx);
-+    REQUIRE_ZKNE(ctx);
-+    return gen_aes32_sm4(ctx, a, gen_helper_aes32esmi);
-+}
-+
-+static bool trans_aes32esi(DisasContext *ctx, arg_aes32esi *a)
-+{
-+    REQUIRE_32BIT(ctx);
-+    REQUIRE_ZKNE(ctx);
-+    return gen_aes32_sm4(ctx, a, gen_helper_aes32esi);
-+}
-+
-+static bool trans_aes32dsmi(DisasContext *ctx, arg_aes32dsmi *a)
-+{
-+    REQUIRE_32BIT(ctx);
-+    REQUIRE_ZKND(ctx);
-+    return gen_aes32_sm4(ctx, a, gen_helper_aes32dsmi);
-+}
-+
-+static bool trans_aes32dsi(DisasContext *ctx, arg_aes32dsi *a)
-+{
-+    REQUIRE_32BIT(ctx);
-+    REQUIRE_ZKND(ctx);
-+    return gen_aes32_sm4(ctx, a, gen_helper_aes32dsi);
-+}
-diff --git a/target/riscv/meson.build b/target/riscv/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/meson.build
-+++ b/target/riscv/meson.build
-@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
-   'vector_helper.c',
-   'bitmanip_helper.c',
-   'translate.c',
--  'm128_helper.c'
-+  'm128_helper.c',
-+  'crypto_helper.c'
- ))
- riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
---
-.35.1

-[PULL 11/25] target/riscv: rvk: add support for sha256 related instructions in zknh extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
- - add sha256sig0, sha256sig1, sha256sum0 and sha256sum1 instructions
-Co-authored-by: Zewen Ye <lustrew@foxmail.com>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423023510.30794-9-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn32.decode              |  5 +++
- target/riscv/insn_trans/trans_rvk.c.inc | 55 +++++++++++++++++++++++++
-files changed, 60 insertions(+)
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn32.decode
-+++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ aes64esm    00 11011 ..... ..... 000 ..... 0110011 @r
- # *** RV64 Zkne/zknd Standard Extension ***
- aes64ks2    01 11111 ..... ..... 000 ..... 0110011 @r
- aes64ks1i   00 11000 1.... ..... 001 ..... 0010011 @i_aes
-+# *** RV32 Zknh Standard Extension ***
-+sha256sig0  00 01000 00010 ..... 001 ..... 0010011 @r2
-+sha256sig1  00 01000 00011 ..... 001 ..... 0010011 @r2
-+sha256sum0  00 01000 00000 ..... 001 ..... 0010011 @r2
-+sha256sum1  00 01000 00001 ..... 001 ..... 0010011 @r2
-diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/insn_trans/trans_rvk.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvk.c.inc
-+++ b/target/riscv/insn_trans/trans_rvk.c.inc
-@@ -XXX,XX +XXX,XX @@
-     }                                           \
- } while (0)
-+#define REQUIRE_ZKNH(ctx) do {                  \
-+    if (!ctx->cfg_ptr->ext_zknh) {              \
-+        return false;                           \
-+    }                                           \
-+} while (0)
-+
- static bool gen_aes32_sm4(DisasContext *ctx, arg_k_aes *a,
-                           void (*func)(TCGv, TCGv, TCGv, TCGv))
- {
-@@ -XXX,XX +XXX,XX @@ static bool trans_aes64im(DisasContext *ctx, arg_aes64im *a)
-     REQUIRE_ZKND(ctx);
-     return gen_unary(ctx, a, EXT_NONE, gen_helper_aes64im);
- }
-+
-+static bool gen_sha256(DisasContext *ctx, arg_r2 *a, DisasExtend ext,
-+                       void (*func)(TCGv_i32, TCGv_i32, int32_t),
-+                       int32_t num1, int32_t num2, int32_t num3)
-+{
-+    TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv src1 = get_gpr(ctx, a->rs1, ext);
-+    TCGv_i32 t0 = tcg_temp_new_i32();
-+    TCGv_i32 t1 = tcg_temp_new_i32();
-+    TCGv_i32 t2 = tcg_temp_new_i32();
-+
-+    tcg_gen_trunc_tl_i32(t0, src1);
-+    tcg_gen_rotri_i32(t1, t0, num1);
-+    tcg_gen_rotri_i32(t2, t0, num2);
-+    tcg_gen_xor_i32(t1, t1, t2);
-+    func(t2, t0, num3);
-+    tcg_gen_xor_i32(t1, t1, t2);
-+    tcg_gen_ext_i32_tl(dest, t1);
-+
-+    gen_set_gpr(ctx, a->rd, dest);
-+    tcg_temp_free_i32(t0);
-+    tcg_temp_free_i32(t1);
-+    tcg_temp_free_i32(t2);
-+    return true;
-+}
-+
-+static bool trans_sha256sig0(DisasContext *ctx, arg_sha256sig0 *a)
-+{
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha256(ctx, a, EXT_NONE, tcg_gen_shri_i32, 7, 18, 3);
-+}
-+
-+static bool trans_sha256sig1(DisasContext *ctx, arg_sha256sig1 *a)
-+{
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha256(ctx, a, EXT_NONE, tcg_gen_shri_i32, 17, 19, 10);
-+}
-+
-+static bool trans_sha256sum0(DisasContext *ctx, arg_sha256sum0 *a)
-+{
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha256(ctx, a, EXT_NONE, tcg_gen_rotri_i32, 2, 13, 22);
-+}
-+
-+static bool trans_sha256sum1(DisasContext *ctx, arg_sha256sum1 *a)
-+{
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha256(ctx, a, EXT_NONE, tcg_gen_rotri_i32, 6, 11, 25);
-+}
---
-.35.1

-[PULL 12/25] target/riscv: rvk: add support for sha512 related instructions for RV32 in zknh extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
- - add sha512sum0r, sha512sig0l, sha512sum1r, sha512sig1l, sha512sig0h and sha512sig1h instructions
-Co-authored-by: Zewen Ye <lustrew@foxmail.com>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423023510.30794-10-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn32.decode              |   6 ++
- target/riscv/insn_trans/trans_rvk.c.inc | 100 ++++++++++++++++++++++++
-files changed, 106 insertions(+)
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn32.decode
-+++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ sha256sig0  00 01000 00010 ..... 001 ..... 0010011 @r2
- sha256sig1  00 01000 00011 ..... 001 ..... 0010011 @r2
- sha256sum0  00 01000 00000 ..... 001 ..... 0010011 @r2
- sha256sum1  00 01000 00001 ..... 001 ..... 0010011 @r2
-+sha512sum0r 01 01000 ..... ..... 000 ..... 0110011 @r
-+sha512sum1r 01 01001 ..... ..... 000 ..... 0110011 @r
-+sha512sig0l 01 01010 ..... ..... 000 ..... 0110011 @r
-+sha512sig0h 01 01110 ..... ..... 000 ..... 0110011 @r
-+sha512sig1l 01 01011 ..... ..... 000 ..... 0110011 @r
-+sha512sig1h 01 01111 ..... ..... 000 ..... 0110011 @r
-diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/insn_trans/trans_rvk.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvk.c.inc
-+++ b/target/riscv/insn_trans/trans_rvk.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_sha256sum1(DisasContext *ctx, arg_sha256sum1 *a)
-     REQUIRE_ZKNH(ctx);
-     return gen_sha256(ctx, a, EXT_NONE, tcg_gen_rotri_i32, 6, 11, 25);
- }
-+
-+static bool gen_sha512_rv32(DisasContext *ctx, arg_r *a, DisasExtend ext,
-+                            void (*func1)(TCGv_i64, TCGv_i64, int64_t),
-+                            void (*func2)(TCGv_i64, TCGv_i64, int64_t),
-+                            int64_t num1, int64_t num2, int64_t num3)
-+{
-+    TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv src1 = get_gpr(ctx, a->rs1, ext);
-+    TCGv src2 = get_gpr(ctx, a->rs2, ext);
-+    TCGv_i64 t0 = tcg_temp_new_i64();
-+    TCGv_i64 t1 = tcg_temp_new_i64();
-+    TCGv_i64 t2 = tcg_temp_new_i64();
-+
-+    tcg_gen_concat_tl_i64(t0, src1, src2);
-+    func1(t1, t0, num1);
-+    func2(t2, t0, num2);
-+    tcg_gen_xor_i64(t1, t1, t2);
-+    tcg_gen_rotri_i64(t2, t0, num3);
-+    tcg_gen_xor_i64(t1, t1, t2);
-+    tcg_gen_trunc_i64_tl(dest, t1);
-+
-+    gen_set_gpr(ctx, a->rd, dest);
-+    tcg_temp_free_i64(t0);
-+    tcg_temp_free_i64(t1);
-+    tcg_temp_free_i64(t2);
-+    return true;
-+}
-+
-+static bool trans_sha512sum0r(DisasContext *ctx, arg_sha512sum0r *a)
-+{
-+    REQUIRE_32BIT(ctx);
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha512_rv32(ctx, a, EXT_NONE, tcg_gen_rotli_i64,
-+                           tcg_gen_rotli_i64, 25, 30, 28);
-+}
-+
-+static bool trans_sha512sum1r(DisasContext *ctx, arg_sha512sum1r *a)
-+{
-+    REQUIRE_32BIT(ctx);
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha512_rv32(ctx, a, EXT_NONE, tcg_gen_rotli_i64,
-+                           tcg_gen_rotri_i64, 23, 14, 18);
-+}
-+
-+static bool trans_sha512sig0l(DisasContext *ctx, arg_sha512sig0l *a)
-+{
-+    REQUIRE_32BIT(ctx);
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha512_rv32(ctx, a, EXT_NONE, tcg_gen_rotri_i64,
-+                           tcg_gen_rotri_i64, 1, 7, 8);
-+}
-+
-+static bool trans_sha512sig1l(DisasContext *ctx, arg_sha512sig1l *a)
-+{
-+    REQUIRE_32BIT(ctx);
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha512_rv32(ctx, a, EXT_NONE, tcg_gen_rotli_i64,
-+                           tcg_gen_rotri_i64, 3, 6, 19);
-+}
-+
-+static bool gen_sha512h_rv32(DisasContext *ctx, arg_r *a, DisasExtend ext,
-+                             void (*func)(TCGv_i64, TCGv_i64, int64_t),
-+                             int64_t num1, int64_t num2, int64_t num3)
-+{
-+    TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv src1 = get_gpr(ctx, a->rs1, ext);
-+    TCGv src2 = get_gpr(ctx, a->rs2, ext);
-+    TCGv_i64 t0 = tcg_temp_new_i64();
-+    TCGv_i64 t1 = tcg_temp_new_i64();
-+    TCGv_i64 t2 = tcg_temp_new_i64();
-+
-+    tcg_gen_concat_tl_i64(t0, src1, src2);
-+    func(t1, t0, num1);
-+    tcg_gen_ext32u_i64(t2, t0);
-+    tcg_gen_shri_i64(t2, t2, num2);
-+    tcg_gen_xor_i64(t1, t1, t2);
-+    tcg_gen_rotri_i64(t2, t0, num3);
-+    tcg_gen_xor_i64(t1, t1, t2);
-+    tcg_gen_trunc_i64_tl(dest, t1);
-+
-+    gen_set_gpr(ctx, a->rd, dest);
-+    tcg_temp_free_i64(t0);
-+    tcg_temp_free_i64(t1);
-+    tcg_temp_free_i64(t2);
-+    return true;
-+}
-+
-+static bool trans_sha512sig0h(DisasContext *ctx, arg_sha512sig0h *a)
-+{
-+    REQUIRE_32BIT(ctx);
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha512h_rv32(ctx, a, EXT_NONE, tcg_gen_rotri_i64, 1, 7, 8);
-+}
-+
-+static bool trans_sha512sig1h(DisasContext *ctx, arg_sha512sig1h *a)
-+{
-+    REQUIRE_32BIT(ctx);
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha512h_rv32(ctx, a, EXT_NONE, tcg_gen_rotli_i64, 3, 6, 19);
-+}
---
-.35.1

-[PULL 13/25] target/riscv: rvk: add support for sha512 related instructions for RV64 in zknh extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
- - add sha512sum0, sha512sig0, sha512sum1 and sha512sig1 instructions
-Co-authored-by: Zewen Ye <lustrew@foxmail.com>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423023510.30794-11-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/insn32.decode              |  5 +++
- target/riscv/insn_trans/trans_rvk.c.inc | 53 +++++++++++++++++++++++++
-files changed, 58 insertions(+)
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn32.decode
-+++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ sha512sig0l 01 01010 ..... ..... 000 ..... 0110011 @r
- sha512sig0h 01 01110 ..... ..... 000 ..... 0110011 @r
- sha512sig1l 01 01011 ..... ..... 000 ..... 0110011 @r
- sha512sig1h 01 01111 ..... ..... 000 ..... 0110011 @r
-+# *** RV64 Zknh Standard Extension ***
-+sha512sig0  00 01000 00110 ..... 001 ..... 0010011 @r2
-+sha512sig1  00 01000 00111 ..... 001 ..... 0010011 @r2
-+sha512sum0  00 01000 00100 ..... 001 ..... 0010011 @r2
-+sha512sum1  00 01000 00101 ..... 001 ..... 0010011 @r2
-diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/insn_trans/trans_rvk.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvk.c.inc
-+++ b/target/riscv/insn_trans/trans_rvk.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_sha512sig1h(DisasContext *ctx, arg_sha512sig1h *a)
-     REQUIRE_ZKNH(ctx);
-     return gen_sha512h_rv32(ctx, a, EXT_NONE, tcg_gen_rotli_i64, 3, 6, 19);
- }
-+
-+static bool gen_sha512_rv64(DisasContext *ctx, arg_r2 *a, DisasExtend ext,
-+                            void (*func)(TCGv_i64, TCGv_i64, int64_t),
-+                            int64_t num1, int64_t num2, int64_t num3)
-+{
-+    TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv src1 = get_gpr(ctx, a->rs1, ext);
-+    TCGv_i64 t0 = tcg_temp_new_i64();
-+    TCGv_i64 t1 = tcg_temp_new_i64();
-+    TCGv_i64 t2 = tcg_temp_new_i64();
-+
-+    tcg_gen_extu_tl_i64(t0, src1);
-+    tcg_gen_rotri_i64(t1, t0, num1);
-+    tcg_gen_rotri_i64(t2, t0, num2);
-+    tcg_gen_xor_i64(t1, t1, t2);
-+    func(t2, t0, num3);
-+    tcg_gen_xor_i64(t1, t1, t2);
-+    tcg_gen_trunc_i64_tl(dest, t1);
-+
-+    gen_set_gpr(ctx, a->rd, dest);
-+    tcg_temp_free_i64(t0);
-+    tcg_temp_free_i64(t1);
-+    tcg_temp_free_i64(t2);
-+    return true;
-+}
-+
-+static bool trans_sha512sig0(DisasContext *ctx, arg_sha512sig0 *a)
-+{
-+    REQUIRE_64BIT(ctx);
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha512_rv64(ctx, a, EXT_NONE, tcg_gen_shri_i64, 1, 8, 7);
-+}
-+
-+static bool trans_sha512sig1(DisasContext *ctx, arg_sha512sig1 *a)
-+{
-+    REQUIRE_64BIT(ctx);
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha512_rv64(ctx, a, EXT_NONE, tcg_gen_shri_i64, 19, 61, 6);
-+}
-+
-+static bool trans_sha512sum0(DisasContext *ctx, arg_sha512sum0 *a)
-+{
-+    REQUIRE_64BIT(ctx);
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha512_rv64(ctx, a, EXT_NONE, tcg_gen_rotri_i64, 28, 34, 39);
-+}
-+
-+static bool trans_sha512sum1(DisasContext *ctx, arg_sha512sum1 *a)
-+{
-+    REQUIRE_64BIT(ctx);
-+    REQUIRE_ZKNH(ctx);
-+    return gen_sha512_rv64(ctx, a, EXT_NONE, tcg_gen_rotri_i64, 14, 18, 41);
-+}
---
-.35.1

-[PULL 14/25] target/riscv: rvk: add support for zksed/zksh extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
- - add sm3p0, sm3p1, sm4ed and sm4ks instructions
-Co-authored-by: Ruibo Lu <luruibo2000@163.com>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423023510.30794-12-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/helper.h                   |  3 ++
- target/riscv/insn32.decode              |  6 +++
- target/riscv/crypto_helper.c            | 28 ++++++++++++
- target/riscv/insn_trans/trans_rvk.c.inc | 58 +++++++++++++++++++++++++
-files changed, 95 insertions(+)
-diff --git a/target/riscv/helper.h b/target/riscv/helper.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/helper.h
-+++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(aes64dsm, TCG_CALL_NO_RWG_SE, tl, tl, tl)
- DEF_HELPER_FLAGS_2(aes64ks2, TCG_CALL_NO_RWG_SE, tl, tl, tl)
- DEF_HELPER_FLAGS_2(aes64ks1i, TCG_CALL_NO_RWG_SE, tl, tl, tl)
- DEF_HELPER_FLAGS_1(aes64im, TCG_CALL_NO_RWG_SE, tl, tl)
-+
-+DEF_HELPER_FLAGS_3(sm4ed, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
-+DEF_HELPER_FLAGS_3(sm4ks, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn32.decode
-+++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ sha512sig0  00 01000 00110 ..... 001 ..... 0010011 @r2
- sha512sig1  00 01000 00111 ..... 001 ..... 0010011 @r2
- sha512sum0  00 01000 00100 ..... 001 ..... 0010011 @r2
- sha512sum1  00 01000 00101 ..... 001 ..... 0010011 @r2
-+# *** RV32 Zksh Standard Extension ***
-+sm3p0       00 01000 01000 ..... 001 ..... 0010011 @r2
-+sm3p1       00 01000 01001 ..... 001 ..... 0010011 @r2
-+# *** RV32 Zksed Standard Extension ***
-+sm4ed       .. 11000 ..... ..... 000 ..... 0110011 @k_aes
-+sm4ks       .. 11010 ..... ..... 000 ..... 0110011 @k_aes
-diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/crypto_helper.c
-+++ b/target/riscv/crypto_helper.c
-@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes64im)(target_ulong rs1)
-     return result;
- }
-+
-+target_ulong HELPER(sm4ed)(target_ulong rs1, target_ulong rs2,
-+                           target_ulong shamt)
-+{
-+    uint32_t sb_in = (uint8_t)(rs2 >> shamt);
-+    uint32_t sb_out = (uint32_t)sm4_sbox[sb_in];
-+
-+    uint32_t x = sb_out ^ (sb_out << 8) ^ (sb_out << 2) ^ (sb_out << 18) ^
-+                 ((sb_out & 0x3f) << 26) ^ ((sb_out & 0xC0) << 10);
-+
-+    uint32_t rotl = rol32(x, shamt);
-+
-+    return sext32_xlen(rotl ^ (uint32_t)rs1);
-+}
-+
-+target_ulong HELPER(sm4ks)(target_ulong rs1, target_ulong rs2,
-+                           target_ulong shamt)
-+{
-+    uint32_t sb_in = (uint8_t)(rs2 >> shamt);
-+    uint32_t sb_out = sm4_sbox[sb_in];
-+
-+    uint32_t x = sb_out ^ ((sb_out & 0x07) << 29) ^ ((sb_out & 0xFE) << 7) ^
-+                 ((sb_out & 0x01) << 23) ^ ((sb_out & 0xF8) << 13);
-+
-+    uint32_t rotl = rol32(x, shamt);
-+
-+    return sext32_xlen(rotl ^ (uint32_t)rs1);
-+}
- #undef sext32_xlen
-diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/insn_trans/trans_rvk.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvk.c.inc
-+++ b/target/riscv/insn_trans/trans_rvk.c.inc
-@@ -XXX,XX +XXX,XX @@
-     }                                           \
- } while (0)
-+#define REQUIRE_ZKSED(ctx) do {                 \
-+    if (!ctx->cfg_ptr->ext_zksed) {             \
-+        return false;                           \
-+    }                                           \
-+} while (0)
-+
-+#define REQUIRE_ZKSH(ctx) do {                  \
-+    if (!ctx->cfg_ptr->ext_zksh) {              \
-+        return false;                           \
-+    }                                           \
-+} while (0)
-+
- static bool gen_aes32_sm4(DisasContext *ctx, arg_k_aes *a,
-                           void (*func)(TCGv, TCGv, TCGv, TCGv))
- {
-@@ -XXX,XX +XXX,XX @@ static bool trans_sha512sum1(DisasContext *ctx, arg_sha512sum1 *a)
-     REQUIRE_ZKNH(ctx);
-     return gen_sha512_rv64(ctx, a, EXT_NONE, tcg_gen_rotri_i64, 14, 18, 41);
- }
-+
-+/* SM3 */
-+static bool gen_sm3(DisasContext *ctx, arg_r2 *a, int32_t b, int32_t c)
-+{
-+    TCGv dest = dest_gpr(ctx, a->rd);
-+    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
-+    TCGv_i32 t0 = tcg_temp_new_i32();
-+    TCGv_i32 t1 = tcg_temp_new_i32();
-+
-+    tcg_gen_trunc_tl_i32(t0, src1);
-+    tcg_gen_rotli_i32(t1, t0, b);
-+    tcg_gen_xor_i32(t1, t0, t1);
-+    tcg_gen_rotli_i32(t0, t0, c);
-+    tcg_gen_xor_i32(t1, t1, t0);
-+    tcg_gen_ext_i32_tl(dest, t1);
-+    gen_set_gpr(ctx, a->rd, dest);
-+
-+    tcg_temp_free_i32(t0);
-+    tcg_temp_free_i32(t1);
-+    return true;
-+}
-+
-+static bool trans_sm3p0(DisasContext *ctx, arg_sm3p0 *a)
-+{
-+    REQUIRE_ZKSH(ctx);
-+    return gen_sm3(ctx, a, 9, 17);
-+}
-+
-+static bool trans_sm3p1(DisasContext *ctx, arg_sm3p1 *a)
-+{
-+    REQUIRE_ZKSH(ctx);
-+    return gen_sm3(ctx, a, 15, 23);
-+}
-+
-+/* SM4 */
-+static bool trans_sm4ed(DisasContext *ctx, arg_sm4ed *a)
-+{
-+    REQUIRE_ZKSED(ctx);
-+    return gen_aes32_sm4(ctx, a, gen_helper_sm4ed);
-+}
-+
-+static bool trans_sm4ks(DisasContext *ctx, arg_sm4ks *a)
-+{
-+    REQUIRE_ZKSED(ctx);
-+    return gen_aes32_sm4(ctx, a, gen_helper_sm4ks);
-+}
---
-.35.1

-[PULL 23/25] hw/riscv: virt: Add support for generating platform FDT entries
+[PULL 07/10] target/riscv: refactor VSTART_CHECK_EARLY_EXIT() to accept vl as a parameter
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Chao Liu <lc00631@tecorigin.com>
-Similar to the ARM virt machine add support for adding device tree
+Some vector instructions are special, such as the vlm.v instruction,
-entries for dynamically created devices.
+where setting its vl actually sets evl = (vl + 7) >> 3. To improve
 maintainability, we will uniformly use VSTART_CHECK_EARLY_EXIT() to
 check for the condition vstart >= vl. This function will also handle
 cases involving evl.
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Fixes: df4252b2ec ("target/riscv/vector_helpers: do early exit when
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
+vstart >= vl")
-Message-Id: <20220427234146.1130752-5-alistair.francis@opensource.wdc.com>
+Signed-off-by: Chao Liu <lc00631@tecorigin.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <f575979874e323a9e0da7796aa391c7d87e56f88.1741573286.git.lc00631@tecorigin.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 19 +++++++++++++++++++
+ target/riscv/vector_internals.h | 12 +++---
-file changed, 19 insertions(+)
+ target/riscv/vcrypto_helper.c   | 32 +++++++--------
  target/riscv/vector_helper.c    | 69 ++++++++++++++++-----------------
  target/riscv/vector_internals.c |  4 +-
 files changed, 57 insertions(+), 60 deletions(-)
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
+--- a/target/riscv/vector_internals.h
-+++ b/hw/riscv/virt.c
++++ b/target/riscv/vector_internals.h
 @@ -XXX,XX +XXX,XX @@
- #include "hw/qdev-properties.h"
+ #include "tcg/tcg-gvec-desc.h"
- #include "hw/char/serial.h"
+ #include "internals.h"
- #include "target/riscv/cpu.h"
-+#include "hw/core/sysbus-fdt.h"
+-#define VSTART_CHECK_EARLY_EXIT(env) do { \
- #include "hw/riscv/riscv_hart.h"
+-    if (env->vstart >= env->vl) {         \
- #include "hw/riscv/virt.h"
+-        env->vstart = 0;                  \
- #include "hw/riscv/boot.h"
+-        return;                           \
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
+-    }                                     \
-     riscv_socket_fdt_write_id(mc, mc->fdt, plic_name, socket);
++#define VSTART_CHECK_EARLY_EXIT(env, vl) do { \
-     qemu_fdt_setprop_cell(mc->fdt, plic_name, "phandle",
++    if (env->vstart >= vl) {                  \
-         plic_phandles[socket]);
++        env->vstart = 0;                      \
-+
++        return;                               \
-+    platform_bus_add_all_fdt_nodes(mc->fdt, plic_name,
++    }                                         \
-+                                   memmap[VIRT_PLATFORM_BUS].base,
+ } while (0)
-+                                   memmap[VIRT_PLATFORM_BUS].size,
-+                                   VIRT_PLATFORM_BUS_IRQ);
+ static inline uint32_t vext_nf(uint32_t desc)
-+
+@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-     g_free(plic_name);
+     uint32_t vma = vext_vma(desc);                     \
+     uint32_t i;                                        \
-     g_free(plic_cells);
+                                                        \
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
+-    VSTART_CHECK_EARLY_EXIT(env);                      \
-             IMSIC_MMIO_GROUP_MIN_SHIFT);
++    VSTART_CHECK_EARLY_EXIT(env, vl);                  \
-     }
+                                                        \
-     qemu_fdt_setprop_cell(mc->fdt, imsic_name, "phandle", *msi_m_phandle);
+     for (i = env->vstart; i < vl; i++) {               \
-+
+         if (!vm && !vext_elem_mask(v0, i)) {           \
-+    platform_bus_add_all_fdt_nodes(mc->fdt, imsic_name,
+diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
-+                                   memmap[VIRT_PLATFORM_BUS].base,
+index XXXXXXX..XXXXXXX 100644
-+                                   memmap[VIRT_PLATFORM_BUS].size,
+--- a/target/riscv/vcrypto_helper.c
-+                                   VIRT_PLATFORM_BUS_IRQ);
++++ b/target/riscv/vcrypto_helper.c
-+
+@@ -XXX,XX +XXX,XX @@ static inline void xor_round_key(AESState *round_state, AESState *round_key)
-     g_free(imsic_name);
+         uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
+         uint32_t vta = vext_vta(desc);                                    \
-     /* S-level IMSIC node */
+                                                                           \
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
+-        VSTART_CHECK_EARLY_EXIT(env);                                     \
-         VIRT_IRQCHIP_NUM_SOURCES);
++        VSTART_CHECK_EARLY_EXIT(env, vl);                                 \
-     riscv_socket_fdt_write_id(mc, mc->fdt, aplic_name, socket);
+                                                                           \
-     qemu_fdt_setprop_cell(mc->fdt, aplic_name, "phandle", aplic_s_phandle);
+         for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
-+
+             AESState round_key;                                           \
-+    platform_bus_add_all_fdt_nodes(mc->fdt, aplic_name,
+@@ -XXX,XX +XXX,XX @@ static inline void xor_round_key(AESState *round_state, AESState *round_key)
-+                                   memmap[VIRT_PLATFORM_BUS].base,
+         uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
-+                                   memmap[VIRT_PLATFORM_BUS].size,
+         uint32_t vta = vext_vta(desc);                                    \
-+                                   VIRT_PLATFORM_BUS_IRQ);
+                                                                           \
-+
+-        VSTART_CHECK_EARLY_EXIT(env);                                     \
-     g_free(aplic_name);
++        VSTART_CHECK_EARLY_EXIT(env, vl);                                 \
+                                                                           \
-     g_free(aplic_cells);
+         for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
              AESState round_key;                                           \
@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
      uint32_t total_elems = vext_get_total_elems(env, desc, 4);
      uint32_t vta = vext_vta(desc);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, vl);
      uimm &= 0b1111;
      if (uimm > 10 || uimm == 0) {
@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
      uint32_t total_elems = vext_get_total_elems(env, desc, 4);
      uint32_t vta = vext_vta(desc);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, vl);
      uimm &= 0b1111;
      if (uimm > 14 || uimm < 2) {
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
      uint32_t total_elems;
      uint32_t vta = vext_vta(desc);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
          if (sew == MO_32) {
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
      uint32_t total_elems;
      uint32_t vta = vext_vta(desc);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
          vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
      uint32_t total_elems;
      uint32_t vta = vext_vta(desc);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
          vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
      uint32_t total_elems;
      uint32_t vta = vext_vta(desc);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
          vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
      uint32_t total_elems;
      uint32_t vta = vext_vta(desc);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
          vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm3me_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
      uint32_t *vs1 = vs1_vptr;
      uint32_t *vs2 = vs2_vptr;
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (int i = env->vstart / 8; i < env->vl / 8; i++) {
          uint32_t w[24];
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
      uint32_t *vs2 = vs2_vptr;
      uint32_t v1[8], v2[8], v3[8];
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (int i = env->vstart / 8; i < env->vl / 8; i++) {
          for (int k = 0; k < 8; k++) {
@@ -XXX,XX +XXX,XX @@ void HELPER(vghsh_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
      uint32_t vta = vext_vta(desc);
      uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
          uint64_t Y[2] = {vd[i * 2 + 0], vd[i * 2 + 1]};
@@ -XXX,XX +XXX,XX @@ void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
      uint32_t vta = vext_vta(desc);
      uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
          uint64_t Y[2] = {brev8(vd[i * 2 + 0]), brev8(vd[i * 2 + 1])};
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm4k_vi)(void *vd, void *vs2, uint32_t uimm5, CPURISCVState *env,
      uint32_t esz = sizeof(uint32_t);
      uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (uint32_t i = group_start; i < group_end; ++i) {
          uint32_t vstart = i * egs;
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm4r_vv)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
      uint32_t esz = sizeof(uint32_t);
      uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (uint32_t i = group_start; i < group_end; ++i) {
          uint32_t vstart = i * egs;
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm4r_vs)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
      uint32_t esz = sizeof(uint32_t);
      uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (uint32_t i = group_start; i < group_end; ++i) {
          uint32_t vstart = i * egs;
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldst_stride(void *vd, void *v0, target_ulong base, target_ulong stride,
      uint32_t esz = 1 << log2_esz;
      uint32_t vma = vext_vma(desc);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      for (i = env->vstart; i < env->vl; env->vstart = ++i) {
          k = 0;
@@ -XXX,XX +XXX,XX @@ vext_ldst_us(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
      uint32_t msize = nf * esz;
      int mmu_index = riscv_env_mmu_index(env, false);
 -    if (env->vstart >= evl) {
 -        env->vstart = 0;
 -        return;
 -    }
 +    VSTART_CHECK_EARLY_EXIT(env, evl);
  #if defined(CONFIG_USER_ONLY)
      /*
@@ -XXX,XX +XXX,XX @@ vext_ldst_index(void *vd, void *v0, target_ulong base,
      uint32_t esz = 1 << log2_esz;
      uint32_t vma = vext_vma(desc);
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      /* load bytes from guest memory */
      for (i = env->vstart; i < env->vl; env->vstart = ++i) {
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base, CPURISCVState *env,
      int flags;
      void *host;
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, env->vl);
      addr = base + ((env->vstart * nf) << log2_esz);
      page_split = -(addr | TARGET_PAGE_MASK);
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
      uint32_t vta = vext_vta(desc);                            \
      uint32_t i;                                               \
                                                                \
 -    VSTART_CHECK_EARLY_EXIT(env);                             \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                         \
                                                                \
      for (i = env->vstart; i < vl; i++) {                      \
          ETYPE s1 = *((ETYPE *)vs1 + H(i));                    \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,        \
      uint32_t vta = vext_vta(desc);                                       \
      uint32_t i;                                                          \
                                                                           \
 -    VSTART_CHECK_EARLY_EXIT(env);                                        \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                    \
                                                                           \
      for (i = env->vstart; i < vl; i++) {                                 \
          ETYPE s2 = *((ETYPE *)vs2 + H(i));                               \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
      uint32_t vta_all_1s = vext_vta_all_1s(desc);              \
      uint32_t i;                                               \
                                                                \
 -    VSTART_CHECK_EARLY_EXIT(env);                             \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                         \
                                                                \
      for (i = env->vstart; i < vl; i++) {                      \
          ETYPE s1 = *((ETYPE *)vs1 + H(i));                    \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,          \
      uint32_t vta_all_1s = vext_vta_all_1s(desc);                \
      uint32_t i;                                                 \
                                                                  \
 -    VSTART_CHECK_EARLY_EXIT(env);                               \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                           \
                                                                  \
      for (i = env->vstart; i < vl; i++) {                        \
          ETYPE s2 = *((ETYPE *)vs2 + H(i));                      \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,                          \
      uint32_t vma = vext_vma(desc);                                        \
      uint32_t i;                                                           \
                                                                            \
 -    VSTART_CHECK_EARLY_EXIT(env);                                         \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                            \
      for (i = env->vstart; i < vl; i++) {                                  \
          if (!vm && !vext_elem_mask(v0, i)) {                              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,      \
      uint32_t vma = vext_vma(desc);                          \
      uint32_t i;                                             \
                                                              \
 -    VSTART_CHECK_EARLY_EXIT(env);                           \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                       \
                                                              \
      for (i = env->vstart; i < vl; i++) {                    \
          if (!vm && !vext_elem_mask(v0, i)) {                \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
      uint32_t vma = vext_vma(desc);                            \
      uint32_t i;                                               \
                                                                \
 -    VSTART_CHECK_EARLY_EXIT(env);                             \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                         \
                                                                \
      for (i = env->vstart; i < vl; i++) {                      \
          ETYPE s1 = *((ETYPE *)vs1 + H(i));                    \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,   \
      uint32_t vma = vext_vma(desc);                                  \
      uint32_t i;                                                     \
                                                                      \
 -    VSTART_CHECK_EARLY_EXIT(env);                                   \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                               \
                                                                      \
      for (i = env->vstart; i < vl; i++) {                            \
          ETYPE s2 = *((ETYPE *)vs2 + H(i));                          \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *vs1, CPURISCVState *env,           \
      uint32_t vta = vext_vta(desc);                                   \
      uint32_t i;                                                      \
                                                                       \
 -    VSTART_CHECK_EARLY_EXIT(env);                                    \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                \
                                                                       \
      for (i = env->vstart; i < vl; i++) {                             \
          ETYPE s1 = *((ETYPE *)vs1 + H(i));                           \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, uint64_t s1, CPURISCVState *env,         \
      uint32_t vta = vext_vta(desc);                                   \
      uint32_t i;                                                      \
                                                                       \
 -    VSTART_CHECK_EARLY_EXIT(env);                                    \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                \
                                                                       \
      for (i = env->vstart; i < vl; i++) {                             \
          *((ETYPE *)vd + H(i)) = (ETYPE)s1;                           \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,          \
      uint32_t vta = vext_vta(desc);                                   \
      uint32_t i;                                                      \
                                                                       \
 -    VSTART_CHECK_EARLY_EXIT(env);                                    \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                \
                                                                       \
      for (i = env->vstart; i < vl; i++) {                             \
          ETYPE *vt = (!vext_elem_mask(v0, i) ? vs2 : vs1);            \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,               \
      uint32_t vta = vext_vta(desc);                                   \
      uint32_t i;                                                      \
                                                                       \
 -    VSTART_CHECK_EARLY_EXIT(env);                                    \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                \
                                                                       \
      for (i = env->vstart; i < vl; i++) {                             \
          ETYPE s2 = *((ETYPE *)vs2 + H(i));                           \
@@ -XXX,XX +XXX,XX @@ vext_vv_rm_1(void *vd, void *v0, void *vs1, void *vs2,
               uint32_t vl, uint32_t vm, int vxrm,
               opivv2_rm_fn *fn, uint32_t vma, uint32_t esz)
  {
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, vl);
      for (uint32_t i = env->vstart; i < vl; i++) {
          if (!vm && !vext_elem_mask(v0, i)) {
@@ -XXX,XX +XXX,XX @@ vext_vx_rm_1(void *vd, void *v0, target_long s1, void *vs2,
               uint32_t vl, uint32_t vm, int vxrm,
               opivx2_rm_fn *fn, uint32_t vma, uint32_t esz)
  {
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, vl);
      for (uint32_t i = env->vstart; i < vl; i++) {
          if (!vm && !vext_elem_mask(v0, i)) {
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
      uint32_t vma = vext_vma(desc);                        \
      uint32_t i;                                           \
                                                            \
 -    VSTART_CHECK_EARLY_EXIT(env);                         \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                     \
                                                            \
      for (i = env->vstart; i < vl; i++) {                  \
          if (!vm && !vext_elem_mask(v0, i)) {              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1,        \
      uint32_t vma = vext_vma(desc);                        \
      uint32_t i;                                           \
                                                            \
 -    VSTART_CHECK_EARLY_EXIT(env);                         \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                     \
                                                            \
      for (i = env->vstart; i < vl; i++) {                  \
          if (!vm && !vext_elem_mask(v0, i)) {              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
      uint32_t vma = vext_vma(desc);                     \
      uint32_t i;                                        \
                                                         \
 -    VSTART_CHECK_EARLY_EXIT(env);                      \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                  \
                                                         \
      if (vl == 0) {                                     \
          return;                                        \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
      uint32_t vma = vext_vma(desc);                            \
      uint32_t i;                                               \
                                                                \
 -    VSTART_CHECK_EARLY_EXIT(env);                             \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                         \
                                                                \
      for (i = env->vstart; i < vl; i++) {                      \
          ETYPE s1 = *((ETYPE *)vs1 + H(i));                    \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2,       \
      uint32_t vma = vext_vma(desc);                                  \
      uint32_t i;                                                     \
                                                                      \
 -    VSTART_CHECK_EARLY_EXIT(env);                                   \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                               \
                                                                      \
      for (i = env->vstart; i < vl; i++) {                            \
          ETYPE s2 = *((ETYPE *)vs2 + H(i));                          \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2, \
      uint32_t vta = vext_vta(desc);                            \
      uint32_t i;                                               \
                                                                \
 -    VSTART_CHECK_EARLY_EXIT(env);                             \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                         \
                                                                \
      for (i = env->vstart; i < vl; i++) {                      \
          ETYPE s2 = *((ETYPE *)vs2 + H(i));                    \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
      uint32_t i;                                           \
      int a, b;                                             \
                                                            \
 -    VSTART_CHECK_EARLY_EXIT(env);                         \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                     \
                                                            \
      for (i = env->vstart; i < vl; i++) {                  \
          a = vext_elem_mask(vs1, i);                       \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, CPURISCVState *env, uint32_t desc)  \
      uint32_t vma = vext_vma(desc);                                        \
      int i;                                                                \
                                                                            \
 -    VSTART_CHECK_EARLY_EXIT(env);                                         \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                            \
      for (i = env->vstart; i < vl; i++) {                                  \
          if (!vm && !vext_elem_mask(v0, i)) {                              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,         \
      uint32_t vma = vext_vma(desc);                                        \
      target_ulong offset = s1, i_min, i;                                   \
                                                                            \
 -    VSTART_CHECK_EARLY_EXIT(env);                                         \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                            \
      i_min = MAX(env->vstart, offset);                                     \
      for (i = i_min; i < vl; i++) {                                        \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,         \
      uint32_t vma = vext_vma(desc);                                        \
      target_ulong i_max, i_min, i;                                         \
                                                                            \
 -    VSTART_CHECK_EARLY_EXIT(env);                                         \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                            \
      i_min = MIN(s1 < vlmax ? vlmax - s1 : 0, vl);                         \
      i_max = MAX(i_min, env->vstart);                                      \
@@ -XXX,XX +XXX,XX @@ static void vslide1up_##BITWIDTH(void *vd, void *v0, uint64_t s1,           \
      uint32_t vma = vext_vma(desc);                                          \
      uint32_t i;                                                             \
                                                                              \
 -    VSTART_CHECK_EARLY_EXIT(env);                                           \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                       \
                                                                              \
      for (i = env->vstart; i < vl; i++) {                                    \
          if (!vm && !vext_elem_mask(v0, i)) {                                \
@@ -XXX,XX +XXX,XX @@ static void vslide1down_##BITWIDTH(void *vd, void *v0, uint64_t s1,           \
      uint32_t vma = vext_vma(desc);                                            \
      uint32_t i;                                                               \
                                                                                \
 -    VSTART_CHECK_EARLY_EXIT(env);                                             \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                         \
                                                                                \
      for (i = env->vstart; i < vl; i++) {                                      \
          if (!vm && !vext_elem_mask(v0, i)) {                                  \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,               \
      uint64_t index;                                                       \
      uint32_t i;                                                           \
                                                                            \
 -    VSTART_CHECK_EARLY_EXIT(env);                                         \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                            \
      for (i = env->vstart; i < vl; i++) {                                  \
          if (!vm && !vext_elem_mask(v0, i)) {                              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,         \
      uint64_t index = s1;                                                  \
      uint32_t i;                                                           \
                                                                            \
 -    VSTART_CHECK_EARLY_EXIT(env);                                         \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                            \
      for (i = env->vstart; i < vl; i++) {                                  \
          if (!vm && !vext_elem_mask(v0, i)) {                              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,                 \
      uint32_t vma = vext_vma(desc);                               \
      uint32_t i;                                                  \
                                                                   \
 -    VSTART_CHECK_EARLY_EXIT(env);                                \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                            \
                                                                   \
      for (i = env->vstart; i < vl; i++) {                         \
          if (!vm && !vext_elem_mask(v0, i)) {                     \
 diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_internals.c
 +++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@ void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
      uint32_t vma = vext_vma(desc);
      uint32_t i;
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, vl);
      for (i = env->vstart; i < vl; i++) {
          if (!vm && !vext_elem_mask(v0, i)) {
@@ -XXX,XX +XXX,XX @@ void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
      uint32_t vma = vext_vma(desc);
      uint32_t i;
 -    VSTART_CHECK_EARLY_EXIT(env);
 +    VSTART_CHECK_EARLY_EXIT(env, vl);
      for (i = env->vstart; i < vl; i++) {
          if (!vm && !vext_elem_mask(v0, i)) {
 --
-.35.1
+.48.1

-[PULL 21/25] hw/core: Move the ARM sysbus-fdt to core
+[PULL 08/10] target/riscv: fix handling of nop for vstart >= vl in some vector instruction
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Chao Liu <lc00631@tecorigin.com>
-The ARM virt machine currently uses sysbus-fdt to create device tree
+Recently, when I was writing a RISCV test, I found that when VL is set to 0, the
-entries for dynamically created MMIO devices.
+instruction should be nop, but when I tested it, I found that QEMU will treat
 all elements as tail elements, and in the case of VTA=1, write all elements
 to 1.
-The RISC-V virt machine can also benefit from this, so move the code to
+After troubleshooting, it was found that the vext_vx_rm_1 function was called in
-the core directory.
+the vext_vx_rm_2, and then the vext_set_elems_1s function was called to process
 the tail element, but only VSTART >= vl was checked in the vext_vx_rm_1
 function, which caused the tail element to still be processed even if it was
 returned in advance.
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+So I've made the following change:
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Put VSTART_CHECK_EARLY_EXIT(env) at the beginning of the vext_vx_rm_2 function,
-Message-Id: <20220427234146.1130752-3-alistair.francis@opensource.wdc.com>
+so that the VSTART register is checked correctly.
 Fixes: df4252b2ec ("target/riscv/vector_helpers: do early exit when
 vstart >= vl")
 Signed-off-by: Chao Liu <lc00631@tecorigin.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-ID: <b2649f14915150be4c602d63cd3ea4adf47e9d75.1741573286.git.lc00631@tecorigin.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/{arm => core}/sysbus-fdt.h | 0
+ target/riscv/vector_helper.c | 18 ++++++++++++++----
- hw/arm/virt.c                         | 2 +-
+file changed, 14 insertions(+), 4 deletions(-)
  hw/arm/xlnx-versal-virt.c             | 1 -
  hw/{arm => core}/sysbus-fdt.c         | 2 +-
  hw/arm/meson.build                    | 1 -
  hw/core/meson.build                   | 1 +
 files changed, 3 insertions(+), 4 deletions(-)
  rename include/hw/{arm => core}/sysbus-fdt.h (100%)
  rename hw/{arm => core}/sysbus-fdt.c (99%)
-diff --git a/include/hw/arm/sysbus-fdt.h b/include/hw/core/sysbus-fdt.h
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 similarity index 100%
 rename from include/hw/arm/sysbus-fdt.h
 rename to include/hw/core/sysbus-fdt.h
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/target/riscv/vector_helper.c
-+++ b/hw/arm/virt.c
++++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ vext_vv_rm_1(void *vd, void *v0, void *vs1, void *vs2,
- #include "qemu/module.h"
+              uint32_t vl, uint32_t vm, int vxrm,
- #include "hw/pci-host/gpex.h"
+              opivv2_rm_fn *fn, uint32_t vma, uint32_t esz)
- #include "hw/virtio/virtio-pci.h"
+ {
--#include "hw/arm/sysbus-fdt.h"
+-    VSTART_CHECK_EARLY_EXIT(env, vl);
-+#include "hw/core/sysbus-fdt.h"
+-
- #include "hw/platform-bus.h"
+     for (uint32_t i = env->vstart; i < vl; i++) {
- #include "hw/qdev-properties.h"
+         if (!vm && !vext_elem_mask(v0, i)) {
- #include "hw/arm/fdt.h"
+             /* set masked-off elements to 1s */
-diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
+@@ -XXX,XX +XXX,XX @@ vext_vv_rm_2(void *vd, void *v0, void *vs1, void *vs2,
-index XXXXXXX..XXXXXXX 100644
+     uint32_t vta = vext_vta(desc);
---- a/hw/arm/xlnx-versal-virt.c
+     uint32_t vma = vext_vma(desc);
-+++ b/hw/arm/xlnx-versal-virt.c
-@@ -XXX,XX +XXX,XX @@
++    VSTART_CHECK_EARLY_EXIT(env, vl);
- #include "sysemu/device_tree.h"
++
- #include "hw/boards.h"
+     switch (env->vxrm) {
- #include "hw/sysbus.h"
+     case 0: /* rnu */
--#include "hw/arm/sysbus-fdt.h"
+         vext_vv_rm_1(vd, v0, vs1, vs2,
- #include "hw/arm/fdt.h"
+@@ -XXX,XX +XXX,XX @@ vext_vx_rm_1(void *vd, void *v0, target_long s1, void *vs2,
- #include "cpu.h"
+              uint32_t vl, uint32_t vm, int vxrm,
- #include "hw/qdev-properties.h"
+              opivx2_rm_fn *fn, uint32_t vma, uint32_t esz)
-diff --git a/hw/arm/sysbus-fdt.c b/hw/core/sysbus-fdt.c
+ {
-similarity index 99%
+-    VSTART_CHECK_EARLY_EXIT(env, vl);
-rename from hw/arm/sysbus-fdt.c
+-
-rename to hw/core/sysbus-fdt.c
+     for (uint32_t i = env->vstart; i < vl; i++) {
-index XXXXXXX..XXXXXXX 100644
+         if (!vm && !vext_elem_mask(v0, i)) {
---- a/hw/arm/sysbus-fdt.c
+             /* set masked-off elements to 1s */
-+++ b/hw/core/sysbus-fdt.c
+@@ -XXX,XX +XXX,XX @@ vext_vx_rm_2(void *vd, void *v0, target_long s1, void *vs2,
-@@ -XXX,XX +XXX,XX @@
+     uint32_t vta = vext_vta(desc);
- #ifdef CONFIG_LINUX
+     uint32_t vma = vext_vma(desc);
- #include <linux/vfio.h>
- #endif
++    VSTART_CHECK_EARLY_EXIT(env, vl);
--#include "hw/arm/sysbus-fdt.h"
++
-+#include "hw/core/sysbus-fdt.h"
+     switch (env->vxrm) {
- #include "qemu/error-report.h"
+     case 0: /* rnu */
- #include "sysemu/device_tree.h"
+         vext_vx_rm_1(vd, v0, s1, vs2,
- #include "sysemu/tpm.h"
+@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
-diff --git a/hw/arm/meson.build b/hw/arm/meson.build
+     uint32_t i;                                           \
-index XXXXXXX..XXXXXXX 100644
+     TD s1 =  *((TD *)vs1 + HD(0));                        \
---- a/hw/arm/meson.build
+                                                           \
-+++ b/hw/arm/meson.build
++    VSTART_CHECK_EARLY_EXIT(env, vl);                     \
-@@ -XXX,XX +XXX,XX @@
++                                                          \
- arm_ss = ss.source_set()
+     for (i = env->vstart; i < vl; i++) {                  \
- arm_ss.add(files('boot.c'), fdt)
+         TS2 s2 = *((TS2 *)vs2 + HS2(i));                  \
--arm_ss.add(when: 'CONFIG_PLATFORM_BUS', if_true: files('sysbus-fdt.c'))
+         if (!vm && !vext_elem_mask(v0, i)) {              \
- arm_ss.add(when: 'CONFIG_ARM_VIRT', if_true: files('virt.c'))
+@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,           \
- arm_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
+     uint32_t i;                                            \
- arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic_boards.c'))
+     TD s1 =  *((TD *)vs1 + HD(0));                         \
-diff --git a/hw/core/meson.build b/hw/core/meson.build
+                                                            \
-index XXXXXXX..XXXXXXX 100644
++    VSTART_CHECK_EARLY_EXIT(env, vl);                      \
---- a/hw/core/meson.build
++                                                           \
-+++ b/hw/core/meson.build
+     for (i = env->vstart; i < vl; i++) {                   \
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_PTIMER', if_true: files('ptimer.c'))
+         TS2 s2 = *((TS2 *)vs2 + HS2(i));                   \
- softmmu_ss.add(when: 'CONFIG_REGISTER', if_true: files('register.c'))
+         if (!vm && !vext_elem_mask(v0, i)) {               \
- softmmu_ss.add(when: 'CONFIG_SPLIT_IRQ', if_true: files('split-irq.c'))
+@@ -XXX,XX +XXX,XX @@ static void vmsetm(void *vd, void *v0, void *vs2, CPURISCVState *env,
- softmmu_ss.add(when: 'CONFIG_XILINX_AXI', if_true: files('stream.c'))
+     int i;
-+softmmu_ss.add(when: 'CONFIG_PLATFORM_BUS', if_true: files('sysbus-fdt.c'))
+     bool first_mask_bit = false;
- softmmu_ss.add(files(
++    VSTART_CHECK_EARLY_EXIT(env, vl);
-   'cpu-sysemu.c',
++
      for (i = env->vstart; i < vl; i++) {
          if (!vm && !vext_elem_mask(v0, i)) {
              /* set masked-off elements to 1s */
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2, CPURISCVState *env,      \
      uint32_t sum = 0;                                                     \
      int i;                                                                \
                                                                            \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
 +                                                                          \
      for (i = env->vstart; i < vl; i++) {                                  \
          if (!vm && !vext_elem_mask(v0, i)) {                              \
              /* set masked-off elements to 1s */                           \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,               \
      uint32_t vta = vext_vta(desc);                                        \
      uint32_t num = 0, i;                                                  \
                                                                            \
 +    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
 +                                                                          \
      for (i = env->vstart; i < vl; i++) {                                  \
          if (!vext_elem_mask(vs1, i)) {                                    \
              continue;                                                     \
 --
-.35.1
+.48.1

-[PULL 20/25] hw/riscv: virt: Add a machine done notifier
+[PULL 09/10] linux-user/riscv: Fix handling of cpu mask in riscv_hwprobe syscall
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Move the binary and device tree loading code to the machine done
+The third argument of the syscall contains the size of the
-notifier. This allows us to prepare for editing the device tree as part
+cpu mask in bytes, not bits.  Nor is the size rounded up to
-of the notifier.
+a multiple of sizeof(abi_ulong).
-This is based on similar code in the ARM virt machine.
+Cc: qemu-stable@nongnu.org
+Reported-by: Andreas Schwab <schwab@suse.de>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Fixes: 9e1c7d982d7 ("linux-user/riscv: Add syscall riscv_hwprobe")
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220427234146.1130752-2-alistair.francis@opensource.wdc.com>
+Message-ID: <20250308225902.1208237-3-richard.henderson@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h |   1 +
+ linux-user/syscall.c | 55 +++++++++++++++++++++++---------------------
- hw/riscv/virt.c         | 191 +++++++++++++++++++++-------------------
+file changed, 29 insertions(+), 26 deletions(-)
 files changed, 102 insertions(+), 90 deletions(-)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
+--- a/linux-user/syscall.c
-+++ b/include/hw/riscv/virt.h
++++ b/linux-user/syscall.c
-@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
+@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
-     MachineState parent;
+     }
      /*< public >*/
 +    Notifier machine_done;
      RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
      DeviceState *irqchip[VIRT_SOCKETS_MAX];
      PFlashCFI01 *flash[2];
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
      return aplic_m;
  }
-+static void virt_machine_done(Notifier *notifier, void *data)
+-static int cpu_set_valid(abi_long arg3, abi_long arg4)
-+{
++/*
-+    RISCVVirtState *s = container_of(notifier, RISCVVirtState,
++ * If the cpumask_t of (target_cpus, cpusetsize) cannot be read: -EFAULT.
-+                                     machine_done);
++ * If the cpumast_t has no bits set: -EINVAL.
-+    const MemMapEntry *memmap = virt_memmap;
++ * Otherwise the cpumask_t contains some bit set: 0.
-+    MachineState *machine = MACHINE(s);
++ * Unlike the kernel, we do not mask cpumask_t by the set of online cpus,
-+    target_ulong start_addr = memmap[VIRT_DRAM].base;
++ * nor bound the search by cpumask_size().
-+    target_ulong firmware_end_addr, kernel_start_addr;
++ */
-+    uint32_t fdt_load_addr;
++static int nonempty_cpu_set(abi_ulong cpusetsize, abi_ptr target_cpus)
 +    uint64_t kernel_entry;
 +
 +    /*
 +     * Only direct boot kernel is currently supported for KVM VM,
 +     * so the "-bios" parameter is not supported when KVM is enabled.
 +     */
 +    if (kvm_enabled()) {
 +        if (machine->firmware) {
 +            if (strcmp(machine->firmware, "none")) {
 +                error_report("Machine mode firmware is not supported in "
 +                             "combination with KVM.");
 +                exit(1);
 +            }
 +        } else {
 +            machine->firmware = g_strdup("none");
 +        }
 +    }
 +
 +    if (riscv_is_32bit(&s->soc[0])) {
 +        firmware_end_addr = riscv_find_and_load_firmware(machine,
 +                                    RISCV32_BIOS_BIN, start_addr, NULL);
 +    } else {
 +        firmware_end_addr = riscv_find_and_load_firmware(machine,
 +                                    RISCV64_BIOS_BIN, start_addr, NULL);
 +    }
 +
 +    if (machine->kernel_filename) {
 +        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc[0],
 +                                                         firmware_end_addr);
 +
 +        kernel_entry = riscv_load_kernel(machine->kernel_filename,
 +                                         kernel_start_addr, NULL);
 +
 +        if (machine->initrd_filename) {
 +            hwaddr start;
 +            hwaddr end = riscv_load_initrd(machine->initrd_filename,
 +                                           machine->ram_size, kernel_entry,
 +                                           &start);
 +            qemu_fdt_setprop_cell(machine->fdt, "/chosen",
 +                                  "linux,initrd-start", start);
 +            qemu_fdt_setprop_cell(machine->fdt, "/chosen", "linux,initrd-end",
 +                                  end);
 +        }
 +    } else {
 +       /*
 +        * If dynamic firmware is used, it doesn't know where is the next mode
 +        * if kernel argument is not set.
 +        */
 +        kernel_entry = 0;
 +    }
 +
 +    if (drive_get(IF_PFLASH, 0, 0)) {
 +        /*
 +         * Pflash was supplied, let's overwrite the address we jump to after
 +         * reset to the base of the flash.
 +         */
 +        start_addr = virt_memmap[VIRT_FLASH].base;
 +    }
 +
 +    /*
 +     * Init fw_cfg.  Must be done before riscv_load_fdt, otherwise the device
 +     * tree cannot be altered and we get FDT_ERR_NOSPACE.
 +     */
 +    s->fw_cfg = create_fw_cfg(machine);
 +    rom_set_fw(s->fw_cfg);
 +
 +    /* Compute the fdt load address in dram */
 +    fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
 +                                   machine->ram_size, machine->fdt);
 +    /* load the reset vector */
 +    riscv_setup_rom_reset_vec(machine, &s->soc[0], start_addr,
 +                              virt_memmap[VIRT_MROM].base,
 +                              virt_memmap[VIRT_MROM].size, kernel_entry,
 +                              fdt_load_addr, machine->fdt);
 +
 +    /*
 +     * Only direct boot kernel is currently supported for KVM VM,
 +     * So here setup kernel start address and fdt address.
 +     * TODO:Support firmware loading and integrate to TCG start
 +     */
 +    if (kvm_enabled()) {
 +        riscv_setup_direct_kernel(kernel_entry, fdt_load_addr);
 +    }
 +}
 +
  static void virt_machine_init(MachineState *machine)
  {
-     const MemMapEntry *memmap = virt_memmap;
+-    int ret, i, tmp;
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
+-    size_t host_mask_size, target_mask_size;
-     MemoryRegion *system_memory = get_system_memory();
+-    unsigned long *host_mask;
      MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
      char *soc_name;
 -    target_ulong start_addr = memmap[VIRT_DRAM].base;
 -    target_ulong firmware_end_addr, kernel_start_addr;
 -    uint32_t fdt_load_addr;
 -    uint64_t kernel_entry;
      DeviceState *mmio_irqchip, *virtio_irqchip, *pcie_irqchip;
      int i, base_hartid, hart_count;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
      memory_region_add_subregion(system_memory, memmap[VIRT_DRAM].base,
          machine->ram);
 -    /* create device tree */
 -    create_fdt(s, memmap, machine->ram_size, machine->kernel_cmdline,
 -               riscv_is_32bit(&s->soc[0]));
 -
      /* boot rom */
      memory_region_init_rom(mask_rom, NULL, "riscv_virt_board.mrom",
                             memmap[VIRT_MROM].size, &error_fatal);
      memory_region_add_subregion(system_memory, memmap[VIRT_MROM].base,
                                  mask_rom);
 -    /*
 -     * Only direct boot kernel is currently supported for KVM VM,
 -     * so the "-bios" parameter is not supported when KVM is enabled.
 -     */
 -    if (kvm_enabled()) {
 -        if (machine->firmware) {
 -            if (strcmp(machine->firmware, "none")) {
 -                error_report("Machine mode firmware is not supported in "
 -                             "combination with KVM.");
 -                exit(1);
 -            }
 -        } else {
 -            machine->firmware = g_strdup("none");
 -        }
 -    }
 -
 -    if (riscv_is_32bit(&s->soc[0])) {
 -        firmware_end_addr = riscv_find_and_load_firmware(machine,
 -                                    RISCV32_BIOS_BIN, start_addr, NULL);
 -    } else {
 -        firmware_end_addr = riscv_find_and_load_firmware(machine,
 -                                    RISCV64_BIOS_BIN, start_addr, NULL);
 -    }
 -
 -    if (machine->kernel_filename) {
 -        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc[0],
 -                                                         firmware_end_addr);
 -
 -        kernel_entry = riscv_load_kernel(machine->kernel_filename,
 -                                         kernel_start_addr, NULL);
 -
 -        if (machine->initrd_filename) {
 -            hwaddr start;
 -            hwaddr end = riscv_load_initrd(machine->initrd_filename,
 -                                           machine->ram_size, kernel_entry,
 -                                           &start);
 -            qemu_fdt_setprop_cell(machine->fdt, "/chosen",
 -                                  "linux,initrd-start", start);
 -            qemu_fdt_setprop_cell(machine->fdt, "/chosen", "linux,initrd-end",
 -                                  end);
 -        }
 -    } else {
 -       /*
 -        * If dynamic firmware is used, it doesn't know where is the next mode
 -        * if kernel argument is not set.
 -        */
 -        kernel_entry = 0;
 -    }
 -
 -    if (drive_get(IF_PFLASH, 0, 0)) {
 -        /*
 -         * Pflash was supplied, let's overwrite the address we jump to after
 -         * reset to the base of the flash.
 -         */
 -        start_addr = virt_memmap[VIRT_FLASH].base;
 -    }
 -
 -    /*
--     * Init fw_cfg.  Must be done before riscv_load_fdt, otherwise the device
+-     * cpu_set_t represent CPU masks as bit masks of type unsigned long *.
--     * tree cannot be altered and we get FDT_ERR_NOSPACE.
+-     * arg3 contains the cpu count.
 -     */
--    s->fw_cfg = create_fw_cfg(machine);
+-    tmp = (8 * sizeof(abi_ulong));
--    rom_set_fw(s->fw_cfg);
+-    target_mask_size = ((arg3 + tmp - 1) / tmp) * sizeof(abi_ulong);
 -    host_mask_size = (target_mask_size + (sizeof(*host_mask) - 1)) &
 -                     ~(sizeof(*host_mask) - 1);
 -
--    /* Compute the fdt load address in dram */
+-    host_mask = alloca(host_mask_size);
 -    fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
 -                                   machine->ram_size, machine->fdt);
 -    /* load the reset vector */
 -    riscv_setup_rom_reset_vec(machine, &s->soc[0], start_addr,
 -                              virt_memmap[VIRT_MROM].base,
 -                              virt_memmap[VIRT_MROM].size, kernel_entry,
 -                              fdt_load_addr, machine->fdt);
 -
--    /*
+-    ret = target_to_host_cpu_mask(host_mask, host_mask_size,
--     * Only direct boot kernel is currently supported for KVM VM,
+-                                  arg4, target_mask_size);
--     * So here setup kernel start address and fdt address.
+-    if (ret != 0) {
--     * TODO:Support firmware loading and integrate to TCG start
+-        return ret;
 -     */
 -    if (kvm_enabled()) {
 -        riscv_setup_direct_kernel(kernel_entry, fdt_load_addr);
 -    }
--
++    unsigned char *p = lock_user(VERIFY_READ, target_cpus, cpusetsize, 1);
-     /* SiFive Test MMIO device */
++    int ret = -TARGET_EFAULT;
-     sifive_test_create(memmap[VIRT_TEST].base);
+-    for (i = 0 ; i < host_mask_size / sizeof(*host_mask); i++) {
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
+-        if (host_mask[i] != 0) {
-                                   drive_get(IF_PFLASH, 0, i));
+-            return 0;
 +    if (p) {
 +        ret = -TARGET_EINVAL;
 +        /*
 +         * Since we only care about the empty/non-empty state of the cpumask_t
 +         * not the individual bits, we do not need to repartition the bits
 +         * from target abi_ulong to host unsigned long.
 +         *
 +         * Note that the kernel does not round up cpusetsize to a multiple of
 +         * sizeof(abi_ulong).  After bounding cpusetsize by cpumask_size(),
 +         * it copies exactly cpusetsize bytes into a zeroed buffer.
 +         */
 +        for (abi_ulong i = 0; i < cpusetsize; ++i) {
 +            if (p[i]) {
 +                ret = 0;
 +                break;
 +            }
          }
 +        unlock_user(p, target_cpus, 0);
      }
-     virt_flash_map(s, system_memory);
+-    return -TARGET_EINVAL;
-+
++    return ret;
 +    /* create device tree */
 +    create_fdt(s, memmap, machine->ram_size, machine->kernel_cmdline,
 +               riscv_is_32bit(&s->soc[0]));
 +
 +    s->machine_done.notify = virt_machine_done;
 +    qemu_add_machine_init_done_notifier(&s->machine_done);
  }
- static void virt_machine_instance_init(Object *obj)
+ static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
@@ -XXX,XX +XXX,XX @@ static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
      /* check cpu_set */
      if (arg3 != 0) {
 -        ret = cpu_set_valid(arg3, arg4);
 +        ret = nonempty_cpu_set(arg3, arg4);
          if (ret != 0) {
              return ret;
          }
 --
-.35.1
+.48.1

-[PULL 15/25] target/riscv: rvk: add CSR support for Zkr
+[PULL 10/10] target/riscv: Add check for 16-bit aligned PC for different priv versions.
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Yu-Ming Chang <yumin686@andestech.com>
- - add SEED CSR which must be accessed with a read-write instruction:
+For privilege version 1.12 or newer, C always implies Zca. We can only
-   A read-only instruction such as CSRRS/CSRRC with rs1=x0 or CSRRSI/CSRRCI
+check ext_zca to allow 16-bit aligned PC addresses. For older privilege
-with uimm=0 will raise an illegal instruction exception.
+versions, we only check C.
  - add USEED, SSEED fields for MSECCFG CSR
-Co-authored-by: Ruibo Lu <luruibo2000@163.com>
+Signed-off-by: Yu-Ming Chang <yumin686@andestech.com>
 Co-authored-by: Zewen Ye <lustrew@foxmail.com>
 Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423023510.30794-13-liweiwei@iscas.ac.cn>
+Message-ID: <174184718265.10540.10120024221661781046-0@git.sr.ht>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_bits.h  |  9 +++++
+ target/riscv/cpu.h                      | 12 ++++++++++++
- target/riscv/pmp.h       |  8 ++--
+ target/riscv/op_helper.c                |  8 ++++++--
- target/riscv/csr.c       | 80 ++++++++++++++++++++++++++++++++++++++++
+ target/riscv/translate.c                |  4 +++-
- target/riscv/op_helper.c |  9 +++++
+ target/riscv/insn_trans/trans_rvi.c.inc |  8 ++++++--
-files changed, 103 insertions(+), 3 deletions(-)
+files changed, 27 insertions(+), 5 deletions(-)
-diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_bits.h
+--- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL riscv_cpu_sxl(CPURISCVState *env)
  #define CSR_VSPMMASK        0x2c1
  #define CSR_VSPMBASE        0x2c2
 +/* Crypto Extension */
 +#define CSR_SEED            0x015
 +
  /* mstatus CSR bits */
  #define MSTATUS_UIE         0x00000001
  #define MSTATUS_SIE         0x00000002
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define HVICTL_VALID_MASK                  \
      (HVICTL_VTI | HVICTL_IID | HVICTL_IPRIOM | HVICTL_IPRIO)
 +/* seed CSR bits */
 +#define SEED_OPST                        (0b11 << 30)
 +#define SEED_OPST_BIST                   (0b00 << 30)
 +#define SEED_OPST_WAIT                   (0b01 << 30)
 +#define SEED_OPST_ES16                   (0b10 << 30)
 +#define SEED_OPST_DEAD                   (0b11 << 30)
  #endif
 diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.h
 +++ b/target/riscv/pmp.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
  } pmp_am_t;
  typedef enum {
 -    MSECCFG_MML  = 1 << 0,
 -    MSECCFG_MMWP = 1 << 1,
 -    MSECCFG_RLB  = 1 << 2
 +    MSECCFG_MML   = 1 << 0,
 +    MSECCFG_MMWP  = 1 << 1,
 +    MSECCFG_RLB   = 1 << 2,
 +    MSECCFG_USEED = 1 << 8,
 +    MSECCFG_SSEED = 1 << 9
  } mseccfg_field_t;
  typedef struct {
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/main-loop.h"
  #include "exec/exec-all.h"
  #include "sysemu/cpu-timers.h"
 +#include "qemu/guest-random.h"
 +#include "qapi/error.h"
  /* CSR function table public API */
  void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
@@ -XXX,XX +XXX,XX @@ static RISCVException debug(CPURISCVState *env, int csrno)
  }
  #endif
-+static RISCVException seed(CPURISCVState *env, int csrno)
++static inline bool riscv_cpu_allow_16bit_insn(const RISCVCPUConfig *cfg,
 +                                              target_long priv_ver,
 +                                              uint32_t misa_ext)
 +{
-+    RISCVCPU *cpu = env_archcpu(env);
++    /* In priv spec version 1.12 or newer, C always implies Zca */
-+
++    if (priv_ver >= PRIV_VERSION_1_12_0) {
-+    if (!cpu->cfg.ext_zkr) {
++        return cfg->ext_zca;
-+        return RISCV_EXCP_ILLEGAL_INST;
++    } else {
 +        return misa_ext & RVC;
 +    }
-+
-+#if !defined(CONFIG_USER_ONLY)
-+    /*
-+     * With a CSR read-write instruction:
-+     * 1) The seed CSR is always available in machine mode as normal.
-+     * 2) Attempted access to seed from virtual modes VS and VU always raises
-+     * an exception(virtual instruction exception only if mseccfg.sseed=1).
-+     * 3) Without the corresponding access control bit set to 1, any attempted
-+     * access to seed from U, S or HS modes will raise an illegal instruction
-+     * exception.
-+     */
-+    if (env->priv == PRV_M) {
-+        return RISCV_EXCP_NONE;
-+    } else if (riscv_cpu_virt_enabled(env)) {
-+        if (env->mseccfg & MSECCFG_SSEED) {
-+            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-+        } else {
-+            return RISCV_EXCP_ILLEGAL_INST;
-+        }
-+    } else {
-+        if (env->priv == PRV_S && (env->mseccfg & MSECCFG_SSEED)) {
-+            return RISCV_EXCP_NONE;
-+        } else if (env->priv == PRV_U && (env->mseccfg & MSECCFG_USEED)) {
-+            return RISCV_EXCP_NONE;
-+        } else {
-+            return RISCV_EXCP_ILLEGAL_INST;
-+        }
-+    }
-+#else
-+    return RISCV_EXCP_NONE;
-+#endif
-+}
-+
- /* User Floating-Point CSRs */
- static RISCVException read_fflags(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
- #endif
-+/* Crypto Extension */
-+static RISCVException rmw_seed(CPURISCVState *env, int csrno,
-+                               target_ulong *ret_value,
-+                               target_ulong new_value,
-+                               target_ulong write_mask)
-+{
-+    uint16_t random_v;
-+    Error *random_e = NULL;
-+    int random_r;
-+    target_ulong rval;
-+
-+    random_r = qemu_guest_getrandom(&random_v, 2, &random_e);
-+    if (unlikely(random_r < 0)) {
-+        /*
-+         * Failed, for unknown reasons in the crypto subsystem.
-+         * The best we can do is log the reason and return a
-+         * failure indication to the guest.  There is no reason
-+         * we know to expect the failure to be transitory, so
-+         * indicate DEAD to avoid having the guest spin on WAIT.
-+         */
-+        qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
-+                      __func__, error_get_pretty(random_e));
-+        error_free(random_e);
-+        rval = SEED_OPST_DEAD;
-+    } else {
-+        rval = random_v | SEED_OPST_ES16;
-+    }
-+
-+    if (ret_value) {
-+        *ret_value = rval;
-+    }
-+
-+    return RISCV_EXCP_NONE;
 +}
 +
  /*
-  * riscv_csrrw - read and/or update control and status register
+  * Encode LMUL to lmul as follows:
-  *
+  *     LMUL    vlmul    lmul
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_TIME]  = { "time",  ctr,   read_time  },
      [CSR_TIMEH] = { "timeh", ctr32, read_timeh },
 +    /* Crypto Extension */
 +    [CSR_SEED] = { "seed", seed, NULL, NULL, rmw_seed },
 +
  #if !defined(CONFIG_USER_ONLY)
      /* Machine Timers and Counters */
      [CSR_MCYCLE]    = { "mcycle",    any,   read_instret  },
 diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/op_helper.c
 +++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void helper_raise_exception(CPURISCVState *env, uint32_t exception)
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
+     }
- target_ulong helper_csrr(CPURISCVState *env, int csr)
- {
+     target_ulong retpc = env->sepc;
-+    /*
+-    if (!riscv_has_ext(env, RVC) && (retpc & 0x3)) {
-+     * The seed CSR must be accessed with a read-write instruction. A
++    if (!riscv_cpu_allow_16bit_insn(&env_archcpu(env)->cfg,
-+     * read-only instruction such as CSRRS/CSRRC with rs1=x0 or CSRRSI/
++                                    env->priv_ver,
-+     * CSRRCI with uimm=0 will raise an illegal instruction exception.
++                                    env->misa_ext) && (retpc & 0x3)) {
-+     */
+         riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, GETPC());
-+    if (csr == CSR_SEED) {
+     }
-+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
-+    }
+@@ -XXX,XX +XXX,XX @@ static void check_ret_from_m_mode(CPURISCVState *env, target_ulong retpc,
-+
+         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
-     target_ulong val = 0;
+     }
-     RISCVException ret = riscv_csrrw(env, csr, &val, 0, 0);
+-    if (!riscv_has_ext(env, RVC) && (retpc & 0x3)) {
 +    if (!riscv_cpu_allow_16bit_insn(&env_archcpu(env)->cfg,
 +                                    env->priv_ver,
 +                                    env->misa_ext) && (retpc & 0x3)) {
          riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, GETPC());
      }
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
      TCGv succ_pc = dest_gpr(ctx, rd);
      /* check misaligned: */
 -    if (!has_ext(ctx, RVC) && !ctx->cfg_ptr->ext_zca) {
 +    if (!riscv_cpu_allow_16bit_insn(ctx->cfg_ptr,
 +                                    ctx->priv_ver,
 +                                    ctx->misa_ext)) {
          if ((imm & 0x3) != 0) {
              TCGv target_pc = tcg_temp_new();
              gen_pc_plus_diff(target_pc, ctx, imm);
 diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvi.c.inc
 +++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
          tcg_gen_ext32s_tl(target_pc, target_pc);
      }
 -    if (!has_ext(ctx, RVC) && !ctx->cfg_ptr->ext_zca) {
 +    if (!riscv_cpu_allow_16bit_insn(ctx->cfg_ptr,
 +                                    ctx->priv_ver,
 +                                    ctx->misa_ext)) {
          TCGv t0 = tcg_temp_new();
          misaligned = gen_new_label();
@@ -XXX,XX +XXX,XX @@ static bool gen_branch(DisasContext *ctx, arg_b *a, TCGCond cond)
      gen_set_label(l); /* branch taken */
 -    if (!has_ext(ctx, RVC) && !ctx->cfg_ptr->ext_zca &&
 +    if (!riscv_cpu_allow_16bit_insn(ctx->cfg_ptr,
 +                                    ctx->priv_ver,
 +                                    ctx->misa_ext) &&
          (a->imm & 0x3)) {
          /* misaligned */
          TCGv target_pc = tcg_temp_new();
 --
-.35.1
+.48.1

-[PULL 16/25] disas/riscv.c: rvk: add disas support for Zbk* and Zk* instructions
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Co-authored-by: Ruibo Lu <luruibo2000@163.com>
-Co-authored-by: Zewen Ye <lustrew@foxmail.com>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423023510.30794-14-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- disas/riscv.c | 173 +++++++++++++++++++++++++++++++++++++++++++++++++-
-file changed, 172 insertions(+), 1 deletion(-)
-diff --git a/disas/riscv.c b/disas/riscv.c
-index XXXXXXX..XXXXXXX 100644
---- a/disas/riscv.c
-+++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     rv_codec_css_swsp,
-     rv_codec_css_sdsp,
-     rv_codec_css_sqsp,
-+    rv_codec_k_bs,
-+    rv_codec_k_rnum,
- } rv_codec;
- typedef enum {
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-     rv_op_bclr = 359,
-     rv_op_binv = 360,
-     rv_op_bext = 361,
-+    rv_op_aes32esmi = 362,
-+    rv_op_aes32esi = 363,
-+    rv_op_aes32dsmi = 364,
-+    rv_op_aes32dsi = 365,
-+    rv_op_aes64ks1i = 366,
-+    rv_op_aes64ks2 = 367,
-+    rv_op_aes64im = 368,
-+    rv_op_aes64esm = 369,
-+    rv_op_aes64es = 370,
-+    rv_op_aes64dsm = 371,
-+    rv_op_aes64ds = 372,
-+    rv_op_sha256sig0 = 373,
-+    rv_op_sha256sig1 = 374,
-+    rv_op_sha256sum0 = 375,
-+    rv_op_sha256sum1 = 376,
-+    rv_op_sha512sig0 = 377,
-+    rv_op_sha512sig1 = 378,
-+    rv_op_sha512sum0 = 379,
-+    rv_op_sha512sum1 = 380,
-+    rv_op_sha512sum0r = 381,
-+    rv_op_sha512sum1r = 382,
-+    rv_op_sha512sig0l = 383,
-+    rv_op_sha512sig0h = 384,
-+    rv_op_sha512sig1l = 385,
-+    rv_op_sha512sig1h = 386,
-+    rv_op_sm3p0 = 387,
-+    rv_op_sm3p1 = 388,
-+    rv_op_sm4ed = 389,
-+    rv_op_sm4ks = 390,
-+    rv_op_brev8 = 391,
-+    rv_op_pack = 392,
-+    rv_op_packh = 393,
-+    rv_op_packw = 394,
-+    rv_op_unzip = 395,
-+    rv_op_zip = 396,
-+    rv_op_xperm4 = 397,
-+    rv_op_xperm8 = 398,
- } rv_op;
- /* structures */
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     uint8_t   succ;
-     uint8_t   aq;
-     uint8_t   rl;
-+    uint8_t   bs;
-+    uint8_t   rnum;
- } rv_decode;
- typedef struct {
-@@ -XXX,XX +XXX,XX @@ static const char rv_freg_name_sym[32][5] = {
- #define rv_fmt_rd_rs2                 "O\t0,2"
- #define rv_fmt_rs1_offset             "O\t1,o"
- #define rv_fmt_rs2_offset             "O\t2,o"
-+#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
-+#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
- /* pseudo-instruction constraints */
-@@ -XXX,XX +XXX,XX @@ static const rv_comp_data rvcp_csrrw[] = {
-     { rv_op_illegal, NULL }
- };
-+
- static const rv_comp_data rvcp_csrrs[] = {
-     { rv_op_rdcycle, rvcc_rdcycle },
-     { rv_op_rdtime, rvcc_rdtime },
-@@ -XXX,XX +XXX,XX @@ const rv_opcode_data opcode_data[] = {
-     { "bclr", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-     { "binv", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-     { "bext", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "aes32esmi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
-+    { "aes32esi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
-+    { "aes32dsmi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
-+    { "aes32dsi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
-+    { "aes64ks1i", rv_codec_k_rnum,  rv_fmt_rd_rs1_rnum, NULL, 0, 0, 0 },
-+    { "aes64ks2", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "aes64im", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
-+    { "aes64esm", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "aes64es", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "aes64dsm", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "aes64ds", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "sha256sig0", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
-+    { "sha256sig1", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
-+    { "sha256sum0", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
-+    { "sha256sum1", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
-+    { "sha512sig0", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "sha512sig1", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "sha512sum0", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "sha512sum1", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "sha512sum0r", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "sha512sum1r", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "sha512sig0l", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "sha512sig0h", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "sha512sig1l", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "sha512sig1h", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "sm3p0", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
-+    { "sm3p1", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
-+    { "sm4ed", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
-+    { "sm4ks", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
-+    { "brev8", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
-+    { "pack", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "packh", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "packw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "unzip", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
-+    { "zip", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
-+    { "xperm4", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
-+    { "xperm8", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0, 0 }
- };
- /* CSR names */
-@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
-     case 0x0003: return "fcsr";
-     case 0x0004: return "uie";
-     case 0x0005: return "utvec";
-+    case 0x0015: return "seed";
-     case 0x0040: return "uscratch";
-     case 0x0041: return "uepc";
-     case 0x0042: return "ucause";
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
-             case 1:
-                 switch (((inst >> 27) & 0b11111)) {
-                 case 0b00000: op = rv_op_slli; break;
-+                case 0b00001:
-+                    switch (((inst >> 20) & 0b1111111)) {
-+                    case 0b0001111: op = rv_op_zip; break;
-+                    }
-+                    break;
-+                case 0b00010:
-+                    switch (((inst >> 20) & 0b1111111)) {
-+                    case 0b0000000: op = rv_op_sha256sum0; break;
-+                    case 0b0000001: op = rv_op_sha256sum1; break;
-+                    case 0b0000010: op = rv_op_sha256sig0; break;
-+                    case 0b0000011: op = rv_op_sha256sig1; break;
-+                    case 0b0000100: op = rv_op_sha512sum0; break;
-+                    case 0b0000101: op = rv_op_sha512sum1; break;
-+                    case 0b0000110: op = rv_op_sha512sig0; break;
-+                    case 0b0000111: op = rv_op_sha512sig1; break;
-+                    case 0b0001000: op = rv_op_sm3p0; break;
-+                    case 0b0001001: op = rv_op_sm3p1; break;
-+                    }
-+                    break;
-                 case 0b00101: op = rv_op_bseti; break;
-+                case 0b00110:
-+                    switch (((inst >> 20) & 0b1111111)) {
-+                    case 0b0000000: op = rv_op_aes64im; break;
-+                    default:
-+                        if (((inst >> 24) & 0b0111) == 0b001) {
-+                            op = rv_op_aes64ks1i;
-+                        }
-+                        break;
-+                     }
-+                     break;
-                 case 0b01001: op = rv_op_bclri; break;
-                 case 0b01101: op = rv_op_binvi; break;
-                 case 0b01100:
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
-             case 5:
-                 switch (((inst >> 27) & 0b11111)) {
-                 case 0b00000: op = rv_op_srli; break;
-+                case 0b00001:
-+                    switch (((inst >> 20) & 0b1111111)) {
-+                    case 0b0001111: op = rv_op_unzip; break;
-+                    }
-+                    break;
-                 case 0b00101: op = rv_op_orc_b; break;
-                 case 0b01000: op = rv_op_srai; break;
-                 case 0b01001: op = rv_op_bexti; break;
-                 case 0b01100: op = rv_op_rori; break;
-                 case 0b01101:
-                     switch ((inst >> 20) & 0b1111111) {
-+                    case 0b0011000: op = rv_op_rev8; break;
-                     case 0b0111000: op = rv_op_rev8; break;
-+                    case 0b0000111: op = rv_op_brev8; break;
-                     }
-                     break;
-                 }
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
-             case 36:
-                 switch ((inst >> 20) & 0b11111) {
-                 case 0: op = rv_op_zext_h; break;
-+                default: op = rv_op_pack; break;
-                 }
-                 break;
-+            case 39: op = rv_op_packh; break;
-+
-             case 41: op = rv_op_clmul; break;
-             case 42: op = rv_op_clmulr; break;
-             case 43: op = rv_op_clmulh; break;
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
-             case 132: op = rv_op_sh2add; break;
-             case 134: op = rv_op_sh3add; break;
-             case 161: op = rv_op_bset; break;
-+            case 162: op = rv_op_xperm4; break;
-+            case 164: op = rv_op_xperm8; break;
-+            case 200: op = rv_op_aes64es; break;
-+            case 216: op = rv_op_aes64esm; break;
-+            case 232: op = rv_op_aes64ds; break;
-+            case 248: op = rv_op_aes64dsm; break;
-             case 256: op = rv_op_sub; break;
-             case 260: op = rv_op_xnor; break;
-             case 261: op = rv_op_sra; break;
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
-             case 263: op = rv_op_andn; break;
-             case 289: op = rv_op_bclr; break;
-             case 293: op = rv_op_bext; break;
-+            case 320: op = rv_op_sha512sum0r; break;
-+            case 328: op = rv_op_sha512sum1r; break;
-+            case 336: op = rv_op_sha512sig0l; break;
-+            case 344: op = rv_op_sha512sig1l; break;
-+            case 368: op = rv_op_sha512sig0h; break;
-+            case 376: op = rv_op_sha512sig1h; break;
-             case 385: op = rv_op_rol; break;
--            case 386: op = rv_op_ror; break;
-+            case 389: op = rv_op_ror; break;
-             case 417: op = rv_op_binv; break;
-+            case 504: op = rv_op_aes64ks2; break;
-+            }
-+            switch ((inst >> 25) & 0b0011111) {
-+            case 17: op = rv_op_aes32esi; break;
-+            case 19: op = rv_op_aes32esmi; break;
-+            case 21: op = rv_op_aes32dsi; break;
-+            case 23: op = rv_op_aes32dsmi; break;
-+            case 24: op = rv_op_sm4ed; break;
-+            case 26: op = rv_op_sm4ks; break;
-             }
-             break;
-         case 13: op = rv_op_lui; break;
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
-             case 36:
-                 switch ((inst >> 20) & 0b11111) {
-                 case 0: op = rv_op_zext_h; break;
-+                default: op = rv_op_packw; break;
-                 }
-                 break;
-             case 130: op = rv_op_sh1add_uw; break;
-@@ -XXX,XX +XXX,XX @@ static uint32_t operand_cimmq(rv_inst inst)
-         ((inst << 57) >> 62) << 6;
- }
-+static uint32_t operand_bs(rv_inst inst)
-+{
-+    return (inst << 32) >> 62;
-+}
-+
-+static uint32_t operand_rnum(rv_inst inst)
-+{
-+    return (inst << 40) >> 60;
-+}
-+
- /* decode operands */
- static void decode_inst_operands(rv_decode *dec)
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec)
-         dec->rs2 = operand_crs2(inst);
-         dec->imm = operand_cimmsqsp(inst);
-         break;
-+    case rv_codec_k_bs:
-+        dec->rs1 = operand_rs1(inst);
-+        dec->rs2 = operand_rs2(inst);
-+        dec->bs = operand_bs(inst);
-+        break;
-+    case rv_codec_k_rnum:
-+        dec->rd = operand_rd(inst);
-+        dec->rs1 = operand_rs1(inst);
-+        dec->rnum = operand_rnum(inst);
-+        break;
-     };
- }
-@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
-         case ')':
-             append(buf, ")", buflen);
-             break;
-+        case 'b':
-+            snprintf(tmp, sizeof(tmp), "%d", dec->bs);
-+            append(buf, tmp, buflen);
-+            break;
-+        case 'n':
-+            snprintf(tmp, sizeof(tmp), "%d", dec->rnum);
-+            append(buf, tmp, buflen);
-+            break;
-         case '0':
-             append(buf, rv_ireg_name_sym[dec->rd], buflen);
-             break;
---
-.35.1

-[PULL 17/25] target/riscv: rvk: expose zbk* and zk* properties
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423023510.30794-15-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 13 +++++++++++++
-file changed, 13 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
-     DEFINE_PROP_BOOL("zba", RISCVCPU, cfg.ext_zba, true),
-     DEFINE_PROP_BOOL("zbb", RISCVCPU, cfg.ext_zbb, true),
-     DEFINE_PROP_BOOL("zbc", RISCVCPU, cfg.ext_zbc, true),
-+    DEFINE_PROP_BOOL("zbkb", RISCVCPU, cfg.ext_zbkb, false),
-+    DEFINE_PROP_BOOL("zbkc", RISCVCPU, cfg.ext_zbkc, false),
-+    DEFINE_PROP_BOOL("zbkx", RISCVCPU, cfg.ext_zbkx, false),
-     DEFINE_PROP_BOOL("zbs", RISCVCPU, cfg.ext_zbs, true),
-+    DEFINE_PROP_BOOL("zk", RISCVCPU, cfg.ext_zk, false),
-+    DEFINE_PROP_BOOL("zkn", RISCVCPU, cfg.ext_zkn, false),
-+    DEFINE_PROP_BOOL("zknd", RISCVCPU, cfg.ext_zknd, false),
-+    DEFINE_PROP_BOOL("zkne", RISCVCPU, cfg.ext_zkne, false),
-+    DEFINE_PROP_BOOL("zknh", RISCVCPU, cfg.ext_zknh, false),
-+    DEFINE_PROP_BOOL("zkr", RISCVCPU, cfg.ext_zkr, false),
-+    DEFINE_PROP_BOOL("zks", RISCVCPU, cfg.ext_zks, false),
-+    DEFINE_PROP_BOOL("zksed", RISCVCPU, cfg.ext_zksed, false),
-+    DEFINE_PROP_BOOL("zksh", RISCVCPU, cfg.ext_zksh, false),
-+    DEFINE_PROP_BOOL("zkt", RISCVCPU, cfg.ext_zkt, false),
-     DEFINE_PROP_BOOL("zdinx", RISCVCPU, cfg.ext_zdinx, false),
-     DEFINE_PROP_BOOL("zfinx", RISCVCPU, cfg.ext_zfinx, false),
---
-.35.1

-[PULL 18/25] target/riscv: Fix incorrect PTE merge in walk_pte
+Deleted patch
-From: Ralf Ramsauer <ralf.ramsauer@oth-regensburg.de>
-Two non-subsequent PTEs can be mapped to subsequent paddrs. In this
-case, walk_pte will erroneously merge them.
-Enforce the split up, by tracking the virtual base address.
-Let's say we have the mapping:
-x81200000 -> 0x89623000 (4K)
-x8120f000 -> 0x89624000 (4K)
-Before, walk_pte would have shown:
-vaddr            paddr            size             attr
----------------- ---------------- ---------------- -------
-0000000081200000 0000000089623000 0000000000002000 rwxu-ad
-as it only checks for subsequent paddrs. With this patch, it becomes:
-vaddr            paddr            size             attr
----------------- ---------------- ---------------- -------
-0000000081200000 0000000089623000 0000000000001000 rwxu-ad
-000000008120f000 0000000089624000 0000000000001000 rwxu-ad
-Signed-off-by: Ralf Ramsauer <ralf.ramsauer@oth-regensburg.de>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220423215907.673663-1-ralf.ramsauer@oth-regensburg.de>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/monitor.c | 11 +++++++----
-file changed, 7 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/monitor.c
-+++ b/target/riscv/monitor.c
-@@ -XXX,XX +XXX,XX @@ static void walk_pte(Monitor *mon, hwaddr base, target_ulong start,
- {
-     hwaddr pte_addr;
-     hwaddr paddr;
-+    target_ulong last_start = -1;
-     target_ulong pgsize;
-     target_ulong pte;
-     int ptshift;
-@@ -XXX,XX +XXX,XX @@ static void walk_pte(Monitor *mon, hwaddr base, target_ulong start,
-                  * A leaf PTE has been found
-                  *
-                  * If current PTE's permission bits differ from the last one,
--                 * or current PTE's ppn does not make a contiguous physical
--                 * address block together with the last one, print out the last
--                 * contiguous mapped block details.
-+                 * or the current PTE breaks up a contiguous virtual or
-+                 * physical mapping, address block together with the last one,
-+                 * print out the last contiguous mapped block details.
-                  */
-                 if ((*last_attr != attr) ||
--                    (*last_paddr + *last_size != paddr)) {
-+                    (*last_paddr + *last_size != paddr) ||
-+                    (last_start + *last_size != start)) {
-                     print_pte(mon, va_bits, *vbase, *pbase,
-                               *last_paddr + *last_size - *pbase, *last_attr);
-@@ -XXX,XX +XXX,XX @@ static void walk_pte(Monitor *mon, hwaddr base, target_ulong start,
-                     *last_attr = attr;
-                 }
-+                last_start = start;
-                 *last_paddr = paddr;
-                 *last_size = pgsize;
-             } else {
---
-.35.1

-[PULL 19/25] target/riscv: add scalar crypto related extenstion strings to isa_string
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
- - add zbk* and zk* strings to isa_edata_arr
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Tested-by: Jiatai He <jiatai2021@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220426095204.24142-1-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 13 +++++++++++++
-file changed, 13 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str, int max_str_len)
-         ISA_EDATA_ENTRY(zba, ext_zba),
-         ISA_EDATA_ENTRY(zbb, ext_zbb),
-         ISA_EDATA_ENTRY(zbc, ext_zbc),
-+        ISA_EDATA_ENTRY(zbkb, ext_zbkb),
-+        ISA_EDATA_ENTRY(zbkc, ext_zbkc),
-+        ISA_EDATA_ENTRY(zbkx, ext_zbkx),
-         ISA_EDATA_ENTRY(zbs, ext_zbs),
-+        ISA_EDATA_ENTRY(zk, ext_zk),
-+        ISA_EDATA_ENTRY(zkn, ext_zkn),
-+        ISA_EDATA_ENTRY(zknd, ext_zknd),
-+        ISA_EDATA_ENTRY(zkne, ext_zkne),
-+        ISA_EDATA_ENTRY(zknh, ext_zknh),
-+        ISA_EDATA_ENTRY(zkr, ext_zkr),
-+        ISA_EDATA_ENTRY(zks, ext_zks),
-+        ISA_EDATA_ENTRY(zksed, ext_zksed),
-+        ISA_EDATA_ENTRY(zksh, ext_zksh),
-+        ISA_EDATA_ENTRY(zkt, ext_zkt),
-         ISA_EDATA_ENTRY(zve32f, ext_zve32f),
-         ISA_EDATA_ENTRY(zve64f, ext_zve64f),
-         ISA_EDATA_ENTRY(svinval, ext_svinval),
---
-.35.1

From: Alistair Francis <alistair.francis@wdc.com>

The following changes since commit f22833602095b05733bceaddeb20f3edfced3c07:

Merge tag 'pull-target-arm-20220428' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2022-04-28 08:34:17 -0700)

are available in the Git repository at:

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20220429

for you to fetch changes up to 325b7c4e7582c229d28c47123c3b986ed948eb84:

hw/riscv: Enable TPM backends (2022-04-29 10:48:48 +1000)

----------------------------------------------------------------
Second RISC-V PR for QEMU 7.1

* Improve device tree generation
 * Support configuarable marchid, mvendorid, mipid CSR values
 * Add support for the Zbkb, Zbkc, Zbkx, Zknd/Zkne, Zknh, Zksed/Zksh and Zkr extensions
 * Fix incorrect PTE merge in walk_pte
 * Add TPM support to the virt board

----------------------------------------------------------------
Alistair Francis (6):
      hw/riscv: virt: Add a machine done notifier
      hw/core: Move the ARM sysbus-fdt to core
      hw/riscv: virt: Create a platform bus
      hw/riscv: virt: Add support for generating platform FDT entries
      hw/riscv: virt: Add device plug support
      hw/riscv: Enable TPM backends

Bin Meng (2):
      hw/riscv: spike: Add '/chosen/stdout-path' in device tree unconditionally
      hw/riscv: Don't add empty bootargs to device tree

Frank Chang (1):
      target/riscv: Support configuarable marchid, mvendorid, mipid CSR values

Ralf Ramsauer (1):
      target/riscv: Fix incorrect PTE merge in walk_pte

Weiwei Li (15):
      target/riscv: rvk: add cfg properties for zbk* and zk*
      target/riscv: rvk: add support for zbkb extension
      target/riscv: rvk: add support for zbkc extension
      target/riscv: rvk: add support for zbkx extension
      crypto: move sm4_sbox from target/arm
      target/riscv: rvk: add support for zknd/zkne extension in RV32
      target/riscv: rvk: add support for zkne/zknd extension in RV64
      target/riscv: rvk: add support for sha256 related instructions in zknh extension
      target/riscv: rvk: add support for sha512 related instructions for RV32 in zknh extension
      target/riscv: rvk: add support for sha512 related instructions for RV64 in zknh extension
      target/riscv: rvk: add support for zksed/zksh extension
      target/riscv: rvk: add CSR support for Zkr
      disas/riscv.c: rvk: add disas support for Zbk* and Zk* instructions
      target/riscv: rvk: expose zbk* and zk* properties
      target/riscv: add scalar crypto related extenstion strings to isa_string

docs/system/riscv/virt.rst              |  20 ++
 include/crypto/sm4.h                    |   6 +
 include/hw/{arm => core}/sysbus-fdt.h   |   0
 include/hw/riscv/virt.h                 |   8 +-
 target/riscv/cpu.h                      |  17 ++
 target/riscv/cpu_bits.h                 |   9 +
 target/riscv/helper.h                   |  22 ++
 target/riscv/pmp.h                      |   8 +-
 target/riscv/insn32.decode              |  97 ++++++--
 crypto/sm4.c                            |  49 ++++
 disas/riscv.c                           | 173 +++++++++++++-
 hw/arm/virt.c                           |   2 +-
 hw/arm/xlnx-versal-virt.c               |   1 -
 hw/{arm => core}/sysbus-fdt.c           |   2 +-
 hw/riscv/microchip_pfsoc.c              |   2 +-
 hw/riscv/sifive_u.c                     |   2 +-
 hw/riscv/spike.c                        |   7 +-
 hw/riscv/virt.c                         | 319 +++++++++++++++++---------
 target/arm/crypto_helper.c              |  36 +--
 target/riscv/bitmanip_helper.c          |  80 +++++++
 target/riscv/cpu.c                      |  58 +++++
 target/riscv/crypto_helper.c            | 302 ++++++++++++++++++++++++
 target/riscv/csr.c                      | 118 +++++++++-
 target/riscv/monitor.c                  |  11 +-
 target/riscv/op_helper.c                |   9 +
 target/riscv/translate.c                |   8 +
 target/riscv/insn_trans/trans_rvb.c.inc | 116 ++++++++--
 target/riscv/insn_trans/trans_rvk.c.inc | 391 ++++++++++++++++++++++++++++++++
 crypto/meson.build                      |   1 +
 hw/arm/meson.build                      |   1 -
 hw/core/meson.build                     |   1 +
 hw/riscv/Kconfig                        |   2 +
 target/riscv/meson.build                |   3 +-
 33 files changed, 1682 insertions(+), 199 deletions(-)
 create mode 100644 include/crypto/sm4.h
 rename include/hw/{arm => core}/sysbus-fdt.h (100%)
 create mode 100644 crypto/sm4.c
 rename hw/{arm => core}/sysbus-fdt.c (99%)
 create mode 100644 target/riscv/crypto_helper.c
 create mode 100644 target/riscv/insn_trans/trans_rvk.c.inc

From: Bin Meng <bin.meng@windriver.com>

At present the adding '/chosen/stdout-path' property in device tree
is determined by whether a kernel command line is provided, which is
wrong. It should be added unconditionally.

Fixes: 8d8897accb1c ("hw/riscv: spike: Allow using binary firmware as bios")
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220421055629.1177285-1-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/spike.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
 
     riscv_socket_fdt_write_distance_matrix(mc, fdt);
 
+    qemu_fdt_add_subnode(fdt, "/chosen");
+    qemu_fdt_setprop_string(fdt, "/chosen", "stdout-path", "/htif");
+
     if (cmdline) {
-        qemu_fdt_add_subnode(fdt, "/chosen");
         qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", cmdline);
-        qemu_fdt_setprop_string(fdt, "/chosen", "stdout-path", "/htif");
     }
 }
 
-- 
2.35.1

From: Bin Meng <bin.meng@windriver.com>

Commit 7c28f4da20e5 ("RISC-V: Don't add NULL bootargs to device-tree")
tried to avoid adding *NULL* bootargs to device tree, but unfortunately
the changes were entirely useless, due to MachineState::kernel_cmdline
can't be NULL at all as the default value is given as an empty string.
(see hw/core/machine.c::machine_initfn()).

Note the wording of *NULL* bootargs is wrong. It can't be NULL otherwise
a segfault had already been observed by dereferencing the NULL pointer.
It should be worded as *empty" bootargs.

Fixes: 7c28f4da20e5 ("RISC-V: Don't add NULL bootargs to device-tree")
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220421055629.1177285-2-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/microchip_pfsoc.c | 2 +-
 hw/riscv/sifive_u.c        | 2 +-
 hw/riscv/spike.c           | 2 +-
 hw/riscv/virt.c            | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
                                   "linux,initrd-end", end);
         }
 
-        if (machine->kernel_cmdline) {
+        if (machine->kernel_cmdline && *machine->kernel_cmdline) {
             qemu_fdt_setprop_string(machine->fdt, "/chosen",
                                     "bootargs", machine->kernel_cmdline);
         }
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
     g_free(nodename);
 
 update_bootargs:
-    if (cmdline) {
+    if (cmdline && *cmdline) {
         qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", cmdline);
     }
 }
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SpikeState *s, const MemMapEntry *memmap,
     qemu_fdt_add_subnode(fdt, "/chosen");
     qemu_fdt_setprop_string(fdt, "/chosen", "stdout-path", "/htif");
 
-    if (cmdline) {
+    if (cmdline && *cmdline) {
         qemu_fdt_setprop_string(fdt, "/chosen", "bootargs", cmdline);
     }
 }
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
     create_fdt_flash(s, memmap);
 
 update_bootargs:
-    if (cmdline) {
+    if (cmdline && *cmdline) {
         qemu_fdt_setprop_string(mc->fdt, "/chosen", "bootargs", cmdline);
     }
 }
-- 
2.35.1

From: Frank Chang <frank.chang@sifive.com>

Allow user to set core's marchid, mvendorid, mipid CSRs through
-cpu command line option.

The default values of marchid and mipid are built with QEMU's version
numbers.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20220422040436.2233-1-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h |  4 ++++
 target/riscv/cpu.c |  9 +++++++++
 target/riscv/csr.c | 38 ++++++++++++++++++++++++++++++++++----
 3 files changed, 47 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve32f;
     bool ext_zve64f;
 
+    uint32_t mvendorid;
+    uint64_t marchid;
+    uint64_t mipid;
+
     /* Vendor-specific custom extensions */
     bool ext_XVentanaCondOps;
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 
 /* RISC-V CPU definitions */
 
+#define RISCV_CPU_MARCHID   ((QEMU_VERSION_MAJOR << 16) | \
+                             (QEMU_VERSION_MINOR << 8)  | \
+                             (QEMU_VERSION_MICRO))
+#define RISCV_CPU_MIPID     RISCV_CPU_MARCHID
+
 static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
 
 struct isa_ext_data {
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_UINT16("vlen", RISCVCPU, cfg.vlen, 128),
     DEFINE_PROP_UINT16("elen", RISCVCPU, cfg.elen, 64),
 
+    DEFINE_PROP_UINT32("mvendorid", RISCVCPU, cfg.mvendorid, 0),
+    DEFINE_PROP_UINT64("marchid", RISCVCPU, cfg.marchid, RISCV_CPU_MARCHID),
+    DEFINE_PROP_UINT64("mipid", RISCVCPU, cfg.mipid, RISCV_CPU_MIPID),
+
     DEFINE_PROP_BOOL("svinval", RISCVCPU, cfg.ext_svinval, false),
     DEFINE_PROP_BOOL("svnapot", RISCVCPU, cfg.ext_svnapot, false),
     DEFINE_PROP_BOOL("svpbmt", RISCVCPU, cfg.ext_svpbmt, false),
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_ignore(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+static RISCVException read_mvendorid(CPURISCVState *env, int csrno,
+                                     target_ulong *val)
+{
+    CPUState *cs = env_cpu(env);
+    RISCVCPU *cpu = RISCV_CPU(cs);
+
+    *val = cpu->cfg.mvendorid;
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException read_marchid(CPURISCVState *env, int csrno,
+                                   target_ulong *val)
+{
+    CPUState *cs = env_cpu(env);
+    RISCVCPU *cpu = RISCV_CPU(cs);
+
+    *val = cpu->cfg.marchid;
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException read_mipid(CPURISCVState *env, int csrno,
+                                 target_ulong *val)
+{
+    CPUState *cs = env_cpu(env);
+    RISCVCPU *cpu = RISCV_CPU(cs);
+
+    *val = cpu->cfg.mipid;
+    return RISCV_EXCP_NONE;
+}
+
 static RISCVException read_mhartid(CPURISCVState *env, int csrno,
                                    target_ulong *val)
 {
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_MINSTRETH] = { "minstreth", any32, read_instreth },
 
     /* Machine Information Registers */
-    [CSR_MVENDORID] = { "mvendorid", any,   read_zero    },
-    [CSR_MARCHID]   = { "marchid",   any,   read_zero    },
-    [CSR_MIMPID]    = { "mimpid",    any,   read_zero    },
-    [CSR_MHARTID]   = { "mhartid",   any,   read_mhartid },
+    [CSR_MVENDORID] = { "mvendorid", any,   read_mvendorid },
+    [CSR_MARCHID]   = { "marchid",   any,   read_marchid   },
+    [CSR_MIMPID]    = { "mimpid",    any,   read_mipid     },
+    [CSR_MHARTID]   = { "mhartid",   any,   read_mhartid   },
 
     [CSR_MCONFIGPTR]  = { "mconfigptr", any,   read_zero,
                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220423023510.30794-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 13 +++++++++++++
 target/riscv/cpu.c | 23 +++++++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zba;
     bool ext_zbb;
     bool ext_zbc;
+    bool ext_zbkb;
+    bool ext_zbkc;
+    bool ext_zbkx;
     bool ext_zbs;
+    bool ext_zk;
+    bool ext_zkn;
+    bool ext_zknd;
+    bool ext_zkne;
+    bool ext_zknh;
+    bool ext_zkr;
+    bool ext_zks;
+    bool ext_zksed;
+    bool ext_zksh;
+    bool ext_zkt;
     bool ext_counters;
     bool ext_ifencei;
     bool ext_icsr;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
             cpu->cfg.ext_zfinx = true;
         }
 
+        if (cpu->cfg.ext_zk) {
+            cpu->cfg.ext_zkn = true;
+            cpu->cfg.ext_zkr = true;
+            cpu->cfg.ext_zkt = true;
+        }
+
+        if (cpu->cfg.ext_zkn) {
+            cpu->cfg.ext_zbkb = true;
+            cpu->cfg.ext_zbkc = true;
+            cpu->cfg.ext_zbkx = true;
+            cpu->cfg.ext_zkne = true;
+            cpu->cfg.ext_zknd = true;
+            cpu->cfg.ext_zknh = true;
+        }
+
+        if (cpu->cfg.ext_zks) {
+            cpu->cfg.ext_zbkb = true;
+            cpu->cfg.ext_zbkc = true;
+            cpu->cfg.ext_zbkx = true;
+            cpu->cfg.ext_zksed = true;
+            cpu->cfg.ext_zksh = true;
+        }
+
         /* Set the ISA extensions, checks should have happened above */
         if (cpu->cfg.ext_i) {
             ext |= RVI;
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

- reuse partial instructions of zbb extension, update extension check for them
 - add brev8, pack, packh, packw, unzip, zip instructions

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220423023510.30794-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                   |  3 +
 target/riscv/insn32.decode              | 45 +++++++-----
 target/riscv/bitmanip_helper.c          | 53 ++++++++++++++
 target/riscv/translate.c                |  7 ++
 target/riscv/insn_trans/trans_rvb.c.inc | 94 +++++++++++++++++++++----
 5 files changed, 174 insertions(+), 28 deletions(-)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_1(fclass_d, TCG_CALL_NO_RWG_SE, tl, i64)
 /* Bitmanip */
 DEF_HELPER_FLAGS_2(clmul, TCG_CALL_NO_RWG_SE, tl, tl, tl)
 DEF_HELPER_FLAGS_2(clmulr, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+DEF_HELPER_FLAGS_1(brev8, TCG_CALL_NO_RWG_SE, tl, tl)
+DEF_HELPER_FLAGS_1(unzip, TCG_CALL_NO_RWG_SE, tl, tl)
+DEF_HELPER_FLAGS_1(zip, TCG_CALL_NO_RWG_SE, tl, tl)
 
 /* Floating Point - Half Precision */
 DEF_HELPER_FLAGS_3(fadd_h, TCG_CALL_NO_RWG, i64, env, i64, i64)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ sh2add_uw  0010000 .......... 100 ..... 0111011 @r
 sh3add_uw  0010000 .......... 110 ..... 0111011 @r
 slli_uw    00001 ............ 001 ..... 0011011 @sh
 
-# *** RV32 Zbb Standard Extension ***
+# *** RV32 Zbb/Zbkb Standard Extension ***
 andn       0100000 .......... 111 ..... 0110011 @r
+rol        0110000 .......... 001 ..... 0110011 @r
+ror        0110000 .......... 101 ..... 0110011 @r
+rori       01100 ............ 101 ..... 0010011 @sh
+# The encoding for rev8 differs between RV32 and RV64.
+# rev8_32 denotes the RV32 variant.
+rev8_32    011010 011000 ..... 101 ..... 0010011 @r2
+# The encoding for zext.h differs between RV32 and RV64.
+# zext_h_32 denotes the RV32 variant.
+{
+  zext_h_32  0000100 00000 ..... 100 ..... 0110011 @r2
+  pack       0000100 ..... ..... 100 ..... 0110011 @r
+}
+xnor       0100000 .......... 100 ..... 0110011 @r
+# *** RV32 extra Zbb Standard Extension ***
 clz        011000 000000 ..... 001 ..... 0010011 @r2
 cpop       011000 000010 ..... 001 ..... 0010011 @r2
 ctz        011000 000001 ..... 001 ..... 0010011 @r2
@@ -XXX,XX +XXX,XX @@ min        0000101 .......... 100 ..... 0110011 @r
 minu       0000101 .......... 101 ..... 0110011 @r
 orc_b      001010 000111 ..... 101 ..... 0010011 @r2
 orn        0100000 .......... 110 ..... 0110011 @r
-# The encoding for rev8 differs between RV32 and RV64.
-# rev8_32 denotes the RV32 variant.
-rev8_32    011010 011000 ..... 101 ..... 0010011 @r2
-rol        0110000 .......... 001 ..... 0110011 @r
-ror        0110000 .......... 101 ..... 0110011 @r
-rori       01100 ............ 101 ..... 0010011 @sh
 sext_b     011000 000100 ..... 001 ..... 0010011 @r2
 sext_h     011000 000101 ..... 001 ..... 0010011 @r2
-xnor       0100000 .......... 100 ..... 0110011 @r
-# The encoding for zext.h differs between RV32 and RV64.
-# zext_h_32 denotes the RV32 variant.
-zext_h_32  0000100 00000 ..... 100 ..... 0110011 @r2
+# *** RV32 extra Zbkb Standard Extension ***
+brev8      0110100 00111 ..... 101 ..... 0010011 @r2  #grevi
+packh      0000100  .......... 111 ..... 0110011 @r
+unzip      0000100 01111 ..... 101 ..... 0010011 @r2  #unshfl
+zip        0000100 01111 ..... 001 ..... 0010011 @r2  #shfl
 
-# *** RV64 Zbb Standard Extension (in addition to RV32 Zbb) ***
-clzw       0110000 00000 ..... 001 ..... 0011011 @r2
-ctzw       0110000 00001 ..... 001 ..... 0011011 @r2
-cpopw      0110000 00010 ..... 001 ..... 0011011 @r2
+# *** RV64 Zbb/Zbkb Standard Extension (in addition to RV32 Zbb/Zbkb) ***
 # The encoding for rev8 differs between RV32 and RV64.
 # When executing on RV64, the encoding used in RV32 is an illegal
 # instruction, so we use different handler functions to differentiate.
@@ -XXX,XX +XXX,XX @@ rorw       0110000 .......... 101 ..... 0111011 @r
 # The encoding for zext.h differs between RV32 and RV64.
 # When executing on RV64, the encoding used in RV32 is an illegal
 # instruction, so we use different handler functions to differentiate.
-zext_h_64  0000100 00000 ..... 100 ..... 0111011 @r2
+{
+  zext_h_64  0000100 00000 ..... 100 ..... 0111011 @r2
+  packw      0000100 ..... ..... 100 ..... 0111011 @r
+}
+# *** RV64 extra Zbb Standard Extension (in addition to RV32 Zbb) ***
+clzw       0110000 00000 ..... 001 ..... 0011011 @r2
+ctzw       0110000 00001 ..... 001 ..... 0011011 @r2
+cpopw      0110000 00010 ..... 001 ..... 0011011 @r2
 
 # *** RV32 Zbc Standard Extension ***
 clmul      0000101 .......... 001 ..... 0110011 @r
diff --git a/target/riscv/bitmanip_helper.c b/target/riscv/bitmanip_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/bitmanip_helper.c
+++ b/target/riscv/bitmanip_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(clmulr)(target_ulong rs1, target_ulong rs2)
 
     return result;
 }
+
+static inline target_ulong do_swap(target_ulong x, uint64_t mask, int shift)
+{
+    return ((x & mask) << shift) | ((x & ~mask) >> shift);
+}
+
+target_ulong HELPER(brev8)(target_ulong rs1)
+{
+    target_ulong x = rs1;
+
+    x = do_swap(x, 0x5555555555555555ull, 1);
+    x = do_swap(x, 0x3333333333333333ull, 2);
+    x = do_swap(x, 0x0f0f0f0f0f0f0f0full, 4);
+    return x;
+}
+
+static const uint64_t shuf_masks[] = {
+    dup_const(MO_8, 0x44),
+    dup_const(MO_8, 0x30),
+    dup_const(MO_16, 0x0f00),
+    dup_const(MO_32, 0xff0000)
+};
+
+static inline target_ulong do_shuf_stage(target_ulong src, uint64_t maskL,
+                                         uint64_t maskR, int shift)
+{
+    target_ulong x = src & ~(maskL | maskR);
+
+    x |= ((src << shift) & maskL) | ((src >> shift) & maskR);
+    return x;
+}
+
+target_ulong HELPER(unzip)(target_ulong rs1)
+{
+    target_ulong x = rs1;
+
+    x = do_shuf_stage(x, shuf_masks[0], shuf_masks[0] >> 1, 1);
+    x = do_shuf_stage(x, shuf_masks[1], shuf_masks[1] >> 2, 2);
+    x = do_shuf_stage(x, shuf_masks[2], shuf_masks[2] >> 4, 4);
+    x = do_shuf_stage(x, shuf_masks[3], shuf_masks[3] >> 8, 8);
+    return x;
+}
+
+target_ulong HELPER(zip)(target_ulong rs1)
+{
+    target_ulong x = rs1;
+
+    x = do_shuf_stage(x, shuf_masks[3], shuf_masks[3] >> 8, 8);
+    x = do_shuf_stage(x, shuf_masks[2], shuf_masks[2] >> 4, 4);
+    x = do_shuf_stage(x, shuf_masks[1], shuf_masks[1] >> 2, 2);
+    x = do_shuf_stage(x, shuf_masks[0], shuf_masks[0] >> 1, 1);
+    return x;
+}
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ EX_SH(12)
     }                                  \
 } while (0)
 
+#define REQUIRE_EITHER_EXT(ctx, A, B) do {       \
+    if (!ctx->cfg_ptr->ext_##A &&      \
+        !ctx->cfg_ptr->ext_##B) {      \
+        return false;                            \
+    }                                            \
+} while (0)
+
 static int ex_rvc_register(DisasContext *ctx, int reg)
 {
     return 8 + reg;
diff --git a/target/riscv/insn_trans/trans_rvb.c.inc b/target/riscv/insn_trans/trans_rvb.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvb.c.inc
+++ b/target/riscv/insn_trans/trans_rvb.c.inc
@@ -XXX,XX +XXX,XX @@
 /*
- * RISC-V translation routines for the Zb[abcs] Standard Extension.
+ * RISC-V translation routines for the Zb[abcs] and Zbk[bcx] Standard Extension.
  *
  * Copyright (c) 2020 Kito Cheng, kito.cheng@sifive.com
  * Copyright (c) 2020 Frank Chang, frank.chang@sifive.com
@@ -XXX,XX +XXX,XX @@
     }                                            \
 } while (0)
 
+#define REQUIRE_ZBKB(ctx) do {                   \
+    if (!ctx->cfg_ptr->ext_zbkb) {               \
+        return false;                            \
+    }                                            \
+} while (0)
+
 static void gen_clz(TCGv ret, TCGv arg1)
 {
     tcg_gen_clzi_tl(ret, arg1, TARGET_LONG_BITS);
@@ -XXX,XX +XXX,XX @@ static bool trans_cpop(DisasContext *ctx, arg_cpop *a)
 
 static bool trans_andn(DisasContext *ctx, arg_andn *a)
 {
-    REQUIRE_ZBB(ctx);
+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
     return gen_logic(ctx, a, tcg_gen_andc_tl);
 }
 
 static bool trans_orn(DisasContext *ctx, arg_orn *a)
 {
-    REQUIRE_ZBB(ctx);
+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
     return gen_logic(ctx, a, tcg_gen_orc_tl);
 }
 
 static bool trans_xnor(DisasContext *ctx, arg_xnor *a)
 {
-    REQUIRE_ZBB(ctx);
+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
     return gen_logic(ctx, a, tcg_gen_eqv_tl);
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_rorw(TCGv ret, TCGv arg1, TCGv arg2)
 
 static bool trans_ror(DisasContext *ctx, arg_ror *a)
 {
-    REQUIRE_ZBB(ctx);
+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
     return gen_shift_per_ol(ctx, a, EXT_NONE, tcg_gen_rotr_tl, gen_rorw, NULL);
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_roriw(TCGv ret, TCGv arg1, target_long shamt)
 
 static bool trans_rori(DisasContext *ctx, arg_rori *a)
 {
-    REQUIRE_ZBB(ctx);
+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
     return gen_shift_imm_fn_per_ol(ctx, a, EXT_NONE,
                                    tcg_gen_rotri_tl, gen_roriw, NULL);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_rolw(TCGv ret, TCGv arg1, TCGv arg2)
 
 static bool trans_rol(DisasContext *ctx, arg_rol *a)
 {
-    REQUIRE_ZBB(ctx);
+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
     return gen_shift_per_ol(ctx, a, EXT_NONE, tcg_gen_rotl_tl, gen_rolw, NULL);
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_rev8_32(TCGv ret, TCGv src1)
 static bool trans_rev8_32(DisasContext *ctx, arg_rev8_32 *a)
 {
     REQUIRE_32BIT(ctx);
-    REQUIRE_ZBB(ctx);
+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
     return gen_unary(ctx, a, EXT_NONE, gen_rev8_32);
 }
 
 static bool trans_rev8_64(DisasContext *ctx, arg_rev8_64 *a)
 {
     REQUIRE_64BIT(ctx);
-    REQUIRE_ZBB(ctx);
+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
     return gen_unary(ctx, a, EXT_NONE, tcg_gen_bswap_tl);
 }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_cpopw(DisasContext *ctx, arg_cpopw *a)
 static bool trans_rorw(DisasContext *ctx, arg_rorw *a)
 {
     REQUIRE_64BIT(ctx);
-    REQUIRE_ZBB(ctx);
+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
     ctx->ol = MXL_RV32;
     return gen_shift(ctx, a, EXT_NONE, gen_rorw, NULL);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_rorw(DisasContext *ctx, arg_rorw *a)
 static bool trans_roriw(DisasContext *ctx, arg_roriw *a)
 {
     REQUIRE_64BIT(ctx);
-    REQUIRE_ZBB(ctx);
+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
     ctx->ol = MXL_RV32;
     return gen_shift_imm_fn(ctx, a, EXT_NONE, gen_roriw, NULL);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_roriw(DisasContext *ctx, arg_roriw *a)
 static bool trans_rolw(DisasContext *ctx, arg_rolw *a)
 {
     REQUIRE_64BIT(ctx);
-    REQUIRE_ZBB(ctx);
+    REQUIRE_EITHER_EXT(ctx, zbb, zbkb);
     ctx->ol = MXL_RV32;
     return gen_shift(ctx, a, EXT_NONE, gen_rolw, NULL);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_clmulr(DisasContext *ctx, arg_clmulh *a)
     REQUIRE_ZBC(ctx);
     return gen_arith(ctx, a, EXT_NONE, gen_helper_clmulr, NULL);
 }
+
+static void gen_pack(TCGv ret, TCGv src1, TCGv src2)
+{
+    tcg_gen_deposit_tl(ret, src1, src2,
+                       TARGET_LONG_BITS / 2,
+                       TARGET_LONG_BITS / 2);
+}
+
+static void gen_packh(TCGv ret, TCGv src1, TCGv src2)
+{
+    TCGv t = tcg_temp_new();
+
+    tcg_gen_ext8u_tl(t, src2);
+    tcg_gen_deposit_tl(ret, src1, t, 8, TARGET_LONG_BITS - 8);
+    tcg_temp_free(t);
+}
+
+static void gen_packw(TCGv ret, TCGv src1, TCGv src2)
+{
+    TCGv t = tcg_temp_new();
+
+    tcg_gen_ext16s_tl(t, src2);
+    tcg_gen_deposit_tl(ret, src1, t, 16, TARGET_LONG_BITS - 16);
+    tcg_temp_free(t);
+}
+
+static bool trans_brev8(DisasContext *ctx, arg_brev8 *a)
+{
+    REQUIRE_ZBKB(ctx);
+    return gen_unary(ctx, a, EXT_NONE, gen_helper_brev8);
+}
+
+static bool trans_pack(DisasContext *ctx, arg_pack *a)
+{
+    REQUIRE_ZBKB(ctx);
+    return gen_arith(ctx, a, EXT_NONE, gen_pack, NULL);
+}
+
+static bool trans_packh(DisasContext *ctx, arg_packh *a)
+{
+    REQUIRE_ZBKB(ctx);
+    return gen_arith(ctx, a, EXT_NONE, gen_packh, NULL);
+}
+
+static bool trans_packw(DisasContext *ctx, arg_packw *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_ZBKB(ctx);
+    return gen_arith(ctx, a, EXT_NONE, gen_packw, NULL);
+}
+
+static bool trans_unzip(DisasContext *ctx, arg_unzip *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZBKB(ctx);
+    return gen_unary(ctx, a, EXT_NONE, gen_helper_unzip);
+}
+
+static bool trans_zip(DisasContext *ctx, arg_zip *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZBKB(ctx);
+    return gen_unary(ctx, a, EXT_NONE, gen_helper_zip);
+}
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

- reuse partial instructions of zbc extension, update extension check for them

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220423023510.30794-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn32.decode              | 3 ++-
 target/riscv/insn_trans/trans_rvb.c.inc | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

From: Weiwei Li <liweiwei@iscas.ac.cn>

- add xperm4 and xperm8 instructions

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220423023510.30794-5-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                   |  2 ++
 target/riscv/insn32.decode              |  4 ++++
 target/riscv/bitmanip_helper.c          | 27 +++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvb.c.inc | 18 +++++++++++++++++
 4 files changed, 51 insertions(+)

From: Weiwei Li <liweiwei@iscas.ac.cn>

- share it between target/arm and target/riscv

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220423023510.30794-6-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/sm4.h       |  6 +++++
 crypto/sm4.c               | 49 ++++++++++++++++++++++++++++++++++++++
 target/arm/crypto_helper.c | 36 +---------------------------
 crypto/meson.build         |  1 +
 4 files changed, 57 insertions(+), 35 deletions(-)
 create mode 100644 include/crypto/sm4.h
 create mode 100644 crypto/sm4.c

diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/crypto/sm4.h
@@ -XXX,XX +XXX,XX @@
+#ifndef QEMU_SM4_H
+#define QEMU_SM4_H
+
+extern const uint8_t sm4_sbox[256];
+
+#endif
diff --git a/crypto/sm4.c b/crypto/sm4.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/crypto/sm4.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU crypto sm4 support
+ *
+ * Copyright (C) 2013 - 2018 Linaro Ltd <ard.biesheuvel@linaro.org>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "crypto/sm4.h"
+
+uint8_t const sm4_sbox[] = {
+    0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7,
+    0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,
+    0x2b, 0x67, 0x9a, 0x76, 0x2a, 0xbe, 0x04, 0xc3,
+    0xaa, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
+    0x9c, 0x42, 0x50, 0xf4, 0x91, 0xef, 0x98, 0x7a,
+    0x33, 0x54, 0x0b, 0x43, 0xed, 0xcf, 0xac, 0x62,
+    0xe4, 0xb3, 0x1c, 0xa9, 0xc9, 0x08, 0xe8, 0x95,
+    0x80, 0xdf, 0x94, 0xfa, 0x75, 0x8f, 0x3f, 0xa6,
+    0x47, 0x07, 0xa7, 0xfc, 0xf3, 0x73, 0x17, 0xba,
+    0x83, 0x59, 0x3c, 0x19, 0xe6, 0x85, 0x4f, 0xa8,
+    0x68, 0x6b, 0x81, 0xb2, 0x71, 0x64, 0xda, 0x8b,
+    0xf8, 0xeb, 0x0f, 0x4b, 0x70, 0x56, 0x9d, 0x35,
+    0x1e, 0x24, 0x0e, 0x5e, 0x63, 0x58, 0xd1, 0xa2,
+    0x25, 0x22, 0x7c, 0x3b, 0x01, 0x21, 0x78, 0x87,
+    0xd4, 0x00, 0x46, 0x57, 0x9f, 0xd3, 0x27, 0x52,
+    0x4c, 0x36, 0x02, 0xe7, 0xa0, 0xc4, 0xc8, 0x9e,
+    0xea, 0xbf, 0x8a, 0xd2, 0x40, 0xc7, 0x38, 0xb5,
+    0xa3, 0xf7, 0xf2, 0xce, 0xf9, 0x61, 0x15, 0xa1,
+    0xe0, 0xae, 0x5d, 0xa4, 0x9b, 0x34, 0x1a, 0x55,
+    0xad, 0x93, 0x32, 0x30, 0xf5, 0x8c, 0xb1, 0xe3,
+    0x1d, 0xf6, 0xe2, 0x2e, 0x82, 0x66, 0xca, 0x60,
+    0xc0, 0x29, 0x23, 0xab, 0x0d, 0x53, 0x4e, 0x6f,
+    0xd5, 0xdb, 0x37, 0x45, 0xde, 0xfd, 0x8e, 0x2f,
+    0x03, 0xff, 0x6a, 0x72, 0x6d, 0x6c, 0x5b, 0x51,
+    0x8d, 0x1b, 0xaf, 0x92, 0xbb, 0xdd, 0xbc, 0x7f,
+    0x11, 0xd9, 0x5c, 0x41, 0x1f, 0x10, 0x5a, 0xd8,
+    0x0a, 0xc1, 0x31, 0x88, 0xa5, 0xcd, 0x7b, 0xbd,
+    0x2d, 0x74, 0xd0, 0x12, 0xb8, 0xe5, 0xb4, 0xb0,
+    0x89, 0x69, 0x97, 0x4a, 0x0c, 0x96, 0x77, 0x7e,
+    0x65, 0xb9, 0xf1, 0x09, 0xc5, 0x6e, 0xc6, 0x84,
+    0x18, 0xf0, 0x7d, 0xec, 0x3a, 0xdc, 0x4d, 0x20,
+    0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
+};
+
diff --git a/target/arm/crypto_helper.c b/target/arm/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/crypto_helper.c
+++ b/target/arm/crypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "crypto/aes.h"
+#include "crypto/sm4.h"
 #include "vec_internal.h"
 
 union CRYPTO_STATE {
@@ -XXX,XX +XXX,XX @@ DO_SM3TT(crypto_sm3tt2b, 3)
 
 #undef DO_SM3TT
 
-static uint8_t const sm4_sbox[] = {
-    0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7,
-    0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,
-    0x2b, 0x67, 0x9a, 0x76, 0x2a, 0xbe, 0x04, 0xc3,
-    0xaa, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
-    0x9c, 0x42, 0x50, 0xf4, 0x91, 0xef, 0x98, 0x7a,
-    0x33, 0x54, 0x0b, 0x43, 0xed, 0xcf, 0xac, 0x62,
-    0xe4, 0xb3, 0x1c, 0xa9, 0xc9, 0x08, 0xe8, 0x95,
-    0x80, 0xdf, 0x94, 0xfa, 0x75, 0x8f, 0x3f, 0xa6,
-    0x47, 0x07, 0xa7, 0xfc, 0xf3, 0x73, 0x17, 0xba,
-    0x83, 0x59, 0x3c, 0x19, 0xe6, 0x85, 0x4f, 0xa8,
-    0x68, 0x6b, 0x81, 0xb2, 0x71, 0x64, 0xda, 0x8b,
-    0xf8, 0xeb, 0x0f, 0x4b, 0x70, 0x56, 0x9d, 0x35,
-    0x1e, 0x24, 0x0e, 0x5e, 0x63, 0x58, 0xd1, 0xa2,
-    0x25, 0x22, 0x7c, 0x3b, 0x01, 0x21, 0x78, 0x87,
-    0xd4, 0x00, 0x46, 0x57, 0x9f, 0xd3, 0x27, 0x52,
-    0x4c, 0x36, 0x02, 0xe7, 0xa0, 0xc4, 0xc8, 0x9e,
-    0xea, 0xbf, 0x8a, 0xd2, 0x40, 0xc7, 0x38, 0xb5,
-    0xa3, 0xf7, 0xf2, 0xce, 0xf9, 0x61, 0x15, 0xa1,
-    0xe0, 0xae, 0x5d, 0xa4, 0x9b, 0x34, 0x1a, 0x55,
-    0xad, 0x93, 0x32, 0x30, 0xf5, 0x8c, 0xb1, 0xe3,
-    0x1d, 0xf6, 0xe2, 0x2e, 0x82, 0x66, 0xca, 0x60,
-    0xc0, 0x29, 0x23, 0xab, 0x0d, 0x53, 0x4e, 0x6f,
-    0xd5, 0xdb, 0x37, 0x45, 0xde, 0xfd, 0x8e, 0x2f,
-    0x03, 0xff, 0x6a, 0x72, 0x6d, 0x6c, 0x5b, 0x51,
-    0x8d, 0x1b, 0xaf, 0x92, 0xbb, 0xdd, 0xbc, 0x7f,
-    0x11, 0xd9, 0x5c, 0x41, 0x1f, 0x10, 0x5a, 0xd8,
-    0x0a, 0xc1, 0x31, 0x88, 0xa5, 0xcd, 0x7b, 0xbd,
-    0x2d, 0x74, 0xd0, 0x12, 0xb8, 0xe5, 0xb4, 0xb0,
-    0x89, 0x69, 0x97, 0x4a, 0x0c, 0x96, 0x77, 0x7e,
-    0x65, 0xb9, 0xf1, 0x09, 0xc5, 0x6e, 0xc6, 0x84,
-    0x18, 0xf0, 0x7d, 0xec, 0x3a, 0xdc, 0x4d, 0x20,
-    0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
-};
-
 static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
 {
     union CRYPTO_STATE d = { .l = { rn[0], rn[1] } };
diff --git a/crypto/meson.build b/crypto/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/crypto/meson.build
+++ b/crypto/meson.build
@@ -XXX,XX +XXX,XX @@ if have_afalg
 endif
 crypto_ss.add(when: gnutls, if_true: files('tls-cipher-suites.c'))
 
+util_ss.add(files('sm4.c'))
 util_ss.add(files('aes.c'))
 util_ss.add(files('init.c'))
 if gnutls.found()
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

- add aes32esmi, aes32esi, aes32dsmi and aes32dsi instructions

Co-authored-by: Zewen Ye <lustrew@foxmail.com>
Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220423023510.30794-7-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                   |   6 ++
 target/riscv/insn32.decode              |  11 +++
 target/riscv/crypto_helper.c            | 105 ++++++++++++++++++++++++
 target/riscv/translate.c                |   1 +
 target/riscv/insn_trans/trans_rvk.c.inc |  71 ++++++++++++++++
 target/riscv/meson.build                |   3 +-
 6 files changed, 196 insertions(+), 1 deletion(-)
 create mode 100644 target/riscv/crypto_helper.c
 create mode 100644 target/riscv/insn_trans/trans_rvk.c.inc

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(divu_i128, tl, env, tl, tl, tl, tl)
 DEF_HELPER_5(divs_i128, tl, env, tl, tl, tl, tl)
 DEF_HELPER_5(remu_i128, tl, env, tl, tl, tl, tl)
 DEF_HELPER_5(rems_i128, tl, env, tl, tl, tl, tl)
+
+/* Crypto functions */
+DEF_HELPER_FLAGS_3(aes32esmi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+DEF_HELPER_FLAGS_3(aes32esi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+DEF_HELPER_FLAGS_3(aes32dsmi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+DEF_HELPER_FLAGS_3(aes32dsi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 %imm_b    31:s1 7:1 25:6 8:4     !function=ex_shift_1
 %imm_j    31:s1 12:8 20:1 21:10  !function=ex_shift_1
 %imm_u    12:s20                 !function=ex_shift_12
+%imm_bs   30:2                   !function=ex_shift_3
 
 # Argument sets:
 &empty
@@ -XXX,XX +XXX,XX @@
 &rmr       vm rd rs2
 &r2nfvm    vm rd rs1 nf
 &rnfvm     vm rd rs1 rs2 nf
+&k_aes     shamt rs2 rs1 rd
 
 # Formats 32:
 @r       .......   ..... ..... ... ..... ....... &r                %rs2 %rs1 %rd
@@ -XXX,XX +XXX,XX @@
 @sfence_vma ....... ..... .....   ... ..... ....... %rs2 %rs1
 @sfence_vm  ....... ..... .....   ... ..... ....... %rs1
 
+@k_aes   .. ..... ..... .....  ... ..... ....... &k_aes  shamt=%imm_bs   %rs2 %rs1 %rd
+
 # Formats 64:
 @sh5     .......  ..... .....  ... ..... ....... &shift  shamt=%sh5      %rs1 %rd
 
@@ -XXX,XX +XXX,XX @@ sfence_w_inval    0001100 00000 00000 000 00000 1110011
 sfence_inval_ir   0001100 00001 00000 000 00000 1110011
 hinval_vvma       0010011 ..... ..... 000 00000 1110011 @hfence_vvma
 hinval_gvma       0110011 ..... ..... 000 00000 1110011 @hfence_gvma
+
+# *** RV32 Zknd Standard Extension ***
+aes32dsmi   .. 10111 ..... ..... 000 ..... 0110011 @k_aes
+aes32dsi    .. 10101 ..... ..... 000 ..... 0110011 @k_aes
+# *** RV32 Zkne Standard Extension ***
+aes32esmi   .. 10011 ..... ..... 000 ..... 0110011 @k_aes
+aes32esi    .. 10001 ..... ..... 000 ..... 0110011 @k_aes
diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Crypto Emulation Helpers for QEMU.
+ *
+ * Copyright (c) 2021 Ruibo Lu, luruibo2000@163.com
+ * Copyright (c) 2021 Zewen Ye, lustrew@foxmail.com
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "exec/exec-all.h"
+#include "exec/helper-proto.h"
+#include "crypto/aes.h"
+#include "crypto/sm4.h"
+
+#define AES_XTIME(a) \
+    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
+
+#define AES_GFMUL(a, b) (( \
+    (((b) & 0x1) ? (a) : 0) ^ \
+    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
+    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
+    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
+
+static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
+{
+    uint32_t u;
+
+    if (fwd) {
+        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
+            (AES_GFMUL(x, 2) << 0);
+    } else {
+        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
+            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
+    }
+    return u;
+}
+
+#define sext32_xlen(x) (target_ulong)(int32_t)(x)
+
+static inline target_ulong aes32_operation(target_ulong shamt,
+                                           target_ulong rs1, target_ulong rs2,
+                                           bool enc, bool mix)
+{
+    uint8_t si = rs2 >> shamt;
+    uint8_t so;
+    uint32_t mixed;
+    target_ulong res;
+
+    if (enc) {
+        so = AES_sbox[si];
+        if (mix) {
+            mixed = aes_mixcolumn_byte(so, true);
+        } else {
+            mixed = so;
+        }
+    } else {
+        so = AES_isbox[si];
+        if (mix) {
+            mixed = aes_mixcolumn_byte(so, false);
+        } else {
+            mixed = so;
+        }
+    }
+    mixed = rol32(mixed, shamt);
+    res = rs1 ^ mixed;
+
+    return sext32_xlen(res);
+}
+
+target_ulong HELPER(aes32esmi)(target_ulong rs1, target_ulong rs2,
+                               target_ulong shamt)
+{
+    return aes32_operation(shamt, rs1, rs2, true, true);
+}
+
+target_ulong HELPER(aes32esi)(target_ulong rs1, target_ulong rs2,
+                              target_ulong shamt)
+{
+    return aes32_operation(shamt, rs1, rs2, true, false);
+}
+
+target_ulong HELPER(aes32dsmi)(target_ulong rs1, target_ulong rs2,
+                               target_ulong shamt)
+{
+    return aes32_operation(shamt, rs1, rs2, false, true);
+}
+
+target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2,
+                              target_ulong shamt)
+{
+    return aes32_operation(shamt, rs1, rs2, false, false);
+}
+#undef sext32_xlen
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvv.c.inc"
 #include "insn_trans/trans_rvb.c.inc"
 #include "insn_trans/trans_rvzfh.c.inc"
+#include "insn_trans/trans_rvk.c.inc"
 #include "insn_trans/trans_privileged.c.inc"
 #include "insn_trans/trans_svinval.c.inc"
 #include "insn_trans/trans_xventanacondops.c.inc"
diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/insn_trans/trans_rvk.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvk.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the Zk[nd,ne,nh,sed,sh] Standard Extension.
+ *
+ * Copyright (c) 2021 Ruibo Lu, luruibo2000@163.com
+ * Copyright (c) 2021 Zewen Ye, lustrew@foxmail.com
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define REQUIRE_ZKND(ctx) do {                  \
+    if (!ctx->cfg_ptr->ext_zknd) {              \
+        return false;                           \
+    }                                           \
+} while (0)
+
+#define REQUIRE_ZKNE(ctx) do {                  \
+    if (!ctx->cfg_ptr->ext_zkne) {              \
+        return false;                           \
+    }                                           \
+} while (0)
+
+static bool gen_aes32_sm4(DisasContext *ctx, arg_k_aes *a,
+                          void (*func)(TCGv, TCGv, TCGv, TCGv))
+{
+    TCGv shamt = tcg_constant_tl(a->shamt);
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv src1 = get_gpr(ctx, a->rs1, EXT_NONE);
+    TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+
+    func(dest, src1, src2, shamt);
+    gen_set_gpr(ctx, a->rd, dest);
+    return true;
+}
+
+static bool trans_aes32esmi(DisasContext *ctx, arg_aes32esmi *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZKNE(ctx);
+    return gen_aes32_sm4(ctx, a, gen_helper_aes32esmi);
+}
+
+static bool trans_aes32esi(DisasContext *ctx, arg_aes32esi *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZKNE(ctx);
+    return gen_aes32_sm4(ctx, a, gen_helper_aes32esi);
+}
+
+static bool trans_aes32dsmi(DisasContext *ctx, arg_aes32dsmi *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZKND(ctx);
+    return gen_aes32_sm4(ctx, a, gen_helper_aes32dsmi);
+}
+
+static bool trans_aes32dsi(DisasContext *ctx, arg_aes32dsi *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZKND(ctx);
+    return gen_aes32_sm4(ctx, a, gen_helper_aes32dsi);
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
   'vector_helper.c',
   'bitmanip_helper.c',
   'translate.c',
-  'm128_helper.c'
+  'm128_helper.c',
+  'crypto_helper.c'
 ))
 riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
 
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

- add aes64dsm, aes64ds, aes64im, aes64es, aes64esm, aes64ks2, aes64ks1i instructions

Co-authored-by: Ruibo Lu <luruibo2000@163.com>
Co-authored-by: Zewen Ye <lustrew@foxmail.com>
Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220423023510.30794-8-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                   |   8 ++
 target/riscv/insn32.decode              |  12 ++
 target/riscv/crypto_helper.c            | 169 ++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvk.c.inc |  54 ++++++++
 4 files changed, 243 insertions(+)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(aes32esmi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
 DEF_HELPER_FLAGS_3(aes32esi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
 DEF_HELPER_FLAGS_3(aes32dsmi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
 DEF_HELPER_FLAGS_3(aes32dsi, TCG_CALL_NO_RWG_SE, tl, tl, tl, tl)
+
+DEF_HELPER_FLAGS_2(aes64esm, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+DEF_HELPER_FLAGS_2(aes64es, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+DEF_HELPER_FLAGS_2(aes64ds, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+DEF_HELPER_FLAGS_2(aes64dsm, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+DEF_HELPER_FLAGS_2(aes64ks2, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+DEF_HELPER_FLAGS_2(aes64ks1i, TCG_CALL_NO_RWG_SE, tl, tl, tl)
+DEF_HELPER_FLAGS_1(aes64im, TCG_CALL_NO_RWG_SE, tl, tl)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 %imm_j    31:s1 12:8 20:1 21:10  !function=ex_shift_1
 %imm_u    12:s20                 !function=ex_shift_12
 %imm_bs   30:2                   !function=ex_shift_3
+%imm_rnum 20:4
 
 # Argument sets:
 &empty
@@ -XXX,XX +XXX,XX @@
 @sfence_vm  ....... ..... .....   ... ..... ....... %rs1
 
 @k_aes   .. ..... ..... .....  ... ..... ....... &k_aes  shamt=%imm_bs   %rs2 %rs1 %rd
+@i_aes   .. ..... ..... .....  ... ..... ....... &i      imm=%imm_rnum        %rs1 %rd
 
 # Formats 64:
 @sh5     .......  ..... .....  ... ..... ....... &shift  shamt=%sh5      %rs1 %rd
@@ -XXX,XX +XXX,XX @@ hinval_gvma       0110011 ..... ..... 000 00000 1110011 @hfence_gvma
 # *** RV32 Zknd Standard Extension ***
 aes32dsmi   .. 10111 ..... ..... 000 ..... 0110011 @k_aes
 aes32dsi    .. 10101 ..... ..... 000 ..... 0110011 @k_aes
+# *** RV64 Zknd Standard Extension ***
+aes64dsm    00 11111 ..... ..... 000 ..... 0110011 @r
+aes64ds     00 11101 ..... ..... 000 ..... 0110011 @r
+aes64im     00 11000 00000 ..... 001 ..... 0010011 @r2
 # *** RV32 Zkne Standard Extension ***
 aes32esmi   .. 10011 ..... ..... 000 ..... 0110011 @k_aes
 aes32esi    .. 10001 ..... ..... 000 ..... 0110011 @k_aes
+# *** RV64 Zkne Standard Extension ***
+aes64es     00 11001 ..... ..... 000 ..... 0110011 @r
+aes64esm    00 11011 ..... ..... 000 ..... 0110011 @r
+# *** RV64 Zkne/zknd Standard Extension ***
+aes64ks2    01 11111 ..... ..... 000 ..... 0110011 @r
+aes64ks1i   00 11000 1.... ..... 001 ..... 0010011 @i_aes
diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2,
 {
     return aes32_operation(shamt, rs1, rs2, false, false);
 }
+
+#define BY(X, I) ((X >> (8 * I)) & 0xFF)
+
+#define AES_SHIFROWS_LO(RS1, RS2) ( \
+    (((RS1 >> 24) & 0xFF) << 56) | (((RS2 >> 48) & 0xFF) << 48) | \
+    (((RS2 >> 8) & 0xFF) << 40) | (((RS1 >> 32) & 0xFF) << 32) | \
+    (((RS2 >> 56) & 0xFF) << 24) | (((RS2 >> 16) & 0xFF) << 16) | \
+    (((RS1 >> 40) & 0xFF) << 8) | (((RS1 >> 0) & 0xFF) << 0))
+
+#define AES_INVSHIFROWS_LO(RS1, RS2) ( \
+    (((RS2 >> 24) & 0xFF) << 56) | (((RS2 >> 48) & 0xFF) << 48) | \
+    (((RS1 >> 8) & 0xFF) << 40) | (((RS1 >> 32) & 0xFF) << 32) | \
+    (((RS1 >> 56) & 0xFF) << 24) | (((RS2 >> 16) & 0xFF) << 16) | \
+    (((RS2 >> 40) & 0xFF) << 8) | (((RS1 >> 0) & 0xFF) << 0))
+
+#define AES_MIXBYTE(COL, B0, B1, B2, B3) ( \
+    BY(COL, B3) ^ BY(COL, B2) ^ AES_GFMUL(BY(COL, B1), 3) ^ \
+    AES_GFMUL(BY(COL, B0), 2))
+
+#define AES_MIXCOLUMN(COL) ( \
+    AES_MIXBYTE(COL, 3, 0, 1, 2) << 24 | \
+    AES_MIXBYTE(COL, 2, 3, 0, 1) << 16 | \
+    AES_MIXBYTE(COL, 1, 2, 3, 0) << 8 | AES_MIXBYTE(COL, 0, 1, 2, 3) << 0)
+
+#define AES_INVMIXBYTE(COL, B0, B1, B2, B3) ( \
+    AES_GFMUL(BY(COL, B3), 0x9) ^ AES_GFMUL(BY(COL, B2), 0xd) ^ \
+    AES_GFMUL(BY(COL, B1), 0xb) ^ AES_GFMUL(BY(COL, B0), 0xe))
+
+#define AES_INVMIXCOLUMN(COL) ( \
+    AES_INVMIXBYTE(COL, 3, 0, 1, 2) << 24 | \
+    AES_INVMIXBYTE(COL, 2, 3, 0, 1) << 16 | \
+    AES_INVMIXBYTE(COL, 1, 2, 3, 0) << 8 | \
+    AES_INVMIXBYTE(COL, 0, 1, 2, 3) << 0)
+
+static inline target_ulong aes64_operation(target_ulong rs1, target_ulong rs2,
+                                           bool enc, bool mix)
+{
+    uint64_t RS1 = rs1;
+    uint64_t RS2 = rs2;
+    uint64_t result;
+    uint64_t temp;
+    uint32_t col_0;
+    uint32_t col_1;
+
+    if (enc) {
+        temp = AES_SHIFROWS_LO(RS1, RS2);
+        temp = (((uint64_t)AES_sbox[(temp >> 0) & 0xFF] << 0) |
+                ((uint64_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
+                ((uint64_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
+                ((uint64_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
+                ((uint64_t)AES_sbox[(temp >> 32) & 0xFF] << 32) |
+                ((uint64_t)AES_sbox[(temp >> 40) & 0xFF] << 40) |
+                ((uint64_t)AES_sbox[(temp >> 48) & 0xFF] << 48) |
+                ((uint64_t)AES_sbox[(temp >> 56) & 0xFF] << 56));
+        if (mix) {
+            col_0 = temp & 0xFFFFFFFF;
+            col_1 = temp >> 32;
+
+            col_0 = AES_MIXCOLUMN(col_0);
+            col_1 = AES_MIXCOLUMN(col_1);
+
+            result = ((uint64_t)col_1 << 32) | col_0;
+        } else {
+            result = temp;
+        }
+    } else {
+        temp = AES_INVSHIFROWS_LO(RS1, RS2);
+        temp = (((uint64_t)AES_isbox[(temp >> 0) & 0xFF] << 0) |
+                ((uint64_t)AES_isbox[(temp >> 8) & 0xFF] << 8) |
+                ((uint64_t)AES_isbox[(temp >> 16) & 0xFF] << 16) |
+                ((uint64_t)AES_isbox[(temp >> 24) & 0xFF] << 24) |
+                ((uint64_t)AES_isbox[(temp >> 32) & 0xFF] << 32) |
+                ((uint64_t)AES_isbox[(temp >> 40) & 0xFF] << 40) |
+                ((uint64_t)AES_isbox[(temp >> 48) & 0xFF] << 48) |
+                ((uint64_t)AES_isbox[(temp >> 56) & 0xFF] << 56));
+        if (mix) {
+            col_0 = temp & 0xFFFFFFFF;
+            col_1 = temp >> 32;
+
+            col_0 = AES_INVMIXCOLUMN(col_0);
+            col_1 = AES_INVMIXCOLUMN(col_1);
+
+            result = ((uint64_t)col_1 << 32) | col_0;
+        } else {
+            result = temp;
+        }
+    }
+
+    return result;
+}
+
+target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2)
+{
+    return aes64_operation(rs1, rs2, true, true);
+}
+
+target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2)
+{
+    return aes64_operation(rs1, rs2, true, false);
+}
+
+target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2)
+{
+    return aes64_operation(rs1, rs2, false, false);
+}
+
+target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2)
+{
+    return aes64_operation(rs1, rs2, false, true);
+}
+
+target_ulong HELPER(aes64ks2)(target_ulong rs1, target_ulong rs2)
+{
+    uint64_t RS1 = rs1;
+    uint64_t RS2 = rs2;
+    uint32_t rs1_hi = RS1 >> 32;
+    uint32_t rs2_lo = RS2;
+    uint32_t rs2_hi = RS2 >> 32;
+
+    uint32_t r_lo = (rs1_hi ^ rs2_lo);
+    uint32_t r_hi = (rs1_hi ^ rs2_lo ^ rs2_hi);
+    target_ulong result = ((uint64_t)r_hi << 32) | r_lo;
+
+    return result;
+}
+
+target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
+{
+    uint64_t RS1 = rs1;
+    static const uint8_t round_consts[10] = {
+        0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36
+    };
+
+    uint8_t enc_rnum = rnum;
+    uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
+    uint8_t rcon_ = 0;
+    target_ulong result;
+
+    if (enc_rnum != 0xA) {
+        temp = ror32(temp, 8); /* Rotate right by 8 */
+        rcon_ = round_consts[enc_rnum];
+    }
+
+    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
+           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
+           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
+           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
+
+    temp ^= rcon_;
+
+    result = ((uint64_t)temp << 32) | temp;
+
+    return result;
+}
+
+target_ulong HELPER(aes64im)(target_ulong rs1)
+{
+    uint64_t RS1 = rs1;
+    uint32_t col_0 = RS1 & 0xFFFFFFFF;
+    uint32_t col_1 = RS1 >> 32;
+    target_ulong result;
+
+    col_0 = AES_INVMIXCOLUMN(col_0);
+    col_1 = AES_INVMIXCOLUMN(col_1);
+
+    result = ((uint64_t)col_1 << 32) | col_0;
+
+    return result;
+}
 #undef sext32_xlen
diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/insn_trans/trans_rvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_aes32dsi(DisasContext *ctx, arg_aes32dsi *a)
     REQUIRE_ZKND(ctx);
     return gen_aes32_sm4(ctx, a, gen_helper_aes32dsi);
 }
+
+static bool trans_aes64es(DisasContext *ctx, arg_aes64es *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_ZKNE(ctx);
+    return gen_arith(ctx, a, EXT_NONE, gen_helper_aes64es, NULL);
+}
+
+static bool trans_aes64esm(DisasContext *ctx, arg_aes64esm *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_ZKNE(ctx);
+    return gen_arith(ctx, a, EXT_NONE, gen_helper_aes64esm, NULL);
+}
+
+static bool trans_aes64ds(DisasContext *ctx, arg_aes64ds *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_ZKND(ctx);
+    return gen_arith(ctx, a, EXT_NONE, gen_helper_aes64ds, NULL);
+}
+
+static bool trans_aes64dsm(DisasContext *ctx, arg_aes64dsm *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_ZKND(ctx);
+    return gen_arith(ctx, a, EXT_NONE, gen_helper_aes64dsm, NULL);
+}
+
+static bool trans_aes64ks2(DisasContext *ctx, arg_aes64ks2 *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EITHER_EXT(ctx, zknd, zkne);
+    return gen_arith(ctx, a, EXT_NONE, gen_helper_aes64ks2, NULL);
+}
+
+static bool trans_aes64ks1i(DisasContext *ctx, arg_aes64ks1i *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_EITHER_EXT(ctx, zknd, zkne);
+
+    if (a->imm > 0xA) {
+        return false;
+    }
+
+    return gen_arith_imm_tl(ctx, a, EXT_NONE, gen_helper_aes64ks1i, NULL);
+}
+
+static bool trans_aes64im(DisasContext *ctx, arg_aes64im *a)
+{
+    REQUIRE_64BIT(ctx);
+    REQUIRE_ZKND(ctx);
+    return gen_unary(ctx, a, EXT_NONE, gen_helper_aes64im);
+}
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

- add sha256sig0, sha256sig1, sha256sum0 and sha256sum1 instructions

diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ aes64esm    00 11011 ..... ..... 000 ..... 0110011 @r
 # *** RV64 Zkne/zknd Standard Extension ***
 aes64ks2    01 11111 ..... ..... 000 ..... 0110011 @r
 aes64ks1i   00 11000 1.... ..... 001 ..... 0010011 @i_aes
+# *** RV32 Zknh Standard Extension ***
+sha256sig0  00 01000 00010 ..... 001 ..... 0010011 @r2
+sha256sig1  00 01000 00011 ..... 001 ..... 0010011 @r2
+sha256sum0  00 01000 00000 ..... 001 ..... 0010011 @r2
+sha256sum1  00 01000 00001 ..... 001 ..... 0010011 @r2
diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/insn_trans/trans_rvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvk.c.inc
@@ -XXX,XX +XXX,XX @@
     }                                           \
 } while (0)
 
+#define REQUIRE_ZKNH(ctx) do {                  \
+    if (!ctx->cfg_ptr->ext_zknh) {              \
+        return false;                           \
+    }                                           \
+} while (0)
+
 static bool gen_aes32_sm4(DisasContext *ctx, arg_k_aes *a,
                           void (*func)(TCGv, TCGv, TCGv, TCGv))
 {
@@ -XXX,XX +XXX,XX @@ static bool trans_aes64im(DisasContext *ctx, arg_aes64im *a)
     REQUIRE_ZKND(ctx);
     return gen_unary(ctx, a, EXT_NONE, gen_helper_aes64im);
 }
+
+static bool gen_sha256(DisasContext *ctx, arg_r2 *a, DisasExtend ext,
+                       void (*func)(TCGv_i32, TCGv_i32, int32_t),
+                       int32_t num1, int32_t num2, int32_t num3)
+{
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv src1 = get_gpr(ctx, a->rs1, ext);
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+
+    tcg_gen_trunc_tl_i32(t0, src1);
+    tcg_gen_rotri_i32(t1, t0, num1);
+    tcg_gen_rotri_i32(t2, t0, num2);
+    tcg_gen_xor_i32(t1, t1, t2);
+    func(t2, t0, num3);
+    tcg_gen_xor_i32(t1, t1, t2);
+    tcg_gen_ext_i32_tl(dest, t1);
+
+    gen_set_gpr(ctx, a->rd, dest);
+    tcg_temp_free_i32(t0);
+    tcg_temp_free_i32(t1);
+    tcg_temp_free_i32(t2);
+    return true;
+}
+
+static bool trans_sha256sig0(DisasContext *ctx, arg_sha256sig0 *a)
+{
+    REQUIRE_ZKNH(ctx);
+    return gen_sha256(ctx, a, EXT_NONE, tcg_gen_shri_i32, 7, 18, 3);
+}
+
+static bool trans_sha256sig1(DisasContext *ctx, arg_sha256sig1 *a)
+{
+    REQUIRE_ZKNH(ctx);
+    return gen_sha256(ctx, a, EXT_NONE, tcg_gen_shri_i32, 17, 19, 10);
+}
+
+static bool trans_sha256sum0(DisasContext *ctx, arg_sha256sum0 *a)
+{
+    REQUIRE_ZKNH(ctx);
+    return gen_sha256(ctx, a, EXT_NONE, tcg_gen_rotri_i32, 2, 13, 22);
+}
+
+static bool trans_sha256sum1(DisasContext *ctx, arg_sha256sum1 *a)
+{
+    REQUIRE_ZKNH(ctx);
+    return gen_sha256(ctx, a, EXT_NONE, tcg_gen_rotri_i32, 6, 11, 25);
+}
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

- add sha512sum0r, sha512sig0l, sha512sum1r, sha512sig1l, sha512sig0h and sha512sig1h instructions

diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ sha256sig0  00 01000 00010 ..... 001 ..... 0010011 @r2
 sha256sig1  00 01000 00011 ..... 001 ..... 0010011 @r2
 sha256sum0  00 01000 00000 ..... 001 ..... 0010011 @r2
 sha256sum1  00 01000 00001 ..... 001 ..... 0010011 @r2
+sha512sum0r 01 01000 ..... ..... 000 ..... 0110011 @r
+sha512sum1r 01 01001 ..... ..... 000 ..... 0110011 @r
+sha512sig0l 01 01010 ..... ..... 000 ..... 0110011 @r
+sha512sig0h 01 01110 ..... ..... 000 ..... 0110011 @r
+sha512sig1l 01 01011 ..... ..... 000 ..... 0110011 @r
+sha512sig1h 01 01111 ..... ..... 000 ..... 0110011 @r
diff --git a/target/riscv/insn_trans/trans_rvk.c.inc b/target/riscv/insn_trans/trans_rvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_sha256sum1(DisasContext *ctx, arg_sha256sum1 *a)
     REQUIRE_ZKNH(ctx);
     return gen_sha256(ctx, a, EXT_NONE, tcg_gen_rotri_i32, 6, 11, 25);
 }
+
+static bool gen_sha512_rv32(DisasContext *ctx, arg_r *a, DisasExtend ext,
+                            void (*func1)(TCGv_i64, TCGv_i64, int64_t),
+                            void (*func2)(TCGv_i64, TCGv_i64, int64_t),
+                            int64_t num1, int64_t num2, int64_t num3)
+{
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv src1 = get_gpr(ctx, a->rs1, ext);
+    TCGv src2 = get_gpr(ctx, a->rs2, ext);
+    TCGv_i64 t0 = tcg_temp_new_i64();
+    TCGv_i64 t1 = tcg_temp_new_i64();
+    TCGv_i64 t2 = tcg_temp_new_i64();
+
+    tcg_gen_concat_tl_i64(t0, src1, src2);
+    func1(t1, t0, num1);
+    func2(t2, t0, num2);
+    tcg_gen_xor_i64(t1, t1, t2);
+    tcg_gen_rotri_i64(t2, t0, num3);
+    tcg_gen_xor_i64(t1, t1, t2);
+    tcg_gen_trunc_i64_tl(dest, t1);
+
+    gen_set_gpr(ctx, a->rd, dest);
+    tcg_temp_free_i64(t0);
+    tcg_temp_free_i64(t1);
+    tcg_temp_free_i64(t2);
+    return true;
+}
+
+static bool trans_sha512sum0r(DisasContext *ctx, arg_sha512sum0r *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZKNH(ctx);
+    return gen_sha512_rv32(ctx, a, EXT_NONE, tcg_gen_rotli_i64,
+                           tcg_gen_rotli_i64, 25, 30, 28);
+}
+
+static bool trans_sha512sum1r(DisasContext *ctx, arg_sha512sum1r *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZKNH(ctx);
+    return gen_sha512_rv32(ctx, a, EXT_NONE, tcg_gen_rotli_i64,
+                           tcg_gen_rotri_i64, 23, 14, 18);
+}
+
+static bool trans_sha512sig0l(DisasContext *ctx, arg_sha512sig0l *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZKNH(ctx);
+    return gen_sha512_rv32(ctx, a, EXT_NONE, tcg_gen_rotri_i64,
+                           tcg_gen_rotri_i64, 1, 7, 8);
+}
+
+static bool trans_sha512sig1l(DisasContext *ctx, arg_sha512sig1l *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZKNH(ctx);
+    return gen_sha512_rv32(ctx, a, EXT_NONE, tcg_gen_rotli_i64,
+                           tcg_gen_rotri_i64, 3, 6, 19);
+}
+
+static bool gen_sha512h_rv32(DisasContext *ctx, arg_r *a, DisasExtend ext,
+                             void (*func)(TCGv_i64, TCGv_i64, int64_t),
+                             int64_t num1, int64_t num2, int64_t num3)
+{
+    TCGv dest = dest_gpr(ctx, a->rd);
+    TCGv src1 = get_gpr(ctx, a->rs1, ext);
+    TCGv src2 = get_gpr(ctx, a->rs2, ext);
+    TCGv_i64 t0 = tcg_temp_new_i64();
+    TCGv_i64 t1 = tcg_temp_new_i64();
+    TCGv_i64 t2 = tcg_temp_new_i64();
+
+    tcg_gen_concat_tl_i64(t0, src1, src2);
+    func(t1, t0, num1);
+    tcg_gen_ext32u_i64(t2, t0);
+    tcg_gen_shri_i64(t2, t2, num2);
+    tcg_gen_xor_i64(t1, t1, t2);
+    tcg_gen_rotri_i64(t2, t0, num3);
+    tcg_gen_xor_i64(t1, t1, t2);
+    tcg_gen_trunc_i64_tl(dest, t1);
+
+    gen_set_gpr(ctx, a->rd, dest);
+    tcg_temp_free_i64(t0);
+    tcg_temp_free_i64(t1);
+    tcg_temp_free_i64(t2);
+    return true;
+}
+
+static bool trans_sha512sig0h(DisasContext *ctx, arg_sha512sig0h *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZKNH(ctx);
+    return gen_sha512h_rv32(ctx, a, EXT_NONE, tcg_gen_rotri_i64, 1, 7, 8);
+}
+
+static bool trans_sha512sig1h(DisasContext *ctx, arg_sha512sig1h *a)
+{
+    REQUIRE_32BIT(ctx);
+    REQUIRE_ZKNH(ctx);
+    return gen_sha512h_rv32(ctx, a, EXT_NONE, tcg_gen_rotli_i64, 3, 6, 19);
+}
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

- add sha512sum0, sha512sig0, sha512sum1 and sha512sig1 instructions

From: Weiwei Li <liweiwei@iscas.ac.cn>

- add sm3p0, sm3p1, sm4ed and sm4ks instructions

Co-authored-by: Ruibo Lu <luruibo2000@163.com>
Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220423023510.30794-12-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                   |  3 ++
 target/riscv/insn32.decode              |  6 +++
 target/riscv/crypto_helper.c            | 28 ++++++++++++
 target/riscv/insn_trans/trans_rvk.c.inc | 58 +++++++++++++++++++++++++
 4 files changed, 95 insertions(+)

From: Weiwei Li <liweiwei@iscas.ac.cn>

- add SEED CSR which must be accessed with a read-write instruction:
   A read-only instruction such as CSRRS/CSRRC with rs1=x0 or CSRRSI/CSRRCI
with uimm=0 will raise an illegal instruction exception.
 - add USEED, SSEED fields for MSECCFG CSR

Co-authored-by: Ruibo Lu <luruibo2000@163.com>
Co-authored-by: Zewen Ye <lustrew@foxmail.com>
Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220423023510.30794-13-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h  |  9 +++++
 target/riscv/pmp.h       |  8 ++--
 target/riscv/csr.c       | 80 ++++++++++++++++++++++++++++++++++++++++
 target/riscv/op_helper.c |  9 +++++
 4 files changed, 103 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define CSR_VSPMMASK        0x2c1
 #define CSR_VSPMBASE        0x2c2
 
+/* Crypto Extension */
+#define CSR_SEED            0x015
+
 /* mstatus CSR bits */
 #define MSTATUS_UIE         0x00000001
 #define MSTATUS_SIE         0x00000002
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define HVICTL_VALID_MASK                  \
     (HVICTL_VTI | HVICTL_IID | HVICTL_IPRIOM | HVICTL_IPRIO)
 
+/* seed CSR bits */
+#define SEED_OPST                        (0b11 << 30)
+#define SEED_OPST_BIST                   (0b00 << 30)
+#define SEED_OPST_WAIT                   (0b01 << 30)
+#define SEED_OPST_ES16                   (0b10 << 30)
+#define SEED_OPST_DEAD                   (0b11 << 30)
 #endif
diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
 } pmp_am_t;
 
 typedef enum {
-    MSECCFG_MML  = 1 << 0,
-    MSECCFG_MMWP = 1 << 1,
-    MSECCFG_RLB  = 1 << 2
+    MSECCFG_MML   = 1 << 0,
+    MSECCFG_MMWP  = 1 << 1,
+    MSECCFG_RLB   = 1 << 2,
+    MSECCFG_USEED = 1 << 8,
+    MSECCFG_SSEED = 1 << 9
 } mseccfg_field_t;
 
 typedef struct {
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/main-loop.h"
 #include "exec/exec-all.h"
 #include "sysemu/cpu-timers.h"
+#include "qemu/guest-random.h"
+#include "qapi/error.h"
 
 /* CSR function table public API */
 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
@@ -XXX,XX +XXX,XX @@ static RISCVException debug(CPURISCVState *env, int csrno)
 }
 #endif
 
+static RISCVException seed(CPURISCVState *env, int csrno)
+{
+    RISCVCPU *cpu = env_archcpu(env);
+
+    if (!cpu->cfg.ext_zkr) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+#if !defined(CONFIG_USER_ONLY)
+    /*
+     * With a CSR read-write instruction:
+     * 1) The seed CSR is always available in machine mode as normal.
+     * 2) Attempted access to seed from virtual modes VS and VU always raises
+     * an exception(virtual instruction exception only if mseccfg.sseed=1).
+     * 3) Without the corresponding access control bit set to 1, any attempted
+     * access to seed from U, S or HS modes will raise an illegal instruction
+     * exception.
+     */
+    if (env->priv == PRV_M) {
+        return RISCV_EXCP_NONE;
+    } else if (riscv_cpu_virt_enabled(env)) {
+        if (env->mseccfg & MSECCFG_SSEED) {
+            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+        } else {
+            return RISCV_EXCP_ILLEGAL_INST;
+        }
+    } else {
+        if (env->priv == PRV_S && (env->mseccfg & MSECCFG_SSEED)) {
+            return RISCV_EXCP_NONE;
+        } else if (env->priv == PRV_U && (env->mseccfg & MSECCFG_USEED)) {
+            return RISCV_EXCP_NONE;
+        } else {
+            return RISCV_EXCP_ILLEGAL_INST;
+        }
+    }
+#else
+    return RISCV_EXCP_NONE;
+#endif
+}
+
 /* User Floating-Point CSRs */
 static RISCVException read_fflags(CPURISCVState *env, int csrno,
                                   target_ulong *val)
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
 
 #endif
 
+/* Crypto Extension */
+static RISCVException rmw_seed(CPURISCVState *env, int csrno,
+                               target_ulong *ret_value,
+                               target_ulong new_value,
+                               target_ulong write_mask)
+{
+    uint16_t random_v;
+    Error *random_e = NULL;
+    int random_r;
+    target_ulong rval;
+
+    random_r = qemu_guest_getrandom(&random_v, 2, &random_e);
+    if (unlikely(random_r < 0)) {
+        /*
+         * Failed, for unknown reasons in the crypto subsystem.
+         * The best we can do is log the reason and return a
+         * failure indication to the guest.  There is no reason
+         * we know to expect the failure to be transitory, so
+         * indicate DEAD to avoid having the guest spin on WAIT.
+         */
+        qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
+                      __func__, error_get_pretty(random_e));
+        error_free(random_e);
+        rval = SEED_OPST_DEAD;
+    } else {
+        rval = random_v | SEED_OPST_ES16;
+    }
+
+    if (ret_value) {
+        *ret_value = rval;
+    }
+
+    return RISCV_EXCP_NONE;
+}
+
 /*
  * riscv_csrrw - read and/or update control and status register
  *
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_TIME]  = { "time",  ctr,   read_time  },
     [CSR_TIMEH] = { "timeh", ctr32, read_timeh },
 
+    /* Crypto Extension */
+    [CSR_SEED] = { "seed", seed, NULL, NULL, rmw_seed },
+
 #if !defined(CONFIG_USER_ONLY)
     /* Machine Timers and Counters */
     [CSR_MCYCLE]    = { "mcycle",    any,   read_instret  },
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_raise_exception(CPURISCVState *env, uint32_t exception)
 
 target_ulong helper_csrr(CPURISCVState *env, int csr)
 {
+    /*
+     * The seed CSR must be accessed with a read-write instruction. A
+     * read-only instruction such as CSRRS/CSRRC with rs1=x0 or CSRRSI/
+     * CSRRCI with uimm=0 will raise an illegal instruction exception.
+     */
+    if (csr == CSR_SEED) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+    }
+
     target_ulong val = 0;
     RISCVException ret = riscv_csrrw(env, csr, &val, 0, 0);
 
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Co-authored-by: Ruibo Lu <luruibo2000@163.com>
Co-authored-by: Zewen Ye <lustrew@foxmail.com>
Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220423023510.30794-14-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 173 +++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 172 insertions(+), 1 deletion(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_codec_css_swsp,
     rv_codec_css_sdsp,
     rv_codec_css_sqsp,
+    rv_codec_k_bs,
+    rv_codec_k_rnum,
 } rv_codec;
 
 typedef enum {
@@ -XXX,XX +XXX,XX @@ typedef enum {
     rv_op_bclr = 359,
     rv_op_binv = 360,
     rv_op_bext = 361,
+    rv_op_aes32esmi = 362,
+    rv_op_aes32esi = 363,
+    rv_op_aes32dsmi = 364,
+    rv_op_aes32dsi = 365,
+    rv_op_aes64ks1i = 366,
+    rv_op_aes64ks2 = 367,
+    rv_op_aes64im = 368,
+    rv_op_aes64esm = 369,
+    rv_op_aes64es = 370,
+    rv_op_aes64dsm = 371,
+    rv_op_aes64ds = 372,
+    rv_op_sha256sig0 = 373,
+    rv_op_sha256sig1 = 374,
+    rv_op_sha256sum0 = 375,
+    rv_op_sha256sum1 = 376,
+    rv_op_sha512sig0 = 377,
+    rv_op_sha512sig1 = 378,
+    rv_op_sha512sum0 = 379,
+    rv_op_sha512sum1 = 380,
+    rv_op_sha512sum0r = 381,
+    rv_op_sha512sum1r = 382,
+    rv_op_sha512sig0l = 383,
+    rv_op_sha512sig0h = 384,
+    rv_op_sha512sig1l = 385,
+    rv_op_sha512sig1h = 386,
+    rv_op_sm3p0 = 387,
+    rv_op_sm3p1 = 388,
+    rv_op_sm4ed = 389,
+    rv_op_sm4ks = 390,
+    rv_op_brev8 = 391,
+    rv_op_pack = 392,
+    rv_op_packh = 393,
+    rv_op_packw = 394,
+    rv_op_unzip = 395,
+    rv_op_zip = 396,
+    rv_op_xperm4 = 397,
+    rv_op_xperm8 = 398,
 } rv_op;
 
 /* structures */
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint8_t   succ;
     uint8_t   aq;
     uint8_t   rl;
+    uint8_t   bs;
+    uint8_t   rnum;
 } rv_decode;
 
 typedef struct {
@@ -XXX,XX +XXX,XX @@ static const char rv_freg_name_sym[32][5] = {
 #define rv_fmt_rd_rs2                 "O\t0,2"
 #define rv_fmt_rs1_offset             "O\t1,o"
 #define rv_fmt_rs2_offset             "O\t2,o"
+#define rv_fmt_rs1_rs2_bs             "O\t1,2,b"
+#define rv_fmt_rd_rs1_rnum            "O\t0,1,n"
 
 /* pseudo-instruction constraints */
 
@@ -XXX,XX +XXX,XX @@ static const rv_comp_data rvcp_csrrw[] = {
     { rv_op_illegal, NULL }
 };
 
+
 static const rv_comp_data rvcp_csrrs[] = {
     { rv_op_rdcycle, rvcc_rdcycle },
     { rv_op_rdtime, rvcc_rdtime },
@@ -XXX,XX +XXX,XX @@ const rv_opcode_data opcode_data[] = {
     { "bclr", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
     { "binv", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
     { "bext", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "aes32esmi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+    { "aes32esi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+    { "aes32dsmi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+    { "aes32dsi", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+    { "aes64ks1i", rv_codec_k_rnum,  rv_fmt_rd_rs1_rnum, NULL, 0, 0, 0 },
+    { "aes64ks2", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "aes64im", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+    { "aes64esm", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "aes64es", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "aes64dsm", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "aes64ds", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "sha256sig0", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+    { "sha256sig1", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+    { "sha256sum0", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+    { "sha256sum1", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+    { "sha512sig0", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "sha512sig1", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "sha512sum0", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "sha512sum1", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "sha512sum0r", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "sha512sum1r", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "sha512sig0l", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "sha512sig0h", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "sha512sig1l", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "sha512sig1h", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "sm3p0", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+    { "sm3p1", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0 },
+    { "sm4ed", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+    { "sm4ks", rv_codec_k_bs, rv_fmt_rs1_rs2_bs, NULL, 0, 0, 0 },
+    { "brev8", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "pack", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "packh", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "packw", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "unzip", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "zip", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0, 0 },
+    { "xperm4", rv_codec_r, rv_fmt_rd_rs1_rs2, NULL, 0, 0, 0 },
+    { "xperm8", rv_codec_r, rv_fmt_rd_rs1, NULL, 0, 0, 0 }
 };
 
 /* CSR names */
@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
     case 0x0003: return "fcsr";
     case 0x0004: return "uie";
     case 0x0005: return "utvec";
+    case 0x0015: return "seed";
     case 0x0040: return "uscratch";
     case 0x0041: return "uepc";
     case 0x0042: return "ucause";
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
             case 1:
                 switch (((inst >> 27) & 0b11111)) {
                 case 0b00000: op = rv_op_slli; break;
+                case 0b00001:
+                    switch (((inst >> 20) & 0b1111111)) {
+                    case 0b0001111: op = rv_op_zip; break;
+                    }
+                    break;
+                case 0b00010:
+                    switch (((inst >> 20) & 0b1111111)) {
+                    case 0b0000000: op = rv_op_sha256sum0; break;
+                    case 0b0000001: op = rv_op_sha256sum1; break;
+                    case 0b0000010: op = rv_op_sha256sig0; break;
+                    case 0b0000011: op = rv_op_sha256sig1; break;
+                    case 0b0000100: op = rv_op_sha512sum0; break;
+                    case 0b0000101: op = rv_op_sha512sum1; break;
+                    case 0b0000110: op = rv_op_sha512sig0; break;
+                    case 0b0000111: op = rv_op_sha512sig1; break;
+                    case 0b0001000: op = rv_op_sm3p0; break;
+                    case 0b0001001: op = rv_op_sm3p1; break;
+                    }
+                    break;
                 case 0b00101: op = rv_op_bseti; break;
+                case 0b00110:
+                    switch (((inst >> 20) & 0b1111111)) {
+                    case 0b0000000: op = rv_op_aes64im; break;
+                    default:
+                        if (((inst >> 24) & 0b0111) == 0b001) {
+                            op = rv_op_aes64ks1i;
+                        }
+                        break;
+                     }
+                     break;
                 case 0b01001: op = rv_op_bclri; break;
                 case 0b01101: op = rv_op_binvi; break;
                 case 0b01100:
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
             case 5:
                 switch (((inst >> 27) & 0b11111)) {
                 case 0b00000: op = rv_op_srli; break;
+                case 0b00001:
+                    switch (((inst >> 20) & 0b1111111)) {
+                    case 0b0001111: op = rv_op_unzip; break;
+                    }
+                    break;
                 case 0b00101: op = rv_op_orc_b; break;
                 case 0b01000: op = rv_op_srai; break;
                 case 0b01001: op = rv_op_bexti; break;
                 case 0b01100: op = rv_op_rori; break;
                 case 0b01101:
                     switch ((inst >> 20) & 0b1111111) {
+                    case 0b0011000: op = rv_op_rev8; break;
                     case 0b0111000: op = rv_op_rev8; break;
+                    case 0b0000111: op = rv_op_brev8; break;
                     }
                     break;
                 }
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
             case 36:
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_zext_h; break;
+                default: op = rv_op_pack; break;
                 }
                 break;
+            case 39: op = rv_op_packh; break;
+
             case 41: op = rv_op_clmul; break;
             case 42: op = rv_op_clmulr; break;
             case 43: op = rv_op_clmulh; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
             case 132: op = rv_op_sh2add; break;
             case 134: op = rv_op_sh3add; break;
             case 161: op = rv_op_bset; break;
+            case 162: op = rv_op_xperm4; break;
+            case 164: op = rv_op_xperm8; break;
+            case 200: op = rv_op_aes64es; break;
+            case 216: op = rv_op_aes64esm; break;
+            case 232: op = rv_op_aes64ds; break;
+            case 248: op = rv_op_aes64dsm; break;
             case 256: op = rv_op_sub; break;
             case 260: op = rv_op_xnor; break;
             case 261: op = rv_op_sra; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
             case 263: op = rv_op_andn; break;
             case 289: op = rv_op_bclr; break;
             case 293: op = rv_op_bext; break;
+            case 320: op = rv_op_sha512sum0r; break;
+            case 328: op = rv_op_sha512sum1r; break;
+            case 336: op = rv_op_sha512sig0l; break;
+            case 344: op = rv_op_sha512sig1l; break;
+            case 368: op = rv_op_sha512sig0h; break;
+            case 376: op = rv_op_sha512sig1h; break;
             case 385: op = rv_op_rol; break;
-            case 386: op = rv_op_ror; break;
+            case 389: op = rv_op_ror; break;
             case 417: op = rv_op_binv; break;
+            case 504: op = rv_op_aes64ks2; break;
+            }
+            switch ((inst >> 25) & 0b0011111) {
+            case 17: op = rv_op_aes32esi; break;
+            case 19: op = rv_op_aes32esmi; break;
+            case 21: op = rv_op_aes32dsi; break;
+            case 23: op = rv_op_aes32dsmi; break;
+            case 24: op = rv_op_sm4ed; break;
+            case 26: op = rv_op_sm4ks; break;
             }
             break;
         case 13: op = rv_op_lui; break;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa)
             case 36:
                 switch ((inst >> 20) & 0b11111) {
                 case 0: op = rv_op_zext_h; break;
+                default: op = rv_op_packw; break;
                 }
                 break;
             case 130: op = rv_op_sh1add_uw; break;
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_cimmq(rv_inst inst)
         ((inst << 57) >> 62) << 6;
 }
 
+static uint32_t operand_bs(rv_inst inst)
+{
+    return (inst << 32) >> 62;
+}
+
+static uint32_t operand_rnum(rv_inst inst)
+{
+    return (inst << 40) >> 60;
+}
+
 /* decode operands */
 
 static void decode_inst_operands(rv_decode *dec)
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec)
         dec->rs2 = operand_crs2(inst);
         dec->imm = operand_cimmsqsp(inst);
         break;
+    case rv_codec_k_bs:
+        dec->rs1 = operand_rs1(inst);
+        dec->rs2 = operand_rs2(inst);
+        dec->bs = operand_bs(inst);
+        break;
+    case rv_codec_k_rnum:
+        dec->rd = operand_rd(inst);
+        dec->rs1 = operand_rs1(inst);
+        dec->rnum = operand_rnum(inst);
+        break;
     };
 }
 
@@ -XXX,XX +XXX,XX @@ static void format_inst(char *buf, size_t buflen, size_t tab, rv_decode *dec)
         case ')':
             append(buf, ")", buflen);
             break;
+        case 'b':
+            snprintf(tmp, sizeof(tmp), "%d", dec->bs);
+            append(buf, tmp, buflen);
+            break;
+        case 'n':
+            snprintf(tmp, sizeof(tmp), "%d", dec->rnum);
+            append(buf, tmp, buflen);
+            break;
         case '0':
             append(buf, rv_ireg_name_sym[dec->rd], buflen);
             break;
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220423023510.30794-15-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
     DEFINE_PROP_BOOL("zba", RISCVCPU, cfg.ext_zba, true),
     DEFINE_PROP_BOOL("zbb", RISCVCPU, cfg.ext_zbb, true),
     DEFINE_PROP_BOOL("zbc", RISCVCPU, cfg.ext_zbc, true),
+    DEFINE_PROP_BOOL("zbkb", RISCVCPU, cfg.ext_zbkb, false),
+    DEFINE_PROP_BOOL("zbkc", RISCVCPU, cfg.ext_zbkc, false),
+    DEFINE_PROP_BOOL("zbkx", RISCVCPU, cfg.ext_zbkx, false),
     DEFINE_PROP_BOOL("zbs", RISCVCPU, cfg.ext_zbs, true),
+    DEFINE_PROP_BOOL("zk", RISCVCPU, cfg.ext_zk, false),
+    DEFINE_PROP_BOOL("zkn", RISCVCPU, cfg.ext_zkn, false),
+    DEFINE_PROP_BOOL("zknd", RISCVCPU, cfg.ext_zknd, false),
+    DEFINE_PROP_BOOL("zkne", RISCVCPU, cfg.ext_zkne, false),
+    DEFINE_PROP_BOOL("zknh", RISCVCPU, cfg.ext_zknh, false),
+    DEFINE_PROP_BOOL("zkr", RISCVCPU, cfg.ext_zkr, false),
+    DEFINE_PROP_BOOL("zks", RISCVCPU, cfg.ext_zks, false),
+    DEFINE_PROP_BOOL("zksed", RISCVCPU, cfg.ext_zksed, false),
+    DEFINE_PROP_BOOL("zksh", RISCVCPU, cfg.ext_zksh, false),
+    DEFINE_PROP_BOOL("zkt", RISCVCPU, cfg.ext_zkt, false),
 
     DEFINE_PROP_BOOL("zdinx", RISCVCPU, cfg.ext_zdinx, false),
     DEFINE_PROP_BOOL("zfinx", RISCVCPU, cfg.ext_zfinx, false),
-- 
2.35.1

From: Ralf Ramsauer <ralf.ramsauer@oth-regensburg.de>

Two non-subsequent PTEs can be mapped to subsequent paddrs. In this
case, walk_pte will erroneously merge them.

Enforce the split up, by tracking the virtual base address.

Let's say we have the mapping:
0x81200000 -> 0x89623000 (4K)
0x8120f000 -> 0x89624000 (4K)

Before, walk_pte would have shown:

vaddr            paddr            size             attr
---------------- ---------------- ---------------- -------
0000000081200000 0000000089623000 0000000000002000 rwxu-ad

as it only checks for subsequent paddrs. With this patch, it becomes:

vaddr            paddr            size             attr
---------------- ---------------- ---------------- -------
0000000081200000 0000000089623000 0000000000001000 rwxu-ad
000000008120f000 0000000089624000 0000000000001000 rwxu-ad

Signed-off-by: Ralf Ramsauer <ralf.ramsauer@oth-regensburg.de>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220423215907.673663-1-ralf.ramsauer@oth-regensburg.de>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/monitor.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -XXX,XX +XXX,XX @@ static void walk_pte(Monitor *mon, hwaddr base, target_ulong start,
 {
     hwaddr pte_addr;
     hwaddr paddr;
+    target_ulong last_start = -1;
     target_ulong pgsize;
     target_ulong pte;
     int ptshift;
@@ -XXX,XX +XXX,XX @@ static void walk_pte(Monitor *mon, hwaddr base, target_ulong start,
                  * A leaf PTE has been found
                  *
                  * If current PTE's permission bits differ from the last one,
-                 * or current PTE's ppn does not make a contiguous physical
-                 * address block together with the last one, print out the last
-                 * contiguous mapped block details.
+                 * or the current PTE breaks up a contiguous virtual or
+                 * physical mapping, address block together with the last one,
+                 * print out the last contiguous mapped block details.
                  */
                 if ((*last_attr != attr) ||
-                    (*last_paddr + *last_size != paddr)) {
+                    (*last_paddr + *last_size != paddr) ||
+                    (last_start + *last_size != start)) {
                     print_pte(mon, va_bits, *vbase, *pbase,
                               *last_paddr + *last_size - *pbase, *last_attr);
 
@@ -XXX,XX +XXX,XX @@ static void walk_pte(Monitor *mon, hwaddr base, target_ulong start,
                     *last_attr = attr;
                 }
 
+                last_start = start;
                 *last_paddr = paddr;
                 *last_size = pgsize;
             } else {
-- 
2.35.1

From: Weiwei Li <liweiwei@iscas.ac.cn>

- add zbk* and zk* strings to isa_edata_arr

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Tested-by: Jiatai He <jiatai2021@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220426095204.24142-1-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str, int max_str_len)
         ISA_EDATA_ENTRY(zba, ext_zba),
         ISA_EDATA_ENTRY(zbb, ext_zbb),
         ISA_EDATA_ENTRY(zbc, ext_zbc),
+        ISA_EDATA_ENTRY(zbkb, ext_zbkb),
+        ISA_EDATA_ENTRY(zbkc, ext_zbkc),
+        ISA_EDATA_ENTRY(zbkx, ext_zbkx),
         ISA_EDATA_ENTRY(zbs, ext_zbs),
+        ISA_EDATA_ENTRY(zk, ext_zk),
+        ISA_EDATA_ENTRY(zkn, ext_zkn),
+        ISA_EDATA_ENTRY(zknd, ext_zknd),
+        ISA_EDATA_ENTRY(zkne, ext_zkne),
+        ISA_EDATA_ENTRY(zknh, ext_zknh),
+        ISA_EDATA_ENTRY(zkr, ext_zkr),
+        ISA_EDATA_ENTRY(zks, ext_zks),
+        ISA_EDATA_ENTRY(zksed, ext_zksed),
+        ISA_EDATA_ENTRY(zksh, ext_zksh),
+        ISA_EDATA_ENTRY(zkt, ext_zkt),
         ISA_EDATA_ENTRY(zve32f, ext_zve32f),
         ISA_EDATA_ENTRY(zve64f, ext_zve64f),
         ISA_EDATA_ENTRY(svinval, ext_svinval),
-- 
2.35.1

From: Alistair Francis <alistair.francis@wdc.com>

Move the binary and device tree loading code to the machine done
notifier. This allows us to prepare for editing the device tree as part
of the notifier.

This is based on similar code in the ARM virt machine.

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ struct RISCVVirtState {
     MachineState parent;
 
     /*< public >*/
+    Notifier machine_done;
     RISCVHartArrayState soc[VIRT_SOCKETS_MAX];
     DeviceState *irqchip[VIRT_SOCKETS_MAX];
     PFlashCFI01 *flash[2];
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
     return aplic_m;
 }
 
+static void virt_machine_done(Notifier *notifier, void *data)
+{
+    RISCVVirtState *s = container_of(notifier, RISCVVirtState,
+                                     machine_done);
+    const MemMapEntry *memmap = virt_memmap;
+    MachineState *machine = MACHINE(s);
+    target_ulong start_addr = memmap[VIRT_DRAM].base;
+    target_ulong firmware_end_addr, kernel_start_addr;
+    uint32_t fdt_load_addr;
+    uint64_t kernel_entry;
+
+    /*
+     * Only direct boot kernel is currently supported for KVM VM,
+     * so the "-bios" parameter is not supported when KVM is enabled.
+     */
+    if (kvm_enabled()) {
+        if (machine->firmware) {
+            if (strcmp(machine->firmware, "none")) {
+                error_report("Machine mode firmware is not supported in "
+                             "combination with KVM.");
+                exit(1);
+            }
+        } else {
+            machine->firmware = g_strdup("none");
+        }
+    }
+
+    if (riscv_is_32bit(&s->soc[0])) {
+        firmware_end_addr = riscv_find_and_load_firmware(machine,
+                                    RISCV32_BIOS_BIN, start_addr, NULL);
+    } else {
+        firmware_end_addr = riscv_find_and_load_firmware(machine,
+                                    RISCV64_BIOS_BIN, start_addr, NULL);
+    }
+
+    if (machine->kernel_filename) {
+        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc[0],
+                                                         firmware_end_addr);
+
+        kernel_entry = riscv_load_kernel(machine->kernel_filename,
+                                         kernel_start_addr, NULL);
+
+        if (machine->initrd_filename) {
+            hwaddr start;
+            hwaddr end = riscv_load_initrd(machine->initrd_filename,
+                                           machine->ram_size, kernel_entry,
+                                           &start);
+            qemu_fdt_setprop_cell(machine->fdt, "/chosen",
+                                  "linux,initrd-start", start);
+            qemu_fdt_setprop_cell(machine->fdt, "/chosen", "linux,initrd-end",
+                                  end);
+        }
+    } else {
+       /*
+        * If dynamic firmware is used, it doesn't know where is the next mode
+        * if kernel argument is not set.
+        */
+        kernel_entry = 0;
+    }
+
+    if (drive_get(IF_PFLASH, 0, 0)) {
+        /*
+         * Pflash was supplied, let's overwrite the address we jump to after
+         * reset to the base of the flash.
+         */
+        start_addr = virt_memmap[VIRT_FLASH].base;
+    }
+
+    /*
+     * Init fw_cfg.  Must be done before riscv_load_fdt, otherwise the device
+     * tree cannot be altered and we get FDT_ERR_NOSPACE.
+     */
+    s->fw_cfg = create_fw_cfg(machine);
+    rom_set_fw(s->fw_cfg);
+
+    /* Compute the fdt load address in dram */
+    fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
+                                   machine->ram_size, machine->fdt);
+    /* load the reset vector */
+    riscv_setup_rom_reset_vec(machine, &s->soc[0], start_addr,
+                              virt_memmap[VIRT_MROM].base,
+                              virt_memmap[VIRT_MROM].size, kernel_entry,
+                              fdt_load_addr, machine->fdt);
+
+    /*
+     * Only direct boot kernel is currently supported for KVM VM,
+     * So here setup kernel start address and fdt address.
+     * TODO:Support firmware loading and integrate to TCG start
+     */
+    if (kvm_enabled()) {
+        riscv_setup_direct_kernel(kernel_entry, fdt_load_addr);
+    }
+}
+
 static void virt_machine_init(MachineState *machine)
 {
     const MemMapEntry *memmap = virt_memmap;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
     char *soc_name;
-    target_ulong start_addr = memmap[VIRT_DRAM].base;
-    target_ulong firmware_end_addr, kernel_start_addr;
-    uint32_t fdt_load_addr;
-    uint64_t kernel_entry;
     DeviceState *mmio_irqchip, *virtio_irqchip, *pcie_irqchip;
     int i, base_hartid, hart_count;
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
     memory_region_add_subregion(system_memory, memmap[VIRT_DRAM].base,
         machine->ram);
 
-    /* create device tree */
-    create_fdt(s, memmap, machine->ram_size, machine->kernel_cmdline,
-               riscv_is_32bit(&s->soc[0]));
-
     /* boot rom */
     memory_region_init_rom(mask_rom, NULL, "riscv_virt_board.mrom",
                            memmap[VIRT_MROM].size, &error_fatal);
     memory_region_add_subregion(system_memory, memmap[VIRT_MROM].base,
                                 mask_rom);
 
-    /*
-     * Only direct boot kernel is currently supported for KVM VM,
-     * so the "-bios" parameter is not supported when KVM is enabled.
-     */
-    if (kvm_enabled()) {
-        if (machine->firmware) {
-            if (strcmp(machine->firmware, "none")) {
-                error_report("Machine mode firmware is not supported in "
-                             "combination with KVM.");
-                exit(1);
-            }
-        } else {
-            machine->firmware = g_strdup("none");
-        }
-    }
-
-    if (riscv_is_32bit(&s->soc[0])) {
-        firmware_end_addr = riscv_find_and_load_firmware(machine,
-                                    RISCV32_BIOS_BIN, start_addr, NULL);
-    } else {
-        firmware_end_addr = riscv_find_and_load_firmware(machine,
-                                    RISCV64_BIOS_BIN, start_addr, NULL);
-    }
-
-    if (machine->kernel_filename) {
-        kernel_start_addr = riscv_calc_kernel_start_addr(&s->soc[0],
-                                                         firmware_end_addr);
-
-        kernel_entry = riscv_load_kernel(machine->kernel_filename,
-                                         kernel_start_addr, NULL);
-
-        if (machine->initrd_filename) {
-            hwaddr start;
-            hwaddr end = riscv_load_initrd(machine->initrd_filename,
-                                           machine->ram_size, kernel_entry,
-                                           &start);
-            qemu_fdt_setprop_cell(machine->fdt, "/chosen",
-                                  "linux,initrd-start", start);
-            qemu_fdt_setprop_cell(machine->fdt, "/chosen", "linux,initrd-end",
-                                  end);
-        }
-    } else {
-       /*
-        * If dynamic firmware is used, it doesn't know where is the next mode
-        * if kernel argument is not set.
-        */
-        kernel_entry = 0;
-    }
-
-    if (drive_get(IF_PFLASH, 0, 0)) {
-        /*
-         * Pflash was supplied, let's overwrite the address we jump to after
-         * reset to the base of the flash.
-         */
-        start_addr = virt_memmap[VIRT_FLASH].base;
-    }
-
-    /*
-     * Init fw_cfg.  Must be done before riscv_load_fdt, otherwise the device
-     * tree cannot be altered and we get FDT_ERR_NOSPACE.
-     */
-    s->fw_cfg = create_fw_cfg(machine);
-    rom_set_fw(s->fw_cfg);
-
-    /* Compute the fdt load address in dram */
-    fdt_load_addr = riscv_load_fdt(memmap[VIRT_DRAM].base,
-                                   machine->ram_size, machine->fdt);
-    /* load the reset vector */
-    riscv_setup_rom_reset_vec(machine, &s->soc[0], start_addr,
-                              virt_memmap[VIRT_MROM].base,
-                              virt_memmap[VIRT_MROM].size, kernel_entry,
-                              fdt_load_addr, machine->fdt);
-
-    /*
-     * Only direct boot kernel is currently supported for KVM VM,
-     * So here setup kernel start address and fdt address.
-     * TODO:Support firmware loading and integrate to TCG start
-     */
-    if (kvm_enabled()) {
-        riscv_setup_direct_kernel(kernel_entry, fdt_load_addr);
-    }
-
     /* SiFive Test MMIO device */
     sifive_test_create(memmap[VIRT_TEST].base);
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
                                   drive_get(IF_PFLASH, 0, i));
     }
     virt_flash_map(s, system_memory);
+
+    /* create device tree */
+    create_fdt(s, memmap, machine->ram_size, machine->kernel_cmdline,
+               riscv_is_32bit(&s->soc[0]));
+
+    s->machine_done.notify = virt_machine_done;
+    qemu_add_machine_init_done_notifier(&s->machine_done);
 }
 
 static void virt_machine_instance_init(Object *obj)
-- 
2.35.1

From: Alistair Francis <alistair.francis@wdc.com>

The ARM virt machine currently uses sysbus-fdt to create device tree
entries for dynamically created MMIO devices.

The RISC-V virt machine can also benefit from this, so move the code to
the core directory.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20220427234146.1130752-3-alistair.francis@opensource.wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/{arm => core}/sysbus-fdt.h | 0
 hw/arm/virt.c                         | 2 +-
 hw/arm/xlnx-versal-virt.c             | 1 -
 hw/{arm => core}/sysbus-fdt.c         | 2 +-
 hw/arm/meson.build                    | 1 -
 hw/core/meson.build                   | 1 +
 6 files changed, 3 insertions(+), 4 deletions(-)
 rename include/hw/{arm => core}/sysbus-fdt.h (100%)
 rename hw/{arm => core}/sysbus-fdt.c (99%)

diff --git a/include/hw/arm/sysbus-fdt.h b/include/hw/core/sysbus-fdt.h
similarity index 100%
rename from include/hw/arm/sysbus-fdt.h
rename to include/hw/core/sysbus-fdt.h
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/virtio/virtio-pci.h"
-#include "hw/arm/sysbus-fdt.h"
+#include "hw/core/sysbus-fdt.h"
 #include "hw/platform-bus.h"
 #include "hw/qdev-properties.h"
 #include "hw/arm/fdt.h"
diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/device_tree.h"
 #include "hw/boards.h"
 #include "hw/sysbus.h"
-#include "hw/arm/sysbus-fdt.h"
 #include "hw/arm/fdt.h"
 #include "cpu.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/arm/sysbus-fdt.c b/hw/core/sysbus-fdt.c
similarity index 99%
rename from hw/arm/sysbus-fdt.c
rename to hw/core/sysbus-fdt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sysbus-fdt.c
+++ b/hw/core/sysbus-fdt.c
@@ -XXX,XX +XXX,XX @@
 #ifdef CONFIG_LINUX
 #include <linux/vfio.h>
 #endif
-#include "hw/arm/sysbus-fdt.h"
+#include "hw/core/sysbus-fdt.h"
 #include "qemu/error-report.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/tpm.h"
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -XXX,XX +XXX,XX @@
 arm_ss = ss.source_set()
 arm_ss.add(files('boot.c'), fdt)
-arm_ss.add(when: 'CONFIG_PLATFORM_BUS', if_true: files('sysbus-fdt.c'))
 arm_ss.add(when: 'CONFIG_ARM_VIRT', if_true: files('virt.c'))
 arm_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
 arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic_boards.c'))
diff --git a/hw/core/meson.build b/hw/core/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/meson.build
+++ b/hw/core/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_PTIMER', if_true: files('ptimer.c'))
 softmmu_ss.add(when: 'CONFIG_REGISTER', if_true: files('register.c'))
 softmmu_ss.add(when: 'CONFIG_SPLIT_IRQ', if_true: files('split-irq.c'))
 softmmu_ss.add(when: 'CONFIG_XILINX_AXI', if_true: files('stream.c'))
+softmmu_ss.add(when: 'CONFIG_PLATFORM_BUS', if_true: files('sysbus-fdt.c'))
 
 softmmu_ss.add(files(
   'cpu-sysemu.c',
-- 
2.35.1

From: Alistair Francis <alistair.francis@wdc.com>

Create a platform bus to allow dynamic devices to be connected. This is
based on the ARM implementation.

From: Alistair Francis <alistair.francis@wdc.com>

Similar to the ARM virt machine add support for adding device tree
entries for dynamically created devices.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-Id: <20220427234146.1130752-5-alistair.francis@opensource.wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "hw/char/serial.h"
 #include "target/riscv/cpu.h"
+#include "hw/core/sysbus-fdt.h"
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
     riscv_socket_fdt_write_id(mc, mc->fdt, plic_name, socket);
     qemu_fdt_setprop_cell(mc->fdt, plic_name, "phandle",
         plic_phandles[socket]);
+
+    platform_bus_add_all_fdt_nodes(mc->fdt, plic_name,
+                                   memmap[VIRT_PLATFORM_BUS].base,
+                                   memmap[VIRT_PLATFORM_BUS].size,
+                                   VIRT_PLATFORM_BUS_IRQ);
+
     g_free(plic_name);
 
     g_free(plic_cells);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
             IMSIC_MMIO_GROUP_MIN_SHIFT);
     }
     qemu_fdt_setprop_cell(mc->fdt, imsic_name, "phandle", *msi_m_phandle);
+
+    platform_bus_add_all_fdt_nodes(mc->fdt, imsic_name,
+                                   memmap[VIRT_PLATFORM_BUS].base,
+                                   memmap[VIRT_PLATFORM_BUS].size,
+                                   VIRT_PLATFORM_BUS_IRQ);
+
     g_free(imsic_name);
 
     /* S-level IMSIC node */
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
         VIRT_IRQCHIP_NUM_SOURCES);
     riscv_socket_fdt_write_id(mc, mc->fdt, aplic_name, socket);
     qemu_fdt_setprop_cell(mc->fdt, aplic_name, "phandle", aplic_s_phandle);
+
+    platform_bus_add_all_fdt_nodes(mc->fdt, aplic_name,
+                                   memmap[VIRT_PLATFORM_BUS].base,
+                                   memmap[VIRT_PLATFORM_BUS].size,
+                                   VIRT_PLATFORM_BUS_IRQ);
+
     g_free(aplic_name);
 
     g_free(aplic_cells);
-- 
2.35.1

From: Alistair Francis <alistair.francis@wdc.com>

Add support for plugging in devices, this was tested with the TPM
device.

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_set_aclint(Object *obj, bool value, Error **errp)
     s->have_aclint = value;
 }
 
+static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
+                                                        DeviceState *dev)
+{
+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+
+    if (device_is_dynamic_sysbus(mc, dev)) {
+        return HOTPLUG_HANDLER(machine);
+    }
+    return NULL;
+}
+
+static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
+                                        DeviceState *dev, Error **errp)
+{
+    RISCVVirtState *s = RISCV_VIRT_MACHINE(hotplug_dev);
+
+    if (s->platform_bus_dev) {
+        MachineClass *mc = MACHINE_GET_CLASS(s);
+
+        if (device_is_dynamic_sysbus(mc, dev)) {
+            platform_bus_link_device(PLATFORM_BUS_DEVICE(s->platform_bus_dev),
+                                     SYS_BUS_DEVICE(dev));
+        }
+    }
+}
+
 static void virt_machine_class_init(ObjectClass *oc, void *data)
 {
     char str[128];
     MachineClass *mc = MACHINE_CLASS(oc);
+    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
 
     mc->desc = "RISC-V VirtIO board";
     mc->init = virt_machine_init;
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     mc->get_default_cpu_node_id = riscv_numa_get_default_cpu_node_id;
     mc->numa_mem_supported = true;
     mc->default_ram_id = "riscv_virt_board.ram";
+    assert(!mc->get_hotplug_handler);
+    mc->get_hotplug_handler = virt_machine_get_hotplug_handler;
+
+    hc->plug = virt_machine_device_plug_cb;
 
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo virt_machine_typeinfo = {
     .class_init = virt_machine_class_init,
     .instance_init = virt_machine_instance_init,
     .instance_size = sizeof(RISCVVirtState),
+    .interfaces = (InterfaceInfo[]) {
+         { TYPE_HOTPLUG_HANDLER },
+         { }
+    },
 };
 
 static void virt_machine_init_register_types(void)
-- 
2.35.1

From: Alistair Francis <alistair.francis@wdc.com>

Imply the TPM sysbus devices. This allows users to add TPM devices to
the RISC-V virt board.

This was tested by first creating an emulated TPM device:

swtpm socket --tpm2 -t -d --tpmstate dir=/tmp/tpm \
        --ctrl type=unixio,path=swtpm-sock

Then launching QEMU with:

-chardev socket,id=chrtpm,path=swtpm-sock \
    -tpmdev emulator,id=tpm0,chardev=chrtpm \
    -device tpm-tis-device,tpmdev=tpm0

The TPM device can be seen in the memory tree and the generated device
tree.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/942
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20220427234146.1130752-7-alistair.francis@opensource.wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/system/riscv/virt.rst | 20 ++++++++++++++++++++
 hw/riscv/virt.c            |  4 ++++
 hw/riscv/Kconfig           |  1 +
 3 files changed, 25 insertions(+)

diff --git a/docs/system/riscv/virt.rst b/docs/system/riscv/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/riscv/virt.rst
+++ b/docs/system/riscv/virt.rst
@@ -XXX,XX +XXX,XX @@ The minimal QEMU commands to run U-Boot SPL are:
 To test 32-bit U-Boot images, switch to use qemu-riscv32_smode_defconfig and
 riscv32_spl_defconfig builds, and replace ``qemu-system-riscv64`` with
 ``qemu-system-riscv32`` in the command lines above to boot the 32-bit U-Boot.
+
+Enabling TPM
+------------
+
+A TPM device can be connected to the virt board by following the steps below.
+
+First launch the TPM emulator
+
+    swtpm socket --tpm2 -t -d --tpmstate dir=/tmp/tpm \
+        --ctrl type=unixio,path=swtpm-sock
+
+Then launch QEMU with:
+
+    ...
+    -chardev socket,id=chrtpm,path=swtpm-sock \
+    -tpmdev emulator,id=tpm0,chardev=chrtpm \
+    -device tpm-tis-device,tpmdev=tpm0
+
+The TPM device can be seen in the memory tree and the generated device
+tree and should be accessible from the guest software.
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/device_tree.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
+#include "sysemu/tpm.h"
 #include "hw/pci/pci.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/display/ramfb.h"
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     hc->plug = virt_machine_device_plug_cb;
 
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
+#ifdef CONFIG_TPM
+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
+#endif
 
     object_class_property_add_bool(oc, "aclint", virt_get_aclint,
                                    virt_set_aclint);
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     imply PCI_DEVICES
     imply VIRTIO_VGA
     imply TEST_DEVICES
+    imply TPM_TIS_SYSBUS
     select RISCV_NUMA
     select GOLDFISH_RTC
     select MSI_NONBROKEN
-- 
2.35.1

The following changes since commit 1dae461a913f9da88df05de6e2020d3134356f2e:

Update version for v10.0.0-rc0 release (2025-03-18 10:18:14 -0400)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20250319

for you to fetch changes up to ffe4db11f8aed79c7ec7d3ebd92674a1cfab4fe7:

target/riscv: Add check for 16-bit aligned PC for different priv versions. (2025-03-19 17:11:46 +1000)

----------------------------------------------------------------
Fourth RISC-V PR for 10.0

* Fix broken emulation link
* Optimize the memory probing for vector fault-only-first loads
* Fix access permission checks for CSR_SSP
* Fixes a bug against `ssamoswap` behavior in M-mode
* Fix IOMMU process directory table walk
* Fix OVERFLOW_BEFORE_WIDEN in rmw_sctrdepth()
* Enhance VSTART and VL checks for vector instructions
* Fix handling of cpu mask in riscv_hwprobe syscall
* Add check for 16-bit aligned PC for different priv versions

----------------------------------------------------------------
Chao Liu (2):
      target/riscv: refactor VSTART_CHECK_EARLY_EXIT() to accept vl as a parameter
      target/riscv: fix handling of nop for vstart >= vl in some vector instruction

Daniel Henrique Barboza (1):
      target/riscv/csr.c: fix OVERFLOW_BEFORE_WIDEN in rmw_sctrdepth()

Deepak Gupta (2):
      target/riscv: fix access permission checks for CSR_SSP
      target/riscv: fixes a bug against `ssamoswap` behavior in M-mode

Jason Chien (1):
      hw/riscv/riscv-iommu: Fix process directory table walk

Paolo Savini (1):
      optimize the memory probing for vector fault-only-first loads.

Richard Henderson (1):
      linux-user/riscv: Fix handling of cpu mask in riscv_hwprobe syscall

Santiago Monserrat Campanello (1):
      docs/about/emulation: Fix broken link

Yu-Ming Chang (1):
      target/riscv: Add check for 16-bit aligned PC for different priv versions.

From: Santiago Monserrat Campanello <santimonserr@gmail.com>

semihosting link to risc-v changed

Signed-off-by: Santiago Monserrat Campanello <santimonserr@gmail.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2717
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250305102632.91376-1-santimonserr@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/about/emulation.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/about/emulation.rst b/docs/about/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/about/emulation.rst
+++ b/docs/about/emulation.rst
@@ -XXX,XX +XXX,XX @@ for that architecture.
     - Unified Hosting Interface (MD01069)
   * - RISC-V
     - System and User-mode
-    - https://github.com/riscv/riscv-semihosting-spec/blob/main/riscv-semihosting-spec.adoc
+    - https://github.com/riscv-non-isa/riscv-semihosting/blob/main/riscv-semihosting.adoc
   * - Xtensa
     - System
     - Tensilica ISS SIMCALL
-- 
2.48.1

From: Paolo Savini <paolo.savini@embecosm.com>

Fault-only-first loads in the RISC-V vector extension need to update
the vl with the element index that causes an exception.
In order to ensure this the emulation of this instruction used to probe the
memory covered by the load operation with a loop that iterated over each element
so that when a flag was raised it was possible to set the vl to the
corresponding element index.
This loop was executed every time whether an exception happened or not.

This commit removes the per element memory probing from the main execution path
and adds a broad memory probing first. If this probing raises any flag that is
not a watchpoint flag (that per standard is allowed by this instruction) we
proceed with the per element probing to find the index of the element causing
the exception and set vl to such index.

Signed-off-by: Paolo Savini <paolo.savini@embecosm.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250221155320.59159-2-paolo.savini@embecosm.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 103 ++++++++++++++++++++---------------
 1 file changed, 58 insertions(+), 45 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base, CPURISCVState *env,
     uint32_t esz = 1 << log2_esz;
     uint32_t msize = nf * esz;
     uint32_t vma = vext_vma(desc);
-    target_ulong addr, offset, remain, page_split, elems;
+    target_ulong addr, addr_probe, addr_i, offset, remain, page_split, elems;
     int mmu_index = riscv_env_mmu_index(env, false);
+    int flags;
+    void *host;
 
     VSTART_CHECK_EARLY_EXIT(env);
 
-    /* probe every access */
-    for (i = env->vstart; i < env->vl; i++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            continue;
-        }
-        addr = adjust_addr(env, base + i * (nf << log2_esz));
-        if (i == 0) {
-            /* Allow fault on first element. */
-            probe_pages(env, addr, nf << log2_esz, ra, MMU_DATA_LOAD);
-        } else {
-            remain = nf << log2_esz;
-            while (remain > 0) {
-                void *host;
-                int flags;
-
-                offset = -(addr | TARGET_PAGE_MASK);
-
-                /* Probe nonfault on subsequent elements. */
-                flags = probe_access_flags(env, addr, offset, MMU_DATA_LOAD,
-                                           mmu_index, true, &host, 0);
-
-                /*
-                 * Stop if invalid (unmapped) or mmio (transaction may fail).
-                 * Do not stop if watchpoint, as the spec says that
-                 * first-fault should continue to access the same
-                 * elements regardless of any watchpoint.
-                 */
-                if (flags & ~TLB_WATCHPOINT) {
-                    vl = i;
-                    goto ProbeSuccess;
-                }
-                if (remain <= offset) {
-                    break;
+    addr = base + ((env->vstart * nf) << log2_esz);
+    page_split = -(addr | TARGET_PAGE_MASK);
+    /* Get number of elements */
+    elems = page_split / msize;
+    if (unlikely(env->vstart + elems >= env->vl)) {
+        elems = env->vl - env->vstart;
+    }
+
+    /* Check page permission/pmp/watchpoint/etc. */
+    flags = probe_access_flags(env, adjust_addr(env, addr), elems * msize,
+                               MMU_DATA_LOAD, mmu_index, true, &host, ra);
+
+    /* If we are crossing a page check also the second page. */
+    if (env->vl > elems) {
+        addr_probe = addr + (elems << log2_esz);
+        flags |= probe_access_flags(env, adjust_addr(env, addr_probe),
+                                    elems * msize, MMU_DATA_LOAD, mmu_index,
+                                    true, &host, ra);
+    }
+
+    if (flags & ~TLB_WATCHPOINT) {
+        /* probe every access */
+        for (i = env->vstart; i < env->vl; i++) {
+            if (!vm && !vext_elem_mask(v0, i)) {
+                continue;
+            }
+            addr_i = adjust_addr(env, base + i * (nf << log2_esz));
+            if (i == 0) {
+                /* Allow fault on first element. */
+                probe_pages(env, addr_i, nf << log2_esz, ra, MMU_DATA_LOAD);
+            } else {
+                remain = nf << log2_esz;
+                while (remain > 0) {
+                    offset = -(addr_i | TARGET_PAGE_MASK);
+
+                    /* Probe nonfault on subsequent elements. */
+                    flags = probe_access_flags(env, addr_i, offset,
+                                               MMU_DATA_LOAD, mmu_index, true,
+                                               &host, 0);
+
+                    /*
+                     * Stop if invalid (unmapped) or mmio (transaction may
+                     * fail). Do not stop if watchpoint, as the spec says that
+                     * first-fault should continue to access the same
+                     * elements regardless of any watchpoint.
+                     */
+                    if (flags & ~TLB_WATCHPOINT) {
+                        vl = i;
+                        goto ProbeSuccess;
+                    }
+                    if (remain <= offset) {
+                        break;
+                    }
+                    remain -= offset;
+                    addr_i = adjust_addr(env, addr_i + offset);
                 }
-                remain -= offset;
-                addr = adjust_addr(env, addr + offset);
             }
         }
     }
@@ -XXX,XX +XXX,XX @@ ProbeSuccess:
 
     if (env->vstart < env->vl) {
         if (vm) {
-            /* Calculate the page range of first page */
-            addr = base + ((env->vstart * nf) << log2_esz);
-            page_split = -(addr | TARGET_PAGE_MASK);
-            /* Get number of elements */
-            elems = page_split / msize;
-            if (unlikely(env->vstart + elems >= env->vl)) {
-                elems = env->vl - env->vstart;
-            }
-
             /* Load/store elements in the first page */
             if (likely(elems)) {
                 vext_page_ldst_us(env, vd, addr, elems, nf, max_elems,
-- 
2.48.1

From: Deepak Gupta <debug@rivosinc.com>

Commit:8205bc1 ("target/riscv: introduce ssp and enabling controls for
zicfiss") introduced CSR_SSP but it mis-interpreted the spec on access
to CSR_SSP in M-mode. Gated to CSR_SSP is not gated via `xSSE`. But
rather rules clearly specified in section "22.2.1. Shadow Stack Pointer
(ssp) CSR access contr" in the priv spec.

Fixes: 8205bc127a83 ("target/riscv: introduce ssp and enabling controls
for zicfiss". Thanks to Adam Zabrocki for bringing this to attention.

Reported-by: Adam Zabrocki <azabrocki@nvidia.com>
Signed-off-by: Deepak Gupta <debug@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250306064636.452396-1-debug@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException cfi_ss(CPURISCVState *env, int csrno)
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
+    /* If ext implemented, M-mode always have access to SSP CSR */
+    if (env->priv == PRV_M) {
+        return RISCV_EXCP_NONE;
+    }
+
     /* if bcfi not active for current env, access to csr is illegal */
     if (!cpu_get_bcfien(env)) {
 #if !defined(CONFIG_USER_ONLY)
-- 
2.48.1

From: Deepak Gupta <debug@rivosinc.com>

Commit f06bfe3dc38c ("target/riscv: implement zicfiss instructions") adds
`ssamoswap` instruction. `ssamoswap` takes the code-point from existing
reserved encoding (and not a zimop like other shadow stack instructions).
If shadow stack is not enabled (via xenvcfg.SSE) and effective priv is
less than M then `ssamoswap` must result in an illegal instruction
exception. However if effective priv is M, then `ssamoswap` results in
store/AMO access fault. See Section "22.2.3. Shadow Stack Memory
Protection" of priv spec.

Fixes: f06bfe3dc38c ("target/riscv: implement zicfiss instructions")

Reported-by: Ved Shanbhogue <ved@rivosinc.com>
Signed-off-by: Deepak Gupta <debug@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250306064636.452396-2-debug@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzicfiss.c.inc | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
@@ -XXX,XX +XXX,XX @@
  * You should have received a copy of the GNU General Public License along with
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
+
+#define REQUIRE_ZICFISS(ctx) do {        \
+    if (!ctx->cfg_ptr->ext_zicfiss) {    \
+        return false;                    \
+    }                                    \
+} while (0)
+
 static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
 {
     if (!ctx->bcfi_enabled) {
@@ -XXX,XX +XXX,XX @@ static bool trans_ssrdp(DisasContext *ctx, arg_ssrdp *a)
 static bool trans_ssamoswap_w(DisasContext *ctx, arg_amoswap_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
+    REQUIRE_ZICFISS(ctx);
+    if (ctx->priv == PRV_M) {
+        generate_exception(ctx, RISCV_EXCP_STORE_AMO_ACCESS_FAULT);
+    }
+
     if (!ctx->bcfi_enabled) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_ssamoswap_d(DisasContext *ctx, arg_amoswap_w *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
+    REQUIRE_ZICFISS(ctx);
+    if (ctx->priv == PRV_M) {
+        generate_exception(ctx, RISCV_EXCP_STORE_AMO_ACCESS_FAULT);
+    }
+
     if (!ctx->bcfi_enabled) {
         return false;
     }
-- 
2.48.1

From: Jason Chien <jason.chien@sifive.com>

The PPN field in a non-leaf PDT entry is positioned differently from that
in a leaf PDT entry. The original implementation incorrectly used the leaf
entry's PPN mask to extract the PPN from a non-leaf entry, leading to an
erroneous page table walk.

This commit introduces new macros to properly define the fields for
non-leaf PDT entries and corrects the page table walk.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250301173751.9446-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu-bits.h | 6 +++++-
 hw/riscv/riscv-iommu.c      | 4 ++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu-bits.h
+++ b/hw/riscv/riscv-iommu-bits.h
@@ -XXX,XX +XXX,XX @@ enum riscv_iommu_fq_causes {
 #define RISCV_IOMMU_DC_MSIPTP_MODE_OFF  0
 #define RISCV_IOMMU_DC_MSIPTP_MODE_FLAT 1
 
+/* 2.2 Process Directory Table */
+#define RISCV_IOMMU_PDTE_VALID          BIT_ULL(0)
+#define RISCV_IOMMU_PDTE_PPN            RISCV_IOMMU_PPN_FIELD
+
 /* Translation attributes fields */
 #define RISCV_IOMMU_PC_TA_V             BIT_ULL(0)
 #define RISCV_IOMMU_PC_TA_RESERVED      GENMASK_ULL(63, 32)
 
 /* First stage context fields */
-#define RISCV_IOMMU_PC_FSC_PPN          GENMASK_ULL(43, 0)
+#define RISCV_IOMMU_PC_FSC_PPN          RISCV_IOMMU_ATP_PPN_FIELD
 #define RISCV_IOMMU_PC_FSC_RESERVED     GENMASK_ULL(59, 44)
 
 enum riscv_iommu_fq_ttypes {
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -XXX,XX +XXX,XX @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
             return RISCV_IOMMU_FQ_CAUSE_PDT_LOAD_FAULT;
         }
         le64_to_cpus(&de);
-        if (!(de & RISCV_IOMMU_PC_TA_V)) {
+        if (!(de & RISCV_IOMMU_PDTE_VALID)) {
             return RISCV_IOMMU_FQ_CAUSE_PDT_INVALID;
         }
-        addr = PPN_PHYS(get_field(de, RISCV_IOMMU_PC_FSC_PPN));
+        addr = PPN_PHYS(get_field(de, RISCV_IOMMU_PDTE_PPN));
     }
 
     riscv_iommu_hpm_incr_ctr(s, ctx, RISCV_IOMMU_HPMEVENT_PD_WALK);
-- 
2.48.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Coverity found the following issue:

>>>     CID 1593156:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
  >>>     Potentially overflowing expression "0x10 << depth" with type
  "int" (32 bits, signed) is evaluated using 32-bit arithmetic, and then
  used in a context that expects an expression of type "uint64_t" (64
  bits, unsigned).
  4299             depth = 16 << depth;

Fix it by forcing the expression to be 64 bits wide by using '16ULL'.

Resolves: Coverity CID 1593156
Fixes: c48bd18eae ("target/riscv: Add support for Control Transfer Records extension CSRs.")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250307124602.1905754-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_sctrdepth(CPURISCVState *env, int csrno,
         }
 
         /* Update sctrstatus.WRPTR with a legal value */
-        depth = 16 << depth;
+        depth = 16ULL << depth;
         env->sctrstatus =
             env->sctrstatus & (~SCTRSTATUS_WRPTR_MASK | (depth - 1));
     }
-- 
2.48.1

From: Chao Liu <lc00631@tecorigin.com>

Some vector instructions are special, such as the vlm.v instruction,
where setting its vl actually sets evl = (vl + 7) >> 3. To improve
maintainability, we will uniformly use VSTART_CHECK_EARLY_EXIT() to
check for the condition vstart >= vl. This function will also handle
cases involving evl.

Fixes: df4252b2ec ("target/riscv/vector_helpers: do early exit when
vstart >= vl")
Signed-off-by: Chao Liu <lc00631@tecorigin.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <f575979874e323a9e0da7796aa391c7d87e56f88.1741573286.git.lc00631@tecorigin.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 12 +++---
 target/riscv/vcrypto_helper.c   | 32 +++++++--------
 target/riscv/vector_helper.c    | 69 ++++++++++++++++-----------------
 target/riscv/vector_internals.c |  4 +-
 4 files changed, 57 insertions(+), 60 deletions(-)

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_internals.h
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@
 #include "tcg/tcg-gvec-desc.h"
 #include "internals.h"
 
-#define VSTART_CHECK_EARLY_EXIT(env) do { \
-    if (env->vstart >= env->vl) {         \
-        env->vstart = 0;                  \
-        return;                           \
-    }                                     \
+#define VSTART_CHECK_EARLY_EXIT(env, vl) do { \
+    if (env->vstart >= vl) {                  \
+        env->vstart = 0;                      \
+        return;                               \
+    }                                         \
 } while (0)
 
 static inline uint32_t vext_nf(uint32_t desc)
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
     uint32_t vma = vext_vma(desc);                     \
     uint32_t i;                                        \
                                                        \
-    VSTART_CHECK_EARLY_EXIT(env);                      \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                  \
                                                        \
     for (i = env->vstart; i < vl; i++) {               \
         if (!vm && !vext_elem_mask(v0, i)) {           \
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ static inline void xor_round_key(AESState *round_state, AESState *round_key)
         uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
         uint32_t vta = vext_vta(desc);                                    \
                                                                           \
-        VSTART_CHECK_EARLY_EXIT(env);                                     \
+        VSTART_CHECK_EARLY_EXIT(env, vl);                                 \
                                                                           \
         for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
             AESState round_key;                                           \
@@ -XXX,XX +XXX,XX @@ static inline void xor_round_key(AESState *round_state, AESState *round_key)
         uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
         uint32_t vta = vext_vta(desc);                                    \
                                                                           \
-        VSTART_CHECK_EARLY_EXIT(env);                                     \
+        VSTART_CHECK_EARLY_EXIT(env, vl);                                 \
                                                                           \
         for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
             AESState round_key;                                           \
@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
     uint32_t total_elems = vext_get_total_elems(env, desc, 4);
     uint32_t vta = vext_vta(desc);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, vl);
 
     uimm &= 0b1111;
     if (uimm > 10 || uimm == 0) {
@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
     uint32_t total_elems = vext_get_total_elems(env, desc, 4);
     uint32_t vta = vext_vta(desc);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, vl);
 
     uimm &= 0b1111;
     if (uimm > 14 || uimm < 2) {
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
     uint32_t total_elems;
     uint32_t vta = vext_vta(desc);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
         if (sew == MO_32) {
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
     uint32_t total_elems;
     uint32_t vta = vext_vta(desc);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
         vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
     uint32_t total_elems;
     uint32_t vta = vext_vta(desc);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
         vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
     uint32_t total_elems;
     uint32_t vta = vext_vta(desc);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
         vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
     uint32_t total_elems;
     uint32_t vta = vext_vta(desc);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
         vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm3me_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
     uint32_t *vs1 = vs1_vptr;
     uint32_t *vs2 = vs2_vptr;
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (int i = env->vstart / 8; i < env->vl / 8; i++) {
         uint32_t w[24];
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
     uint32_t *vs2 = vs2_vptr;
     uint32_t v1[8], v2[8], v3[8];
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (int i = env->vstart / 8; i < env->vl / 8; i++) {
         for (int k = 0; k < 8; k++) {
@@ -XXX,XX +XXX,XX @@ void HELPER(vghsh_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
     uint32_t vta = vext_vta(desc);
     uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
         uint64_t Y[2] = {vd[i * 2 + 0], vd[i * 2 + 1]};
@@ -XXX,XX +XXX,XX @@ void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
     uint32_t vta = vext_vta(desc);
     uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
         uint64_t Y[2] = {brev8(vd[i * 2 + 0]), brev8(vd[i * 2 + 1])};
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm4k_vi)(void *vd, void *vs2, uint32_t uimm5, CPURISCVState *env,
     uint32_t esz = sizeof(uint32_t);
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (uint32_t i = group_start; i < group_end; ++i) {
         uint32_t vstart = i * egs;
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm4r_vv)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
     uint32_t esz = sizeof(uint32_t);
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (uint32_t i = group_start; i < group_end; ++i) {
         uint32_t vstart = i * egs;
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm4r_vs)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
     uint32_t esz = sizeof(uint32_t);
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (uint32_t i = group_start; i < group_end; ++i) {
         uint32_t vstart = i * egs;
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldst_stride(void *vd, void *v0, target_ulong base, target_ulong stride,
     uint32_t esz = 1 << log2_esz;
     uint32_t vma = vext_vma(desc);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     for (i = env->vstart; i < env->vl; env->vstart = ++i) {
         k = 0;
@@ -XXX,XX +XXX,XX @@ vext_ldst_us(void *vd, target_ulong base, CPURISCVState *env, uint32_t desc,
     uint32_t msize = nf * esz;
     int mmu_index = riscv_env_mmu_index(env, false);
 
-    if (env->vstart >= evl) {
-        env->vstart = 0;
-        return;
-    }
+    VSTART_CHECK_EARLY_EXIT(env, evl);
 
 #if defined(CONFIG_USER_ONLY)
     /*
@@ -XXX,XX +XXX,XX @@ vext_ldst_index(void *vd, void *v0, target_ulong base,
     uint32_t esz = 1 << log2_esz;
     uint32_t vma = vext_vma(desc);
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     /* load bytes from guest memory */
     for (i = env->vstart; i < env->vl; env->vstart = ++i) {
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base, CPURISCVState *env,
     int flags;
     void *host;
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, env->vl);
 
     addr = base + ((env->vstart * nf) << log2_esz);
     page_split = -(addr | TARGET_PAGE_MASK);
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
     uint32_t vta = vext_vta(desc);                            \
     uint32_t i;                                               \
                                                               \
-    VSTART_CHECK_EARLY_EXIT(env);                             \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                         \
                                                               \
     for (i = env->vstart; i < vl; i++) {                      \
         ETYPE s1 = *((ETYPE *)vs1 + H(i));                    \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,        \
     uint32_t vta = vext_vta(desc);                                       \
     uint32_t i;                                                          \
                                                                          \
-    VSTART_CHECK_EARLY_EXIT(env);                                        \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                    \
                                                                          \
     for (i = env->vstart; i < vl; i++) {                                 \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                               \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
     uint32_t vta_all_1s = vext_vta_all_1s(desc);              \
     uint32_t i;                                               \
                                                               \
-    VSTART_CHECK_EARLY_EXIT(env);                             \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                         \
                                                               \
     for (i = env->vstart; i < vl; i++) {                      \
         ETYPE s1 = *((ETYPE *)vs1 + H(i));                    \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,          \
     uint32_t vta_all_1s = vext_vta_all_1s(desc);                \
     uint32_t i;                                                 \
                                                                 \
-    VSTART_CHECK_EARLY_EXIT(env);                               \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                           \
                                                                 \
     for (i = env->vstart; i < vl; i++) {                        \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                      \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,                          \
     uint32_t vma = vext_vma(desc);                                        \
     uint32_t i;                                                           \
                                                                           \
-    VSTART_CHECK_EARLY_EXIT(env);                                         \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                           \
     for (i = env->vstart; i < vl; i++) {                                  \
         if (!vm && !vext_elem_mask(v0, i)) {                              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,      \
     uint32_t vma = vext_vma(desc);                          \
     uint32_t i;                                             \
                                                             \
-    VSTART_CHECK_EARLY_EXIT(env);                           \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                       \
                                                             \
     for (i = env->vstart; i < vl; i++) {                    \
         if (!vm && !vext_elem_mask(v0, i)) {                \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
     uint32_t vma = vext_vma(desc);                            \
     uint32_t i;                                               \
                                                               \
-    VSTART_CHECK_EARLY_EXIT(env);                             \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                         \
                                                               \
     for (i = env->vstart; i < vl; i++) {                      \
         ETYPE s1 = *((ETYPE *)vs1 + H(i));                    \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,   \
     uint32_t vma = vext_vma(desc);                                  \
     uint32_t i;                                                     \
                                                                     \
-    VSTART_CHECK_EARLY_EXIT(env);                                   \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                               \
                                                                     \
     for (i = env->vstart; i < vl; i++) {                            \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                          \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *vs1, CPURISCVState *env,           \
     uint32_t vta = vext_vta(desc);                                   \
     uint32_t i;                                                      \
                                                                      \
-    VSTART_CHECK_EARLY_EXIT(env);                                    \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                \
                                                                      \
     for (i = env->vstart; i < vl; i++) {                             \
         ETYPE s1 = *((ETYPE *)vs1 + H(i));                           \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, uint64_t s1, CPURISCVState *env,         \
     uint32_t vta = vext_vta(desc);                                   \
     uint32_t i;                                                      \
                                                                      \
-    VSTART_CHECK_EARLY_EXIT(env);                                    \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                \
                                                                      \
     for (i = env->vstart; i < vl; i++) {                             \
         *((ETYPE *)vd + H(i)) = (ETYPE)s1;                           \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,          \
     uint32_t vta = vext_vta(desc);                                   \
     uint32_t i;                                                      \
                                                                      \
-    VSTART_CHECK_EARLY_EXIT(env);                                    \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                \
                                                                      \
     for (i = env->vstart; i < vl; i++) {                             \
         ETYPE *vt = (!vext_elem_mask(v0, i) ? vs2 : vs1);            \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,               \
     uint32_t vta = vext_vta(desc);                                   \
     uint32_t i;                                                      \
                                                                      \
-    VSTART_CHECK_EARLY_EXIT(env);                                    \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                \
                                                                      \
     for (i = env->vstart; i < vl; i++) {                             \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                           \
@@ -XXX,XX +XXX,XX @@ vext_vv_rm_1(void *vd, void *v0, void *vs1, void *vs2,
              uint32_t vl, uint32_t vm, int vxrm,
              opivv2_rm_fn *fn, uint32_t vma, uint32_t esz)
 {
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, vl);
 
     for (uint32_t i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
@@ -XXX,XX +XXX,XX @@ vext_vx_rm_1(void *vd, void *v0, target_long s1, void *vs2,
              uint32_t vl, uint32_t vm, int vxrm,
              opivx2_rm_fn *fn, uint32_t vma, uint32_t esz)
 {
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, vl);
 
     for (uint32_t i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
     uint32_t vma = vext_vma(desc);                        \
     uint32_t i;                                           \
                                                           \
-    VSTART_CHECK_EARLY_EXIT(env);                         \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                     \
                                                           \
     for (i = env->vstart; i < vl; i++) {                  \
         if (!vm && !vext_elem_mask(v0, i)) {              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1,        \
     uint32_t vma = vext_vma(desc);                        \
     uint32_t i;                                           \
                                                           \
-    VSTART_CHECK_EARLY_EXIT(env);                         \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                     \
                                                           \
     for (i = env->vstart; i < vl; i++) {                  \
         if (!vm && !vext_elem_mask(v0, i)) {              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
     uint32_t vma = vext_vma(desc);                     \
     uint32_t i;                                        \
                                                        \
-    VSTART_CHECK_EARLY_EXIT(env);                      \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                  \
                                                        \
     if (vl == 0) {                                     \
         return;                                        \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
     uint32_t vma = vext_vma(desc);                            \
     uint32_t i;                                               \
                                                               \
-    VSTART_CHECK_EARLY_EXIT(env);                             \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                         \
                                                               \
     for (i = env->vstart; i < vl; i++) {                      \
         ETYPE s1 = *((ETYPE *)vs1 + H(i));                    \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2,       \
     uint32_t vma = vext_vma(desc);                                  \
     uint32_t i;                                                     \
                                                                     \
-    VSTART_CHECK_EARLY_EXIT(env);                                   \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                               \
                                                                     \
     for (i = env->vstart; i < vl; i++) {                            \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                          \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2, \
     uint32_t vta = vext_vta(desc);                            \
     uint32_t i;                                               \
                                                               \
-    VSTART_CHECK_EARLY_EXIT(env);                             \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                         \
                                                               \
     for (i = env->vstart; i < vl; i++) {                      \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                    \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
     uint32_t i;                                           \
     int a, b;                                             \
                                                           \
-    VSTART_CHECK_EARLY_EXIT(env);                         \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                     \
                                                           \
     for (i = env->vstart; i < vl; i++) {                  \
         a = vext_elem_mask(vs1, i);                       \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, CPURISCVState *env, uint32_t desc)  \
     uint32_t vma = vext_vma(desc);                                        \
     int i;                                                                \
                                                                           \
-    VSTART_CHECK_EARLY_EXIT(env);                                         \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                           \
     for (i = env->vstart; i < vl; i++) {                                  \
         if (!vm && !vext_elem_mask(v0, i)) {                              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,         \
     uint32_t vma = vext_vma(desc);                                        \
     target_ulong offset = s1, i_min, i;                                   \
                                                                           \
-    VSTART_CHECK_EARLY_EXIT(env);                                         \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                           \
     i_min = MAX(env->vstart, offset);                                     \
     for (i = i_min; i < vl; i++) {                                        \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,         \
     uint32_t vma = vext_vma(desc);                                        \
     target_ulong i_max, i_min, i;                                         \
                                                                           \
-    VSTART_CHECK_EARLY_EXIT(env);                                         \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                           \
     i_min = MIN(s1 < vlmax ? vlmax - s1 : 0, vl);                         \
     i_max = MAX(i_min, env->vstart);                                      \
@@ -XXX,XX +XXX,XX @@ static void vslide1up_##BITWIDTH(void *vd, void *v0, uint64_t s1,           \
     uint32_t vma = vext_vma(desc);                                          \
     uint32_t i;                                                             \
                                                                             \
-    VSTART_CHECK_EARLY_EXIT(env);                                           \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                       \
                                                                             \
     for (i = env->vstart; i < vl; i++) {                                    \
         if (!vm && !vext_elem_mask(v0, i)) {                                \
@@ -XXX,XX +XXX,XX @@ static void vslide1down_##BITWIDTH(void *vd, void *v0, uint64_t s1,           \
     uint32_t vma = vext_vma(desc);                                            \
     uint32_t i;                                                               \
                                                                               \
-    VSTART_CHECK_EARLY_EXIT(env);                                             \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                         \
                                                                               \
     for (i = env->vstart; i < vl; i++) {                                      \
         if (!vm && !vext_elem_mask(v0, i)) {                                  \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,               \
     uint64_t index;                                                       \
     uint32_t i;                                                           \
                                                                           \
-    VSTART_CHECK_EARLY_EXIT(env);                                         \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                           \
     for (i = env->vstart; i < vl; i++) {                                  \
         if (!vm && !vext_elem_mask(v0, i)) {                              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,         \
     uint64_t index = s1;                                                  \
     uint32_t i;                                                           \
                                                                           \
-    VSTART_CHECK_EARLY_EXIT(env);                                         \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
                                                                           \
     for (i = env->vstart; i < vl; i++) {                                  \
         if (!vm && !vext_elem_mask(v0, i)) {                              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,                 \
     uint32_t vma = vext_vma(desc);                               \
     uint32_t i;                                                  \
                                                                  \
-    VSTART_CHECK_EARLY_EXIT(env);                                \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                            \
                                                                  \
     for (i = env->vstart; i < vl; i++) {                         \
         if (!vm && !vext_elem_mask(v0, i)) {                     \
diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_internals.c
+++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@ void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
     uint32_t vma = vext_vma(desc);
     uint32_t i;
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, vl);
 
     for (i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
@@ -XXX,XX +XXX,XX @@ void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
     uint32_t vma = vext_vma(desc);
     uint32_t i;
 
-    VSTART_CHECK_EARLY_EXIT(env);
+    VSTART_CHECK_EARLY_EXIT(env, vl);
 
     for (i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
-- 
2.48.1

From: Chao Liu <lc00631@tecorigin.com>

Recently, when I was writing a RISCV test, I found that when VL is set to 0, the
instruction should be nop, but when I tested it, I found that QEMU will treat
all elements as tail elements, and in the case of VTA=1, write all elements
to 1.

After troubleshooting, it was found that the vext_vx_rm_1 function was called in
the vext_vx_rm_2, and then the vext_set_elems_1s function was called to process
the tail element, but only VSTART >= vl was checked in the vext_vx_rm_1
function, which caused the tail element to still be processed even if it was
returned in advance.

So I've made the following change:

Put VSTART_CHECK_EARLY_EXIT(env) at the beginning of the vext_vx_rm_2 function,
so that the VSTART register is checked correctly.

Fixes: df4252b2ec ("target/riscv/vector_helpers: do early exit when
vstart >= vl")
Signed-off-by: Chao Liu <lc00631@tecorigin.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <b2649f14915150be4c602d63cd3ea4adf47e9d75.1741573286.git.lc00631@tecorigin.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_vv_rm_1(void *vd, void *v0, void *vs1, void *vs2,
              uint32_t vl, uint32_t vm, int vxrm,
              opivv2_rm_fn *fn, uint32_t vma, uint32_t esz)
 {
-    VSTART_CHECK_EARLY_EXIT(env, vl);
-
     for (uint32_t i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
             /* set masked-off elements to 1s */
@@ -XXX,XX +XXX,XX @@ vext_vv_rm_2(void *vd, void *v0, void *vs1, void *vs2,
     uint32_t vta = vext_vta(desc);
     uint32_t vma = vext_vma(desc);
 
+    VSTART_CHECK_EARLY_EXIT(env, vl);
+
     switch (env->vxrm) {
     case 0: /* rnu */
         vext_vv_rm_1(vd, v0, vs1, vs2,
@@ -XXX,XX +XXX,XX @@ vext_vx_rm_1(void *vd, void *v0, target_long s1, void *vs2,
              uint32_t vl, uint32_t vm, int vxrm,
              opivx2_rm_fn *fn, uint32_t vma, uint32_t esz)
 {
-    VSTART_CHECK_EARLY_EXIT(env, vl);
-
     for (uint32_t i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
             /* set masked-off elements to 1s */
@@ -XXX,XX +XXX,XX @@ vext_vx_rm_2(void *vd, void *v0, target_long s1, void *vs2,
     uint32_t vta = vext_vta(desc);
     uint32_t vma = vext_vma(desc);
 
+    VSTART_CHECK_EARLY_EXIT(env, vl);
+
     switch (env->vxrm) {
     case 0: /* rnu */
         vext_vx_rm_1(vd, v0, s1, vs2,
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
     uint32_t i;                                           \
     TD s1 =  *((TD *)vs1 + HD(0));                        \
                                                           \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                     \
+                                                          \
     for (i = env->vstart; i < vl; i++) {                  \
         TS2 s2 = *((TS2 *)vs2 + HS2(i));                  \
         if (!vm && !vext_elem_mask(v0, i)) {              \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,           \
     uint32_t i;                                            \
     TD s1 =  *((TD *)vs1 + HD(0));                         \
                                                            \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                      \
+                                                           \
     for (i = env->vstart; i < vl; i++) {                   \
         TS2 s2 = *((TS2 *)vs2 + HS2(i));                   \
         if (!vm && !vext_elem_mask(v0, i)) {               \
@@ -XXX,XX +XXX,XX @@ static void vmsetm(void *vd, void *v0, void *vs2, CPURISCVState *env,
     int i;
     bool first_mask_bit = false;
 
+    VSTART_CHECK_EARLY_EXIT(env, vl);
+
     for (i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
             /* set masked-off elements to 1s */
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2, CPURISCVState *env,      \
     uint32_t sum = 0;                                                     \
     int i;                                                                \
                                                                           \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
+                                                                          \
     for (i = env->vstart; i < vl; i++) {                                  \
         if (!vm && !vext_elem_mask(v0, i)) {                              \
             /* set masked-off elements to 1s */                           \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,               \
     uint32_t vta = vext_vta(desc);                                        \
     uint32_t num = 0, i;                                                  \
                                                                           \
+    VSTART_CHECK_EARLY_EXIT(env, vl);                                     \
+                                                                          \
     for (i = env->vstart; i < vl; i++) {                                  \
         if (!vext_elem_mask(vs1, i)) {                                    \
             continue;                                                     \
-- 
2.48.1

From: Richard Henderson <richard.henderson@linaro.org>

The third argument of the syscall contains the size of the
cpu mask in bytes, not bits.  Nor is the size rounded up to
a multiple of sizeof(abi_ulong).

Cc: qemu-stable@nongnu.org
Reported-by: Andreas Schwab <schwab@suse.de>
Fixes: 9e1c7d982d7 ("linux-user/riscv: Add syscall riscv_hwprobe")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250308225902.1208237-3-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/syscall.c | 55 +++++++++++++++++++++++---------------------
 1 file changed, 29 insertions(+), 26 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
     }
 }
 
-static int cpu_set_valid(abi_long arg3, abi_long arg4)
+/*
+ * If the cpumask_t of (target_cpus, cpusetsize) cannot be read: -EFAULT.
+ * If the cpumast_t has no bits set: -EINVAL.
+ * Otherwise the cpumask_t contains some bit set: 0.
+ * Unlike the kernel, we do not mask cpumask_t by the set of online cpus,
+ * nor bound the search by cpumask_size().
+ */
+static int nonempty_cpu_set(abi_ulong cpusetsize, abi_ptr target_cpus)
 {
-    int ret, i, tmp;
-    size_t host_mask_size, target_mask_size;
-    unsigned long *host_mask;
-
-    /*
-     * cpu_set_t represent CPU masks as bit masks of type unsigned long *.
-     * arg3 contains the cpu count.
-     */
-    tmp = (8 * sizeof(abi_ulong));
-    target_mask_size = ((arg3 + tmp - 1) / tmp) * sizeof(abi_ulong);
-    host_mask_size = (target_mask_size + (sizeof(*host_mask) - 1)) &
-                     ~(sizeof(*host_mask) - 1);
-
-    host_mask = alloca(host_mask_size);
-
-    ret = target_to_host_cpu_mask(host_mask, host_mask_size,
-                                  arg4, target_mask_size);
-    if (ret != 0) {
-        return ret;
-    }
+    unsigned char *p = lock_user(VERIFY_READ, target_cpus, cpusetsize, 1);
+    int ret = -TARGET_EFAULT;
 
-    for (i = 0 ; i < host_mask_size / sizeof(*host_mask); i++) {
-        if (host_mask[i] != 0) {
-            return 0;
+    if (p) {
+        ret = -TARGET_EINVAL;
+        /*
+         * Since we only care about the empty/non-empty state of the cpumask_t
+         * not the individual bits, we do not need to repartition the bits
+         * from target abi_ulong to host unsigned long.
+         *
+         * Note that the kernel does not round up cpusetsize to a multiple of
+         * sizeof(abi_ulong).  After bounding cpusetsize by cpumask_size(),
+         * it copies exactly cpusetsize bytes into a zeroed buffer.
+         */
+        for (abi_ulong i = 0; i < cpusetsize; ++i) {
+            if (p[i]) {
+                ret = 0;
+                break;
+            }
         }
+        unlock_user(p, target_cpus, 0);
     }
-    return -TARGET_EINVAL;
+    return ret;
 }
 
 static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
@@ -XXX,XX +XXX,XX @@ static abi_long do_riscv_hwprobe(CPUArchState *cpu_env, abi_long arg1,
 
     /* check cpu_set */
     if (arg3 != 0) {
-        ret = cpu_set_valid(arg3, arg4);
+        ret = nonempty_cpu_set(arg3, arg4);
         if (ret != 0) {
             return ret;
         }
-- 
2.48.1

From: Yu-Ming Chang <yumin686@andestech.com>

For privilege version 1.12 or newer, C always implies Zca. We can only
check ext_zca to allow 16-bit aligned PC addresses. For older privilege
versions, we only check C.

Signed-off-by: Yu-Ming Chang <yumin686@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <174184718265.10540.10120024221661781046-0@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                      | 12 ++++++++++++
 target/riscv/op_helper.c                |  8 ++++++--
 target/riscv/translate.c                |  4 +++-
 target/riscv/insn_trans/trans_rvi.c.inc |  8 ++++++--
 4 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline RISCVMXL riscv_cpu_sxl(CPURISCVState *env)
 }
 #endif
 
+static inline bool riscv_cpu_allow_16bit_insn(const RISCVCPUConfig *cfg,
+                                              target_long priv_ver,
+                                              uint32_t misa_ext)
+{
+    /* In priv spec version 1.12 or newer, C always implies Zca */
+    if (priv_ver >= PRIV_VERSION_1_12_0) {
+        return cfg->ext_zca;
+    } else {
+        return misa_ext & RVC;
+    }
+}
+
 /*
  * Encode LMUL to lmul as follows:
  *     LMUL    vlmul    lmul
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
     }
 
     target_ulong retpc = env->sepc;
-    if (!riscv_has_ext(env, RVC) && (retpc & 0x3)) {
+    if (!riscv_cpu_allow_16bit_insn(&env_archcpu(env)->cfg,
+                                    env->priv_ver,
+                                    env->misa_ext) && (retpc & 0x3)) {
         riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, GETPC());
     }
 
@@ -XXX,XX +XXX,XX @@ static void check_ret_from_m_mode(CPURISCVState *env, target_ulong retpc,
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
     }
 
-    if (!riscv_has_ext(env, RVC) && (retpc & 0x3)) {
+    if (!riscv_cpu_allow_16bit_insn(&env_archcpu(env)->cfg,
+                                    env->priv_ver,
+                                    env->misa_ext) && (retpc & 0x3)) {
         riscv_raise_exception(env, RISCV_EXCP_INST_ADDR_MIS, GETPC());
     }
 
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
     TCGv succ_pc = dest_gpr(ctx, rd);
 
     /* check misaligned: */
-    if (!has_ext(ctx, RVC) && !ctx->cfg_ptr->ext_zca) {
+    if (!riscv_cpu_allow_16bit_insn(ctx->cfg_ptr,
+                                    ctx->priv_ver,
+                                    ctx->misa_ext)) {
         if ((imm & 0x3) != 0) {
             TCGv target_pc = tcg_temp_new();
             gen_pc_plus_diff(target_pc, ctx, imm);
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
         tcg_gen_ext32s_tl(target_pc, target_pc);
     }
 
-    if (!has_ext(ctx, RVC) && !ctx->cfg_ptr->ext_zca) {
+    if (!riscv_cpu_allow_16bit_insn(ctx->cfg_ptr,
+                                    ctx->priv_ver,
+                                    ctx->misa_ext)) {
         TCGv t0 = tcg_temp_new();
 
         misaligned = gen_new_label();
@@ -XXX,XX +XXX,XX @@ static bool gen_branch(DisasContext *ctx, arg_b *a, TCGCond cond)
 
     gen_set_label(l); /* branch taken */
 
-    if (!has_ext(ctx, RVC) && !ctx->cfg_ptr->ext_zca &&
+    if (!riscv_cpu_allow_16bit_insn(ctx->cfg_ptr,
+                                    ctx->priv_ver,
+                                    ctx->misa_ext) &&
         (a->imm & 0x3)) {
         /* misaligned */
         TCGv target_pc = tcg_temp_new();
-- 
2.48.1