Series comparison

-[PULL 00/44] riscv-to-apply queue
+[PULL 00/28] riscv-to-apply queue
-The following changes since commit 946e9bccf12f2bcc3ca471b820738fb22d14fc80:
+The following changes since commit ad10b4badc1dd5b28305f9b9f1168cf0aa3ae946:
-  Merge tag 'samuel-thibault' of https://people.debian.org/~sthibault/qemu into staging (2022-09-06 08:31:24 -0400)
+  Merge tag 'pull-error-2024-05-27' of https://repo.or.cz/qemu/armbru into staging (2024-05-27 06:40:42 -0700)
 are available in the Git repository at:
-  git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20220907
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240528
-for you to fetch changes up to f0551560b5c01b1dcbed1ac46ca0bd1155330f5f:
+for you to fetch changes up to 1806da76cb81088ea026ca3441551782b850e393:
-  target/riscv: Update the privilege field for sscofpmf CSRs (2022-09-07 09:19:15 +0200)
+  target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR (2024-05-28 12:20:27 +1000)
 ----------------------------------------------------------------
-First RISC-V PR for QEMU 7.2
+RISC-V PR for 9.1
-* Update [m|h]tinst CSR in interrupt handling
+* APLICs add child earlier than realize
-* Force disable extensions if priv spec version does not match
+* Fix exposure of Zkr
-* fix shifts shamt value for rv128c
+* Raise exceptions on wrs.nto
-* move zmmul out of the experimental
+* Implement SBI debug console (DBCN) calls for KVM
-* virt: pass random seed to fdt
+* Support 64-bit addresses for initrd
-* Add checks for supported extension combinations
+* Change RISCV_EXCP_SEMIHOST exception number to 63
-* Upgrade OpenSBI to v1.1
+* Tolerate KVM disable ext errors
-* Fix typo and restore Pointer Masking functionality for RISC-V
+* Set tval in breakpoints
-* Add mask agnostic behaviour (rvv_ma_all_1s) for vector extension
+* Add support for Zve32x extension
-* Add Zihintpause support
+* Add support for Zve64x extension
-* opentitan: bump opentitan version
+* Relax vector register check in RISCV gdbstub
-* microchip_pfsoc: fix kernel panics due to missing peripherals
+* Fix the element agnostic Vector function problem
-* Remove additional priv version check for mcountinhibit
+* Fix Zvkb extension config
-* virt machine device tree improvements
+* Implement dynamic establishment of custom decoder
-* Add xicondops in ISA entry
+* Add th.sxstatus CSR emulation
-* Use official extension names for AIA CSRs
+* Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
 * Check single width operator for vector fp widen instructions
 * Check single width operator for vfncvt.rod.f.f.w
 * Remove redudant SEW checking for vector fp narrow/widen instructions
 * Prioritize pmp errors in raise_mmu_exception()
 * Do not set mtval2 for non guest-page faults
 * Remove experimental prefix from "B" extension
 * Fixup CBO extension register calculation
 * Fix the hart bit setting of AIA
 * Fix reg_width in ricsv_gen_dynamic_vector_feature()
 * Decode all of the pmpcfg and pmpaddr CSRs
 * Raise an exception when CSRRS/CSRRC writes a read-only CSR
 ----------------------------------------------------------------
-Alexey Baturo (1):
+Alexei Filippov (1):
-      target/riscv: Fix typo and restore Pointer Masking functionality for RISC-V
+      target/riscv: do not set mtval2 for non guest-page faults
-Anup Patel (3):
+Alistair Francis (2):
-      target/riscv: Update [m|h]tinst CSR in riscv_cpu_do_interrupt()
+      target/riscv: rvzicbo: Fixup CBO extension register calculation
-      target/riscv: Force disable extensions if priv spec version does not match
+      disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
       target/riscv: Use official extension names for AIA CSRs
-Atish Patra (9):
+Andrew Jones (2):
-      target/riscv: Remove additional priv version check for mcountinhibit
+      target/riscv/kvm: Fix exposure of Zkr
-      hw/intc: Move mtimer/mtimecmp to aclint
+      target/riscv: Raise exceptions on wrs.nto
       target/riscv: Add stimecmp support
       target/riscv: Add vstimecmp support
       target/riscv: Add sscofpmf extension support
       target/riscv: Simplify counter predicate function
       target/riscv: Add few cache related PMU events
       hw/riscv: virt: Add PMU DT node to the device tree
       target/riscv: Update the privilege field for sscofpmf CSRs
-Bin Meng (2):
+Cheng Yang (1):
-      roms/opensbi: Upgrade from v1.0 to v1.1
+      hw/riscv/boot.c: Support 64-bit address for initrd
       docs: List kvm as a supported accelerator on RISC-V
-Conor Dooley (5):
+Christoph Müllner (1):
-      hw/riscv: microchip_pfsoc: fix kernel panics due to missing peripherals
+      riscv: thead: Add th.sxstatus CSR emulation
       hw/riscv: virt: fix uart node name
       hw/riscv: virt: fix the plic's address cells
       hw/riscv: virt: fix syscon subnode paths
       hw/core: fix platform bus node name
-Daniel Henrique Barboza (1):
+Clément Léger (1):
-      hw/riscv: remove 'fdt' param from riscv_setup_rom_reset_vec()
+      target/riscv: change RISCV_EXCP_SEMIHOST exception number to 63
-Dao Lu (1):
+Daniel Henrique Barboza (6):
-      target/riscv: Add Zihintpause support
+      target/riscv/kvm: implement SBI debug console (DBCN) calls
       target/riscv/kvm: tolerate KVM disable ext errors
       target/riscv/debug: set tval=pc in breakpoint exceptions
       trans_privileged.c.inc: set (m|s)tval on ebreak breakpoint
       target/riscv: prioritize pmp errors in raise_mmu_exception()
       riscv, gdbstub.c: fix reg_width in ricsv_gen_dynamic_vector_feature()
-Frédéric Pétrot (1):
+Huang Tao (2):
-      target/riscv: fix shifts shamt value for rv128c
+      target/riscv: Fix the element agnostic function problem
       target/riscv: Implement dynamic establishment of custom decoder
-Jason A. Donenfeld (1):
+Jason Chien (3):
-      hw/riscv: virt: pass random seed to fdt
+      target/riscv: Add support for Zve32x extension
       target/riscv: Add support for Zve64x extension
       target/riscv: Relax vector register check in RISCV gdbstub
-Rahul Pathak (1):
+Max Chou (4):
-      target/riscv: Add xicondops in ISA entry
+      target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
       target/riscv: rvv: Check single width operator for vector fp widen instructions
       target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
       target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
-Weiwei Li (8):
+Rob Bradford (1):
-      target/riscv: move zmmul out of the experimental properties
+      target/riscv: Remove experimental prefix from "B" extension
       target/riscv: Add check for supported privilege mode combinations
       target/riscv: H extension depends on I extension
       target/riscv: Fix checkpatch warning may triggered in csr_ops table
       target/riscv: Add check for csrs existed with U extension
       target/riscv: Fix checks in hmode/hmode32
       target/riscv: Simplify the check in hmode to reuse the check in riscv_csrrw_check
       target/riscv: Fix priority of csr related check in riscv_csrrw_check
-Wilfred Mallawa (1):
+Yangyu Chen (1):
-      hw/riscv: opentitan: bump opentitan version
+      target/riscv/cpu.c: fix Zvkb extension config
-Yueh-Ting (eop) Chen (9):
+Yong-Xuan Wang (1):
-      target/riscv: rvv: Add mask agnostic for vv instructions
+      target/riscv/kvm.c: Fix the hart bit setting of AIA
       target/riscv: rvv: Add mask agnostic for vector load / store instructions
       target/riscv: rvv: Add mask agnostic for vx instructions
       target/riscv: rvv: Add mask agnostic for vector integer shift instructions
       target/riscv: rvv: Add mask agnostic for vector integer comparison instructions
       target/riscv: rvv: Add mask agnostic for vector fix-point arithmetic instructions
       target/riscv: rvv: Add mask agnostic for vector floating-point instructions
       target/riscv: rvv: Add mask agnostic for vector mask instructions
       target/riscv: rvv: Add mask agnostic for vector permutation instructions
-eopXD (1):
+Yu-Ming Chang (1):
-      target/riscv: rvv: Add option 'rvv_ma_all_1s' to enable optional mask agnostic behavior
+      target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR
- docs/about/build-platforms.rst                 |    2 +-
+yang.zhang (1):
- include/hw/intc/riscv_aclint.h                 |    2 +
+      hw/intc/riscv_aplic: APLICs should add child earlier than realize
  include/hw/riscv/boot.h                        |    2 +-
  include/hw/riscv/microchip_pfsoc.h             |   14 +-
  include/hw/riscv/opentitan.h                   |   11 +-
  include/hw/riscv/virt.h                        |    1 +
  include/hw/timer/ibex_timer.h                  |    2 +
  target/riscv/cpu.h                             |   48 +-
  target/riscv/cpu_bits.h                        |   63 ++
  target/riscv/instmap.h                         |   45 +
  target/riscv/internals.h                       |    5 +-
  target/riscv/pmu.h                             |    8 +
  target/riscv/time_helper.h                     |   30 +
  target/riscv/insn16.decode                     |    7 +-
  target/riscv/insn32.decode                     |    7 +-
  disas/riscv.c                                  |   27 +-
  hw/core/sysbus-fdt.c                           |    2 +-
  hw/intc/riscv_aclint.c                         |   48 +-
  hw/intc/riscv_imsic.c                          |    4 +-
  hw/riscv/boot.c                                |    4 +-
  hw/riscv/microchip_pfsoc.c                     |   69 +-
  hw/riscv/opentitan.c                           |   12 +-
  hw/riscv/shakti_c.c                            |    3 +-
  hw/riscv/spike.c                               |    2 +-
  hw/riscv/virt.c                                |   45 +-
  hw/timer/ibex_timer.c                          |   18 +-
  target/riscv/cpu.c                             |  204 +++--
  target/riscv/cpu_helper.c                      |  293 ++++++-
  target/riscv/csr.c                             | 1038 +++++++++++++++---------
  target/riscv/machine.c                         |    8 +-
  target/riscv/pmu.c                             |  425 +++++++++-
  target/riscv/time_helper.c                     |  114 +++
  target/riscv/translate.c                       |   24 +-
  target/riscv/vector_helper.c                   |  152 +++-
  target/riscv/insn_trans/trans_rvi.c.inc        |   16 +
  target/riscv/insn_trans/trans_rvv.c.inc        |   28 +
  pc-bios/opensbi-riscv32-generic-fw_dynamic.bin |  Bin 108504 -> 117704 bytes
  pc-bios/opensbi-riscv64-generic-fw_dynamic.bin |  Bin 105296 -> 115344 bytes
  roms/opensbi                                   |    2 +-
  target/riscv/meson.build                       |    3 +-
 files changed, 2229 insertions(+), 559 deletions(-)
  create mode 100644 target/riscv/time_helper.h
  create mode 100644 target/riscv/time_helper.c
+ MAINTAINERS                                    |   1 +
+ target/riscv/cpu.h                             |  11 ++
+ target/riscv/cpu_bits.h                        |   2 +-
+ target/riscv/cpu_cfg.h                         |   2 +
+ target/riscv/helper.h                          |   1 +
+ target/riscv/sbi_ecall_interface.h             |  17 +++
+ target/riscv/tcg/tcg-cpu.h                     |  15 +++
+ disas/riscv.c                                  |  65 +++++++++-
+ hw/intc/riscv_aplic.c                          |   8 +-
+ hw/riscv/boot.c                                |   4 +-
+ target/riscv/cpu.c                             |  10 +-
+ target/riscv/cpu_helper.c                      |  37 +++---
+ target/riscv/csr.c                             |  71 +++++++++--
+ target/riscv/debug.c                           |   3 +
+ target/riscv/gdbstub.c                         |   8 +-
+ target/riscv/kvm/kvm-cpu.c                     | 157 ++++++++++++++++++++++++-
+ target/riscv/op_helper.c                       |  17 ++-
+ target/riscv/tcg/tcg-cpu.c                     |  50 +++++---
+ target/riscv/th_csr.c                          |  79 +++++++++++++
+ target/riscv/translate.c                       |  31 +++--
+ target/riscv/vector_internals.c                |  22 ++++
+ target/riscv/insn_trans/trans_privileged.c.inc |   2 +
+ target/riscv/insn_trans/trans_rvv.c.inc        |  46 +++++---
+ target/riscv/insn_trans/trans_rvzawrs.c.inc    |  29 +++--
+ target/riscv/insn_trans/trans_rvzicbo.c.inc    |  16 ++-
+ target/riscv/meson.build                       |   1 +
+files changed, 596 insertions(+), 109 deletions(-)
+ create mode 100644 target/riscv/th_csr.c

-[PULL 27/44] target/riscv: Fix priority of csr related check in riscv_csrrw_check
+[PULL 01/28] hw/intc/riscv_aplic: APLICs should add child earlier than realize
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: "yang.zhang" <yang.zhang@hexintek.com>
-Normally, riscv_csrrw_check is called when executing Zicsr instructions.
+Since only root APLICs can have hw IRQ lines, aplic->parent should
-And we can only do access control for existed CSRs. So the priority of
+be initialized first.
 CSR related check, from highest to lowest, should be as follows:
 ) check whether Zicsr is supported: raise RISCV_EXCP_ILLEGAL_INST if not
 ) check whether csr is existed: raise RISCV_EXCP_ILLEGAL_INST if not
 ) do access control: raise RISCV_EXCP_ILLEGAL_INST or RISCV_EXCP_VIRT_
 INSTRUCTION_FAULT if not allowed
-The predicates contain parts of function of both 2) and 3), So they need
+Fixes: e8f79343cf ("hw/intc: Add RISC-V AIA APLIC device emulation")
-to be placed in the middle of riscv_csrrw_check
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Signed-off-by: yang.zhang <yang.zhang@hexintek.com>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Cc: qemu-stable <qemu-stable@nongnu.org>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Message-ID: <20240409014445.278-1-gaoshanliukou@163.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20220803123652.3700-1-liweiwei@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 44 +++++++++++++++++++++++++-------------------
+ hw/intc/riscv_aplic.c | 8 ++++----
-file changed, 25 insertions(+), 19 deletions(-)
+file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/hw/intc/riscv_aplic.c
-+++ b/target/riscv/csr.c
++++ b/hw/intc/riscv_aplic.c
-@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
+@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
-     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
+     qdev_prop_set_bit(dev, "msimode", msimode);
-     int read_only = get_field(csrno, 0xC00) == 3;
+     qdev_prop_set_bit(dev, "mmode", mmode);
-     int csr_min_priv = csr_ops[csrno].min_priv_ver;
-+
++    if (parent) {
-+    /* ensure the CSR extension is enabled. */
++        riscv_aplic_add_child(parent, dev);
 +    if (!cpu->cfg.ext_icsr) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
-+    if (env->priv_ver < csr_min_priv) {
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-+        return RISCV_EXCP_ILLEGAL_INST;
-+    }
+     if (!is_kvm_aia(msimode)) {
-+
+         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +    /* check predicate */
 +    if (!csr_ops[csrno].predicate) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    if (write_mask && read_only) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    RISCVException ret = csr_ops[csrno].predicate(env, csrno);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
  #if !defined(CONFIG_USER_ONLY)
      int csr_priv, effective_priv = env->priv;
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
          return RISCV_EXCP_ILLEGAL_INST;
      }
- #endif
--    if (write_mask && read_only) {
+-    if (parent) {
--        return RISCV_EXCP_ILLEGAL_INST;
+-        riscv_aplic_add_child(parent, dev);
 -    }
 -
--    /* ensure the CSR extension is enabled. */
+     if (!msimode) {
--    if (!cpu->cfg.ext_icsr) {
+         for (i = 0; i < num_harts; i++) {
--        return RISCV_EXCP_ILLEGAL_INST;
+             CPUState *cpu = cpu_by_arch_id(hartid_base + i);
 -    }
 -
 -    /* check predicate */
 -    if (!csr_ops[csrno].predicate) {
 -        return RISCV_EXCP_ILLEGAL_INST;
 -    }
 -
 -    if (env->priv_ver < csr_min_priv) {
 -        return RISCV_EXCP_ILLEGAL_INST;
 -    }
 -
 -    return csr_ops[csrno].predicate(env, csrno);
 +    return RISCV_EXCP_NONE;
  }
  static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
 --
-.37.2
+.45.1

-[PULL 40/44] target/riscv: Add sscofpmf extension support
+[PULL 02/28] target/riscv/kvm: Fix exposure of Zkr
-From: Atish Patra <atishp@rivosinc.com>
+From: Andrew Jones <ajones@ventanamicro.com>
-The Sscofpmf ('Ss' for Privileged arch and Supervisor-level extensions,
+The Zkr extension may only be exposed to KVM guests if the VMM
-and 'cofpmf' for Count OverFlow and Privilege Mode Filtering)
+implements the SEED CSR. Use the same implementation as TCG.
 extension allows the perf to handle overflow interrupts and filtering
 support. This patch provides a framework for programmable
 counters to leverage the extension. As the extension doesn't have any
 provision for the overflow bit for fixed counters, the fixed events
 can also be monitoring using programmable counters. The underlying
 counters for cycle and instruction counters are always running. Thus,
 a separate timer device is programmed to handle the overflow.
-Tested-by: Heiko Stuebner <heiko@sntech.de>
+Without this patch, running with a KVM which does not forward the
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+SEED CSR access to QEMU will result in an ILL exception being
-Signed-off-by: Atish Patra <atish.patra@wdc.com>
+injected into the guest (this results in Linux guests crashing on
-Signed-off-by: Atish Patra <atishp@rivosinc.com>
+boot). And, when running with a KVM which does forward the access,
-Message-Id: <20220824221701.41932-2-atishp@rivosinc.com>
+QEMU will crash, since QEMU doesn't know what to do with the exit.
 Fixes: 3108e2f1c69d ("target/riscv/kvm: update KVM exts to Linux 6.8")
 Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240422134605.534207-2-ajones@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h      |  25 +++
+ target/riscv/cpu.h         |  3 +++
- target/riscv/cpu_bits.h |  55 ++++++
+ target/riscv/csr.c         | 18 ++++++++++++++----
- target/riscv/pmu.h      |   7 +
+ target/riscv/kvm/kvm-cpu.c | 25 +++++++++++++++++++++++++
- target/riscv/cpu.c      |  12 ++
+files changed, 42 insertions(+), 4 deletions(-)
  target/riscv/csr.c      | 166 +++++++++++++++++-
  target/riscv/machine.c  |   1 +
  target/riscv/pmu.c      | 368 +++++++++++++++++++++++++++++++++++++++-
 files changed, 623 insertions(+), 11 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct PMUCTRState {
+@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops);
-     /* Snapshort value of a counter in RV32 */
-     target_ulong mhpmcounterh_prev;
+ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs);
-     bool started;
-+    /* Value beyond UINT32_MAX/UINT64_MAX before overflow interrupt trigger */
++target_ulong riscv_new_csr_seed(target_ulong new_value,
-+    target_ulong irq_overflow_left;
++                                target_ulong write_mask);
  } PMUCTRState;
  struct CPUArchState {
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
      /* PMU event selector configured values. First three are unused*/
      target_ulong mhpmevent_val[RV_MAX_MHPMEVENTS];
 +    /* PMU event selector configured values for RV32*/
 +    target_ulong mhpmeventh_val[RV_MAX_MHPMEVENTS];
 +
-     target_ulong sscratch;
+ uint8_t satp_mode_max_from_map(uint32_t map);
-     target_ulong mscratch;
+ const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zmmul;
      bool ext_smaia;
      bool ext_ssaia;
 +    bool ext_sscofpmf;
      bool rvv_ta_all_1s;
      bool rvv_ma_all_1s;
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
      /* Configuration Settings */
      RISCVCPUConfig cfg;
 +
 +    QEMUTimer *pmu_timer;
 +    /* A bitmask of Available programmable counters */
 +    uint32_t pmu_avail_ctrs;
 +    /* Mapping of events to counters */
 +    GHashTable *pmu_event_ctr_map;
  };
  static inline int riscv_has_ext(CPURISCVState *env, target_ulong ext)
@@ -XXX,XX +XXX,XX @@ enum {
      CSR_TABLE_SIZE = 0x1000
  };
 +/**
 + * The event id are encoded based on the encoding specified in the
 + * SBI specification v0.3
 + */
 +
 +enum riscv_pmu_event_idx {
 +    RISCV_PMU_EVENT_HW_CPU_CYCLES = 0x01,
 +    RISCV_PMU_EVENT_HW_INSTRUCTIONS = 0x02,
 +    RISCV_PMU_EVENT_CACHE_DTLB_READ_MISS = 0x10019,
 +    RISCV_PMU_EVENT_CACHE_DTLB_WRITE_MISS = 0x1001B,
 +    RISCV_PMU_EVENT_CACHE_ITLB_PREFETCH_MISS = 0x10021,
 +};
 +
  /* CSR function table */
  extern riscv_csr_operations csr_ops[CSR_TABLE_SIZE];
 diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_bits.h
 +++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
  #define CSR_MHPMEVENT29     0x33d
  #define CSR_MHPMEVENT30     0x33e
  #define CSR_MHPMEVENT31     0x33f
 +
 +#define CSR_MHPMEVENT3H     0x723
 +#define CSR_MHPMEVENT4H     0x724
 +#define CSR_MHPMEVENT5H     0x725
 +#define CSR_MHPMEVENT6H     0x726
 +#define CSR_MHPMEVENT7H     0x727
 +#define CSR_MHPMEVENT8H     0x728
 +#define CSR_MHPMEVENT9H     0x729
 +#define CSR_MHPMEVENT10H    0x72a
 +#define CSR_MHPMEVENT11H    0x72b
 +#define CSR_MHPMEVENT12H    0x72c
 +#define CSR_MHPMEVENT13H    0x72d
 +#define CSR_MHPMEVENT14H    0x72e
 +#define CSR_MHPMEVENT15H    0x72f
 +#define CSR_MHPMEVENT16H    0x730
 +#define CSR_MHPMEVENT17H    0x731
 +#define CSR_MHPMEVENT18H    0x732
 +#define CSR_MHPMEVENT19H    0x733
 +#define CSR_MHPMEVENT20H    0x734
 +#define CSR_MHPMEVENT21H    0x735
 +#define CSR_MHPMEVENT22H    0x736
 +#define CSR_MHPMEVENT23H    0x737
 +#define CSR_MHPMEVENT24H    0x738
 +#define CSR_MHPMEVENT25H    0x739
 +#define CSR_MHPMEVENT26H    0x73a
 +#define CSR_MHPMEVENT27H    0x73b
 +#define CSR_MHPMEVENT28H    0x73c
 +#define CSR_MHPMEVENT29H    0x73d
 +#define CSR_MHPMEVENT30H    0x73e
 +#define CSR_MHPMEVENT31H    0x73f
 +
  #define CSR_MHPMCOUNTER3H   0xb83
  #define CSR_MHPMCOUNTER4H   0xb84
  #define CSR_MHPMCOUNTER5H   0xb85
@@ -XXX,XX +XXX,XX @@
  #define CSR_VSMTE           0x2c0
  #define CSR_VSPMMASK        0x2c1
  #define CSR_VSPMBASE        0x2c2
 +#define CSR_SCOUNTOVF       0xda0
  /* Crypto Extension */
  #define CSR_SEED            0x015
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define IRQ_VS_EXT                         10
  #define IRQ_M_EXT                          11
  #define IRQ_S_GEXT                         12
 +#define IRQ_PMU_OVF                        13
  #define IRQ_LOCAL_MAX                      16
  #define IRQ_LOCAL_GUEST_MAX                (TARGET_LONG_BITS - 1)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define MIP_VSEIP                          (1 << IRQ_VS_EXT)
  #define MIP_MEIP                           (1 << IRQ_M_EXT)
  #define MIP_SGEIP                          (1 << IRQ_S_GEXT)
 +#define MIP_LCOFIP                         (1 << IRQ_PMU_OVF)
  /* sip masks */
  #define SIP_SSIP                           MIP_SSIP
  #define SIP_STIP                           MIP_STIP
  #define SIP_SEIP                           MIP_SEIP
 +#define SIP_LCOFIP                         MIP_LCOFIP
  /* MIE masks */
  #define MIE_SEIE                           (1 << IRQ_S_EXT)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
  #define SEED_OPST_WAIT                   (0b01 << 30)
  #define SEED_OPST_ES16                   (0b10 << 30)
  #define SEED_OPST_DEAD                   (0b11 << 30)
 +/* PMU related bits */
 +#define MIE_LCOFIE                         (1 << IRQ_PMU_OVF)
 +
 +#define MHPMEVENT_BIT_OF                   BIT_ULL(63)
 +#define MHPMEVENTH_BIT_OF                  BIT(31)
 +#define MHPMEVENT_BIT_MINH                 BIT_ULL(62)
 +#define MHPMEVENTH_BIT_MINH                BIT(30)
 +#define MHPMEVENT_BIT_SINH                 BIT_ULL(61)
 +#define MHPMEVENTH_BIT_SINH                BIT(29)
 +#define MHPMEVENT_BIT_UINH                 BIT_ULL(60)
 +#define MHPMEVENTH_BIT_UINH                BIT(28)
 +#define MHPMEVENT_BIT_VSINH                BIT_ULL(59)
 +#define MHPMEVENTH_BIT_VSINH               BIT(27)
 +#define MHPMEVENT_BIT_VUINH                BIT_ULL(58)
 +#define MHPMEVENTH_BIT_VUINH               BIT(26)
 +
 +#define MHPMEVENT_SSCOF_MASK               _ULL(0xFFFF000000000000)
 +#define MHPMEVENT_IDX_MASK                 0xFFFFF
 +#define MHPMEVENT_SSCOF_RESVD              16
 +
  #endif
 diff --git a/target/riscv/pmu.h b/target/riscv/pmu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmu.h
 +++ b/target/riscv/pmu.h
@@ -XXX,XX +XXX,XX @@ bool riscv_pmu_ctr_monitor_instructions(CPURISCVState *env,
                                          uint32_t target_ctr);
  bool riscv_pmu_ctr_monitor_cycles(CPURISCVState *env,
                                    uint32_t target_ctr);
 +void riscv_pmu_timer_cb(void *priv);
 +int riscv_pmu_init(RISCVCPU *cpu, int num_counters);
 +int riscv_pmu_update_event_map(CPURISCVState *env, uint64_t value,
 +                               uint32_t ctr_idx);
 +int riscv_pmu_incr_ctr(RISCVCPU *cpu, enum riscv_pmu_event_idx event_idx);
 +int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value,
 +                          uint32_t ctr_idx);
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/ctype.h"
  #include "qemu/log.h"
  #include "cpu.h"
 +#include "pmu.h"
  #include "internals.h"
  #include "time_helper.h"
  #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zhinxmin, true, PRIV_VERSION_1_12_0, ext_zhinxmin),
      ISA_EXT_DATA_ENTRY(smaia, true, PRIV_VERSION_1_12_0, ext_smaia),
      ISA_EXT_DATA_ENTRY(ssaia, true, PRIV_VERSION_1_12_0, ext_ssaia),
 +    ISA_EXT_DATA_ENTRY(sscofpmf, true, PRIV_VERSION_1_12_0, ext_sscofpmf),
      ISA_EXT_DATA_ENTRY(sstc, true, PRIV_VERSION_1_12_0, ext_sstc),
      ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
      ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
          set_misa(env, env->misa_mxl, ext);
      }
 +#ifndef CONFIG_USER_ONLY
 +    if (cpu->cfg.pmu_num) {
 +        if (!riscv_pmu_init(cpu, cpu->cfg.pmu_num) && cpu->cfg.ext_sscofpmf) {
 +            cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 +                                          riscv_pmu_timer_cb, cpu);
 +        }
 +     }
 +#endif
 +
      riscv_cpu_register_gdb_regs_for_features(cs);
      qemu_init_vcpu(cs);
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
      DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
      DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
 +    DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
      DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
      DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
      DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
-     CPUState *cs = env_cpu(env);
+ #endif
-     RISCVCPU *cpu = RISCV_CPU(cs);
-     int ctr_index;
+ /* Crypto Extension */
--    int base_csrno = CSR_HPMCOUNTER3;
+-static RISCVException rmw_seed(CPURISCVState *env, int csrno,
-+    int base_csrno = CSR_CYCLE;
+-                               target_ulong *ret_value,
-     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
+-                               target_ulong new_value,
+-                               target_ulong write_mask)
-     if (rv32 && csrno >= CSR_CYCLEH) {
++target_ulong riscv_new_csr_seed(target_ulong new_value,
-@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
++                                target_ulong write_mask)
  {
      uint16_t random_v;
      Error *random_e = NULL;
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
          rval = random_v | SEED_OPST_ES16;
      }
-     ctr_index = csrno - base_csrno;
++    return rval;
 -    if (!cpu->cfg.pmu_num || ctr_index >= (cpu->cfg.pmu_num)) {
 +    if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) ||
 +        (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) {
 +        goto skip_ext_pmu_check;
 +    }
 +
 +    if ((!cpu->cfg.pmu_num || !(cpu->pmu_avail_ctrs & BIT(ctr_index)))) {
          /* No counter is enabled in PMU or the counter is out of range */
          return RISCV_EXCP_ILLEGAL_INST;
      }
 +skip_ext_pmu_check:
 +
      if (env->priv == PRV_S) {
          switch (csrno) {
          case CSR_CYCLE:
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
              }
              break;
          case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
 -            ctr_index = csrno - CSR_CYCLE;
              if (!get_field(env->mcounteren, 1 << ctr_index)) {
                  return RISCV_EXCP_ILLEGAL_INST;
              }
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
                  }
                  break;
              case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
 -                ctr_index = csrno - CSR_CYCLEH;
                  if (!get_field(env->mcounteren, 1 << ctr_index)) {
                      return RISCV_EXCP_ILLEGAL_INST;
                  }
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
              }
              break;
          case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
 -            ctr_index = csrno - CSR_CYCLE;
              if (!get_field(env->hcounteren, 1 << ctr_index) &&
                   get_field(env->mcounteren, 1 << ctr_index)) {
                  return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
                  }
                  break;
              case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
 -                ctr_index = csrno - CSR_CYCLEH;
                  if (!get_field(env->hcounteren, 1 << ctr_index) &&
                       get_field(env->mcounteren, 1 << ctr_index)) {
                      return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException mctr32(CPURISCVState *env, int csrno)
      return mctr(env, csrno);
  }
 +static RISCVException sscofpmf(CPURISCVState *env, int csrno)
 +{
 +    CPUState *cs = env_cpu(env);
 +    RISCVCPU *cpu = RISCV_CPU(cs);
 +
 +    if (!cpu->cfg.ext_sscofpmf) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    return RISCV_EXCP_NONE;
 +}
 +
- static RISCVException any(CPURISCVState *env, int csrno)
++static RISCVException rmw_seed(CPURISCVState *env, int csrno,
- {
++                               target_ulong *ret_value,
-     return RISCV_EXCP_NONE;
++                               target_ulong new_value,
-@@ -XXX,XX +XXX,XX @@ static int read_mhpmevent(CPURISCVState *env, int csrno, target_ulong *val)
++                               target_ulong write_mask)
- static int write_mhpmevent(CPURISCVState *env, int csrno, target_ulong val)
++{
- {
++    target_ulong rval;
      int evt_index = csrno - CSR_MCOUNTINHIBIT;
 +    uint64_t mhpmevt_val = val;
      env->mhpmevent_val[evt_index] = val;
 +    if (riscv_cpu_mxl(env) == MXL_RV32) {
 +        mhpmevt_val = mhpmevt_val |
 +                      ((uint64_t)env->mhpmeventh_val[evt_index] << 32);
 +    }
 +    riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
 +
-+    return RISCV_EXCP_NONE;
++    rval = riscv_new_csr_seed(new_value, write_mask);
 +}
 +
-+static int read_mhpmeventh(CPURISCVState *env, int csrno, target_ulong *val)
+     if (ret_value) {
          *ret_value = rval;
      }
 diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm/kvm-cpu.c
 +++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
      return ret;
  }
 +static int kvm_riscv_handle_csr(CPUState *cs, struct kvm_run *run)
 +{
-+    int evt_index = csrno - CSR_MHPMEVENT3H + 3;
++    target_ulong csr_num = run->riscv_csr.csr_num;
 +    target_ulong new_value = run->riscv_csr.new_value;
 +    target_ulong write_mask = run->riscv_csr.write_mask;
 +    int ret = 0;
 +
-+    *val = env->mhpmeventh_val[evt_index];
++    switch (csr_num) {
-+
++    case CSR_SEED:
-+    return RISCV_EXCP_NONE;
++        run->riscv_csr.ret_value = riscv_new_csr_seed(new_value, write_mask);
-+}
++        break;
-+
++    default:
-+static int write_mhpmeventh(CPURISCVState *env, int csrno, target_ulong val)
++        qemu_log_mask(LOG_UNIMP,
-+{
++                      "%s: un-handled CSR EXIT for CSR %lx\n",
-+    int evt_index = csrno - CSR_MHPMEVENT3H + 3;
++                      __func__, csr_num);
-+    uint64_t mhpmevth_val = val;
++        ret = -1;
-+    uint64_t mhpmevt_val = env->mhpmevent_val[evt_index];
++        break;
 +
 +    mhpmevt_val = mhpmevt_val | (mhpmevth_val << 32);
 +    env->mhpmeventh_val[evt_index] = val;
 +
 +    riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
 +
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static int write_mhpmcounter(CPURISCVState *env, int csrno, target_ulong val)
  {
      int ctr_idx = csrno - CSR_MCYCLE;
      PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
 +    uint64_t mhpmctr_val = val;
      counter->mhpmcounter_val = val;
      if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
          riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
          counter->mhpmcounter_prev = get_ticks(false);
 -    } else {
 +        if (ctr_idx > 2) {
 +            if (riscv_cpu_mxl(env) == MXL_RV32) {
 +                mhpmctr_val = mhpmctr_val |
 +                              ((uint64_t)counter->mhpmcounterh_val << 32);
 +            }
 +            riscv_pmu_setup_timer(env, mhpmctr_val, ctr_idx);
 +        }
 +     } else {
          /* Other counters can keep incrementing from the given value */
          counter->mhpmcounter_prev = val;
      }
@@ -XXX,XX +XXX,XX @@ static int write_mhpmcounterh(CPURISCVState *env, int csrno, target_ulong val)
  {
      int ctr_idx = csrno - CSR_MCYCLEH;
      PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
 +    uint64_t mhpmctr_val = counter->mhpmcounter_val;
 +    uint64_t mhpmctrh_val = val;
      counter->mhpmcounterh_val = val;
 +    mhpmctr_val = mhpmctr_val | (mhpmctrh_val << 32);
      if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
          riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
          counter->mhpmcounterh_prev = get_ticks(true);
 +        if (ctr_idx > 2) {
 +            riscv_pmu_setup_timer(env, mhpmctr_val, ctr_idx);
 +        }
      } else {
          counter->mhpmcounterh_prev = val;
      }
@@ -XXX,XX +XXX,XX @@ static int read_hpmcounterh(CPURISCVState *env, int csrno, target_ulong *val)
      return riscv_pmu_read_ctr(env, val, true, ctr_index);
  }
 +static int read_scountovf(CPURISCVState *env, int csrno, target_ulong *val)
 +{
 +    int mhpmevt_start = CSR_MHPMEVENT3 - CSR_MCOUNTINHIBIT;
 +    int i;
 +    *val = 0;
 +    target_ulong *mhpm_evt_val;
 +    uint64_t of_bit_mask;
 +
 +    if (riscv_cpu_mxl(env) == MXL_RV32) {
 +        mhpm_evt_val = env->mhpmeventh_val;
 +        of_bit_mask = MHPMEVENTH_BIT_OF;
 +    } else {
 +        mhpm_evt_val = env->mhpmevent_val;
 +        of_bit_mask = MHPMEVENT_BIT_OF;
 +    }
 +
 +    for (i = mhpmevt_start; i < RV_MAX_MHPMEVENTS; i++) {
 +        if ((get_field(env->mcounteren, BIT(i))) &&
 +            (mhpm_evt_val[i] & of_bit_mask)) {
 +                    *val |= BIT(i);
 +            }
 +    }
 +
 +    return RISCV_EXCP_NONE;
 +}
 +
  static RISCVException read_time(CPURISCVState *env, int csrno,
                                  target_ulong *val)
  {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
  /* Machine constants */
  #define M_MODE_INTERRUPTS  ((uint64_t)(MIP_MSIP | MIP_MTIP | MIP_MEIP))
 -#define S_MODE_INTERRUPTS  ((uint64_t)(MIP_SSIP | MIP_STIP | MIP_SEIP))
 +#define S_MODE_INTERRUPTS  ((uint64_t)(MIP_SSIP | MIP_STIP | MIP_SEIP | \
 +                                      MIP_LCOFIP))
  #define VS_MODE_INTERRUPTS ((uint64_t)(MIP_VSSIP | MIP_VSTIP | MIP_VSEIP))
  #define HS_MODE_INTERRUPTS ((uint64_t)(MIP_SGEIP | VS_MODE_INTERRUPTS))
@@ -XXX,XX +XXX,XX @@ static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
  static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
      SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
      SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS;
 -static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
 +static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP |
 +                                              SIP_LCOFIP;
  static const target_ulong hip_writable_mask = MIP_VSSIP;
  static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
  static const target_ulong vsip_writable_mask = MIP_VSSIP;
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_MHPMEVENT31]    = { "mhpmevent31",    any,    read_mhpmevent,
                               write_mhpmevent                           },
 +    [CSR_MHPMEVENT3H]    = { "mhpmevent3h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT4H]    = { "mhpmevent4h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT5H]    = { "mhpmevent5h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT6H]    = { "mhpmevent6h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT7H]    = { "mhpmevent7h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT8H]    = { "mhpmevent8h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT9H]    = { "mhpmevent9h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT10H]   = { "mhpmevent10h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT11H]   = { "mhpmevent11h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT12H]   = { "mhpmevent12h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT13H]   = { "mhpmevent13h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT14H]   = { "mhpmevent14h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT15H]   = { "mhpmevent15h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT16H]   = { "mhpmevent16h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT17H]   = { "mhpmevent17h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT18H]   = { "mhpmevent18h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT19H]   = { "mhpmevent19h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT20H]   = { "mhpmevent20h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT21H]   = { "mhpmevent21h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT22H]   = { "mhpmevent22h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT23H]   = { "mhpmevent23h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT24H]   = { "mhpmevent24h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT25H]   = { "mhpmevent25h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT26H]   = { "mhpmevent26h",    sscofpmf,  read_mhpmeventh,
 +                              write_mhpmeventh                          },
 +    [CSR_MHPMEVENT27H]   = { "mhpmevent27h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT28H]   = { "mhpmevent28h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT29H]   = { "mhpmevent29h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT30H]   = { "mhpmevent30h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +    [CSR_MHPMEVENT31H]   = { "mhpmevent31h",    sscofpmf,  read_mhpmeventh,
 +                             write_mhpmeventh                           },
 +
      [CSR_HPMCOUNTER3H]   = { "hpmcounter3h",   ctr32,  read_hpmcounterh },
      [CSR_HPMCOUNTER4H]   = { "hpmcounter4h",   ctr32,  read_hpmcounterh },
      [CSR_HPMCOUNTER5H]   = { "hpmcounter5h",   ctr32,  read_hpmcounterh },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                               write_mhpmcounterh                         },
      [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", mctr32,  read_hpmcounterh,
                               write_mhpmcounterh                         },
 +    [CSR_SCOUNTOVF]      = { "scountovf", sscofpmf,  read_scountovf },
 +
  #endif /* !CONFIG_USER_ONLY */
  };
 diff --git a/target/riscv/machine.c b/target/riscv/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/machine.c
 +++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
          VMSTATE_STRUCT_ARRAY(env.pmu_ctrs, RISCVCPU, RV_MAX_MHPMCOUNTERS, 0,
                               vmstate_pmu_ctr_state, PMUCTRState),
          VMSTATE_UINTTL_ARRAY(env.mhpmevent_val, RISCVCPU, RV_MAX_MHPMEVENTS),
 +        VMSTATE_UINTTL_ARRAY(env.mhpmeventh_val, RISCVCPU, RV_MAX_MHPMEVENTS),
          VMSTATE_UINTTL(env.sscratch, RISCVCPU),
          VMSTATE_UINTTL(env.mscratch, RISCVCPU),
          VMSTATE_UINT64(env.mfromhost, RISCVCPU),
 diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmu.c
 +++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "cpu.h"
  #include "pmu.h"
 +#include "sysemu/cpu-timers.h"
 +
 +#define RISCV_TIMEBASE_FREQ 1000000000 /* 1Ghz */
 +#define MAKE_32BIT_MASK(shift, length) \
 +        (((uint32_t)(~0UL) >> (32 - (length))) << (shift))
 +
 +static bool riscv_pmu_counter_valid(RISCVCPU *cpu, uint32_t ctr_idx)
 +{
 +    if (ctr_idx < 3 || ctr_idx >= RV_MAX_MHPMCOUNTERS ||
 +        !(cpu->pmu_avail_ctrs & BIT(ctr_idx))) {
 +        return false;
 +    } else {
 +        return true;
 +    }
 +}
 +
 +static bool riscv_pmu_counter_enabled(RISCVCPU *cpu, uint32_t ctr_idx)
 +{
 +    CPURISCVState *env = &cpu->env;
 +
 +    if (riscv_pmu_counter_valid(cpu, ctr_idx) &&
 +        !get_field(env->mcountinhibit, BIT(ctr_idx))) {
 +        return true;
 +    } else {
 +        return false;
 +    }
 +}
 +
 +static int riscv_pmu_incr_ctr_rv32(RISCVCPU *cpu, uint32_t ctr_idx)
 +{
 +    CPURISCVState *env = &cpu->env;
 +    target_ulong max_val = UINT32_MAX;
 +    PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
 +    bool virt_on = riscv_cpu_virt_enabled(env);
 +
 +    /* Privilege mode filtering */
 +    if ((env->priv == PRV_M &&
 +        (env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_MINH)) ||
 +        (env->priv == PRV_S && virt_on &&
 +        (env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_VSINH)) ||
 +        (env->priv == PRV_U && virt_on &&
 +        (env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_VUINH)) ||
 +        (env->priv == PRV_S && !virt_on &&
 +        (env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_SINH)) ||
 +        (env->priv == PRV_U && !virt_on &&
 +        (env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_UINH))) {
 +        return 0;
 +    }
 +
 +    /* Handle the overflow scenario */
 +    if (counter->mhpmcounter_val == max_val) {
 +        if (counter->mhpmcounterh_val == max_val) {
 +            counter->mhpmcounter_val = 0;
 +            counter->mhpmcounterh_val = 0;
 +            /* Generate interrupt only if OF bit is clear */
 +            if (!(env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_OF)) {
 +                env->mhpmeventh_val[ctr_idx] |= MHPMEVENTH_BIT_OF;
 +                riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
 +            }
 +        } else {
 +            counter->mhpmcounterh_val++;
 +        }
 +    } else {
 +        counter->mhpmcounter_val++;
 +    }
 +
 +    return 0;
 +}
 +
 +static int riscv_pmu_incr_ctr_rv64(RISCVCPU *cpu, uint32_t ctr_idx)
 +{
 +    CPURISCVState *env = &cpu->env;
 +    PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
 +    uint64_t max_val = UINT64_MAX;
 +    bool virt_on = riscv_cpu_virt_enabled(env);
 +
 +    /* Privilege mode filtering */
 +    if ((env->priv == PRV_M &&
 +        (env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_MINH)) ||
 +        (env->priv == PRV_S && virt_on &&
 +        (env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_VSINH)) ||
 +        (env->priv == PRV_U && virt_on &&
 +        (env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_VUINH)) ||
 +        (env->priv == PRV_S && !virt_on &&
 +        (env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_SINH)) ||
 +        (env->priv == PRV_U && !virt_on &&
 +        (env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_UINH))) {
 +        return 0;
 +    }
 +
 +    /* Handle the overflow scenario */
 +    if (counter->mhpmcounter_val == max_val) {
 +        counter->mhpmcounter_val = 0;
 +        /* Generate interrupt only if OF bit is clear */
 +        if (!(env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_OF)) {
 +            env->mhpmevent_val[ctr_idx] |= MHPMEVENT_BIT_OF;
 +            riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
 +        }
 +    } else {
 +        counter->mhpmcounter_val++;
 +    }
 +    return 0;
 +}
 +
 +int riscv_pmu_incr_ctr(RISCVCPU *cpu, enum riscv_pmu_event_idx event_idx)
 +{
 +    uint32_t ctr_idx;
 +    int ret;
 +    CPURISCVState *env = &cpu->env;
 +    gpointer value;
 +
 +    if (!cpu->cfg.pmu_num) {
 +        return 0;
 +    }
 +    value = g_hash_table_lookup(cpu->pmu_event_ctr_map,
 +                                GUINT_TO_POINTER(event_idx));
 +    if (!value) {
 +        return -1;
 +    }
 +
 +    ctr_idx = GPOINTER_TO_UINT(value);
 +    if (!riscv_pmu_counter_enabled(cpu, ctr_idx) ||
 +        get_field(env->mcountinhibit, BIT(ctr_idx))) {
 +        return -1;
 +    }
 +
 +    if (riscv_cpu_mxl(env) == MXL_RV32) {
 +        ret = riscv_pmu_incr_ctr_rv32(cpu, ctr_idx);
 +    } else {
 +        ret = riscv_pmu_incr_ctr_rv64(cpu, ctr_idx);
 +    }
 +
 +    return ret;
 +}
  bool riscv_pmu_ctr_monitor_instructions(CPURISCVState *env,
                                          uint32_t target_ctr)
  {
 -    return (target_ctr == 0) ? true : false;
 +    RISCVCPU *cpu;
 +    uint32_t event_idx;
 +    uint32_t ctr_idx;
 +
 +    /* Fixed instret counter */
 +    if (target_ctr == 2) {
 +        return true;
 +    }
 +
 +    cpu = RISCV_CPU(env_cpu(env));
 +    if (!cpu->pmu_event_ctr_map) {
 +        return false;
 +    }
 +
 +    event_idx = RISCV_PMU_EVENT_HW_INSTRUCTIONS;
 +    ctr_idx = GPOINTER_TO_UINT(g_hash_table_lookup(cpu->pmu_event_ctr_map,
 +                               GUINT_TO_POINTER(event_idx)));
 +    if (!ctr_idx) {
 +        return false;
 +    }
 +
 +    return target_ctr == ctr_idx ? true : false;
  }
  bool riscv_pmu_ctr_monitor_cycles(CPURISCVState *env, uint32_t target_ctr)
  {
 -    return (target_ctr == 2) ? true : false;
 +    RISCVCPU *cpu;
 +    uint32_t event_idx;
 +    uint32_t ctr_idx;
 +
 +    /* Fixed mcycle counter */
 +    if (target_ctr == 0) {
 +        return true;
 +    }
 +
 +    cpu = RISCV_CPU(env_cpu(env));
 +    if (!cpu->pmu_event_ctr_map) {
 +        return false;
 +    }
 +
 +    event_idx = RISCV_PMU_EVENT_HW_CPU_CYCLES;
 +    ctr_idx = GPOINTER_TO_UINT(g_hash_table_lookup(cpu->pmu_event_ctr_map,
 +                               GUINT_TO_POINTER(event_idx)));
 +
 +    /* Counter zero is not used for event_ctr_map */
 +    if (!ctr_idx) {
 +        return false;
 +    }
 +
 +    return (target_ctr == ctr_idx) ? true : false;
 +}
 +
 +static gboolean pmu_remove_event_map(gpointer key, gpointer value,
 +                                     gpointer udata)
 +{
 +    return (GPOINTER_TO_UINT(value) == GPOINTER_TO_UINT(udata)) ? true : false;
 +}
 +
 +static int64_t pmu_icount_ticks_to_ns(int64_t value)
 +{
 +    int64_t ret = 0;
 +
 +    if (icount_enabled()) {
 +        ret = icount_to_ns(value);
 +    } else {
 +        ret = (NANOSECONDS_PER_SECOND / RISCV_TIMEBASE_FREQ) * value;
 +    }
 +
 +    return ret;
 +}
 +
-+int riscv_pmu_update_event_map(CPURISCVState *env, uint64_t value,
+ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
-+                               uint32_t ctr_idx)
+ {
-+{
+     int ret = 0;
-+    uint32_t event_idx;
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
-+    RISCVCPU *cpu = RISCV_CPU(env_cpu(env));
+     case KVM_EXIT_RISCV_SBI:
-+
+         ret = kvm_riscv_handle_sbi(cs, run);
-+    if (!riscv_pmu_counter_valid(cpu, ctr_idx) || !cpu->pmu_event_ctr_map) {
+         break;
-+        return -1;
++    case KVM_EXIT_RISCV_CSR:
-+    }
++        ret = kvm_riscv_handle_csr(cs, run);
 +
 +    /*
 +     * Expected mhpmevent value is zero for reset case. Remove the current
 +     * mapping.
 +     */
 +    if (!value) {
 +        g_hash_table_foreach_remove(cpu->pmu_event_ctr_map,
 +                                    pmu_remove_event_map,
 +                                    GUINT_TO_POINTER(ctr_idx));
 +        return 0;
 +    }
 +
 +    event_idx = value & MHPMEVENT_IDX_MASK;
 +    if (g_hash_table_lookup(cpu->pmu_event_ctr_map,
 +                            GUINT_TO_POINTER(event_idx))) {
 +        return 0;
 +    }
 +
 +    switch (event_idx) {
 +    case RISCV_PMU_EVENT_HW_CPU_CYCLES:
 +    case RISCV_PMU_EVENT_HW_INSTRUCTIONS:
 +    case RISCV_PMU_EVENT_CACHE_DTLB_READ_MISS:
 +    case RISCV_PMU_EVENT_CACHE_DTLB_WRITE_MISS:
 +    case RISCV_PMU_EVENT_CACHE_ITLB_PREFETCH_MISS:
 +        break;
-+    default:
+     default:
-+        /* We don't support any raw events right now */
+         qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",
-+        return -1;
+                       __func__, run->exit_reason);
 +    }
 +    g_hash_table_insert(cpu->pmu_event_ctr_map, GUINT_TO_POINTER(event_idx),
 +                        GUINT_TO_POINTER(ctr_idx));
 +
 +    return 0;
 +}
 +
 +static void pmu_timer_trigger_irq(RISCVCPU *cpu,
 +                                  enum riscv_pmu_event_idx evt_idx)
 +{
 +    uint32_t ctr_idx;
 +    CPURISCVState *env = &cpu->env;
 +    PMUCTRState *counter;
 +    target_ulong *mhpmevent_val;
 +    uint64_t of_bit_mask;
 +    int64_t irq_trigger_at;
 +
 +    if (evt_idx != RISCV_PMU_EVENT_HW_CPU_CYCLES &&
 +        evt_idx != RISCV_PMU_EVENT_HW_INSTRUCTIONS) {
 +        return;
 +    }
 +
 +    ctr_idx = GPOINTER_TO_UINT(g_hash_table_lookup(cpu->pmu_event_ctr_map,
 +                               GUINT_TO_POINTER(evt_idx)));
 +    if (!riscv_pmu_counter_enabled(cpu, ctr_idx)) {
 +        return;
 +    }
 +
 +    if (riscv_cpu_mxl(env) == MXL_RV32) {
 +        mhpmevent_val = &env->mhpmeventh_val[ctr_idx];
 +        of_bit_mask = MHPMEVENTH_BIT_OF;
 +     } else {
 +        mhpmevent_val = &env->mhpmevent_val[ctr_idx];
 +        of_bit_mask = MHPMEVENT_BIT_OF;
 +    }
 +
 +    counter = &env->pmu_ctrs[ctr_idx];
 +    if (counter->irq_overflow_left > 0) {
 +        irq_trigger_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 +                        counter->irq_overflow_left;
 +        timer_mod_anticipate_ns(cpu->pmu_timer, irq_trigger_at);
 +        counter->irq_overflow_left = 0;
 +        return;
 +    }
 +
 +    if (cpu->pmu_avail_ctrs & BIT(ctr_idx)) {
 +        /* Generate interrupt only if OF bit is clear */
 +        if (!(*mhpmevent_val & of_bit_mask)) {
 +            *mhpmevent_val |= of_bit_mask;
 +            riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
 +        }
 +    }
 +}
 +
 +/* Timer callback for instret and cycle counter overflow */
 +void riscv_pmu_timer_cb(void *priv)
 +{
 +    RISCVCPU *cpu = priv;
 +
 +    /* Timer event was triggered only for these events */
 +    pmu_timer_trigger_irq(cpu, RISCV_PMU_EVENT_HW_CPU_CYCLES);
 +    pmu_timer_trigger_irq(cpu, RISCV_PMU_EVENT_HW_INSTRUCTIONS);
 +}
 +
 +int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value, uint32_t ctr_idx)
 +{
 +    uint64_t overflow_delta, overflow_at;
 +    int64_t overflow_ns, overflow_left = 0;
 +    RISCVCPU *cpu = RISCV_CPU(env_cpu(env));
 +    PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
 +
 +    if (!riscv_pmu_counter_valid(cpu, ctr_idx) || !cpu->cfg.ext_sscofpmf) {
 +        return -1;
 +    }
 +
 +    if (value) {
 +        overflow_delta = UINT64_MAX - value + 1;
 +    } else {
 +        overflow_delta = UINT64_MAX;
 +    }
 +
 +    /*
 +     * QEMU supports only int64_t timers while RISC-V counters are uint64_t.
 +     * Compute the leftover and save it so that it can be reprogrammed again
 +     * when timer expires.
 +     */
 +    if (overflow_delta > INT64_MAX) {
 +        overflow_left = overflow_delta - INT64_MAX;
 +    }
 +
 +    if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
 +        riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
 +        overflow_ns = pmu_icount_ticks_to_ns((int64_t)overflow_delta);
 +        overflow_left = pmu_icount_ticks_to_ns(overflow_left) ;
 +    } else {
 +        return -1;
 +    }
 +    overflow_at = (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + overflow_ns;
 +
 +    if (overflow_at > INT64_MAX) {
 +        overflow_left += overflow_at - INT64_MAX;
 +        counter->irq_overflow_left = overflow_left;
 +        overflow_at = INT64_MAX;
 +    }
 +    timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
 +
 +    return 0;
 +}
 +
 +
 +int riscv_pmu_init(RISCVCPU *cpu, int num_counters)
 +{
 +    if (num_counters > (RV_MAX_MHPMCOUNTERS - 3)) {
 +        return -1;
 +    }
 +
 +    cpu->pmu_event_ctr_map = g_hash_table_new(g_direct_hash, g_direct_equal);
 +    if (!cpu->pmu_event_ctr_map) {
 +        /* PMU support can not be enabled */
 +        qemu_log_mask(LOG_UNIMP, "PMU events can't be supported\n");
 +        cpu->cfg.pmu_num = 0;
 +        return -1;
 +    }
 +
 +    /* Create a bitmask of available programmable counters */
 +    cpu->pmu_avail_ctrs = MAKE_32BIT_MASK(3, num_counters);
 +
 +    return 0;
  }
 --
-.37.2
+.45.1

-[PULL 43/44] hw/riscv: virt: Add PMU DT node to the device tree
+[PULL 03/28] target/riscv: Raise exceptions on wrs.nto
-From: Atish Patra <atishp@rivosinc.com>
+From: Andrew Jones <ajones@ventanamicro.com>
-Qemu virt machine can support few cache events and cycle/instret counters.
+Implementing wrs.nto to always just return is consistent with the
-It also supports counter overflow for these events.
+specification, as the instruction is permitted to terminate the
 stall for any reason, but it's not useful for virtualization, where
 we'd like the guest to trap to the hypervisor in order to allow
 scheduling of the lock holding VCPU. Change to always immediately
 raise exceptions when the appropriate conditions are present,
 otherwise continue to just return. Note, immediately raising
 exceptions is also consistent with the specification since the
 time limit that should expire prior to the exception is
 implementation-specific.
-Add a DT node so that OpenSBI/Linux kernel is aware of the virt machine
+Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
-capabilities. There are some dummy nodes added for testing as well.
+Reviewed-by: Christoph Müllner <christoph.muellner@vrull.eu>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Atish Patra <atish.patra@wdc.com>
+Message-ID: <20240424142808.62936-2-ajones@ventanamicro.com>
 Signed-off-by: Atish Patra <atishp@rivosinc.com>
 Message-Id: <20220824221701.41932-5-atishp@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/pmu.h |  1 +
+ target/riscv/helper.h                       |  1 +
- hw/riscv/virt.c    | 16 +++++++++++++
+ target/riscv/op_helper.c                    | 11 ++++++++
- target/riscv/pmu.c | 57 ++++++++++++++++++++++++++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvzawrs.c.inc | 29 ++++++++++++++-------
-files changed, 74 insertions(+)
+files changed, 32 insertions(+), 9 deletions(-)
-diff --git a/target/riscv/pmu.h b/target/riscv/pmu.h
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmu.h
+--- a/target/riscv/helper.h
-+++ b/target/riscv/pmu.h
++++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ int riscv_pmu_init(RISCVCPU *cpu, int num_counters);
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
- int riscv_pmu_update_event_map(CPURISCVState *env, uint64_t value,
+ DEF_HELPER_1(sret, tl, env)
-                                uint32_t ctr_idx);
+ DEF_HELPER_1(mret, tl, env)
- int riscv_pmu_incr_ctr(RISCVCPU *cpu, enum riscv_pmu_event_idx event_idx);
+ DEF_HELPER_1(wfi, void, env)
-+void riscv_pmu_generate_fdt_node(void *fdt, int num_counters, char *pmu_name);
++DEF_HELPER_1(wrs_nto, void, env)
- int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value,
+ DEF_HELPER_1(tlb_flush, void, env)
-                           uint32_t ctr_idx);
+ DEF_HELPER_1(tlb_flush_all, void, env)
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
+ /* Native Debug */
 diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
+--- a/target/riscv/op_helper.c
-+++ b/hw/riscv/virt.c
++++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
- #include "hw/char/serial.h"
+     }
  #include "target/riscv/cpu.h"
  #include "hw/core/sysbus-fdt.h"
 +#include "target/riscv/pmu.h"
  #include "hw/riscv/riscv_hart.h"
  #include "hw/riscv/virt.h"
  #include "hw/riscv/boot.h"
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
      aplic_phandles[socket] = aplic_s_phandle;
  }
-+static void create_fdt_pmu(RISCVVirtState *s)
++void helper_wrs_nto(CPURISCVState *env)
 +{
-+    char *pmu_name;
++    if (env->virt_enabled && (env->priv == PRV_S || env->priv == PRV_U) &&
-+    MachineState *mc = MACHINE(s);
++        get_field(env->hstatus, HSTATUS_VTW) &&
-+    RISCVCPU hart = s->soc[0].harts[0];
++        !get_field(env->mstatus, MSTATUS_TW)) {
-+
++        riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
-+    pmu_name = g_strdup_printf("/soc/pmu");
++    } else if (env->priv != PRV_M && get_field(env->mstatus, MSTATUS_TW)) {
-+    qemu_fdt_add_subnode(mc->fdt, pmu_name);
++        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
-+    qemu_fdt_setprop_string(mc->fdt, pmu_name, "compatible", "riscv,pmu");
++    }
 +    riscv_pmu_generate_fdt_node(mc->fdt, hart.cfg.pmu_num, pmu_name);
 +
 +    g_free(pmu_name);
 +}
 +
- static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
+ void helper_tlb_flush(CPURISCVState *env)
-                                bool is_32_bit, uint32_t *phandle,
+ {
-                                uint32_t *irq_mmio_phandle,
+     CPUState *cs = env_cpu(env);
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
+diff --git a/target/riscv/insn_trans/trans_rvzawrs.c.inc b/target/riscv/insn_trans/trans_rvzawrs.c.inc
      create_fdt_flash(s, memmap);
      create_fdt_fw_cfg(s, memmap);
 +    create_fdt_pmu(s);
  update_bootargs:
      if (cmdline && *cmdline) {
 diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmu.c
+--- a/target/riscv/insn_trans/trans_rvzawrs.c.inc
-+++ b/target/riscv/pmu.c
++++ b/target/riscv/insn_trans/trans_rvzawrs.c.inc
 @@ -XXX,XX +XXX,XX @@
- #include "cpu.h"
+  * this program.  If not, see <http://www.gnu.org/licenses/>.
- #include "pmu.h"
+  */
- #include "sysemu/cpu-timers.h"
-+#include "sysemu/device_tree.h"
+-static bool trans_wrs(DisasContext *ctx)
++static bool trans_wrs_sto(DisasContext *ctx, arg_wrs_sto *a)
- #define RISCV_TIMEBASE_FREQ 1000000000 /* 1Ghz */
+ {
- #define MAKE_32BIT_MASK(shift, length) \
+     if (!ctx->cfg_ptr->ext_zawrs) {
-         (((uint32_t)(~0UL) >> (32 - (length))) << (shift))
+         return false;
+@@ -XXX,XX +XXX,XX @@ static bool trans_wrs(DisasContext *ctx)
-+/*
+     return true;
-+ * To keep it simple, any event can be mapped to any programmable counters in
+ }
-+ * QEMU. The generic cycle & instruction count events can also be monitored
-+ * using programmable counters. In that case, mcycle & minstret must continue
+-#define GEN_TRANS_WRS(insn)                                     \
-+ * to provide the correct value as well. Heterogeneous PMU per hart is not
+-static bool trans_ ## insn(DisasContext *ctx, arg_ ## insn *a)  \
-+ * supported yet. Thus, number of counters are same across all harts.
+-{                                                               \
-+ */
+-    (void)a;                                                    \
-+void riscv_pmu_generate_fdt_node(void *fdt, int num_ctrs, char *pmu_name)
+-    return trans_wrs(ctx);                                      \
 -}
 +static bool trans_wrs_nto(DisasContext *ctx, arg_wrs_nto *a)
 +{
-+    uint32_t fdt_event_ctr_map[20] = {};
++    if (!ctx->cfg_ptr->ext_zawrs) {
-+    uint32_t cmask;
++        return false;
 +    }
 -GEN_TRANS_WRS(wrs_nto)
 -GEN_TRANS_WRS(wrs_sto)
 +    /*
 +     * Depending on the mode of execution, mstatus.TW and hstatus.VTW, wrs.nto
 +     * should raise an exception when the implementation-specific bounded time
 +     * limit has expired. Our time limit is zero, so we either return
 +     * immediately, as does our implementation of wrs.sto, or raise an
 +     * exception, as handled by the wrs.nto helper.
 +     */
 +#ifndef CONFIG_USER_ONLY
 +    gen_helper_wrs_nto(tcg_env);
 +#endif
 +
-+    /* All the programmable counters can map to any event */
++    /* We only get here when helper_wrs_nto() doesn't raise an exception. */
-+    cmask = MAKE_32BIT_MASK(3, num_ctrs);
++    return trans_wrs_sto(ctx, NULL);
 +
 +   /*
 +    * The event encoding is specified in the SBI specification
 +    * Event idx is a 20bits wide number encoded as follows:
 +    * event_idx[19:16] = type
 +    * event_idx[15:0] = code
 +    * The code field in cache events are encoded as follows:
 +    * event_idx.code[15:3] = cache_id
 +    * event_idx.code[2:1] = op_id
 +    * event_idx.code[0:0] = result_id
 +    */
 +
 +   /* SBI_PMU_HW_CPU_CYCLES: 0x01 : type(0x00) */
 +   fdt_event_ctr_map[0] = cpu_to_be32(0x00000001);
 +   fdt_event_ctr_map[1] = cpu_to_be32(0x00000001);
 +   fdt_event_ctr_map[2] = cpu_to_be32(cmask | 1 << 0);
 +
 +   /* SBI_PMU_HW_INSTRUCTIONS: 0x02 : type(0x00) */
 +   fdt_event_ctr_map[3] = cpu_to_be32(0x00000002);
 +   fdt_event_ctr_map[4] = cpu_to_be32(0x00000002);
 +   fdt_event_ctr_map[5] = cpu_to_be32(cmask | 1 << 2);
 +
 +   /* SBI_PMU_HW_CACHE_DTLB : 0x03 READ : 0x00 MISS : 0x00 type(0x01) */
 +   fdt_event_ctr_map[6] = cpu_to_be32(0x00010019);
 +   fdt_event_ctr_map[7] = cpu_to_be32(0x00010019);
 +   fdt_event_ctr_map[8] = cpu_to_be32(cmask);
 +
 +   /* SBI_PMU_HW_CACHE_DTLB : 0x03 WRITE : 0x01 MISS : 0x00 type(0x01) */
 +   fdt_event_ctr_map[9] = cpu_to_be32(0x0001001B);
 +   fdt_event_ctr_map[10] = cpu_to_be32(0x0001001B);
 +   fdt_event_ctr_map[11] = cpu_to_be32(cmask);
 +
 +   /* SBI_PMU_HW_CACHE_ITLB : 0x04 READ : 0x00 MISS : 0x00 type(0x01) */
 +   fdt_event_ctr_map[12] = cpu_to_be32(0x00010021);
 +   fdt_event_ctr_map[13] = cpu_to_be32(0x00010021);
 +   fdt_event_ctr_map[14] = cpu_to_be32(cmask);
 +
 +   /* This a OpenSBI specific DT property documented in OpenSBI docs */
 +   qemu_fdt_setprop(fdt, pmu_name, "riscv,event-to-mhpmcounters",
 +                    fdt_event_ctr_map, sizeof(fdt_event_ctr_map));
 +}
-+
- static bool riscv_pmu_counter_valid(RISCVCPU *cpu, uint32_t ctr_idx)
- {
-     if (ctr_idx < 3 || ctr_idx >= RV_MAX_MHPMCOUNTERS ||
 --
-.37.2
+.45.1

-[PULL 02/44] target/riscv: Force disable extensions if priv spec version does not match
+[PULL 04/28] target/riscv/kvm: implement SBI debug console (DBCN) calls
-From: Anup Patel <apatel@ventanamicro.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We should disable extensions in riscv_cpu_realize() if minimum required
+SBI defines a Debug Console extension "DBCN" that will, in time, replace
-priv spec version is not satisfied. This also ensures that machines with
+the legacy console putchar and getchar SBI extensions.
-priv spec v1.11 (or lower) cannot enable H, V, and various multi-letter
-extensions.
+The appeal of the DBCN extension is that it allows multiple bytes to be
+read/written in the SBI console in a single SBI call.
-Fixes: a775398be2e9 ("target/riscv: Add isa extenstion strings to the device tree")
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+As far as KVM goes, the DBCN calls are forwarded by an in-kernel KVM
-Signed-off-by: Anup Patel <apatel@ventanamicro.com>
+module to userspace. But this will only happens if the KVM module
-Signed-off-by: Rahul Pathak <rpathak@ventanamicro.com>
+actually supports this SBI extension and we activate it.
-Message-Id: <20220630061150.905174-3-apatel@ventanamicro.com>
 We'll check for DBCN support during init time, checking if get-reg-list
 is advertising KVM_RISCV_SBI_EXT_DBCN. In that case, we'll enable it via
 kvm_set_one_reg() during kvm_arch_init_vcpu().
 Finally, change kvm_riscv_handle_sbi() to handle the incoming calls for
 SBI_EXT_DBCN, reading and writing as required.
 A simple KVM guest with 'earlycon=sbi', running in an emulated RISC-V
 host, takes around 20 seconds to boot without using DBCN. With this
 patch we're taking around 14 seconds to boot due to the speed-up in the
 terminal output.  There's no change in boot time if the guest isn't
 using earlycon.
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20240425155012.581366-1-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 150 ++++++++++++++++++++++++++++-----------------
+ target/riscv/sbi_ecall_interface.h |  17 +++++
-file changed, 94 insertions(+), 56 deletions(-)
+ target/riscv/kvm/kvm-cpu.c         | 111 +++++++++++++++++++++++++++++
+files changed, 128 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 diff --git a/target/riscv/sbi_ecall_interface.h b/target/riscv/sbi_ecall_interface.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
+--- a/target/riscv/sbi_ecall_interface.h
-+++ b/target/riscv/cpu.c
++++ b/target/riscv/sbi_ecall_interface.h
-@@ -XXX,XX +XXX,XX @@ static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
+@@ -XXX,XX +XXX,XX @@
- struct isa_ext_data {
+ /* clang-format off */
-     const char *name;
--    bool enabled;
++#define SBI_SUCCESS                      0
-+    bool multi_letter;
++#define SBI_ERR_FAILED                  -1
-+    int min_version;
++#define SBI_ERR_NOT_SUPPORTED           -2
-+    int ext_enable_offset;
++#define SBI_ERR_INVALID_PARAM           -3
 +#define SBI_ERR_DENIED                  -4
 +#define SBI_ERR_INVALID_ADDRESS         -5
 +#define SBI_ERR_ALREADY_AVAILABLE       -6
 +#define SBI_ERR_ALREADY_STARTED         -7
 +#define SBI_ERR_ALREADY_STOPPED         -8
 +#define SBI_ERR_NO_SHMEM                -9
 +
  /* SBI Extension IDs */
  #define SBI_EXT_0_1_SET_TIMER           0x0
  #define SBI_EXT_0_1_CONSOLE_PUTCHAR     0x1
@@ -XXX,XX +XXX,XX @@
  #define SBI_EXT_IPI                     0x735049
  #define SBI_EXT_RFENCE                  0x52464E43
  #define SBI_EXT_HSM                     0x48534D
 +#define SBI_EXT_DBCN                    0x4442434E
  /* SBI function IDs for BASE extension */
  #define SBI_EXT_BASE_GET_SPEC_VERSION   0x0
@@ -XXX,XX +XXX,XX @@
  #define SBI_EXT_HSM_HART_STOP           0x1
  #define SBI_EXT_HSM_HART_GET_STATUS     0x2
 +/* SBI function IDs for DBCN extension */
 +#define SBI_EXT_DBCN_CONSOLE_WRITE      0x0
 +#define SBI_EXT_DBCN_CONSOLE_READ       0x1
 +#define SBI_EXT_DBCN_CONSOLE_WRITE_BYTE 0x2
 +
  #define SBI_HSM_HART_STATUS_STARTED     0x0
  #define SBI_HSM_HART_STATUS_STOPPED     0x1
  #define SBI_HSM_HART_STATUS_START_PENDING   0x2
 diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/kvm/kvm-cpu.c
 +++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_v_vlenb = {
                     KVM_REG_RISCV_VECTOR_CSR_REG(vlenb)
  };
-+#define ISA_EXT_DATA_ENTRY(_name, _m_letter, _min_ver, _prop) \
++static KVMCPUConfig kvm_sbi_dbcn = {
-+{#_name, _m_letter, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
++    .name = "sbi_dbcn",
-+
++    .kvm_reg_id = KVM_REG_RISCV | KVM_REG_SIZE_U64 |
-+/**
++                  KVM_REG_RISCV_SBI_EXT | KVM_RISCV_SBI_EXT_DBCN
 + * Here are the ordering rules of extension naming defined by RISC-V
 + * specification :
 + * 1. All extensions should be separated from other multi-letter extensions
 + *    by an underscore.
 + * 2. The first letter following the 'Z' conventionally indicates the most
 + *    closely related alphabetical extension category, IMAFDQLCBKJTPVH.
 + *    If multiple 'Z' extensions are named, they should be ordered first
 + *    by category, then alphabetically within a category.
 + * 3. Standard supervisor-level extensions (starts with 'S') should be
 + *    listed after standard unprivileged extensions.  If multiple
 + *    supervisor-level extensions are listed, they should be ordered
 + *    alphabetically.
 + * 4. Non-standard extensions (starts with 'X') must be listed after all
 + *    standard extensions. They must be separated from other multi-letter
 + *    extensions by an underscore.
 + */
 +static const struct isa_ext_data isa_edata_arr[] = {
 +    ISA_EXT_DATA_ENTRY(h, false, PRIV_VERSION_1_12_0, ext_h),
 +    ISA_EXT_DATA_ENTRY(v, false, PRIV_VERSION_1_12_0, ext_v),
 +    ISA_EXT_DATA_ENTRY(zicsr, true, PRIV_VERSION_1_10_0, ext_icsr),
 +    ISA_EXT_DATA_ENTRY(zifencei, true, PRIV_VERSION_1_10_0, ext_ifencei),
 +    ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_12_0, ext_zfh),
 +    ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_12_0, ext_zfhmin),
 +    ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
 +    ISA_EXT_DATA_ENTRY(zdinx, true, PRIV_VERSION_1_12_0, ext_zdinx),
 +    ISA_EXT_DATA_ENTRY(zba, true, PRIV_VERSION_1_12_0, ext_zba),
 +    ISA_EXT_DATA_ENTRY(zbb, true, PRIV_VERSION_1_12_0, ext_zbb),
 +    ISA_EXT_DATA_ENTRY(zbc, true, PRIV_VERSION_1_12_0, ext_zbc),
 +    ISA_EXT_DATA_ENTRY(zbkb, true, PRIV_VERSION_1_12_0, ext_zbkb),
 +    ISA_EXT_DATA_ENTRY(zbkc, true, PRIV_VERSION_1_12_0, ext_zbkc),
 +    ISA_EXT_DATA_ENTRY(zbkx, true, PRIV_VERSION_1_12_0, ext_zbkx),
 +    ISA_EXT_DATA_ENTRY(zbs, true, PRIV_VERSION_1_12_0, ext_zbs),
 +    ISA_EXT_DATA_ENTRY(zk, true, PRIV_VERSION_1_12_0, ext_zk),
 +    ISA_EXT_DATA_ENTRY(zkn, true, PRIV_VERSION_1_12_0, ext_zkn),
 +    ISA_EXT_DATA_ENTRY(zknd, true, PRIV_VERSION_1_12_0, ext_zknd),
 +    ISA_EXT_DATA_ENTRY(zkne, true, PRIV_VERSION_1_12_0, ext_zkne),
 +    ISA_EXT_DATA_ENTRY(zknh, true, PRIV_VERSION_1_12_0, ext_zknh),
 +    ISA_EXT_DATA_ENTRY(zkr, true, PRIV_VERSION_1_12_0, ext_zkr),
 +    ISA_EXT_DATA_ENTRY(zks, true, PRIV_VERSION_1_12_0, ext_zks),
 +    ISA_EXT_DATA_ENTRY(zksed, true, PRIV_VERSION_1_12_0, ext_zksed),
 +    ISA_EXT_DATA_ENTRY(zksh, true, PRIV_VERSION_1_12_0, ext_zksh),
 +    ISA_EXT_DATA_ENTRY(zkt, true, PRIV_VERSION_1_12_0, ext_zkt),
 +    ISA_EXT_DATA_ENTRY(zve32f, true, PRIV_VERSION_1_12_0, ext_zve32f),
 +    ISA_EXT_DATA_ENTRY(zve64f, true, PRIV_VERSION_1_12_0, ext_zve64f),
 +    ISA_EXT_DATA_ENTRY(zhinx, true, PRIV_VERSION_1_12_0, ext_zhinx),
 +    ISA_EXT_DATA_ENTRY(zhinxmin, true, PRIV_VERSION_1_12_0, ext_zhinxmin),
 +    ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
 +    ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
 +    ISA_EXT_DATA_ENTRY(svpbmt, true, PRIV_VERSION_1_12_0, ext_svpbmt),
 +};
 +
-+static bool isa_ext_is_enabled(RISCVCPU *cpu,
+ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
-+                               const struct isa_ext_data *edata)
+ {
      CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static int uint64_cmp(const void *a, const void *b)
      return 0;
  }
 +static void kvm_riscv_check_sbi_dbcn_support(RISCVCPU *cpu,
 +                                             KVMScratchCPU *kvmcpu,
 +                                             struct kvm_reg_list *reglist)
 +{
-+    bool *ext_enabled = (void *)&cpu->cfg + edata->ext_enable_offset;
++    struct kvm_reg_list *reg_search;
 +
-+    return *ext_enabled;
++    reg_search = bsearch(&kvm_sbi_dbcn.kvm_reg_id, reglist->reg, reglist->n,
 +                         sizeof(uint64_t), uint64_cmp);
 +
 +    if (reg_search) {
 +        kvm_sbi_dbcn.supported = true;
 +    }
 +}
 +
-+static void isa_ext_update_enabled(RISCVCPU *cpu,
+ static void kvm_riscv_read_vlenb(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
-+                                   const struct isa_ext_data *edata, bool en)
+                                  struct kvm_reg_list *reglist)
  {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
      if (riscv_has_ext(&cpu->env, RVV)) {
          kvm_riscv_read_vlenb(cpu, kvmcpu, reglist);
      }
 +
 +    kvm_riscv_check_sbi_dbcn_support(cpu, kvmcpu, reglist);
  }
  static void riscv_init_kvm_registers(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
      return ret;
  }
 +static int kvm_vcpu_enable_sbi_dbcn(RISCVCPU *cpu, CPUState *cs)
 +{
-+    bool *ext_enabled = (void *)&cpu->cfg + edata->ext_enable_offset;
++    target_ulong reg = 1;
 +
-+    *ext_enabled = en;
++    if (!kvm_sbi_dbcn.supported) {
 +        return 0;
 +    }
 +
 +    return kvm_set_one_reg(cs, kvm_sbi_dbcn.kvm_reg_id, &reg);
 +}
 +
- const char * const riscv_int_regnames[] = {
+ int kvm_arch_init_vcpu(CPUState *cs)
-   "x0/zero", "x1/ra",  "x2/sp",  "x3/gp",  "x4/tp",  "x5/t0",   "x6/t1",
+ {
-   "x7/t2",   "x8/s0",  "x9/s1",  "x10/a0", "x11/a1", "x12/a2",  "x13/a3",
+     int ret = 0;
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
-     CPURISCVState *env = &cpu->env;
+     kvm_riscv_update_cpu_misa_ext(cpu, cs);
-     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
+     kvm_riscv_update_cpu_cfg_isa_ext(cpu, cs);
-     CPUClass *cc = CPU_CLASS(mcc);
--    int priv_version = -1;
++    ret = kvm_vcpu_enable_sbi_dbcn(cpu, cs);
-+    int i, priv_version = -1;
++
-     Error *local_err = NULL;
+     return ret;
+ }
-     cpu_exec_realizefn(cs, &local_err);
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
-         set_priv_version(env, priv_version);
+     return true;
-     }
+ }
-+    /* Force disable extensions if priv spec version does not match */
++static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
-+    for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
++{
-+        if (isa_ext_is_enabled(cpu, &isa_edata_arr[i]) &&
++    g_autofree uint8_t *buf = NULL;
-+            (env->priv_ver < isa_edata_arr[i].min_version)) {
++    RISCVCPU *cpu = RISCV_CPU(cs);
-+            isa_ext_update_enabled(cpu, &isa_edata_arr[i], false);
++    target_ulong num_bytes;
-+#ifndef CONFIG_USER_ONLY
++    uint64_t addr;
-+            warn_report("disabling %s extension for hart 0x%lx because "
++    unsigned char ch;
-+                        "privilege spec version does not match",
++    int ret;
-+                        isa_edata_arr[i].name, (unsigned long)env->mhartid);
++
-+#else
++    switch (run->riscv_sbi.function_id) {
-+            warn_report("disabling %s extension because "
++    case SBI_EXT_DBCN_CONSOLE_READ:
-+                        "privilege spec version does not match",
++    case SBI_EXT_DBCN_CONSOLE_WRITE:
-+                        isa_edata_arr[i].name);
++        num_bytes = run->riscv_sbi.args[0];
-+#endif
++
-+        }
++        if (num_bytes == 0) {
 +            run->riscv_sbi.ret[0] = SBI_SUCCESS;
 +            run->riscv_sbi.ret[1] = 0;
 +            break;
 +        }
 +
 +        addr = run->riscv_sbi.args[1];
 +
 +        /*
 +         * Handle the case where a 32 bit CPU is running in a
 +         * 64 bit addressing env.
 +         */
 +        if (riscv_cpu_mxl(&cpu->env) == MXL_RV32) {
 +            addr |= (uint64_t)run->riscv_sbi.args[2] << 32;
 +        }
 +
 +        buf = g_malloc0(num_bytes);
 +
 +        if (run->riscv_sbi.function_id == SBI_EXT_DBCN_CONSOLE_READ) {
 +            ret = qemu_chr_fe_read_all(serial_hd(0)->be, buf, num_bytes);
 +            if (ret < 0) {
 +                error_report("SBI_EXT_DBCN_CONSOLE_READ: error when "
 +                             "reading chardev");
 +                exit(1);
 +            }
 +
 +            cpu_physical_memory_write(addr, buf, ret);
 +        } else {
 +            cpu_physical_memory_read(addr, buf, num_bytes);
 +
 +            ret = qemu_chr_fe_write_all(serial_hd(0)->be, buf, num_bytes);
 +            if (ret < 0) {
 +                error_report("SBI_EXT_DBCN_CONSOLE_WRITE: error when "
 +                             "writing chardev");
 +                exit(1);
 +            }
 +        }
 +
 +        run->riscv_sbi.ret[0] = SBI_SUCCESS;
 +        run->riscv_sbi.ret[1] = ret;
 +        break;
 +    case SBI_EXT_DBCN_CONSOLE_WRITE_BYTE:
 +        ch = run->riscv_sbi.args[0];
 +        ret = qemu_chr_fe_write(serial_hd(0)->be, &ch, sizeof(ch));
 +
 +        if (ret < 0) {
 +            error_report("SBI_EXT_DBCN_CONSOLE_WRITE_BYTE: error when "
 +                         "writing chardev");
 +            exit(1);
 +        }
 +
 +        run->riscv_sbi.ret[0] = SBI_SUCCESS;
 +        run->riscv_sbi.ret[1] = 0;
 +        break;
 +    default:
 +        run->riscv_sbi.ret[0] = SBI_ERR_NOT_SUPPORTED;
 +    }
-+
++}
-     if (cpu->cfg.mmu) {
++
-         riscv_set_feature(env, RISCV_FEATURE_MMU);
+ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
-     }
+ {
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
+     int ret = 0;
-     device_class_set_props(dc, riscv_cpu_properties);
+@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
- }
+         }
+         ret = 0;
--#define ISA_EDATA_ENTRY(name, prop) {#name, cpu->cfg.prop}
+         break;
--
++    case SBI_EXT_DBCN:
- static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str, int max_str_len)
++        kvm_riscv_handle_sbi_dbcn(cs, run);
- {
++        break;
-     char *old = *isa_str;
+     default:
-     char *new = *isa_str;
+         qemu_log_mask(LOG_UNIMP,
-     int i;
+                       "%s: un-handled SBI EXIT, specific reasons is %lu\n",
 -    /**
 -     * Here are the ordering rules of extension naming defined by RISC-V
 -     * specification :
 -     * 1. All extensions should be separated from other multi-letter extensions
 -     *    by an underscore.
 -     * 2. The first letter following the 'Z' conventionally indicates the most
 -     *    closely related alphabetical extension category, IMAFDQLCBKJTPVH.
 -     *    If multiple 'Z' extensions are named, they should be ordered first
 -     *    by category, then alphabetically within a category.
 -     * 3. Standard supervisor-level extensions (starts with 'S') should be
 -     *    listed after standard unprivileged extensions.  If multiple
 -     *    supervisor-level extensions are listed, they should be ordered
 -     *    alphabetically.
 -     * 4. Non-standard extensions (starts with 'X') must be listed after all
 -     *    standard extensions. They must be separated from other multi-letter
 -     *    extensions by an underscore.
 -     */
 -    struct isa_ext_data isa_edata_arr[] = {
 -        ISA_EDATA_ENTRY(zicsr, ext_icsr),
 -        ISA_EDATA_ENTRY(zifencei, ext_ifencei),
 -        ISA_EDATA_ENTRY(zmmul, ext_zmmul),
 -        ISA_EDATA_ENTRY(zfh, ext_zfh),
 -        ISA_EDATA_ENTRY(zfhmin, ext_zfhmin),
 -        ISA_EDATA_ENTRY(zfinx, ext_zfinx),
 -        ISA_EDATA_ENTRY(zdinx, ext_zdinx),
 -        ISA_EDATA_ENTRY(zba, ext_zba),
 -        ISA_EDATA_ENTRY(zbb, ext_zbb),
 -        ISA_EDATA_ENTRY(zbc, ext_zbc),
 -        ISA_EDATA_ENTRY(zbkb, ext_zbkb),
 -        ISA_EDATA_ENTRY(zbkc, ext_zbkc),
 -        ISA_EDATA_ENTRY(zbkx, ext_zbkx),
 -        ISA_EDATA_ENTRY(zbs, ext_zbs),
 -        ISA_EDATA_ENTRY(zk, ext_zk),
 -        ISA_EDATA_ENTRY(zkn, ext_zkn),
 -        ISA_EDATA_ENTRY(zknd, ext_zknd),
 -        ISA_EDATA_ENTRY(zkne, ext_zkne),
 -        ISA_EDATA_ENTRY(zknh, ext_zknh),
 -        ISA_EDATA_ENTRY(zkr, ext_zkr),
 -        ISA_EDATA_ENTRY(zks, ext_zks),
 -        ISA_EDATA_ENTRY(zksed, ext_zksed),
 -        ISA_EDATA_ENTRY(zksh, ext_zksh),
 -        ISA_EDATA_ENTRY(zkt, ext_zkt),
 -        ISA_EDATA_ENTRY(zve32f, ext_zve32f),
 -        ISA_EDATA_ENTRY(zve64f, ext_zve64f),
 -        ISA_EDATA_ENTRY(zhinx, ext_zhinx),
 -        ISA_EDATA_ENTRY(zhinxmin, ext_zhinxmin),
 -        ISA_EDATA_ENTRY(svinval, ext_svinval),
 -        ISA_EDATA_ENTRY(svnapot, ext_svnapot),
 -        ISA_EDATA_ENTRY(svpbmt, ext_svpbmt),
 -    };
 -
      for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
 -        if (isa_edata_arr[i].enabled) {
 +        if (isa_edata_arr[i].multi_letter &&
 +            isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
              new = g_strconcat(old, "_", isa_edata_arr[i].name, NULL);
              g_free(old);
              old = new;
 --
-.37.2
+.45.1

-[PULL 26/44] hw/riscv: remove 'fdt' param from riscv_setup_rom_reset_vec()
+[PULL 05/28] hw/riscv/boot.c: Support 64-bit address for initrd
-From: Daniel Henrique Barboza <danielhb413@gmail.com>
+From: Cheng Yang <yangcheng.work@foxmail.com>
-The 'fdt' param is not being used in riscv_setup_rom_reset_vec().
+Use qemu_fdt_setprop_u64() instead of qemu_fdt_setprop_cell()
-Simplify the API by removing it. While we're at it, remove the redundant
+to set the address of initrd in FDT to support 64-bit address.
 'return' statement at the end of function.
-Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Signed-off-by: Cheng Yang <yangcheng.work@foxmail.com>
 Cc: Alistair Francis <alistair.francis@wdc.com>
 Cc: Bin Meng <bin.meng@windriver.com>
 Cc: Vijai Kumar K <vijai@behindbytes.com>
 Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
 Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220728181926.2123771-1-danielhb413@gmail.com>
+Message-ID: <tencent_A4482251DD0890F312758FA6B33F60815609@qq.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/boot.h    | 2 +-
+ hw/riscv/boot.c | 4 ++--
- hw/riscv/boot.c            | 4 +---
+file changed, 2 insertions(+), 2 deletions(-)
  hw/riscv/microchip_pfsoc.c | 2 +-
  hw/riscv/shakti_c.c        | 3 +--
  hw/riscv/spike.c           | 2 +-
  hw/riscv/virt.c            | 2 +-
 files changed, 6 insertions(+), 9 deletions(-)
-diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/boot.h
-+++ b/include/hw/riscv/boot.h
-@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts
-                                hwaddr saddr,
-                                hwaddr rom_base, hwaddr rom_size,
-                                uint64_t kernel_entry,
--                               uint64_t fdt_load_addr, void *fdt);
-+                               uint64_t fdt_load_addr);
- void riscv_rom_copy_firmware_info(MachineState *machine, hwaddr rom_base,
-                                   hwaddr rom_size,
-                                   uint32_t reset_vec_size,
 diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/boot.c
 +++ b/hw/riscv/boot.c
-@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts
+@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
-                                hwaddr start_addr,
+     /* Some RISC-V machines (e.g. opentitan) don't have a fdt. */
-                                hwaddr rom_base, hwaddr rom_size,
+     if (fdt) {
-                                uint64_t kernel_entry,
+         end = start + size;
--                               uint64_t fdt_load_addr, void *fdt)
+-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start", start);
-+                               uint64_t fdt_load_addr)
+-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end", end);
- {
++        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-start", start);
-     int i;
++        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-end", end);
      uint32_t start_addr_hi32 = 0x00000000;
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts
                            rom_base, &address_space_memory);
      riscv_rom_copy_firmware_info(machine, rom_base, rom_size, sizeof(reset_vec),
                                   kernel_entry);
 -
 -    return;
  }
  void riscv_setup_direct_kernel(hwaddr kernel_addr, hwaddr fdt_addr)
 diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/microchip_pfsoc.c
 +++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
          riscv_setup_rom_reset_vec(machine, &s->soc.u_cpus, firmware_load_addr,
                                    memmap[MICROCHIP_PFSOC_ENVM_DATA].base,
                                    memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
 -                                  kernel_entry, fdt_load_addr, machine->fdt);
 +                                  kernel_entry, fdt_load_addr);
      }
  }
-diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/shakti_c.c
-+++ b/hw/riscv/shakti_c.c
-@@ -XXX,XX +XXX,XX @@ static void shakti_c_machine_state_init(MachineState *mstate)
-     riscv_setup_rom_reset_vec(mstate, &sms->soc.cpus,
-                               shakti_c_memmap[SHAKTI_C_RAM].base,
-                               shakti_c_memmap[SHAKTI_C_ROM].base,
--                              shakti_c_memmap[SHAKTI_C_ROM].size, 0, 0,
--                              NULL);
-+                              shakti_c_memmap[SHAKTI_C_ROM].size, 0, 0);
-     if (mstate->firmware) {
-         riscv_load_firmware(mstate->firmware,
-                             shakti_c_memmap[SHAKTI_C_RAM].base,
-diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/spike.c
-+++ b/hw/riscv/spike.c
-@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
-     riscv_setup_rom_reset_vec(machine, &s->soc[0], memmap[SPIKE_DRAM].base,
-                               memmap[SPIKE_MROM].base,
-                               memmap[SPIKE_MROM].size, kernel_entry,
--                              fdt_load_addr, s->fdt);
-+                              fdt_load_addr);
-     /* initialize HTIF using symbols found in load_kernel */
-     htif_mm_init(system_memory, mask_rom,
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
-+++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
-     riscv_setup_rom_reset_vec(machine, &s->soc[0], start_addr,
-                               virt_memmap[VIRT_MROM].base,
-                               virt_memmap[VIRT_MROM].size, kernel_entry,
--                              fdt_load_addr, machine->fdt);
-+                              fdt_load_addr);
-     /*
-      * Only direct boot kernel is currently supported for KVM VM,
 --
-.37.2
+.45.1

-[PULL 13/44] target/riscv: Fix typo and restore Pointer Masking functionality for RISC-V
+[PULL 06/28] target/riscv: change RISCV_EXCP_SEMIHOST exception number to 63
-From: Alexey Baturo <baturo.alexey@gmail.com>
+From: Clément Léger <cleger@rivosinc.com>
-Fixes: 4302bef9e178 ("target/riscv: Calculate address according to XLEN")
+The current semihost exception number (16) is a reserved number (range
-Signed-off-by: Alexey Baturo <baturo.alexey@gmail.com>
+[16-17]). The upcoming double trap specification uses that number for
 the double trap exception. Since the privileged spec (Table 22) defines
 ranges for custom uses change the semihosting exception number to 63
 which belongs to the range [48-63] in order to avoid any future
 collisions with reserved exception.
 Signed-off-by: Clément Léger <cleger@rivosinc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220717101543.478533-2-space.monkey.delivers@gmail.com>
+Message-ID: <20240422135840.1959967-1-cleger@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/translate.c | 2 +-
+ target/riscv/cpu_bits.h | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/target/riscv/cpu_bits.h
-+++ b/target/riscv/translate.c
++++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+     RISCV_EXCP_INST_PAGE_FAULT = 0xc, /* since: priv-1.10.0 */
-     tcg_gen_addi_tl(addr, src1, imm);
+     RISCV_EXCP_LOAD_PAGE_FAULT = 0xd, /* since: priv-1.10.0 */
-     if (ctx->pm_mask_enabled) {
+     RISCV_EXCP_STORE_PAGE_FAULT = 0xf, /* since: priv-1.10.0 */
--        tcg_gen_and_tl(addr, addr, pm_mask);
+-    RISCV_EXCP_SEMIHOST = 0x10,
-+        tcg_gen_andc_tl(addr, addr, pm_mask);
+     RISCV_EXCP_INST_GUEST_PAGE_FAULT = 0x14,
-     } else if (get_xl(ctx) == MXL_RV32) {
+     RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT = 0x15,
-         tcg_gen_ext32u_tl(addr, addr);
+     RISCV_EXCP_VIRT_INSTRUCTION_FAULT = 0x16,
-     }
+     RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT = 0x17,
 +    RISCV_EXCP_SEMIHOST = 0x3f,
  } RISCVException;
  #define RISCV_EXCP_INT_FLAG                0x80000000
 --
-.37.2
+.45.1

-[PULL 41/44] target/riscv: Simplify counter predicate function
+[PULL 07/28] target/riscv/kvm: tolerate KVM disable ext errors
-From: Atish Patra <atishp@rivosinc.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-All the hpmcounters and the fixed counters (CY, IR, TM) can be represented
+Running a KVM guest using a 6.9-rc3 kernel, in a 6.8 host that has zkr
-as a unified counter. Thus, the predicate function doesn't need handle each
+enabled, will fail with a kernel oops SIGILL right at the start. The
-case separately.
+reason is that we can't expose zkr without implementing the SEED CSR.
 Disabling zkr in the guest would be a workaround, but if the KVM doesn't
 allow it we'll error out and never boot.
-Simplify the predicate function so that we just handle things differently
+In hindsight this is too strict. If we keep proceeding, despite not
-between RV32/RV64 and S/HS mode.
+disabling the extension in the KVM vcpu, we'll not add the extension in
 the riscv,isa. The guest kernel will be unaware of the extension, i.e.
 it doesn't matter if the KVM vcpu has it enabled underneath or not. So
 it's ok to keep booting in this case.
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Change our current logic to not error out if we fail to disable an
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+extension in kvm_set_one_reg(), but show a warning and keep booting. It
-Signed-off-by: Atish Patra <atishp@rivosinc.com>
+is important to throw a warning because we must make the user aware that
-Message-Id: <20220824221701.41932-3-atishp@rivosinc.com>
+the extension is still available in the vcpu, meaning that an
 ill-behaved guest can ignore the riscv,isa settings and  use the
 extension.
 The case we're handling happens with an EINVAL error code. If we fail to
 disable the extension in KVM for any other reason, error out.
 We'll also keep erroring out when we fail to enable an extension in KVM,
 since adding the extension in riscv,isa at this point will cause a guest
 malfunction because the extension isn't enabled in the vcpu.
 Suggested-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240422171425.333037-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 110 ++++-----------------------------------------
+ target/riscv/kvm/kvm-cpu.c | 12 ++++++++----
-file changed, 9 insertions(+), 101 deletions(-)
+file changed, 8 insertions(+), 4 deletions(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/csr.c
++++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
-     CPUState *cs = env_cpu(env);
+         reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
-     RISCVCPU *cpu = RISCV_CPU(cs);
+         ret = kvm_set_one_reg(cs, id, &reg);
-     int ctr_index;
+         if (ret != 0) {
-+    target_ulong ctr_mask;
+-            error_report("Unable to %s extension %s in KVM, error %d",
-     int base_csrno = CSR_CYCLE;
+-                         reg ? "enable" : "disable",
-     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
+-                         multi_ext_cfg->name, ret);
+-            exit(EXIT_FAILURE);
-@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
++            if (!reg && ret == -EINVAL) {
-         base_csrno += 0x80;
++                warn_report("KVM cannot disable extension %s",
-     }
++                            multi_ext_cfg->name);
-     ctr_index = csrno - base_csrno;
++            } else {
-+    ctr_mask = BIT(ctr_index);
++                error_report("Unable to enable extension %s in KVM, error %d",
++                             multi_ext_cfg->name, ret);
-     if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) ||
++                exit(EXIT_FAILURE);
-         (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) {
++            }
          goto skip_ext_pmu_check;
      }
 -    if ((!cpu->cfg.pmu_num || !(cpu->pmu_avail_ctrs & BIT(ctr_index)))) {
 +    if (!(cpu->pmu_avail_ctrs & ctr_mask)) {
          /* No counter is enabled in PMU or the counter is out of range */
          return RISCV_EXCP_ILLEGAL_INST;
      }
  skip_ext_pmu_check:
 -    if (env->priv == PRV_S) {
 -        switch (csrno) {
 -        case CSR_CYCLE:
 -            if (!get_field(env->mcounteren, COUNTEREN_CY)) {
 -                return RISCV_EXCP_ILLEGAL_INST;
 -            }
 -            break;
 -        case CSR_TIME:
 -            if (!get_field(env->mcounteren, COUNTEREN_TM)) {
 -                return RISCV_EXCP_ILLEGAL_INST;
 -            }
 -            break;
 -        case CSR_INSTRET:
 -            if (!get_field(env->mcounteren, COUNTEREN_IR)) {
 -                return RISCV_EXCP_ILLEGAL_INST;
 -            }
 -            break;
 -        case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
 -            if (!get_field(env->mcounteren, 1 << ctr_index)) {
 -                return RISCV_EXCP_ILLEGAL_INST;
 -            }
 -            break;
 -        }
 -        if (rv32) {
 -            switch (csrno) {
 -            case CSR_CYCLEH:
 -                if (!get_field(env->mcounteren, COUNTEREN_CY)) {
 -                    return RISCV_EXCP_ILLEGAL_INST;
 -                }
 -                break;
 -            case CSR_TIMEH:
 -                if (!get_field(env->mcounteren, COUNTEREN_TM)) {
 -                    return RISCV_EXCP_ILLEGAL_INST;
 -                }
 -                break;
 -            case CSR_INSTRETH:
 -                if (!get_field(env->mcounteren, COUNTEREN_IR)) {
 -                    return RISCV_EXCP_ILLEGAL_INST;
 -                }
 -                break;
 -            case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
 -                if (!get_field(env->mcounteren, 1 << ctr_index)) {
 -                    return RISCV_EXCP_ILLEGAL_INST;
 -                }
 -                break;
 -            }
 -        }
 +    if (((env->priv == PRV_S) && (!get_field(env->mcounteren, ctr_mask))) ||
 +        ((env->priv == PRV_U) && (!get_field(env->scounteren, ctr_mask)))) {
 +        return RISCV_EXCP_ILLEGAL_INST;
      }
      if (riscv_cpu_virt_enabled(env)) {
 -        switch (csrno) {
 -        case CSR_CYCLE:
 -            if (!get_field(env->hcounteren, COUNTEREN_CY) &&
 -                get_field(env->mcounteren, COUNTEREN_CY)) {
 -                return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 -            }
 -            break;
 -        case CSR_TIME:
 -            if (!get_field(env->hcounteren, COUNTEREN_TM) &&
 -                get_field(env->mcounteren, COUNTEREN_TM)) {
 -                return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 -            }
 -            break;
 -        case CSR_INSTRET:
 -            if (!get_field(env->hcounteren, COUNTEREN_IR) &&
 -                get_field(env->mcounteren, COUNTEREN_IR)) {
 -                return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 -            }
 -            break;
 -        case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
 -            if (!get_field(env->hcounteren, 1 << ctr_index) &&
 -                 get_field(env->mcounteren, 1 << ctr_index)) {
 -                return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 -            }
 -            break;
 -        }
 -        if (rv32) {
 -            switch (csrno) {
 -            case CSR_CYCLEH:
 -                if (!get_field(env->hcounteren, COUNTEREN_CY) &&
 -                    get_field(env->mcounteren, COUNTEREN_CY)) {
 -                    return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 -                }
 -                break;
 -            case CSR_TIMEH:
 -                if (!get_field(env->hcounteren, COUNTEREN_TM) &&
 -                    get_field(env->mcounteren, COUNTEREN_TM)) {
 -                    return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 -                }
 -                break;
 -            case CSR_INSTRETH:
 -                if (!get_field(env->hcounteren, COUNTEREN_IR) &&
 -                    get_field(env->mcounteren, COUNTEREN_IR)) {
 -                    return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 -                }
 -                break;
 -            case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
 -                if (!get_field(env->hcounteren, 1 << ctr_index) &&
 -                     get_field(env->mcounteren, 1 << ctr_index)) {
 -                    return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 -                }
 -                break;
 -            }
 +        if (!get_field(env->hcounteren, ctr_mask) &&
 +            get_field(env->mcounteren, ctr_mask)) {
 +            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
          }
      }
- #endif
+ }
 --
-.37.2
+.45.1

-[PULL 15/44] target/riscv: rvv: Add mask agnostic for vv instructions
+[PULL 08/28] target/riscv/debug: set tval=pc in breakpoint exceptions
-From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-According to v-spec, mask agnostic behavior can be either kept as
+We're not setting (s/m)tval when triggering breakpoints of type 2
-undisturbed or set elements' bits to all 1s. To distinguish the
+(mcontrol) and 6 (mcontrol6). According to the debug spec section
-difference of mask policies, QEMU should be able to simulate the mask
+.7.12, "Match Control Type 6":
 agnostic behavior as "set mask elements' bits to all 1s".
-There are multiple possibility for agnostic elements according to
+"The Privileged Spec says that breakpoint exceptions that occur on
-v-spec. The main intent of this patch-set tries to add option that
+instruction fetches, loads, or stores update the tval CSR with either
-can distinguish between mask policies. Setting agnostic elements to
+zero or the faulting virtual address. The faulting virtual address for
-all 1s allows QEMU to express this.
+an mcontrol6 trigger with action = 0 is the address being accessed and
 which caused that trigger to fire."
-This is the first commit regarding the optional mask agnostic
+A similar text is also found in the Debug spec section 5.7.11 w.r.t.
-behavior. Follow-up commits will add this optional behavior
+mcontrol.
 for all rvv instructions.
-Signed-off-by: eop Chen <eop.chen@sifive.com>
+Note that what we're doing ATM is not violating the spec, but it's
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
+simple enough to set mtval/stval and it makes life easier for any
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+software that relies on this info.
 Given that we always use action = 0, save the faulting address for the
 mcontrol and mcontrol6 trigger breakpoints into env->badaddr, which is
 used as as scratch area for traps with address information. 'tval' is
 then set during riscv_cpu_do_interrupt().
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <165570784143.17634.35095816584573691-1@git.sr.ht>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Message-ID: <20240416230437.1869024-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h                      | 2 ++
+ target/riscv/cpu_helper.c | 1 +
- target/riscv/internals.h                | 5 +++--
+ target/riscv/debug.c      | 3 +++
- target/riscv/cpu_helper.c               | 2 ++
+files changed, 4 insertions(+)
  target/riscv/translate.c                | 2 ++
  target/riscv/vector_helper.c            | 8 ++++++++
  target/riscv/insn_trans/trans_rvv.c.inc | 3 +++
 files changed, 20 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_zve64f;
-     bool ext_zmmul;
-     bool rvv_ta_all_1s;
-+    bool rvv_ma_all_1s;
-     uint32_t mvendorid;
-     uint64_t marchid;
-@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, XL, 20, 2)
- FIELD(TB_FLAGS, PM_MASK_ENABLED, 22, 1)
- FIELD(TB_FLAGS, PM_BASE_ENABLED, 23, 1)
- FIELD(TB_FLAGS, VTA, 24, 1)
-+FIELD(TB_FLAGS, VMA, 25, 1)
- #ifdef TARGET_RISCV32
- #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
-diff --git a/target/riscv/internals.h b/target/riscv/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/internals.h
-+++ b/target/riscv/internals.h
-@@ -XXX,XX +XXX,XX @@ FIELD(VDATA, VM, 0, 1)
- FIELD(VDATA, LMUL, 1, 3)
- FIELD(VDATA, VTA, 4, 1)
- FIELD(VDATA, VTA_ALL_1S, 5, 1)
--FIELD(VDATA, NF, 6, 4)
--FIELD(VDATA, WD, 6, 1)
-+FIELD(VDATA, VMA, 6, 1)
-+FIELD(VDATA, NF, 7, 4)
-+FIELD(VDATA, WD, 7, 1)
- /* float point classify helpers */
- target_ulong fclass_h(uint64_t frs1);
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
-         flags = FIELD_DP32(flags, TB_FLAGS, VL_EQ_VLMAX, vl_eq_vlmax);
+             tval = env->bins;
-         flags = FIELD_DP32(flags, TB_FLAGS, VTA,
+             break;
-                     FIELD_EX64(env->vtype, VTYPE, VTA));
+         case RISCV_EXCP_BREAKPOINT:
-+        flags = FIELD_DP32(flags, TB_FLAGS, VMA,
++            tval = env->badaddr;
-+                    FIELD_EX64(env->vtype, VTYPE, VMA));
+             if (cs->watchpoint_hit) {
-     } else {
+                 tval = cs->watchpoint_hit->hitaddr;
-         flags = FIELD_DP32(flags, TB_FLAGS, VILL, 1);
+                 cs->watchpoint_hit = NULL;
-     }
+diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/target/riscv/debug.c
-+++ b/target/riscv/translate.c
++++ b/target/riscv/debug.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
-     int8_t lmul;
+                 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
-     uint8_t sew;
+                     /* check U/S/M bit against current privilege level */
-     uint8_t vta;
+                     if ((ctrl >> 3) & BIT(env->priv)) {
-+    uint8_t vma;
++                        env->badaddr = pc;
-     bool cfg_vta_all_1s;
+                         return true;
-     target_ulong vstart;
+                     }
-     bool vl_eq_vlmax;
+                 }
-@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
-     ctx->sew = FIELD_EX32(tb_flags, TB_FLAGS, SEW);
+                     if (env->virt_enabled) {
-     ctx->lmul = sextract32(FIELD_EX32(tb_flags, TB_FLAGS, LMUL), 0, 3);
+                         /* check VU/VS bit against current privilege level */
-     ctx->vta = FIELD_EX32(tb_flags, TB_FLAGS, VTA) && cpu->cfg.rvv_ta_all_1s;
+                         if ((ctrl >> 23) & BIT(env->priv)) {
-+    ctx->vma = FIELD_EX32(tb_flags, TB_FLAGS, VMA) && cpu->cfg.rvv_ma_all_1s;
++                            env->badaddr = pc;
-     ctx->cfg_vta_all_1s = cpu->cfg.rvv_ta_all_1s;
+                             return true;
-     ctx->vstart = env->vstart;
+                         }
-     ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
+                     } else {
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
+                         /* check U/S/M bit against current privilege level */
-index XXXXXXX..XXXXXXX 100644
+                         if ((ctrl >> 3) & BIT(env->priv)) {
---- a/target/riscv/vector_helper.c
++                            env->badaddr = pc;
-+++ b/target/riscv/vector_helper.c
+                             return true;
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_vta(uint32_t desc)
+                         }
-     return FIELD_EX32(simd_data(desc), VDATA, VTA);
+                     }
  }
 +static inline uint32_t vext_vma(uint32_t desc)
 +{
 +    return FIELD_EX32(simd_data(desc), VDATA, VMA);
 +}
 +
  static inline uint32_t vext_vta_all_1s(uint32_t desc)
  {
      return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
@@ -XXX,XX +XXX,XX @@ static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
      uint32_t vl = env->vl;
      uint32_t total_elems = vext_get_total_elems(env, desc, esz);
      uint32_t vta = vext_vta(desc);
 +    uint32_t vma = vext_vma(desc);
      uint32_t i;
      for (i = env->vstart; i < vl; i++) {
          if (!vm && !vext_elem_mask(v0, i)) {
 +            /* set masked-off elements to 1s */
 +            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
              continue;
          }
          fn(vd, vs1, vs2, i);
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
          data = FIELD_DP32(data, VDATA, VM, a->vm);
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
          data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                             vreg_ofs(s, a->rs1), vreg_ofs(s, a->rs2),
                             cpu_env, s->cfg_ptr->vlen / 8,
@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
          data = FIELD_DP32(data, VDATA, VM, a->vm);
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
          data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                             vreg_ofs(s, a->rs1),
                             vreg_ofs(s, a->rs2),
@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
          data = FIELD_DP32(data, VDATA, VM, a->vm);
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
          data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);
          tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                             vreg_ofs(s, a->rs1),
                             vreg_ofs(s, a->rs2),
 --
-.37.2
+.45.1

-[PULL 44/44] target/riscv: Update the privilege field for sscofpmf CSRs
+[PULL 09/28] trans_privileged.c.inc: set (m|s)tval on ebreak breakpoint
-From: Atish Patra <atishp@rivosinc.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The sscofpmf extension was ratified as a part of priv spec v1.12.
+Privileged spec section 4.1.9 mentions:
 Mark the csr_ops accordingly.
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+"When a trap is taken into S-mode, stval is written with
 exception-specific information to assist software in handling the trap.
 (...)
 If stval is written with a nonzero value when a breakpoint,
 address-misaligned, access-fault, or page-fault exception occurs on an
 instruction fetch, load, or store, then stval will contain the faulting
 virtual address."
 A similar text is found for mtval in section 3.1.16.
 Setting mtval/stval in this scenario is optional, but some softwares read
 these regs when handling ebreaks.
 Write 'badaddr' in all ebreak breakpoints to write the appropriate
 'tval' during riscv_do_cpu_interrrupt().
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Atish Patra <atishp@rivosinc.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Message-Id: <20220824221701.41932-6-atishp@rivosinc.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20240416230437.1869024-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 90 ++++++++++++++++++++++++++++++----------------
+ target/riscv/insn_trans/trans_privileged.c.inc | 2 ++
-file changed, 60 insertions(+), 30 deletions(-)
+file changed, 2 insertions(+)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/target/riscv/insn_trans/trans_privileged.c.inc
-+++ b/target/riscv/csr.c
++++ b/target/riscv/insn_trans/trans_privileged.c.inc
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
+@@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
-                              write_mhpmevent                           },
+     if (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
+         generate_exception(ctx, RISCV_EXCP_SEMIHOST);
-     [CSR_MHPMEVENT3H]    = { "mhpmevent3h",    sscofpmf,  read_mhpmeventh,
+     } else {
--                             write_mhpmeventh                           },
++        tcg_gen_st_tl(tcg_constant_tl(ebreak_addr), tcg_env,
-+                             write_mhpmeventh,
++                      offsetof(CPURISCVState, badaddr));
-+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
+         generate_exception(ctx, RISCV_EXCP_BREAKPOINT);
-     [CSR_MHPMEVENT4H]    = { "mhpmevent4h",    sscofpmf,  read_mhpmeventh,
+     }
--                             write_mhpmeventh                           },
+     return true;
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT5H]    = { "mhpmevent5h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT6H]    = { "mhpmevent6h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT7H]    = { "mhpmevent7h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT8H]    = { "mhpmevent8h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT9H]    = { "mhpmevent9h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT10H]   = { "mhpmevent10h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT11H]   = { "mhpmevent11h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT12H]   = { "mhpmevent12h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT13H]   = { "mhpmevent13h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT14H]   = { "mhpmevent14h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT15H]   = { "mhpmevent15h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT16H]   = { "mhpmevent16h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT17H]   = { "mhpmevent17h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT18H]   = { "mhpmevent18h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT19H]   = { "mhpmevent19h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT20H]   = { "mhpmevent20h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT21H]   = { "mhpmevent21h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT22H]   = { "mhpmevent22h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT23H]   = { "mhpmevent23h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT24H]   = { "mhpmevent24h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT25H]   = { "mhpmevent25h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT26H]   = { "mhpmevent26h",    sscofpmf,  read_mhpmeventh,
 -                              write_mhpmeventh                          },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT27H]   = { "mhpmevent27h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT28H]   = { "mhpmevent28h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT29H]   = { "mhpmevent29h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT30H]   = { "mhpmevent30h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_MHPMEVENT31H]   = { "mhpmevent31h",    sscofpmf,  read_mhpmeventh,
 -                             write_mhpmeventh                           },
 +                             write_mhpmeventh,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0        },
      [CSR_HPMCOUNTER3H]   = { "hpmcounter3h",   ctr32,  read_hpmcounterh },
      [CSR_HPMCOUNTER4H]   = { "hpmcounter4h",   ctr32,  read_hpmcounterh },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                               write_mhpmcounterh                         },
      [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", mctr32,  read_hpmcounterh,
                               write_mhpmcounterh                         },
 -    [CSR_SCOUNTOVF]      = { "scountovf", sscofpmf,  read_scountovf },
 +    [CSR_SCOUNTOVF]      = { "scountovf", sscofpmf,  read_scountovf,
 +                             .min_priv_ver = PRIV_VERSION_1_12_0 },
  #endif /* !CONFIG_USER_ONLY */
  };
 --
-.37.2
+.45.1

-[PULL 36/44] target/riscv: Use official extension names for AIA CSRs
+[PULL 10/28] target/riscv: Add support for Zve32x extension
-From: Anup Patel <apatel@ventanamicro.com>
+From: Jason Chien <jason.chien@sifive.com>
-The arch review of AIA spec is completed and we now have official
+Add support for Zve32x extension and replace some checks for Zve32f with
-extension names for AIA: Smaia (M-mode AIA CSRs) and Ssaia (S-mode
+Zve32x, since Zve32f depends on Zve32x.
 AIA CSRs).
-Refer, section 1.6 of the latest AIA v0.3.1 stable specification at
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
-https://github.com/riscv/riscv-aia/releases/download/0.3.1-draft.32/riscv-interrupts-032.pdf)
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Max Chou <max.chou@sifive.com>
-Based on above, we update QEMU RISC-V to:
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-) Have separate config options for Smaia and Ssaia extensions
+Message-ID: <20240328022343.6871-2-jason.chien@sifive.com>
    which replace RISCV_FEATURE_AIA in CPU features
 ) Not generate AIA INTC compatible string in virt machine
 Signed-off-by: Anup Patel <apatel@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20220820042958.377018-1-apatel@ventanamicro.com
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        |  4 ++--
+ target/riscv/cpu_cfg.h                  |  1 +
- hw/intc/riscv_imsic.c     |  4 +++-
+ target/riscv/cpu.c                      |  2 ++
- hw/riscv/virt.c           | 13 ++-----------
+ target/riscv/cpu_helper.c               |  2 +-
- target/riscv/cpu.c        |  9 ++++-----
+ target/riscv/csr.c                      |  2 +-
- target/riscv/cpu_helper.c |  3 ++-
+ target/riscv/tcg/tcg-cpu.c              | 16 ++++++++--------
- target/riscv/csr.c        | 24 ++++++++++++++++++------
+ target/riscv/insn_trans/trans_rvv.c.inc |  4 ++--
-files changed, 31 insertions(+), 26 deletions(-)
+files changed, 15 insertions(+), 12 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ enum {
      RISCV_FEATURE_PMP,
      RISCV_FEATURE_EPMP,
      RISCV_FEATURE_MISA,
 -    RISCV_FEATURE_AIA,
      RISCV_FEATURE_DEBUG
  };
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_zhinx;
+     bool ext_zhinxmin;
      bool ext_zve32f;
++    bool ext_zve32x;
      bool ext_zve64f;
-     bool ext_zmmul;
+     bool ext_zve64d;
-+    bool ext_smaia;
+     bool ext_zvbb;
 +    bool ext_ssaia;
      bool rvv_ta_all_1s;
      bool rvv_ma_all_1s;
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool mmu;
      bool pmp;
      bool epmp;
 -    bool aia;
      bool debug;
      uint64_t resetvec;
 diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/riscv_imsic.c
 +++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
      /* Force select AIA feature and setup CSR read-modify-write callback */
      if (env) {
 -        riscv_set_feature(env, RISCV_FEATURE_AIA);
          if (!imsic->mmode) {
 +            rcpu->cfg.ext_ssaia = true;
              riscv_cpu_set_geilen(env, imsic->num_pages - 1);
 +        } else {
 +            rcpu->cfg.ext_smaia = true;
          }
          riscv_cpu_set_aia_ireg_rmw_fn(env, (imsic->mmode) ? PRV_M : PRV_S,
                                        riscv_imsic_rmw, imsic);
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
          qemu_fdt_add_subnode(mc->fdt, intc_name);
          qemu_fdt_setprop_cell(mc->fdt, intc_name, "phandle",
              intc_phandles[cpu]);
 -        if (riscv_feature(&s->soc[socket].harts[cpu].env,
 -                          RISCV_FEATURE_AIA)) {
 -            static const char * const compat[2] = {
 -                "riscv,cpu-intc-aia", "riscv,cpu-intc"
 -            };
 -            qemu_fdt_setprop_string_array(mc->fdt, intc_name, "compatible",
 -                                      (char **)&compat, ARRAY_SIZE(compat));
 -        } else {
 -            qemu_fdt_setprop_string(mc->fdt, intc_name, "compatible",
 -                "riscv,cpu-intc");
 -        }
 +        qemu_fdt_setprop_string(mc->fdt, intc_name, "compatible",
 +            "riscv,cpu-intc");
          qemu_fdt_setprop(mc->fdt, intc_name, "interrupt-controller", NULL, 0);
          qemu_fdt_setprop_cell(mc->fdt, intc_name, "#interrupt-cells", 1);
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-     ISA_EXT_DATA_ENTRY(zve64f, true, PRIV_VERSION_1_12_0, ext_zve64f),
+     ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
-     ISA_EXT_DATA_ENTRY(zhinx, true, PRIV_VERSION_1_12_0, ext_zhinx),
+     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
-     ISA_EXT_DATA_ENTRY(zhinxmin, true, PRIV_VERSION_1_12_0, ext_zhinxmin),
+     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
-+    ISA_EXT_DATA_ENTRY(smaia, true, PRIV_VERSION_1_12_0, ext_smaia),
++    ISA_EXT_DATA_ENTRY(zve32x, PRIV_VERSION_1_10_0, ext_zve32x),
-+    ISA_EXT_DATA_ENTRY(ssaia, true, PRIV_VERSION_1_12_0, ext_ssaia),
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
-     ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
+     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
-     ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
+     ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
-     ISA_EXT_DATA_ENTRY(svpbmt, true, PRIV_VERSION_1_12_0, ext_svpbmt),
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
-         }
+     MULTI_EXT_CFG_BOOL("zfhmin", ext_zfhmin, false),
-     }
+     MULTI_EXT_CFG_BOOL("zve32f", ext_zve32f, false),
++    MULTI_EXT_CFG_BOOL("zve32x", ext_zve32x, false),
--    if (cpu->cfg.aia) {
+     MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
--        riscv_set_feature(env, RISCV_FEATURE_AIA);
+     MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
--    }
+     MULTI_EXT_CFG_BOOL("zvfbfmin", ext_zvfbfmin, false),
 -
      if (cpu->cfg.debug) {
          riscv_set_feature(env, RISCV_FEATURE_DEBUG);
      }
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-j", RISCVCPU, cfg.ext_j, false),
      /* ePMP 0.9.3 */
      DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
 -    DEFINE_PROP_BOOL("x-aia", RISCVCPU, cfg.aia, false),
 +    DEFINE_PROP_BOOL("x-smaia", RISCVCPU, cfg.ext_smaia, false),
 +    DEFINE_PROP_BOOL("x-ssaia", RISCVCPU, cfg.ext_ssaia, false),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_pending_to_irq(CPURISCVState *env,
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
-                                     int extirq, unsigned int extirq_def_prio,
+     *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
-                                     uint64_t pending, uint8_t *iprio)
+     *cs_base = 0;
- {
-+    RISCVCPU *cpu = env_archcpu(env);
+-    if (cpu->cfg.ext_zve32f) {
-     int irq, best_irq = RISCV_EXCP_NONE;
++    if (cpu->cfg.ext_zve32x) {
-     unsigned int prio, best_prio = UINT_MAX;
+         /*
+          * If env->vl equals to VLMAX, we can use generic vector operation
-@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_pending_to_irq(CPURISCVState *env,
+          * expanders (GVEC) to accerlate the vector operations.
      }
      irq = ctz64(pending);
 -    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
 +    if (!((extirq == IRQ_M_EXT) ? cpu->cfg.ext_smaia : cpu->cfg.ext_ssaia)) {
          return irq;
      }
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException any32(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static RISCVException fs(CPURISCVState *env, int csrno)
- static int aia_any(CPURISCVState *env, int csrno)
+ static RISCVException vs(CPURISCVState *env, int csrno)
  {
--    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+-    if (riscv_cpu_cfg(env)->ext_zve32f) {
-+    RISCVCPU *cpu = env_archcpu(env);
++    if (riscv_cpu_cfg(env)->ext_zve32x) {
-+
+ #if !defined(CONFIG_USER_ONLY)
-+    if (!cpu->cfg.ext_smaia) {
+         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
-         return RISCV_EXCP_ILLEGAL_INST;
+             return RISCV_EXCP_ILLEGAL_INST;
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
-@@ -XXX,XX +XXX,XX @@ static int aia_any(CPURISCVState *env, int csrno)
+-    if (cpu->cfg.ext_zve32f && !riscv_has_ext(env, RVF)) {
+-        error_setg(errp, "Zve32f/Zve64f extensions require F extension");
- static int aia_any32(CPURISCVState *env, int csrno)
+-        return;
 +    /* The Zve32f extension depends on the Zve32x extension */
 +    if (cpu->cfg.ext_zve32f) {
 +        if (!riscv_has_ext(env, RVF)) {
 +            error_setg(errp, "Zve32f/Zve64f extensions require F extension");
 +            return;
 +        }
 +        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32x), true);
      }
      if (cpu->cfg.ext_zvfh) {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zvbc), true);
      }
 -    /*
 -     * In principle Zve*x would also suffice here, were they supported
 -     * in qemu
 -     */
      if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkb || cpu->cfg.ext_zvkg ||
           cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksed ||
 -         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
 +         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32x) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
  {
--    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+     TCGv s1, dst;
-+    RISCVCPU *cpu = env_archcpu(env);
-+
+-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
-+    if (!cpu->cfg.ext_smaia) {
++    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
-         return RISCV_EXCP_ILLEGAL_INST;
+         return false;
      }
-@@ -XXX,XX +XXX,XX @@ static int smode32(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
  static int aia_smode(CPURISCVState *env, int csrno)
  {
--    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+     TCGv dst;
-+    RISCVCPU *cpu = env_archcpu(env);
-+
+-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
-+    if (!cpu->cfg.ext_ssaia) {
++    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
-         return RISCV_EXCP_ILLEGAL_INST;
+         return false;
      }
-@@ -XXX,XX +XXX,XX @@ static int aia_smode(CPURISCVState *env, int csrno)
- static int aia_smode32(CPURISCVState *env, int csrno)
- {
--    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
-+    RISCVCPU *cpu = env_archcpu(env);
-+
-+    if (!cpu->cfg.ext_ssaia) {
-         return RISCV_EXCP_ILLEGAL_INST;
-     }
-@@ -XXX,XX +XXX,XX @@ static RISCVException pointer_masking(CPURISCVState *env, int csrno)
- static int aia_hmode(CPURISCVState *env, int csrno)
- {
--    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
-+    RISCVCPU *cpu = env_archcpu(env);
-+
-+    if (!cpu->cfg.ext_ssaia) {
-         return RISCV_EXCP_ILLEGAL_INST;
-      }
-@@ -XXX,XX +XXX,XX @@ static int aia_hmode(CPURISCVState *env, int csrno)
- static int aia_hmode32(CPURISCVState *env, int csrno)
- {
--    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
-+    RISCVCPU *cpu = env_archcpu(env);
-+
-+    if (!cpu->cfg.ext_ssaia) {
-         return RISCV_EXCP_ILLEGAL_INST;
-     }
 --
-.37.2
+.45.1

-[PULL 10/44] target/riscv: Fix checks in hmode/hmode32
+[PULL 11/28] target/riscv: Add support for Zve64x extension
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Jason Chien <jason.chien@sifive.com>
-Add check for the implicit dependence between H and S
+Add support for Zve64x extension. Enabling Zve64f enables Zve64x and
 enabling Zve64x enables Zve32x according to their dependency.
-Csrs only existed in RV32 will not trigger virtual instruction fault
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2107
-when not in RV32 based on section 8.6.1 of riscv-privileged spec
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
-(draft-20220717)
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
+Reviewed-by: Max Chou <max.chou@sifive.com>
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+Message-ID: <20240328022343.6871-3-jason.chien@sifive.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20220718130955.11899-6-liweiwei@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 5 +++++
+ target/riscv/cpu_cfg.h     |  1 +
- target/riscv/csr.c | 9 ++-------
+ target/riscv/cpu.c         |  2 ++
-files changed, 7 insertions(+), 7 deletions(-)
+ target/riscv/tcg/tcg-cpu.c | 17 +++++++++++------
 files changed, 14 insertions(+), 6 deletions(-)
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_cfg.h
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_zve32x;
+     bool ext_zve64f;
+     bool ext_zve64d;
++    bool ext_zve64x;
+     bool ext_zvbb;
+     bool ext_zvbc;
+     bool ext_zvkb;
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
-             return;
+     ISA_EXT_DATA_ENTRY(zve32x, PRIV_VERSION_1_10_0, ext_zve32x),
-         }
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
+     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
-+        if (cpu->cfg.ext_h && !cpu->cfg.ext_s) {
++    ISA_EXT_DATA_ENTRY(zve64x, PRIV_VERSION_1_10_0, ext_zve64x),
-+            error_setg(errp, "H extension implicitly requires S-mode");
+     ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
      ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
      ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
      MULTI_EXT_CFG_BOOL("zve32x", ext_zve32x, false),
      MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
      MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
 +    MULTI_EXT_CFG_BOOL("zve64x", ext_zve64x, false),
      MULTI_EXT_CFG_BOOL("zvfbfmin", ext_zvfbfmin, false),
      MULTI_EXT_CFG_BOOL("zvfbfwma", ext_zvfbfwma, false),
      MULTI_EXT_CFG_BOOL("zvfh", ext_zvfh, false),
 diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/tcg/tcg-cpu.c
 +++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      /* The Zve64d extension depends on the Zve64f extension */
      if (cpu->cfg.ext_zve64d) {
 +        if (!riscv_has_ext(env, RVD)) {
 +            error_setg(errp, "Zve64d/V extensions require D extension");
 +            return;
 +        }
-+
+         cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve64f), true);
          if (cpu->cfg.ext_f && !cpu->cfg.ext_icsr) {
              error_setg(errp, "F extension requires Zicsr");
              return;
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int aia_smode32(CPURISCVState *env, int csrno)
  static RISCVException hmode(CPURISCVState *env, int csrno)
  {
 -    if (riscv_has_ext(env, RVS) &&
 -        riscv_has_ext(env, RVH)) {
 +    if (riscv_has_ext(env, RVH)) {
          /* Hypervisor extension is supported */
          if ((env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
              env->priv == PRV_M) {
@@ -XXX,XX +XXX,XX @@ static RISCVException hmode(CPURISCVState *env, int csrno)
  static RISCVException hmode32(CPURISCVState *env, int csrno)
  {
      if (riscv_cpu_mxl(env) != MXL_RV32) {
 -        if (!riscv_cpu_virt_enabled(env)) {
 -            return RISCV_EXCP_ILLEGAL_INST;
 -        } else {
 -            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 -        }
 +        return RISCV_EXCP_ILLEGAL_INST;
      }
-     return hmode(env, csrno);
+-    /* The Zve64f extension depends on the Zve32f extension */
 +    /* The Zve64f extension depends on the Zve64x and Zve32f extensions */
      if (cpu->cfg.ext_zve64f) {
 +        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve64x), true);
          cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32f), true);
      }
 -    if (cpu->cfg.ext_zve64d && !riscv_has_ext(env, RVD)) {
 -        error_setg(errp, "Zve64d/V extensions require D extension");
 -        return;
 +    /* The Zve64x extension depends on the Zve32x extension */
 +    if (cpu->cfg.ext_zve64x) {
 +        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32x), true);
      }
      /* The Zve32f extension depends on the Zve32x extension */
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
 -    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
 +    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64x) {
          error_setg(
              errp,
 -            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
 +            "Zvbc and Zvknhb extensions require V or Zve64x extensions");
          return;
      }
 --
-.37.2
+.45.1

-[PULL 34/44] hw/core: fix platform bus node name
+[PULL 12/28] target/riscv: Relax vector register check in RISCV gdbstub
-From: Conor Dooley <conor.dooley@microchip.com>
+From: Jason Chien <jason.chien@sifive.com>
-"platform" is not a valid name for a bus node in dt-schema, so warnings
+In current implementation, the gdbstub allows reading vector registers
-can be see in dt-validate on a dump of the riscv virt dtb:
+only if V extension is supported. However, all vector extensions and
 vector crypto extensions have the vector registers and they all depend
 on Zve32x. The gdbstub should check for Zve32x instead.
-/stuff/qemu/qemu.dtb: platform@4000000: $nodename:0: 'platform@4000000' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
-        From schema: /home/conor/.local/lib/python3.9/site-packages/dtschema/schemas/simple-bus.yaml
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-"platform-bus" is a valid name, so use that instead.
+Reviewed-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20240328022343.6871-4-jason.chien@sifive.com>
 CC: Rob Herring <robh@kernel.org>
 Fixes: 11d306b9df ("hw/arm/sysbus-fdt: helpers for platform bus nodes addition")
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
 Message-id: 20220810184612.157317-5-mail@conchuod.ie
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/core/sysbus-fdt.c | 2 +-
+ target/riscv/gdbstub.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/core/sysbus-fdt.c b/hw/core/sysbus-fdt.c
+diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/core/sysbus-fdt.c
+--- a/target/riscv/gdbstub.c
-+++ b/hw/core/sysbus-fdt.c
++++ b/target/riscv/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ void platform_bus_add_all_fdt_nodes(void *fdt, const char *intc, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
+                                  gdb_find_static_feature("riscv-32bit-fpu.xml"),
-     assert(fdt);
+);
+     }
--    node = g_strdup_printf("/platform@%"PRIx64, addr);
+-    if (env->misa_ext & RVV) {
-+    node = g_strdup_printf("/platform-bus@%"PRIx64, addr);
++    if (cpu->cfg.ext_zve32x) {
+         gdb_register_coprocessor(cs, riscv_gdb_get_vector,
-     /* Create a /platform node that we can put all devices into */
+                                  riscv_gdb_set_vector,
-     qemu_fdt_add_subnode(fdt, node);
+                                  ricsv_gen_dynamic_vector_feature(cs, cs->gdb_num_regs),
 --
-.37.2
+.45.1

-[PULL 05/44] hw/riscv: virt: pass random seed to fdt
+[PULL 13/28] target/riscv: Fix the element agnostic function problem
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Huang Tao <eric.huang@linux.alibaba.com>
-If the FDT contains /chosen/rng-seed, then the Linux RNG will use it to
+In RVV and vcrypto instructions, the masked and tail elements are set to 1s
-initialize early. Set this using the usual guest random number
+using vext_set_elems_1s function if the vma/vta bit is set. It is the element
-generation function. This is confirmed to successfully initialize the
+agnostic policy.
 RNG on Linux 5.19-rc2.
-Cc: Alistair Francis <alistair.francis@wdc.com>
+However, this function can't deal the big endian situation. This patch fixes
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+the problem by adding handling of such case.
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Message-Id: <20220613115810.178210-1-Jason@zx2c4.com>
+Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
 Suggested-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240325021654.6594-1-eric.huang@linux.alibaba.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/virt.c | 6 ++++++
+ target/riscv/vector_internals.c | 22 ++++++++++++++++++++++
-file changed, 6 insertions(+)
+file changed, 22 insertions(+)
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
+diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
+--- a/target/riscv/vector_internals.c
-+++ b/hw/riscv/virt.c
++++ b/target/riscv/vector_internals.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
- #include "qemu/osdep.h"
+     if (tot - cnt == 0) {
- #include "qemu/units.h"
+         return ;
  #include "qemu/error-report.h"
 +#include "qemu/guest-random.h"
  #include "qapi/error.h"
  #include "hw/boards.h"
  #include "hw/loader.h"
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
      MachineState *mc = MACHINE(s);
      uint32_t phandle = 1, irq_mmio_phandle = 1, msi_pcie_phandle = 1;
      uint32_t irq_pcie_phandle = 1, irq_virtio_phandle = 1;
 +    uint8_t rng_seed[32];
      if (mc->dtb) {
          mc->fdt = load_device_tree(mc->dtb, &s->fdt_size);
@@ -XXX,XX +XXX,XX @@ update_bootargs:
      if (cmdline && *cmdline) {
          qemu_fdt_setprop_string(mc->fdt, "/chosen", "bootargs", cmdline);
      }
 +
-+    /* Pass seed to RNG */
++    if (HOST_BIG_ENDIAN) {
-+    qemu_guest_getrandom_nofail(rng_seed, sizeof(rng_seed));
++        /*
-+    qemu_fdt_setprop(mc->fdt, "/chosen", "rng-seed", rng_seed, sizeof(rng_seed));
++         * Deal the situation when the elements are insdie
 +         * only one uint64 block including setting the
 +         * masked-off element.
 +         */
 +        if (((tot - 1) ^ cnt) < 8) {
 +            memset(base + H1(tot - 1), -1, tot - cnt);
 +            return;
 +        }
 +        /*
 +         * Otherwise, at least cross two uint64_t blocks.
 +         * Set first unaligned block.
 +         */
 +        if (cnt % 8 != 0) {
 +            uint32_t j = ROUND_UP(cnt, 8);
 +            memset(base + H1(j - 1), -1, j - cnt);
 +            cnt = j;
 +        }
 +        /* Set other 64bit aligend blocks */
 +    }
      memset(base + cnt, -1, tot - cnt);
  }
- static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
 --
-.37.2
+.45.1

-[PULL 35/44] target/riscv: Add xicondops in ISA entry
+[PULL 14/28] target/riscv/cpu.c: fix Zvkb extension config
-From: Rahul Pathak <rpathak@ventanamicro.com>
+From: Yangyu Chen <cyy@cyyself.name>
-XVentanaCondOps is Ventana custom extension. Add
+This code has a typo that writes zvkb to zvkg, causing users can't
-its extension entry in the ISA Ext array
+enable zvkb through the config. This patch gets this fixed.
-Signed-off-by: Rahul Pathak <rpathak@ventanamicro.com>
+Signed-off-by: Yangyu Chen <cyy@cyyself.name>
 Fixes: ea61ef7097d0 ("target/riscv: Move vector crypto extensions to riscv_cpu_extensions")
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220816045408.1231135-1-rpathak@ventanamicro.com
+Reviewed-by: Max Chou <max.chou@sifive.com>
 Reviewed-by:  Weiwei Li <liwei1518@gmail.com>
 Message-ID: <tencent_7E34EEF0F90B9A68BF38BEE09EC6D4877C0A@qq.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 1 +
+ target/riscv/cpu.c | 2 +-
-file changed, 1 insertion(+)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
-     ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
+     /* Vector cryptography extensions */
-     ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
+     MULTI_EXT_CFG_BOOL("zvbb", ext_zvbb, false),
-     ISA_EXT_DATA_ENTRY(svpbmt, true, PRIV_VERSION_1_12_0, ext_svpbmt),
+     MULTI_EXT_CFG_BOOL("zvbc", ext_zvbc, false),
-+    ISA_EXT_DATA_ENTRY(xventanacondops, true, PRIV_VERSION_1_12_0, ext_XVentanaCondOps),
+-    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkg, false),
- };
++    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkb, false),
+     MULTI_EXT_CFG_BOOL("zvkg", ext_zvkg, false),
- static bool isa_ext_is_enabled(RISCVCPU *cpu,
+     MULTI_EXT_CFG_BOOL("zvkned", ext_zvkned, false),
      MULTI_EXT_CFG_BOOL("zvknha", ext_zvknha, false),
 --
-.37.2
+.45.1

-[PULL 25/44] target/riscv: Add Zihintpause support
+[PULL 15/28] target/riscv: Implement dynamic establishment of custom decoder
-From: Dao Lu <daolu@rivosinc.com>
+From: Huang Tao <eric.huang@linux.alibaba.com>
-Added support for RISC-V PAUSE instruction from Zihintpause extension,
+In this patch, we modify the decoder to be a freely composable data
-enabled by default.
+structure instead of a hardcoded one. It can be dynamically builded up
 according to the extensions.
 This approach has several benefits:
 . Provides support for heterogeneous cpu architectures. As we add decoder in
    RISCVCPU, each cpu can have their own decoder, and the decoders can be
    different due to cpu's features.
 . Improve the decoding efficiency. We run the guard_func to see if the decoder
    can be added to the dynamic_decoder when building up the decoder. Therefore,
    there is no need to run the guard_func when decoding each instruction. It can
    improve the decoding efficiency
 . For vendor or dynamic cpus, it allows them to customize their own decoder
    functions to improve decoding efficiency, especially when vendor-defined
    instruction sets increase. Because of dynamic building up, it can skip the other
    decoder guard functions when decoding.
 . Pre patch for allowing adding a vendor decoder before decode_insn32() with minimal
    overhead for users that don't need this particular vendor decoder.
-Tested-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
 Suggested-by: Christoph Muellner <christoph.muellner@vrull.eu>
 Co-authored-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Dao Lu <daolu@rivosinc.com>
+Message-ID: <20240506023607.29544-1-eric.huang@linux.alibaba.com>
 Message-Id: <20220725034728.2620750-2-daolu@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h                      |  1 +
+ target/riscv/cpu.h         |  1 +
- target/riscv/insn32.decode              |  7 ++++++-
+ target/riscv/tcg/tcg-cpu.h | 15 +++++++++++++++
- target/riscv/cpu.c                      |  2 ++
+ target/riscv/cpu.c         |  1 +
- target/riscv/insn_trans/trans_rvi.c.inc | 16 ++++++++++++++++
+ target/riscv/tcg/tcg-cpu.c | 15 +++++++++++++++
-files changed, 25 insertions(+), 1 deletion(-)
+ target/riscv/translate.c   | 31 +++++++++++++++----------------
 files changed, 47 insertions(+), 16 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
-     bool ext_zkt;
+     uint32_t pmu_avail_ctrs;
-     bool ext_ifencei;
+     /* Mapping of events to counters */
-     bool ext_icsr;
+     GHashTable *pmu_event_ctr_map;
-+    bool ext_zihintpause;
++    const GPtrArray *decoders;
-     bool ext_svinval;
+ };
-     bool ext_svnapot;
-     bool ext_svpbmt;
+ /**
-diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
+diff --git a/target/riscv/tcg/tcg-cpu.h b/target/riscv/tcg/tcg-cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn32.decode
+--- a/target/riscv/tcg/tcg-cpu.h
-+++ b/target/riscv/insn32.decode
++++ b/target/riscv/tcg/tcg-cpu.h
-@@ -XXX,XX +XXX,XX @@ srl      0000000 .....    ..... 101 ..... 0110011 @r
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp);
- sra      0100000 .....    ..... 101 ..... 0110011 @r
+ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp);
- or       0000000 .....    ..... 110 ..... 0110011 @r
+ bool riscv_cpu_tcg_compatible(RISCVCPU *cpu);
- and      0000000 .....    ..... 111 ..... 0110011 @r
--fence    ---- pred:4 succ:4 ----- 000 ----- 0001111
++struct DisasContext;
 +struct RISCVCPUConfig;
 +typedef struct RISCVDecoder {
 +    bool (*guard_func)(const struct RISCVCPUConfig *);
 +    bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
 +} RISCVDecoder;
 +
-+{
++typedef bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
 +  pause  0000 0001   0000   00000 000 00000 0001111
 +  fence  ---- pred:4 succ:4 ----- 000 ----- 0001111
 +}
 +
- fence_i  ---- ----   ----   ----- 001 ----- 0001111
++extern const size_t decoder_table_size;
- csrrw    ............     ..... 001 ..... 1110011 @csr
++
- csrrs    ............     ..... 010 ..... 1110011 @csr
++extern const RISCVDecoder decoder_table[];
 +
 +void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu);
 +
  #endif
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
-     ISA_EXT_DATA_ENTRY(v, false, PRIV_VERSION_1_12_0, ext_v),
+             error_propagate(errp, local_err);
-     ISA_EXT_DATA_ENTRY(zicsr, true, PRIV_VERSION_1_10_0, ext_icsr),
+             return;
-     ISA_EXT_DATA_ENTRY(zifencei, true, PRIV_VERSION_1_10_0, ext_ifencei),
+         }
-+    ISA_EXT_DATA_ENTRY(zihintpause, true, PRIV_VERSION_1_10_0, ext_zihintpause),
++        riscv_tcg_cpu_finalize_dynamic_decoder(cpu);
-     ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_12_0, ext_zfh),
+     } else if (kvm_enabled()) {
-     ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_12_0, ext_zfhmin),
+         riscv_kvm_cpu_finalize_features(cpu, &local_err);
-     ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
+         if (local_err != NULL) {
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
      DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
      DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
      DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
 +    DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
      DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
      DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
      DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
 diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvi.c.inc
+--- a/target/riscv/tcg/tcg-cpu.c
-+++ b/target/riscv/insn_trans/trans_rvi.c.inc
++++ b/target/riscv/tcg/tcg-cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_srad(DisasContext *ctx, arg_srad *a)
+@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
-     return gen_shift(ctx, a, EXT_SIGN, tcg_gen_sar_tl, NULL);
+     }
  }
-+static bool trans_pause(DisasContext *ctx, arg_pause *a)
++void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu)
 +{
-+    if (!ctx->cfg_ptr->ext_zihintpause) {
++    GPtrArray *dynamic_decoders;
-+        return false;
++    dynamic_decoders = g_ptr_array_sized_new(decoder_table_size);
 +    for (size_t i = 0; i < decoder_table_size; ++i) {
 +        if (decoder_table[i].guard_func &&
 +            decoder_table[i].guard_func(&cpu->cfg)) {
 +            g_ptr_array_add(dynamic_decoders,
 +                            (gpointer)decoder_table[i].riscv_cpu_decode_fn);
 +        }
 +    }
 +
-+    /*
++    cpu->decoders = dynamic_decoders;
-+     * PAUSE is a no-op in QEMU,
++}
 +     * end the TB and return to main loop
 +     */
 +    gen_set_pc_imm(ctx, ctx->pc_succ_insn);
 +    tcg_gen_exit_tb(NULL, 0);
 +    ctx->base.is_jmp = DISAS_NORETURN;
 +
-+    return true;
+ bool riscv_cpu_tcg_compatible(RISCVCPU *cpu)
 +}
  static bool trans_fence(DisasContext *ctx, arg_fence *a)
  {
+     return object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST) == NULL;
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/translate.c
++++ b/target/riscv/translate.c
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/helper-info.c.inc"
+ #undef  HELPER_H
++#include "tcg/tcg-cpu.h"
++
+ /* global register indices */
+ static TCGv cpu_gpr[32], cpu_gprh[32], cpu_pc, cpu_vl, cpu_vstart;
+ static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+     /* FRM is known to contain a valid value. */
+     bool frm_valid;
+     bool insn_start_updated;
++    const GPtrArray *decoders;
+ } DisasContext;
+ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
+@@ -XXX,XX +XXX,XX @@ static inline int insn_len(uint16_t first_word)
+     return (first_word & 3) == 3 ? 4 : 2;
+ }
++const RISCVDecoder decoder_table[] = {
++    { always_true_p, decode_insn32 },
++    { has_xthead_p, decode_xthead},
++    { has_XVentanaCondOps_p, decode_XVentanaCodeOps},
++};
++
++const size_t decoder_table_size = ARRAY_SIZE(decoder_table);
++
+ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
+ {
+-    /*
+-     * A table with predicate (i.e., guard) functions and decoder functions
+-     * that are tested in-order until a decoder matches onto the opcode.
+-     */
+-    static const struct {
+-        bool (*guard_func)(const RISCVCPUConfig *);
+-        bool (*decode_func)(DisasContext *, uint32_t);
+-    } decoders[] = {
+-        { always_true_p,  decode_insn32 },
+-        { has_xthead_p, decode_xthead },
+-        { has_XVentanaCondOps_p,  decode_XVentanaCodeOps },
+-    };
+-
+     ctx->virt_inst_excp = false;
+     ctx->cur_insn_len = insn_len(opcode);
+     /* Check for compressed insn */
+@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
+                                              ctx->base.pc_next + 2));
+         ctx->opcode = opcode32;
+-        for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
+-            if (decoders[i].guard_func(ctx->cfg_ptr) &&
+-                decoders[i].decode_func(ctx, opcode32)) {
++        for (guint i = 0; i < ctx->decoders->len; ++i) {
++            riscv_cpu_decode_fn func = g_ptr_array_index(ctx->decoders, i);
++            if (func(ctx, opcode32)) {
+                 return;
+             }
+         }
+@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+     ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
+     ctx->zero = tcg_constant_tl(0);
+     ctx->virt_inst_excp = false;
++    ctx->decoders = cpu->decoders;
+ }
+ static void riscv_tr_tb_start(DisasContextBase *db, CPUState *cpu)
 --
-.37.2
+.45.1

-[PULL 38/44] target/riscv: Add stimecmp support
+[PULL 16/28] riscv: thead: Add th.sxstatus CSR emulation
-From: Atish Patra <atishp@rivosinc.com>
+From: Christoph Müllner <christoph.muellner@vrull.eu>
-stimecmp allows the supervisor mode to update stimecmp CSR directly
+The th.sxstatus CSR can be used to identify available custom extension
-to program the next timer interrupt. This CSR is part of the Sstc
+on T-Head CPUs. The CSR is documented here:
-extension which was ratified recently.
+  https://github.com/T-head-Semi/thead-extension-spec/blob/master/xtheadsxstatus.adoc
+An important property of this patch is, that the th.sxstatus MAEE field
+is not set (indicating that XTheadMae is not available).
+XTheadMae is a memory attribute extension (similar to Svpbmt) which is
+implemented in many T-Head CPUs (C906, C910, etc.) and utilizes bits
+in PTEs that are marked as reserved. QEMU maintainers prefer to not
+implement XTheadMae, so we need give kernels a mechanism to identify
+if XTheadMae is available in a system or not. And this patch introduces
+this mechanism in QEMU in a way that's compatible with real HW
+(i.e., probing the th.sxstatus.MAEE bit).
+Further context can be found on the list:
+https://lists.gnu.org/archive/html/qemu-devel/2024-02/msg00775.html
+Reviewed-by: LIU Zhiwei <zhiwe_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Atish Patra <atishp@rivosinc.com>
+Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
-Message-Id: <20220824221357.41070-3-atishp@rivosinc.com>
+Message-ID: <20240429073656.2486732-1-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h         |  5 ++
+ MAINTAINERS              |  1 +
- target/riscv/cpu_bits.h    |  4 ++
+ target/riscv/cpu.h       |  3 ++
- target/riscv/time_helper.h | 30 ++++++++++++
+ target/riscv/cpu.c       |  1 +
- target/riscv/cpu.c         |  9 ++++
+ target/riscv/th_csr.c    | 79 ++++++++++++++++++++++++++++++++++++++++
- target/riscv/csr.c         | 86 +++++++++++++++++++++++++++++++++
+ target/riscv/meson.build |  1 +
- target/riscv/machine.c     |  1 +
+files changed, 85 insertions(+)
- target/riscv/time_helper.c | 98 ++++++++++++++++++++++++++++++++++++++
+ create mode 100644 target/riscv/th_csr.c
  target/riscv/meson.build   |  3 +-
 files changed, 235 insertions(+), 1 deletion(-)
  create mode 100644 target/riscv/time_helper.h
  create mode 100644 target/riscv/time_helper.c
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ L: qemu-riscv@nongnu.org
+ S: Supported
+ F: target/riscv/insn_trans/trans_xthead.c.inc
+ F: target/riscv/xthead*.decode
++F: target/riscv/th_*
+ F: disas/riscv-xthead*
+ RISC-V XVentanaCondOps extension
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
+@@ -XXX,XX +XXX,XX @@ target_ulong riscv_new_csr_seed(target_ulong new_value,
-     uint64_t mfromhost;
+ uint8_t satp_mode_max_from_map(uint32_t map);
-     uint64_t mtohost;
+ const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
-+    /* Sstc CSRs */
++/* Implemented in th_csr.c */
-+    uint64_t stimecmp;
++void th_register_custom_csrs(RISCVCPU *cpu);
 +
-     /* physical memory protection */
+ #endif /* RISCV_CPU_H */
      pmp_table_t pmp_state;
      target_ulong mseccfg;
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
      float_status fp_status;
      /* Fields from here on are preserved across CPU reset. */
 +    QEMUTimer *stimer; /* Internal timer for S-mode interrupt */
      hwaddr kernel_addr;
      hwaddr fdt_addr;
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_ifencei;
      bool ext_icsr;
      bool ext_zihintpause;
 +    bool ext_sstc;
      bool ext_svinval;
      bool ext_svnapot;
      bool ext_svpbmt;
 diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_bits.h
 +++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
  #define CSR_STVAL           0x143
  #define CSR_SIP             0x144
 +/* Sstc supervisor CSRs */
 +#define CSR_STIMECMP        0x14D
 +#define CSR_STIMECMPH       0x15D
 +
  /* Supervisor Protection and Translation */
  #define CSR_SPTBR           0x180
  #define CSR_SATP            0x180
 diff --git a/target/riscv/time_helper.h b/target/riscv/time_helper.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/riscv/time_helper.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * RISC-V timer header file.
 + *
 + * Copyright (c) 2022 Rivos Inc.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#ifndef RISCV_TIME_HELPER_H
 +#define RISCV_TIME_HELPER_H
 +
 +#include "cpu.h"
 +#include "qemu/timer.h"
 +
 +void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
 +                               uint64_t timecmp, uint64_t delta,
 +                               uint32_t timer_irq);
 +void riscv_timer_init(RISCVCPU *cpu);
 +
 +#endif
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
- #include "qemu/log.h"
+     cpu->cfg.mvendorid = THEAD_VENDOR_ID;
- #include "cpu.h"
+ #ifndef CONFIG_USER_ONLY
- #include "internals.h"
+     set_satp_mode_max_supported(cpu, VM_1_10_SV39);
-+#include "time_helper.h"
++    th_register_custom_csrs(cpu);
- #include "exec/exec-all.h"
+ #endif
- #include "qapi/error.h"
- #include "qemu/error-report.h"
+     /* inherited from parent obj via riscv_cpu_init() */
-@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
+diff --git a/target/riscv/th_csr.c b/target/riscv/th_csr.c
      ISA_EXT_DATA_ENTRY(zhinxmin, true, PRIV_VERSION_1_12_0, ext_zhinxmin),
      ISA_EXT_DATA_ENTRY(smaia, true, PRIV_VERSION_1_12_0, ext_smaia),
      ISA_EXT_DATA_ENTRY(ssaia, true, PRIV_VERSION_1_12_0, ext_ssaia),
 +    ISA_EXT_DATA_ENTRY(sstc, true, PRIV_VERSION_1_12_0, ext_sstc),
      ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
      ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
      ISA_EXT_DATA_ENTRY(svpbmt, true, PRIV_VERSION_1_12_0, ext_svpbmt),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
      set_resetvec(env, cpu->cfg.resetvec);
 +#ifndef CONFIG_USER_ONLY
 +    if (cpu->cfg.ext_sstc) {
 +        riscv_timer_init(cpu);
 +    }
 +#endif /* CONFIG_USER_ONLY */
 +
      /* Validate that MISA_MXL is set properly. */
      switch (env->misa_mxl_max) {
  #ifdef TARGET_RISCV64
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("Zve64f", RISCVCPU, cfg.ext_zve64f, false),
      DEFINE_PROP_BOOL("mmu", RISCVCPU, cfg.mmu, true),
      DEFINE_PROP_BOOL("pmp", RISCVCPU, cfg.pmp, true),
 +    DEFINE_PROP_BOOL("sstc", RISCVCPU, cfg.ext_sstc, true),
      DEFINE_PROP_STRING("priv_spec", RISCVCPU, cfg.priv_spec),
      DEFINE_PROP_STRING("vext_spec", RISCVCPU, cfg.vext_spec),
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/timer.h"
  #include "cpu.h"
  #include "pmu.h"
 +#include "time_helper.h"
  #include "qemu/main-loop.h"
  #include "exec/exec-all.h"
  #include "sysemu/cpu-timers.h"
@@ -XXX,XX +XXX,XX @@ static RISCVException read_timeh(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
 +static RISCVException sstc(CPURISCVState *env, int csrno)
 +{
 +    CPUState *cs = env_cpu(env);
 +    RISCVCPU *cpu = RISCV_CPU(cs);
 +
 +    if (!cpu->cfg.ext_sstc || !env->rdtime_fn) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    if (env->priv == PRV_M) {
 +        return RISCV_EXCP_NONE;
 +    }
 +
 +    /*
 +     * No need of separate function for rv32 as menvcfg stores both menvcfg
 +     * menvcfgh for RV32.
 +     */
 +    if (!(get_field(env->mcounteren, COUNTEREN_TM) &&
 +          get_field(env->menvcfg, MENVCFG_STCE))) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    return smode(env, csrno);
 +}
 +
 +static RISCVException sstc_32(CPURISCVState *env, int csrno)
 +{
 +    if (riscv_cpu_mxl(env) != MXL_RV32) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    return sstc(env, csrno);
 +}
 +
 +static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
 +                                    target_ulong *val)
 +{
 +    *val = env->stimecmp;
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
 +                                    target_ulong *val)
 +{
 +    *val = env->stimecmp >> 32;
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
 +                                    target_ulong val)
 +{
 +    RISCVCPU *cpu = env_archcpu(env);
 +
 +    if (riscv_cpu_mxl(env) == MXL_RV32) {
 +        env->stimecmp = deposit64(env->stimecmp, 0, 32, (uint64_t)val);
 +    } else {
 +        env->stimecmp = val;
 +    }
 +
 +    riscv_timer_write_timecmp(cpu, env->stimer, env->stimecmp, 0, MIP_STIP);
 +
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
 +                                    target_ulong val)
 +{
 +    RISCVCPU *cpu = env_archcpu(env);
 +
 +    env->stimecmp = deposit64(env->stimecmp, 32, 32, (uint64_t)val);
 +    riscv_timer_write_timecmp(cpu, env->stimer, env->stimecmp, 0, MIP_STIP);
 +
 +    return RISCV_EXCP_NONE;
 +}
 +
  /* Machine constants */
  #define M_MODE_INTERRUPTS  ((uint64_t)(MIP_MSIP | MIP_MTIP | MIP_MEIP))
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
          new_val |= env->external_seip * MIP_SEIP;
      }
 +    if (cpu->cfg.ext_sstc && (env->priv == PRV_M) &&
 +        get_field(env->menvcfg, MENVCFG_STCE)) {
 +        /* sstc extension forbids STIP & VSTIP to be writeable in mip */
 +        mask = mask & ~(MIP_STIP | MIP_VSTIP);
 +    }
 +
      if (mask) {
          old_mip = riscv_cpu_update_mip(cpu, mask, (new_val & mask));
      } else {
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_SCAUSE]   = { "scause",   smode, read_scause,   write_scause   },
      [CSR_STVAL]    = { "stval",    smode, read_stval,    write_stval    },
      [CSR_SIP]      = { "sip",      smode, NULL,    NULL, rmw_sip        },
 +    [CSR_STIMECMP] = { "stimecmp", sstc, read_stimecmp, write_stimecmp,
 +                       .min_priv_ver = PRIV_VERSION_1_12_0 },
 +    [CSR_STIMECMPH] = { "stimecmph", sstc_32, read_stimecmph, write_stimecmph,
 +                        .min_priv_ver = PRIV_VERSION_1_12_0 },
      /* Supervisor Protection and Translation */
      [CSR_SATP]     = { "satp",     smode, read_satp,     write_satp     },
 diff --git a/target/riscv/machine.c b/target/riscv/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/machine.c
 +++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
          VMSTATE_UINTTL(env.mscratch, RISCVCPU),
          VMSTATE_UINT64(env.mfromhost, RISCVCPU),
          VMSTATE_UINT64(env.mtohost, RISCVCPU),
 +        VMSTATE_UINT64(env.stimecmp, RISCVCPU),
          VMSTATE_END_OF_LIST()
      },
 diff --git a/target/riscv/time_helper.c b/target/riscv/time_helper.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/target/riscv/time_helper.c
++++ b/target/riscv/th_csr.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * RISC-V timer helper implementation.
++ * T-Head-specific CSRs.
 + *
-+ * Copyright (c) 2022 Rivos Inc.
++ * Copyright (c) 2024 VRULL GmbH
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
-+#include "qemu/log.h"
++#include "cpu.h"
-+#include "cpu_bits.h"
++#include "cpu_vendorid.h"
 +#include "time_helper.h"
 +#include "hw/intc/riscv_aclint.h"
 +
-+static void riscv_stimer_cb(void *opaque)
++#define CSR_TH_SXSTATUS 0x5c0
 +
 +/* TH_SXSTATUS bits */
 +#define TH_SXSTATUS_UCME        BIT(16)
 +#define TH_SXSTATUS_MAEE        BIT(21)
 +#define TH_SXSTATUS_THEADISAEE  BIT(22)
 +
 +typedef struct {
 +    int csrno;
 +    int (*insertion_test)(RISCVCPU *cpu);
 +    riscv_csr_operations csr_ops;
 +} riscv_csr;
 +
 +static RISCVException smode(CPURISCVState *env, int csrno)
 +{
-+    RISCVCPU *cpu = opaque;
++    if (riscv_has_ext(env, RVS)) {
-+    riscv_cpu_update_mip(cpu, MIP_STIP, BOOL_TO_MASK(1));
++        return RISCV_EXCP_NONE;
 +    }
 +
 +    return RISCV_EXCP_ILLEGAL_INST;
 +}
 +
-+/*
++static int test_thead_mvendorid(RISCVCPU *cpu)
 + * Called when timecmp is written to update the QEMU timer or immediately
 + * trigger timer interrupt if mtimecmp <= current timer value.
 + */
 +void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
 +                               uint64_t timecmp, uint64_t delta,
 +                               uint32_t timer_irq)
 +{
-+    uint64_t diff, ns_diff, next;
++    if (cpu->cfg.mvendorid != THEAD_VENDOR_ID) {
-+    CPURISCVState *env = &cpu->env;
++        return -1;
 +    RISCVAclintMTimerState *mtimer = env->rdtime_fn_arg;
 +    uint32_t timebase_freq = mtimer->timebase_freq;
 +    uint64_t rtc_r = env->rdtime_fn(env->rdtime_fn_arg) + delta;
 +
 +    if (timecmp <= rtc_r) {
 +        /*
 +         * If we're setting an stimecmp value in the "past",
 +         * immediately raise the timer interrupt
 +         */
 +        riscv_cpu_update_mip(cpu, timer_irq, BOOL_TO_MASK(1));
 +        return;
 +    }
 +
-+    /* Clear the [V]STIP bit in mip */
++    return 0;
 +    riscv_cpu_update_mip(cpu, timer_irq, BOOL_TO_MASK(0));
 +
 +    /* otherwise, set up the future timer interrupt */
 +    diff = timecmp - rtc_r;
 +    /* back to ns (note args switched in muldiv64) */
 +    ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
 +
 +    /*
 +     * check if ns_diff overflowed and check if the addition would potentially
 +     * overflow
 +     */
 +    if ((NANOSECONDS_PER_SECOND > timebase_freq && ns_diff < diff) ||
 +        ns_diff > INT64_MAX) {
 +        next = INT64_MAX;
 +    } else {
 +        /*
 +         * as it is very unlikely qemu_clock_get_ns will return a value
 +         * greater than INT64_MAX, no additional check is needed for an
 +         * unsigned integer overflow.
 +         */
 +        next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + ns_diff;
 +        /*
 +         * if ns_diff is INT64_MAX next may still be outside the range
 +         * of a signed integer.
 +         */
 +        next = MIN(next, INT64_MAX);
 +    }
 +
 +    timer_mod(timer, next);
 +}
 +
-+void riscv_timer_init(RISCVCPU *cpu)
++static RISCVException read_th_sxstatus(CPURISCVState *env, int csrno,
 +                                       target_ulong *val)
 +{
-+    CPURISCVState *env;
++    /* We don't set MAEE here, because QEMU does not implement MAEE. */
 +    *val = TH_SXSTATUS_UCME | TH_SXSTATUS_THEADISAEE;
 +    return RISCV_EXCP_NONE;
 +}
 +
-+    if (!cpu) {
++static riscv_csr th_csr_list[] = {
-+        return;
++    {
 +        .csrno = CSR_TH_SXSTATUS,
 +        .insertion_test = test_thead_mvendorid,
 +        .csr_ops = { "th.sxstatus", smode, read_th_sxstatus }
 +    }
++};
 +
-+    env = &cpu->env;
++void th_register_custom_csrs(RISCVCPU *cpu)
-+    env->stimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, &riscv_stimer_cb, cpu);
++{
-+    env->stimecmp = 0;
++    for (size_t i = 0; i < ARRAY_SIZE(th_csr_list); i++) {
-+
++        int csrno = th_csr_list[i].csrno;
 +        riscv_csr_operations *csr_ops = &th_csr_list[i].csr_ops;
 +        if (!th_csr_list[i].insertion_test(cpu)) {
 +            riscv_set_csr_ops(csrno, csr_ops);
 +        }
 +    }
 +}
 diff --git a/target/riscv/meson.build b/target/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/meson.build
 +++ b/target/riscv/meson.build
-@@ -XXX,XX +XXX,XX @@ riscv_softmmu_ss.add(files(
+@@ -XXX,XX +XXX,XX @@ riscv_system_ss.add(files(
    'debug.c',
    'monitor.c',
    'machine.c',
--  'pmu.c'
+   'pmu.c',
-+  'pmu.c',
++  'th_csr.c',
-+  'time_helper.c'
+   'time_helper.c',
    'riscv-qmp-cmds.c',
  ))
- target_arch += {'riscv': riscv_ss}
 --
-.37.2
+.45.1

-[PULL 16/44] target/riscv: rvv: Add mask agnostic for vector load / store instructions
+[PULL 17/28] target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
-From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>
+From: Max Chou <max.chou@sifive.com>
-Signed-off-by: eop Chen <eop.chen@sifive.com>
+According v spec 18.4, only the vfwcvt.f.f.v and vfncvt.f.f.w
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
+instructions will be affected by Zvfhmin extension.
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+And the vfwcvt.f.f.v and vfncvt.f.f.w instructions only support the
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+conversions of
-Message-Id: <165570784143.17634.35095816584573691-2@git.sr.ht>
 * From 1*SEW(16/32) to 2*SEW(32/64)
 * From 2*SEW(32/64) to 1*SEW(16/32)
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240322092600.1198921-2-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/vector_helper.c            | 35 +++++++++++++++++--------
+ target/riscv/insn_trans/trans_rvv.c.inc | 20 ++++++++++++++++++--
- target/riscv/insn_trans/trans_rvv.c.inc |  5 ++++
+file changed, 18 insertions(+), 2 deletions(-)
 files changed, 29 insertions(+), 11 deletions(-)
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
-+++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ vext_ldst_stride(void *vd, void *v0, target_ulong base,
-     uint32_t esz = 1 << log2_esz;
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-     uint32_t vta = vext_vta(desc);
-+    uint32_t vma = vext_vma(desc);
-     for (i = env->vstart; i < env->vl; i++, env->vstart++) {
--        if (!vm && !vext_elem_mask(v0, i)) {
--            continue;
--        }
--
-         k = 0;
-         while (k < nf) {
-+            if (!vm && !vext_elem_mask(v0, i)) {
-+                /* set masked-off elements to 1s */
-+                vext_set_elems_1s(vd, vma, (i + k * max_elems) * esz,
-+                                  (i + k * max_elems + 1) * esz);
-+                k++;
-+                continue;
-+            }
-             target_ulong addr = base + stride * i + (k << log2_esz);
-             ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
-             k++;
-@@ -XXX,XX +XXX,XX @@ vext_ldst_index(void *vd, void *v0, target_ulong base,
-     uint32_t esz = 1 << log2_esz;
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-     uint32_t vta = vext_vta(desc);
-+    uint32_t vma = vext_vma(desc);
-     /* load bytes from guest memory */
-     for (i = env->vstart; i < env->vl; i++, env->vstart++) {
--        if (!vm && !vext_elem_mask(v0, i)) {
--            continue;
--        }
--
-         k = 0;
-         while (k < nf) {
-+            if (!vm && !vext_elem_mask(v0, i)) {
-+                /* set masked-off elements to 1s */
-+                vext_set_elems_1s(vd, vma, (i + k * max_elems) * esz,
-+                                  (i + k * max_elems + 1) * esz);
-+                k++;
-+                continue;
-+            }
-             abi_ptr addr = get_index_addr(base, i, vs2) + (k << log2_esz);
-             ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
-             k++;
-@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
-     uint32_t esz = 1 << log2_esz;
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-     uint32_t vta = vext_vta(desc);
-+    uint32_t vma = vext_vma(desc);
-     target_ulong addr, offset, remain;
-     /* probe every access*/
-@@ -XXX,XX +XXX,XX @@ ProbeSuccess:
-     }
-     for (i = env->vstart; i < env->vl; i++) {
-         k = 0;
--        if (!vm && !vext_elem_mask(v0, i)) {
--            continue;
--        }
-         while (k < nf) {
-+            if (!vm && !vext_elem_mask(v0, i)) {
-+                /* set masked-off elements to 1s */
-+                vext_set_elems_1s(vd, vma, (i + k * max_elems) * esz,
-+                                  (i + k * max_elems + 1) * esz);
-+                k++;
-+                continue;
-+            }
-             target_ulong addr = base + ((i * nf + k) << log2_esz);
-             ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
-             k++;
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool ld_us_op(DisasContext *s, arg_r2nfvm *a, uint8_t eew)
+@@ -XXX,XX +XXX,XX @@ static bool require_rvf(DisasContext *s)
-     data = FIELD_DP32(data, VDATA, LMUL, emul);
+     }
      data = FIELD_DP32(data, VDATA, NF, a->nf);
      data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +    data = FIELD_DP32(data, VDATA, VMA, s->vma);
      return ldst_us_trans(a->rd, a->rs1, data, fn, s, false);
  }
-@@ -XXX,XX +XXX,XX @@ static bool ld_us_mask_op(DisasContext *s, arg_vlm_v *a, uint8_t eew)
++static bool require_rvfmin(DisasContext *s)
-     data = FIELD_DP32(data, VDATA, NF, 1);
++{
-     /* Mask destination register are always tail-agnostic */
++    if (s->mstatus_fs == EXT_STATUS_DISABLED) {
-     data = FIELD_DP32(data, VDATA, VTA, s->cfg_vta_all_1s);
++        return false;
-+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
++    }
-     return ldst_us_trans(a->rd, a->rs1, data, fn, s, false);
++
 +    switch (s->sew) {
 +    case MO_16:
 +        return s->cfg_ptr->ext_zvfhmin;
 +    case MO_32:
 +        return s->cfg_ptr->ext_zve32f;
 +    default:
 +        return false;
 +    }
 +}
 +
  static bool require_scale_rvf(DisasContext *s)
  {
      if (s->mstatus_fs == EXT_STATUS_DISABLED) {
@@ -XXX,XX +XXX,XX @@ static bool require_scale_rvfmin(DisasContext *s)
      }
      switch (s->sew) {
 -    case MO_8:
 -        return s->cfg_ptr->ext_zvfhmin;
      case MO_16:
          return s->cfg_ptr->ext_zve32f;
      case MO_32:
@@ -XXX,XX +XXX,XX @@ static bool opxfv_widen_check(DisasContext *s, arg_rmr *a)
  static bool opffv_widen_check(DisasContext *s, arg_rmr *a)
  {
      return opfv_widen_check(s, a) &&
 +           require_rvfmin(s) &&
             require_scale_rvfmin(s) &&
             (s->sew != MO_8);
  }
+@@ -XXX,XX +XXX,XX @@ static bool opfxv_narrow_check(DisasContext *s, arg_rmr *a)
-@@ -XXX,XX +XXX,XX @@ static bool ld_stride_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
+ static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
-     data = FIELD_DP32(data, VDATA, LMUL, emul);
+ {
-     data = FIELD_DP32(data, VDATA, NF, a->nf);
+     return opfv_narrow_check(s, a) &&
-     data = FIELD_DP32(data, VDATA, VTA, s->vta);
++           require_rvfmin(s) &&
-+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
+            require_scale_rvfmin(s) &&
-     return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, fn, s, false);
+            (s->sew != MO_8);
  }
-@@ -XXX,XX +XXX,XX @@ static bool ld_index_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
-     data = FIELD_DP32(data, VDATA, LMUL, emul);
-     data = FIELD_DP32(data, VDATA, NF, a->nf);
-     data = FIELD_DP32(data, VDATA, VTA, s->vta);
-+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
-     return ldst_index_trans(a->rd, a->rs1, a->rs2, data, fn, s, false);
- }
-@@ -XXX,XX +XXX,XX @@ static bool ldff_op(DisasContext *s, arg_r2nfvm *a, uint8_t eew)
-     data = FIELD_DP32(data, VDATA, LMUL, emul);
-     data = FIELD_DP32(data, VDATA, NF, a->nf);
-     data = FIELD_DP32(data, VDATA, VTA, s->vta);
-+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
-     return ldff_trans(a->rd, a->rs1, data, fn, s);
- }
 --
-.37.2
+.45.1

-[PULL 23/44] target/riscv: rvv: Add mask agnostic for vector permutation instructions
+[PULL 18/28] target/riscv: rvv: Check single width operator for vector fp widen instructions
-From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>
+From: Max Chou <max.chou@sifive.com>
-Signed-off-by: eop Chen <eop.chen@sifive.com>
+The require_scale_rvf function only checks the double width operator for
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
+the vector floating point widen instructions, so most of the widen
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+checking functions need to add require_rvf for single width operator.
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <165570784143.17634.35095816584573691-9@git.sr.ht>
+The vfwcvt.f.x.v and vfwcvt.f.xu.v instructions convert single width
 integer to double width float, so the opfxv_widen_check function doesn’t
 need require_rvf for the single width operator(integer).
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240322092600.1198921-3-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/vector_helper.c            | 26 +++++++++++++++++++++++--
+ target/riscv/insn_trans/trans_rvv.c.inc | 5 +++++
- target/riscv/insn_trans/trans_rvv.c.inc |  1 +
+file changed, 5 insertions(+)
 files changed, 25 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
-+++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,         \
-     uint32_t esz = sizeof(ETYPE);                                         \
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);          \
-     uint32_t vta = vext_vta(desc);                                        \
-+    uint32_t vma = vext_vma(desc);                                        \
-     target_ulong offset = s1, i_min, i;                                   \
-                                                                           \
-     i_min = MAX(env->vstart, offset);                                     \
-     for (i = i_min; i < vl; i++) {                                        \
-         if (!vm && !vext_elem_mask(v0, i)) {                              \
-+            /* set masked-off elements to 1s */                           \
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);           \
-             continue;                                                     \
-         }                                                                 \
-         *((ETYPE *)vd + H(i)) = *((ETYPE *)vs2 + H(i - offset));          \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,         \
-     uint32_t esz = sizeof(ETYPE);                                         \
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);          \
-     uint32_t vta = vext_vta(desc);                                        \
-+    uint32_t vma = vext_vma(desc);                                        \
-     target_ulong i_max, i;                                                \
-                                                                           \
-     i_max = MAX(MIN(s1 < vlmax ? vlmax - s1 : 0, vl), env->vstart);       \
-     for (i = env->vstart; i < i_max; ++i) {                               \
--        if (vm || vext_elem_mask(v0, i)) {                                \
--            *((ETYPE *)vd + H(i)) = *((ETYPE *)vs2 + H(i + s1));          \
-+        if (!vm && !vext_elem_mask(v0, i)) {                              \
-+            /* set masked-off elements to 1s */                           \
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);           \
-+            continue;                                                     \
-         }                                                                 \
-+        *((ETYPE *)vd + H(i)) = *((ETYPE *)vs2 + H(i + s1));              \
-     }                                                                     \
-                                                                           \
-     for (i = i_max; i < vl; ++i) {                                        \
-@@ -XXX,XX +XXX,XX @@ static void vslide1up_##BITWIDTH(void *vd, void *v0, target_ulong s1,       \
-     uint32_t esz = sizeof(ETYPE);                                           \
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);            \
-     uint32_t vta = vext_vta(desc);                                          \
-+    uint32_t vma = vext_vma(desc);                                          \
-     uint32_t i;                                                             \
-                                                                             \
-     for (i = env->vstart; i < vl; i++) {                                    \
-         if (!vm && !vext_elem_mask(v0, i)) {                                \
-+            /* set masked-off elements to 1s */                             \
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);             \
-             continue;                                                       \
-         }                                                                   \
-         if (i == 0) {                                                       \
-@@ -XXX,XX +XXX,XX @@ static void vslide1down_##BITWIDTH(void *vd, void *v0, target_ulong s1,       \
-     uint32_t esz = sizeof(ETYPE);                                             \
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);              \
-     uint32_t vta = vext_vta(desc);                                            \
-+    uint32_t vma = vext_vma(desc);                                            \
-     uint32_t i;                                                               \
-                                                                               \
-     for (i = env->vstart; i < vl; i++) {                                      \
-         if (!vm && !vext_elem_mask(v0, i)) {                                  \
-+            /* set masked-off elements to 1s */                               \
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);               \
-             continue;                                                         \
-         }                                                                     \
-         if (i == vl - 1) {                                                    \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,               \
-     uint32_t esz = sizeof(TS2);                                           \
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);          \
-     uint32_t vta = vext_vta(desc);                                        \
-+    uint32_t vma = vext_vma(desc);                                        \
-     uint64_t index;                                                       \
-     uint32_t i;                                                           \
-                                                                           \
-     for (i = env->vstart; i < vl; i++) {                                  \
-         if (!vm && !vext_elem_mask(v0, i)) {                              \
-+            /* set masked-off elements to 1s */                           \
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);           \
-             continue;                                                     \
-         }                                                                 \
-         index = *((TS1 *)vs1 + HS1(i));                                   \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,         \
-     uint32_t esz = sizeof(ETYPE);                                         \
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);          \
-     uint32_t vta = vext_vta(desc);                                        \
-+    uint32_t vma = vext_vma(desc);                                        \
-     uint64_t index = s1;                                                  \
-     uint32_t i;                                                           \
-                                                                           \
-     for (i = env->vstart; i < vl; i++) {                                  \
-         if (!vm && !vext_elem_mask(v0, i)) {                              \
-+            /* set masked-off elements to 1s */                           \
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);           \
-             continue;                                                     \
-         }                                                                 \
-         if (index >= vlmax) {                                             \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,                 \
-     uint32_t esz = sizeof(ETYPE);                                \
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz); \
-     uint32_t vta = vext_vta(desc);                               \
-+    uint32_t vma = vext_vma(desc);                               \
-     uint32_t i;                                                  \
-                                                                  \
-     for (i = env->vstart; i < vl; i++) {                         \
-         if (!vm && !vext_elem_mask(v0, i)) {                     \
-+            /* set masked-off elements to 1s */                  \
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);  \
-             continue;                                            \
-         }                                                        \
-         *((ETYPE *)vd + HD(i)) = *((DTYPE *)vs2 + HS1(i));       \
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool int_ext_op(DisasContext *s, arg_rmr *a, uint8_t seq)
+@@ -XXX,XX +XXX,XX @@ GEN_OPFVF_TRANS(vfrsub_vf,  opfvf_check)
-     data = FIELD_DP32(data, VDATA, VM, a->vm);
+ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
-     data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+ {
-     data = FIELD_DP32(data, VDATA, VTA, s->vta);
+     return require_rvv(s) &&
-+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
++           require_rvf(s) &&
+            require_scale_rvf(s) &&
-     tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
+            (s->sew != MO_8) &&
-                        vreg_ofs(s, a->rs2), cpu_env,
+            vext_check_isa_ill(s) &&
@@ -XXX,XX +XXX,XX @@ GEN_OPFVV_WIDEN_TRANS(vfwsub_vv, opfvv_widen_check)
  static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
  {
      return require_rvv(s) &&
 +           require_rvf(s) &&
             require_scale_rvf(s) &&
             (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
@@ -XXX,XX +XXX,XX @@ GEN_OPFVF_WIDEN_TRANS(vfwsub_vf)
  static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
  {
      return require_rvv(s) &&
 +           require_rvf(s) &&
             require_scale_rvf(s) &&
             (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
@@ -XXX,XX +XXX,XX @@ GEN_OPFWV_WIDEN_TRANS(vfwsub_wv)
  static bool opfwf_widen_check(DisasContext *s, arg_rmrr *a)
  {
      return require_rvv(s) &&
 +           require_rvf(s) &&
             require_scale_rvf(s) &&
             (s->sew != MO_8) &&
             vext_check_isa_ill(s) &&
@@ -XXX,XX +XXX,XX @@ GEN_OPFVV_TRANS(vfredmin_vs, freduction_check)
  static bool freduction_widen_check(DisasContext *s, arg_rmrr *a)
  {
      return reduction_widen_check(s, a) &&
 +           require_rvf(s) &&
             require_scale_rvf(s) &&
             (s->sew != MO_8);
  }
 --
-.37.2
+.45.1

-[PULL 22/44] target/riscv: rvv: Add mask agnostic for vector mask instructions
+[PULL 19/28] target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
-From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>
+From: Max Chou <max.chou@sifive.com>
-Signed-off-by: eop Chen <eop.chen@sifive.com>
+The opfv_narrow_check needs to check the single width float operator by
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
+require_rvf.
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Message-Id: <165570784143.17634.35095816584573691-8@git.sr.ht>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240322092600.1198921-4-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/vector_helper.c            | 11 +++++++++++
+ target/riscv/insn_trans/trans_rvv.c.inc | 1 +
- target/riscv/insn_trans/trans_rvv.c.inc |  3 +++
+file changed, 1 insertion(+)
 files changed, 14 insertions(+)
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
-+++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ static void vmsetm(void *vd, void *v0, void *vs2, CPURISCVState *env,
-     uint32_t vl = env->vl;
-     uint32_t total_elems = env_archcpu(env)->cfg.vlen;
-     uint32_t vta_all_1s = vext_vta_all_1s(desc);
-+    uint32_t vma = vext_vma(desc);
-     int i;
-     bool first_mask_bit = false;
-     for (i = env->vstart; i < vl; i++) {
-         if (!vm && !vext_elem_mask(v0, i)) {
-+            /* set masked-off elements to 1s */
-+            if (vma) {
-+                vext_set_elem_mask(vd, i, 1);
-+            }
-             continue;
-         }
-         /* write a zero to all following active elements */
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2, CPURISCVState *env,      \
-     uint32_t esz = sizeof(ETYPE);                                         \
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);          \
-     uint32_t vta = vext_vta(desc);                                        \
-+    uint32_t vma = vext_vma(desc);                                        \
-     uint32_t sum = 0;                                                     \
-     int i;                                                                \
-                                                                           \
-     for (i = env->vstart; i < vl; i++) {                                  \
-         if (!vm && !vext_elem_mask(v0, i)) {                              \
-+            /* set masked-off elements to 1s */                           \
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);           \
-             continue;                                                     \
-         }                                                                 \
-         *((ETYPE *)vd + H(i)) = sum;                                      \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, CPURISCVState *env, uint32_t desc)  \
-     uint32_t esz = sizeof(ETYPE);                                         \
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);          \
-     uint32_t vta = vext_vta(desc);                                        \
-+    uint32_t vma = vext_vma(desc);                                        \
-     int i;                                                                \
-                                                                           \
-     for (i = env->vstart; i < vl; i++) {                                  \
-         if (!vm && !vext_elem_mask(v0, i)) {                              \
-+            /* set masked-off elements to 1s */                           \
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);           \
-             continue;                                                     \
-         }                                                                 \
-         *((ETYPE *)vd + H(i)) = i;                                        \
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
+@@ -XXX,XX +XXX,XX @@ static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
-         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
+ static bool opffv_rod_narrow_check(DisasContext *s, arg_rmr *a)
-         data =                                                     \
+ {
-             FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);\
+     return opfv_narrow_check(s, a) &&
-+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
++           require_rvf(s) &&
-         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd),                     \
+            require_scale_rvf(s) &&
-                            vreg_ofs(s, 0), vreg_ofs(s, a->rs2),    \
+            (s->sew != MO_8);
-                            cpu_env, s->cfg_ptr->vlen / 8,          \
+ }
@@ -XXX,XX +XXX,XX @@ static bool trans_viota_m(DisasContext *s, arg_viota_m *a)
          data = FIELD_DP32(data, VDATA, VM, a->vm);
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
          data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);
          static gen_helper_gvec_3_ptr * const fns[4] = {
              gen_helper_viota_m_b, gen_helper_viota_m_h,
              gen_helper_viota_m_w, gen_helper_viota_m_d,
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
          data = FIELD_DP32(data, VDATA, VM, a->vm);
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
          data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);
          static gen_helper_gvec_2_ptr * const fns[4] = {
              gen_helper_vid_v_b, gen_helper_vid_v_h,
              gen_helper_vid_v_w, gen_helper_vid_v_d,
 --
-.37.2
+.45.1

-[PULL 21/44] target/riscv: rvv: Add mask agnostic for vector floating-point instructions
+[PULL 20/28] target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
-From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>
+From: Max Chou <max.chou@sifive.com>
-Signed-off-by: eop Chen <eop.chen@sifive.com>
+If the checking functions check both the single and double width
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
+operators at the same time, then the single width operator checking
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+functions (require_rvf[min]) will check whether the SEW is 8.
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <165570784143.17634.35095816584573691-7@git.sr.ht>
+Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240322092600.1198921-5-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/vector_helper.c            | 26 +++++++++++++++++++++++++
+ target/riscv/insn_trans/trans_rvv.c.inc | 16 ++++------------
- target/riscv/insn_trans/trans_rvv.c.inc | 12 ++++++++++++
+file changed, 4 insertions(+), 12 deletions(-)
 files changed, 38 insertions(+)
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
-+++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
-     uint32_t total_elems =                                \
-         vext_get_total_elems(env, desc, ESZ);             \
-     uint32_t vta = vext_vta(desc);                        \
-+    uint32_t vma = vext_vma(desc);                        \
-     uint32_t i;                                           \
-                                                           \
-     for (i = env->vstart; i < vl; i++) {                  \
-         if (!vm && !vext_elem_mask(v0, i)) {              \
-+            /* set masked-off elements to 1s */           \
-+            vext_set_elems_1s(vd, vma, i * ESZ,           \
-+                              (i + 1) * ESZ);             \
-             continue;                                     \
-         }                                                 \
-         do_##NAME(vd, vs1, vs2, i, env);                  \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1,        \
-     uint32_t total_elems =                                \
-         vext_get_total_elems(env, desc, ESZ);              \
-     uint32_t vta = vext_vta(desc);                        \
-+    uint32_t vma = vext_vma(desc);                        \
-     uint32_t i;                                           \
-                                                           \
-     for (i = env->vstart; i < vl; i++) {                  \
-         if (!vm && !vext_elem_mask(v0, i)) {              \
-+            /* set masked-off elements to 1s */           \
-+            vext_set_elems_1s(vd, vma, i * ESZ,           \
-+                              (i + 1) * ESZ);             \
-             continue;                                     \
-         }                                                 \
-         do_##NAME(vd, s1, vs2, i, env);                   \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-     uint32_t total_elems =                             \
-         vext_get_total_elems(env, desc, ESZ);          \
-     uint32_t vta = vext_vta(desc);                     \
-+    uint32_t vma = vext_vma(desc);                     \
-     uint32_t i;                                        \
-                                                        \
-     if (vl == 0) {                                     \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-     }                                                  \
-     for (i = env->vstart; i < vl; i++) {               \
-         if (!vm && !vext_elem_mask(v0, i)) {           \
-+            /* set masked-off elements to 1s */        \
-+            vext_set_elems_1s(vd, vma, i * ESZ,        \
-+                              (i + 1) * ESZ);          \
-             continue;                                  \
-         }                                              \
-         do_##NAME(vd, vs2, i, env);                    \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
-     uint32_t vl = env->vl;                                    \
-     uint32_t total_elems = env_archcpu(env)->cfg.vlen;        \
-     uint32_t vta_all_1s = vext_vta_all_1s(desc);              \
-+    uint32_t vma = vext_vma(desc);                            \
-     uint32_t i;                                               \
-                                                               \
-     for (i = env->vstart; i < vl; i++) {                      \
-         ETYPE s1 = *((ETYPE *)vs1 + H(i));                    \
-         ETYPE s2 = *((ETYPE *)vs2 + H(i));                    \
-         if (!vm && !vext_elem_mask(v0, i)) {                  \
-+            /* set masked-off elements to 1s */               \
-+            if (vma) {                                        \
-+                vext_set_elem_mask(vd, i, 1);                 \
-+            }                                                 \
-             continue;                                         \
-         }                                                     \
-         vext_set_elem_mask(vd, i,                             \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2,       \
-     uint32_t vl = env->vl;                                          \
-     uint32_t total_elems = env_archcpu(env)->cfg.vlen;              \
-     uint32_t vta_all_1s = vext_vta_all_1s(desc);                    \
-+    uint32_t vma = vext_vma(desc);                                  \
-     uint32_t i;                                                     \
-                                                                     \
-     for (i = env->vstart; i < vl; i++) {                            \
-         ETYPE s2 = *((ETYPE *)vs2 + H(i));                          \
-         if (!vm && !vext_elem_mask(v0, i)) {                        \
-+            /* set masked-off elements to 1s */                     \
-+            if (vma) {                                              \
-+                vext_set_elem_mask(vd, i, 1);                       \
-+            }                                                       \
-             continue;                                               \
-         }                                                           \
-         vext_set_elem_mask(vd, i,                                   \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-     uint32_t total_elems =                             \
-         vext_get_total_elems(env, desc, ESZ);          \
-     uint32_t vta = vext_vta(desc);                     \
-+    uint32_t vma = vext_vma(desc);                     \
-     uint32_t i;                                        \
-                                                        \
-     for (i = env->vstart; i < vl; i++) {               \
-         if (!vm && !vext_elem_mask(v0, i)) {           \
-+            /* set masked-off elements to 1s */        \
-+            vext_set_elems_1s(vd, vma, i * ESZ,        \
-+                              (i + 1) * ESZ);          \
-             continue;                                  \
-         }                                              \
-         do_##NAME(vd, vs2, i);                         \
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+@@ -XXX,XX +XXX,XX @@ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
-         data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
+     return require_rvv(s) &&
-         data =                                                     \
+            require_rvf(s) &&
-             FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);\
+            require_scale_rvf(s) &&
-+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
+-           (s->sew != MO_8) &&
-         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
+            vext_check_isa_ill(s) &&
-                            vreg_ofs(s, a->rs1),                    \
+            vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm);
-                            vreg_ofs(s, a->rs2), cpu_env,           \
+ }
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)            \
+@@ -XXX,XX +XXX,XX @@ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
-         data = FIELD_DP32(data, VDATA, VTA, s->vta);              \
+     return require_rvv(s) &&
-         data = FIELD_DP32(data, VDATA, VTA_ALL_1S,                \
+            require_rvf(s) &&
-                           s->cfg_vta_all_1s);                     \
+            require_scale_rvf(s) &&
-+        data = FIELD_DP32(data, VDATA, VMA, s->vma);              \
+-           (s->sew != MO_8) &&
-         return opfvf_trans(a->rd, a->rs1, a->rs2, data,           \
+            vext_check_isa_ill(s) &&
-                            fns[s->sew - 1], s);                   \
+            vext_check_ds(s, a->rd, a->rs2, a->vm);
-     }                                                             \
+ }
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
+@@ -XXX,XX +XXX,XX @@ static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
-         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
+     return require_rvv(s) &&
-         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);           \
+            require_rvf(s) &&
-         data = FIELD_DP32(data, VDATA, VTA, s->vta);             \
+            require_scale_rvf(s) &&
-+        data = FIELD_DP32(data, VDATA, VMA, s->vma);             \
+-           (s->sew != MO_8) &&
-         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),   \
+            vext_check_isa_ill(s) &&
-                            vreg_ofs(s, a->rs1),                  \
+            vext_check_dds(s, a->rd, a->rs1, a->rs2, a->vm);
-                            vreg_ofs(s, a->rs2), cpu_env,         \
+ }
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
+@@ -XXX,XX +XXX,XX @@ static bool opfwf_widen_check(DisasContext *s, arg_rmrr *a)
-         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
+     return require_rvv(s) &&
-         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);           \
+            require_rvf(s) &&
-         data = FIELD_DP32(data, VDATA, VTA, s->vta);             \
+            require_scale_rvf(s) &&
-+        data = FIELD_DP32(data, VDATA, VMA, s->vma);             \
+-           (s->sew != MO_8) &&
-         return opfvf_trans(a->rd, a->rs1, a->rs2, data,          \
+            vext_check_isa_ill(s) &&
-                            fns[s->sew - 1], s);                  \
+            vext_check_dd(s, a->rd, a->rs2, a->vm);
-     }                                                            \
+ }
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+@@ -XXX,XX +XXX,XX @@ static bool opffv_widen_check(DisasContext *s, arg_rmr *a)
-         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+ {
-         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
+     return opfv_widen_check(s, a) &&
-         data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
+            require_rvfmin(s) &&
-+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
+-           require_scale_rvfmin(s) &&
-         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
+-           (s->sew != MO_8);
-                            vreg_ofs(s, a->rs1),                    \
++           require_scale_rvfmin(s);
-                            vreg_ofs(s, a->rs2), cpu_env,           \
+ }
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
-         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
+ #define GEN_OPFV_WIDEN_TRANS(NAME, CHECK, HELPER, FRM)             \
-         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);           \
+@@ -XXX,XX +XXX,XX @@ static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
-         data = FIELD_DP32(data, VDATA, VTA, s->vta);             \
+ {
-+        data = FIELD_DP32(data, VDATA, VMA, s->vma);             \
+     return opfv_narrow_check(s, a) &&
-         return opfvf_trans(a->rd, a->rs1, a->rs2, data,          \
+            require_rvfmin(s) &&
-                            fns[s->sew - 1], s);                  \
+-           require_scale_rvfmin(s) &&
-     }                                                            \
+-           (s->sew != MO_8);
-@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
++           require_scale_rvfmin(s);
-         data = FIELD_DP32(data, VDATA, VM, a->vm);
+ }
-         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
-         data = FIELD_DP32(data, VDATA, VTA, s->vta);
+ static bool opffv_rod_narrow_check(DisasContext *s, arg_rmr *a)
-+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
+ {
-         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
+     return opfv_narrow_check(s, a) &&
-                            vreg_ofs(s, a->rs2), cpu_env,
+            require_rvf(s) &&
-                            s->cfg_ptr->vlen / 8,
+-           require_scale_rvf(s) &&
-@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
+-           (s->sew != MO_8);
-             TCGv_i32 desc;
++           require_scale_rvf(s);
-             uint32_t data = FIELD_DP32(0, VDATA, LMUL, s->lmul);
+ }
-             data = FIELD_DP32(data, VDATA, VTA, s->vta);
-+            data = FIELD_DP32(data, VDATA, VMA, s->vma);
+ #define GEN_OPFV_NARROW_TRANS(NAME, CHECK, HELPER, FRM)            \
-             static gen_helper_vmv_vx * const fns[3] = {
+@@ -XXX,XX +XXX,XX @@ static bool freduction_widen_check(DisasContext *s, arg_rmrr *a)
-                 gen_helper_vmv_v_x_h,
+ {
-                 gen_helper_vmv_v_x_w,
+     return reduction_widen_check(s, a) &&
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
+            require_rvf(s) &&
-         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+-           require_scale_rvf(s) &&
-         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
+-           (s->sew != MO_8);
-         data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
++           require_scale_rvf(s);
-+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
+ }
-         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
-                            vreg_ofs(s, a->rs2), cpu_env,           \
+ GEN_OPFVV_WIDEN_TRANS(vfwredusum_vs, freduction_widen_check)
                             s->cfg_ptr->vlen / 8,                   \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
          tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                             vreg_ofs(s, a->rs2), cpu_env,           \
                             s->cfg_ptr->vlen / 8,                   \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
          tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                             vreg_ofs(s, a->rs2), cpu_env,           \
                             s->cfg_ptr->vlen / 8,                   \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
          data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
          data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
          data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
          tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                             vreg_ofs(s, a->rs2), cpu_env,           \
                             s->cfg_ptr->vlen / 8,                   \
 --
-.37.2
+.45.1

-[PULL 01/44] target/riscv: Update [m|h]tinst CSR in riscv_cpu_do_interrupt()
+[PULL 21/28] target/riscv: prioritize pmp errors in raise_mmu_exception()
-From: Anup Patel <apatel@ventanamicro.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-We should write transformed instruction encoding of the trapped
+raise_mmu_exception(), as is today, is prioritizing guest page faults by
-instruction in [m|h]tinst CSR at time of taking trap as defined
+checking first if virt_enabled && !first_stage, and then considering the
-by the RISC-V privileged specification v1.12.
+regular inst/load/store faults.
+There's no mention in the spec about guest page fault being a higher
+priority that PMP faults. In fact, privileged spec section 3.7.1 says:
+"Attempting to fetch an instruction from a PMP region that does not have
+execute permissions raises an instruction access-fault exception.
+Attempting to execute a load or load-reserved instruction which accesses
+a physical address within a PMP region without read permissions raises a
+load access-fault exception. Attempting to execute a store,
+store-conditional, or AMO instruction which accesses a physical address
+within a PMP region without write permissions raises a store
+access-fault exception."
+So, in fact, we're doing it wrong - PMP faults should always be thrown,
+regardless of also being a first or second stage fault.
+The way riscv_cpu_tlb_fill() and get_physical_address() work is
+adequate: a TRANSLATE_PMP_FAIL error is immediately reported and
+reflected in the 'pmp_violation' flag. What we need is to change
+raise_mmu_exception() to prioritize it.
+Reported-by: Joseph Chan <jchan@ventanamicro.com>
+Fixes: 82d53adfbb ("target/riscv/cpu_helper.c: Invalid exception on MMU translation stage")
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Anup Patel <apatel@ventanamicro.com>
+Message-ID: <20240413105929.7030-1-alexei.filippov@syntacore.com>
-Acked-by: dramforever <dramforever@live.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-Id: <20220630061150.905174-2-apatel@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        |   5 +
+ target/riscv/cpu_helper.c | 22 ++++++++++++----------
- target/riscv/instmap.h    |  45 +++++++
+file changed, 12 insertions(+), 10 deletions(-)
  target/riscv/cpu_helper.c | 252 +++++++++++++++++++++++++++++++++++++-
 files changed, 296 insertions(+), 6 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
-     /* Signals whether the current exception occurred with two-stage address
-        translation active. */
-     bool two_stage_lookup;
-+    /*
-+     * Signals whether the current exception occurred while doing two-stage
-+     * address translation for the VS-stage page table walk.
-+     */
-+    bool two_stage_indirect_lookup;
-     target_ulong scounteren;
-     target_ulong mcounteren;
-diff --git a/target/riscv/instmap.h b/target/riscv/instmap.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/instmap.h
-+++ b/target/riscv/instmap.h
-@@ -XXX,XX +XXX,XX @@ enum {
-     OPC_RISC_CSRRWI      = OPC_RISC_SYSTEM | (0x5 << 12),
-     OPC_RISC_CSRRSI      = OPC_RISC_SYSTEM | (0x6 << 12),
-     OPC_RISC_CSRRCI      = OPC_RISC_SYSTEM | (0x7 << 12),
-+
-+    OPC_RISC_HLVHSV      = OPC_RISC_SYSTEM | (0x4 << 12),
- };
- #define MASK_OP_FP_LOAD(op)   (MASK_OP_MAJOR(op) | (op & (0x7 << 12)))
-@@ -XXX,XX +XXX,XX @@ enum {
-                            | (extract32(inst, 12, 8) << 12) \
-                            | (sextract64(inst, 31, 1) << 20))
-+#define GET_FUNCT3(inst) extract32(inst, 12, 3)
-+#define GET_FUNCT7(inst) extract32(inst, 25, 7)
- #define GET_RM(inst)   extract32(inst, 12, 3)
- #define GET_RS3(inst)  extract32(inst, 27, 5)
- #define GET_RS1(inst)  extract32(inst, 15, 5)
- #define GET_RS2(inst)  extract32(inst, 20, 5)
- #define GET_RD(inst)   extract32(inst, 7, 5)
- #define GET_IMM(inst)  sextract64(inst, 20, 12)
-+#define SET_RS1(inst, val)  deposit32(inst, 15, 5, val)
-+#define SET_RS2(inst, val)  deposit32(inst, 20, 5, val)
-+#define SET_RD(inst, val)   deposit32(inst, 7, 5, val)
-+#define SET_I_IMM(inst, val)  deposit32(inst, 20, 12, val)
-+#define SET_S_IMM(inst, val)  \
-+    deposit32(deposit32(inst, 7, 5, val), 25, 7, (val) >> 5)
- /* RVC decoding macros */
- #define GET_C_IMM(inst)             (extract32(inst, 2, 5) \
-@@ -XXX,XX +XXX,XX @@ enum {
-                                     | (extract32(inst, 5, 1) << 6))
- #define GET_C_LD_IMM(inst)          ((extract16(inst, 10, 3) << 3) \
-                                     | (extract16(inst, 5, 2) << 6))
-+#define GET_C_SW_IMM(inst)          GET_C_LW_IMM(inst)
-+#define GET_C_SD_IMM(inst)          GET_C_LD_IMM(inst)
- #define GET_C_J_IMM(inst)           ((extract32(inst, 3, 3) << 1) \
-                                     | (extract32(inst, 11, 1) << 4) \
-                                     | (extract32(inst, 2, 1) << 5) \
-@@ -XXX,XX +XXX,XX @@ enum {
- #define GET_C_RS1S(inst)            (8 + extract16(inst, 7, 3))
- #define GET_C_RS2S(inst)            (8 + extract16(inst, 2, 3))
-+#define GET_C_FUNC(inst)           extract32(inst, 13, 3)
-+#define GET_C_OP(inst)             extract32(inst, 0, 2)
-+
-+enum {
-+    /* RVC Quadrants */
-+    OPC_RISC_C_OP_QUAD0 = 0x0,
-+    OPC_RISC_C_OP_QUAD1 = 0x1,
-+    OPC_RISC_C_OP_QUAD2 = 0x2
-+};
-+
-+enum {
-+    /* RVC Quadrant 0 */
-+    OPC_RISC_C_FUNC_ADDI4SPN = 0x0,
-+    OPC_RISC_C_FUNC_FLD_LQ = 0x1,
-+    OPC_RISC_C_FUNC_LW = 0x2,
-+    OPC_RISC_C_FUNC_FLW_LD = 0x3,
-+    OPC_RISC_C_FUNC_FSD_SQ = 0x5,
-+    OPC_RISC_C_FUNC_SW = 0x6,
-+    OPC_RISC_C_FUNC_FSW_SD = 0x7
-+};
-+
-+enum {
-+    /* RVC Quadrant 2 */
-+    OPC_RISC_C_FUNC_SLLI_SLLI64 = 0x0,
-+    OPC_RISC_C_FUNC_FLDSP_LQSP = 0x1,
-+    OPC_RISC_C_FUNC_LWSP = 0x2,
-+    OPC_RISC_C_FUNC_FLWSP_LDSP = 0x3,
-+    OPC_RISC_C_FUNC_JR_MV_EBREAK_JALR_ADD = 0x4,
-+    OPC_RISC_C_FUNC_FSDSP_SQSP = 0x5,
-+    OPC_RISC_C_FUNC_SWSP = 0x6,
-+    OPC_RISC_C_FUNC_FSWSP_SDSP = 0x7
-+};
-+
- #endif
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/main-loop.h"
- #include "cpu.h"
- #include "exec/exec-all.h"
-+#include "instmap.h"
- #include "tcg/tcg-op.h"
- #include "trace.h"
- #include "semihosting/common-semi.h"
-@@ -XXX,XX +XXX,XX @@ restart:
- static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
-                                 MMUAccessType access_type, bool pmp_violation,
--                                bool first_stage, bool two_stage)
-+                                bool first_stage, bool two_stage,
-+                                bool two_stage_indirect)
- {
-     CPUState *cs = env_cpu(env);
-     int page_fault_exceptions, vm;
 @@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
-     }
-     env->badaddr = address;
+     switch (access_type) {
-     env->two_stage_lookup = two_stage;
+     case MMU_INST_FETCH:
-+    env->two_stage_indirect_lookup = two_stage_indirect;
+-        if (env->virt_enabled && !first_stage) {
- }
++        if (pmp_violation) {
++            cs->exception_index = RISCV_EXCP_INST_ACCESS_FAULT;
- hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
++        } else if (env->virt_enabled && !first_stage) {
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
+             cs->exception_index = RISCV_EXCP_INST_GUEST_PAGE_FAULT;
-     env->badaddr = addr;
+         } else {
-     env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
+-            cs->exception_index = pmp_violation ?
-                             riscv_cpu_two_stage_lookup(mmu_idx);
+-                RISCV_EXCP_INST_ACCESS_FAULT : RISCV_EXCP_INST_PAGE_FAULT;
-+    env->two_stage_indirect_lookup = false;
++            cs->exception_index = RISCV_EXCP_INST_PAGE_FAULT;
      cpu_loop_exit_restore(cs, retaddr);
  }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
      env->badaddr = addr;
      env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
                              riscv_cpu_two_stage_lookup(mmu_idx);
 +    env->two_stage_indirect_lookup = false;
      cpu_loop_exit_restore(cs, retaddr);
  }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
      bool pmp_violation = false;
      bool first_stage_error = true;
      bool two_stage_lookup = false;
 +    bool two_stage_indirect_error = false;
      int ret = TRANSLATE_FAIL;
      int mode = mmu_idx;
      /* default TLB page size */
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
           */
          if (ret == TRANSLATE_G_STAGE_FAIL) {
              first_stage_error = false;
 +            two_stage_indirect_error = true;
              access_type = MMU_DATA_LOAD;
          }
+         break;
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+     case MMU_DATA_LOAD:
-         raise_mmu_exception(env, address, access_type, pmp_violation,
+-        if (two_stage && !first_stage) {
-                             first_stage_error,
++        if (pmp_violation) {
-                             riscv_cpu_virt_enabled(env) ||
++            cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT;
--                                riscv_cpu_two_stage_lookup(mmu_idx));
++        } else if (two_stage && !first_stage) {
-+                                riscv_cpu_two_stage_lookup(mmu_idx),
+             cs->exception_index = RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT;
-+                            two_stage_indirect_error);
+         } else {
-         cpu_loop_exit_restore(cs, retaddr);
+-            cs->exception_index = pmp_violation ?
-     }
+-                RISCV_EXCP_LOAD_ACCESS_FAULT : RISCV_EXCP_LOAD_PAGE_FAULT;
++            cs->exception_index = RISCV_EXCP_LOAD_PAGE_FAULT;
-     return true;
+         }
- }
+         break;
-+
+     case MMU_DATA_STORE:
-+static target_ulong riscv_transformed_insn(CPURISCVState *env,
+-        if (two_stage && !first_stage) {
-+                                           target_ulong insn,
++        if (pmp_violation) {
-+                                           target_ulong taddr)
++            cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
-+{
++        } else if (two_stage && !first_stage) {
-+    target_ulong xinsn = 0;
+             cs->exception_index = RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT;
-+    target_ulong access_rs1 = 0, access_imm = 0, access_size = 0;
+         } else {
-+
+-            cs->exception_index = pmp_violation ?
-+    /*
+-                RISCV_EXCP_STORE_AMO_ACCESS_FAULT :
-+     * Only Quadrant 0 and Quadrant 2 of RVC instruction space need to
+-                RISCV_EXCP_STORE_PAGE_FAULT;
-+     * be uncompressed. The Quadrant 1 of RVC instruction space need
++            cs->exception_index = RISCV_EXCP_STORE_PAGE_FAULT;
-+     * not be transformed because these instructions won't generate
+         }
-+     * any load/store trap.
+         break;
-+     */
+     default:
 +
 +    if ((insn & 0x3) != 0x3) {
 +        /* Transform 16bit instruction into 32bit instruction */
 +        switch (GET_C_OP(insn)) {
 +        case OPC_RISC_C_OP_QUAD0: /* Quadrant 0 */
 +            switch (GET_C_FUNC(insn)) {
 +            case OPC_RISC_C_FUNC_FLD_LQ:
 +                if (riscv_cpu_xlen(env) != 128) { /* C.FLD (RV32/64) */
 +                    xinsn = OPC_RISC_FLD;
 +                    xinsn = SET_RD(xinsn, GET_C_RS2S(insn));
 +                    access_rs1 = GET_C_RS1S(insn);
 +                    access_imm = GET_C_LD_IMM(insn);
 +                    access_size = 8;
 +                }
 +                break;
 +            case OPC_RISC_C_FUNC_LW: /* C.LW */
 +                xinsn = OPC_RISC_LW;
 +                xinsn = SET_RD(xinsn, GET_C_RS2S(insn));
 +                access_rs1 = GET_C_RS1S(insn);
 +                access_imm = GET_C_LW_IMM(insn);
 +                access_size = 4;
 +                break;
 +            case OPC_RISC_C_FUNC_FLW_LD:
 +                if (riscv_cpu_xlen(env) == 32) { /* C.FLW (RV32) */
 +                    xinsn = OPC_RISC_FLW;
 +                    xinsn = SET_RD(xinsn, GET_C_RS2S(insn));
 +                    access_rs1 = GET_C_RS1S(insn);
 +                    access_imm = GET_C_LW_IMM(insn);
 +                    access_size = 4;
 +                } else { /* C.LD (RV64/RV128) */
 +                    xinsn = OPC_RISC_LD;
 +                    xinsn = SET_RD(xinsn, GET_C_RS2S(insn));
 +                    access_rs1 = GET_C_RS1S(insn);
 +                    access_imm = GET_C_LD_IMM(insn);
 +                    access_size = 8;
 +                }
 +                break;
 +            case OPC_RISC_C_FUNC_FSD_SQ:
 +                if (riscv_cpu_xlen(env) != 128) { /* C.FSD (RV32/64) */
 +                    xinsn = OPC_RISC_FSD;
 +                    xinsn = SET_RS2(xinsn, GET_C_RS2S(insn));
 +                    access_rs1 = GET_C_RS1S(insn);
 +                    access_imm = GET_C_SD_IMM(insn);
 +                    access_size = 8;
 +                }
 +                break;
 +            case OPC_RISC_C_FUNC_SW: /* C.SW */
 +                xinsn = OPC_RISC_SW;
 +                xinsn = SET_RS2(xinsn, GET_C_RS2S(insn));
 +                access_rs1 = GET_C_RS1S(insn);
 +                access_imm = GET_C_SW_IMM(insn);
 +                access_size = 4;
 +                break;
 +            case OPC_RISC_C_FUNC_FSW_SD:
 +                if (riscv_cpu_xlen(env) == 32) { /* C.FSW (RV32) */
 +                    xinsn = OPC_RISC_FSW;
 +                    xinsn = SET_RS2(xinsn, GET_C_RS2S(insn));
 +                    access_rs1 = GET_C_RS1S(insn);
 +                    access_imm = GET_C_SW_IMM(insn);
 +                    access_size = 4;
 +                } else { /* C.SD (RV64/RV128) */
 +                    xinsn = OPC_RISC_SD;
 +                    xinsn = SET_RS2(xinsn, GET_C_RS2S(insn));
 +                    access_rs1 = GET_C_RS1S(insn);
 +                    access_imm = GET_C_SD_IMM(insn);
 +                    access_size = 8;
 +                }
 +                break;
 +            default:
 +                break;
 +            }
 +            break;
 +        case OPC_RISC_C_OP_QUAD2: /* Quadrant 2 */
 +            switch (GET_C_FUNC(insn)) {
 +            case OPC_RISC_C_FUNC_FLDSP_LQSP:
 +                if (riscv_cpu_xlen(env) != 128) { /* C.FLDSP (RV32/64) */
 +                    xinsn = OPC_RISC_FLD;
 +                    xinsn = SET_RD(xinsn, GET_C_RD(insn));
 +                    access_rs1 = 2;
 +                    access_imm = GET_C_LDSP_IMM(insn);
 +                    access_size = 8;
 +                }
 +                break;
 +            case OPC_RISC_C_FUNC_LWSP: /* C.LWSP */
 +                xinsn = OPC_RISC_LW;
 +                xinsn = SET_RD(xinsn, GET_C_RD(insn));
 +                access_rs1 = 2;
 +                access_imm = GET_C_LWSP_IMM(insn);
 +                access_size = 4;
 +                break;
 +            case OPC_RISC_C_FUNC_FLWSP_LDSP:
 +                if (riscv_cpu_xlen(env) == 32) { /* C.FLWSP (RV32) */
 +                    xinsn = OPC_RISC_FLW;
 +                    xinsn = SET_RD(xinsn, GET_C_RD(insn));
 +                    access_rs1 = 2;
 +                    access_imm = GET_C_LWSP_IMM(insn);
 +                    access_size = 4;
 +                } else { /* C.LDSP (RV64/RV128) */
 +                    xinsn = OPC_RISC_LD;
 +                    xinsn = SET_RD(xinsn, GET_C_RD(insn));
 +                    access_rs1 = 2;
 +                    access_imm = GET_C_LDSP_IMM(insn);
 +                    access_size = 8;
 +                }
 +                break;
 +            case OPC_RISC_C_FUNC_FSDSP_SQSP:
 +                if (riscv_cpu_xlen(env) != 128) { /* C.FSDSP (RV32/64) */
 +                    xinsn = OPC_RISC_FSD;
 +                    xinsn = SET_RS2(xinsn, GET_C_RS2(insn));
 +                    access_rs1 = 2;
 +                    access_imm = GET_C_SDSP_IMM(insn);
 +                    access_size = 8;
 +                }
 +                break;
 +            case OPC_RISC_C_FUNC_SWSP: /* C.SWSP */
 +                xinsn = OPC_RISC_SW;
 +                xinsn = SET_RS2(xinsn, GET_C_RS2(insn));
 +                access_rs1 = 2;
 +                access_imm = GET_C_SWSP_IMM(insn);
 +                access_size = 4;
 +                break;
 +            case 7:
 +                if (riscv_cpu_xlen(env) == 32) { /* C.FSWSP (RV32) */
 +                    xinsn = OPC_RISC_FSW;
 +                    xinsn = SET_RS2(xinsn, GET_C_RS2(insn));
 +                    access_rs1 = 2;
 +                    access_imm = GET_C_SWSP_IMM(insn);
 +                    access_size = 4;
 +                } else { /* C.SDSP (RV64/RV128) */
 +                    xinsn = OPC_RISC_SD;
 +                    xinsn = SET_RS2(xinsn, GET_C_RS2(insn));
 +                    access_rs1 = 2;
 +                    access_imm = GET_C_SDSP_IMM(insn);
 +                    access_size = 8;
 +                }
 +                break;
 +            default:
 +                break;
 +            }
 +            break;
 +        default:
 +            break;
 +        }
 +
 +        /*
 +         * Clear Bit1 of transformed instruction to indicate that
 +         * original insruction was a 16bit instruction
 +         */
 +        xinsn &= ~((target_ulong)0x2);
 +    } else {
 +        /* Transform 32bit (or wider) instructions */
 +        switch (MASK_OP_MAJOR(insn)) {
 +        case OPC_RISC_ATOMIC:
 +            xinsn = insn;
 +            access_rs1 = GET_RS1(insn);
 +            access_size = 1 << GET_FUNCT3(insn);
 +            break;
 +        case OPC_RISC_LOAD:
 +        case OPC_RISC_FP_LOAD:
 +            xinsn = SET_I_IMM(insn, 0);
 +            access_rs1 = GET_RS1(insn);
 +            access_imm = GET_IMM(insn);
 +            access_size = 1 << GET_FUNCT3(insn);
 +            break;
 +        case OPC_RISC_STORE:
 +        case OPC_RISC_FP_STORE:
 +            xinsn = SET_S_IMM(insn, 0);
 +            access_rs1 = GET_RS1(insn);
 +            access_imm = GET_STORE_IMM(insn);
 +            access_size = 1 << GET_FUNCT3(insn);
 +            break;
 +        case OPC_RISC_SYSTEM:
 +            if (MASK_OP_SYSTEM(insn) == OPC_RISC_HLVHSV) {
 +                xinsn = insn;
 +                access_rs1 = GET_RS1(insn);
 +                access_size = 1 << ((GET_FUNCT7(insn) >> 1) & 0x3);
 +                access_size = 1 << access_size;
 +            }
 +            break;
 +        default:
 +            break;
 +        }
 +    }
 +
 +    if (access_size) {
 +        xinsn = SET_RS1(xinsn, (taddr - (env->gpr[access_rs1] + access_imm)) &
 +                               (access_size - 1));
 +    }
 +
 +    return xinsn;
 +}
  #endif /* !CONFIG_USER_ONLY */
  /*
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      target_ulong cause = cs->exception_index & RISCV_EXCP_INT_MASK;
      uint64_t deleg = async ? env->mideleg : env->medeleg;
      target_ulong tval = 0;
 +    target_ulong tinst = 0;
      target_ulong htval = 0;
      target_ulong mtval2 = 0;
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      if (!async) {
          /* set tval to badaddr for traps with address information */
          switch (cause) {
 -        case RISCV_EXCP_INST_GUEST_PAGE_FAULT:
          case RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT:
          case RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT:
 -        case RISCV_EXCP_INST_ADDR_MIS:
 -        case RISCV_EXCP_INST_ACCESS_FAULT:
          case RISCV_EXCP_LOAD_ADDR_MIS:
          case RISCV_EXCP_STORE_AMO_ADDR_MIS:
          case RISCV_EXCP_LOAD_ACCESS_FAULT:
          case RISCV_EXCP_STORE_AMO_ACCESS_FAULT:
 -        case RISCV_EXCP_INST_PAGE_FAULT:
          case RISCV_EXCP_LOAD_PAGE_FAULT:
          case RISCV_EXCP_STORE_PAGE_FAULT:
              write_gva = env->two_stage_lookup;
              tval = env->badaddr;
 +            if (env->two_stage_indirect_lookup) {
 +                /*
 +                 * special pseudoinstruction for G-stage fault taken while
 +                 * doing VS-stage page table walk.
 +                 */
 +                tinst = (riscv_cpu_xlen(env) == 32) ? 0x00002000 : 0x00003000;
 +            } else {
 +                /*
 +                 * The "Addr. Offset" field in transformed instruction is
 +                 * non-zero only for misaligned access.
 +                 */
 +                tinst = riscv_transformed_insn(env, env->bins, tval);
 +            }
 +            break;
 +        case RISCV_EXCP_INST_GUEST_PAGE_FAULT:
 +        case RISCV_EXCP_INST_ADDR_MIS:
 +        case RISCV_EXCP_INST_ACCESS_FAULT:
 +        case RISCV_EXCP_INST_PAGE_FAULT:
 +            write_gva = env->two_stage_lookup;
 +            tval = env->badaddr;
 +            if (env->two_stage_indirect_lookup) {
 +                /*
 +                 * special pseudoinstruction for G-stage fault taken while
 +                 * doing VS-stage page table walk.
 +                 */
 +                tinst = (riscv_cpu_xlen(env) == 32) ? 0x00002000 : 0x00003000;
 +            }
              break;
          case RISCV_EXCP_ILLEGAL_INST:
          case RISCV_EXCP_VIRT_INSTRUCTION_FAULT:
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
          env->sepc = env->pc;
          env->stval = tval;
          env->htval = htval;
 +        env->htinst = tinst;
          env->pc = (env->stvec >> 2 << 2) +
              ((async && (env->stvec & 3) == 1) ? cause * 4 : 0);
          riscv_cpu_set_mode(env, PRV_S);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
          env->mepc = env->pc;
          env->mtval = tval;
          env->mtval2 = mtval2;
 +        env->mtinst = tinst;
          env->pc = (env->mtvec >> 2 << 2) +
              ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
          riscv_cpu_set_mode(env, PRV_M);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
       */
      env->two_stage_lookup = false;
 +    env->two_stage_indirect_lookup = false;
  #endif
      cs->exception_index = RISCV_EXCP_NONE; /* mark handled to qemu */
  }
 --
-.37.2
+.45.1

-[PULL 42/44] target/riscv: Add few cache related PMU events
+[PULL 22/28] target/riscv: do not set mtval2 for non guest-page faults
-From: Atish Patra <atish.patra@wdc.com>
+From: Alexei Filippov <alexei.filippov@syntacore.com>
-Qemu can monitor the following cache related PMU events through
+Previous patch fixed the PMP priority in raise_mmu_exception() but we're still
-tlb_fill functions.
+setting mtval2 incorrectly. In riscv_cpu_tlb_fill(), after pmp check in 2 stage
 translation part, mtval2 will be set in case of successes 2 stage translation but
 failed pmp check.
-. DTLB load/store miss
+In this case we gonna set mtval2 via env->guest_phys_fault_addr in context of
-. ITLB prefetch miss
+riscv_cpu_tlb_fill(), as this was a guest-page-fault, but it didn't and mtval2
 should be zero, according to RISCV privileged spec sect. 9.4.4: When a guest
 page-fault is taken into M-mode, mtval2 is written with either zero or guest
 physical address that faulted, shifted by 2 bits. *For other traps, mtval2
 is set to zero...*
-Increment the PMU counter in tlb_fill function.
+Signed-off-by: Alexei Filippov <alexei.filippov@syntacore.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Tested-by: Heiko Stuebner <heiko@sntech.de>
+Message-ID: <20240503103052.6819-1-alexei.filippov@syntacore.com>
-Signed-off-by: Atish Patra <atish.patra@wdc.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
 Signed-off-by: Atish Patra <atishp@rivosinc.com>
 Message-Id: <20220824221701.41932-4-atishp@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 25 +++++++++++++++++++++++++
+ target/riscv/cpu_helper.c | 12 ++++++------
-file changed, 25 insertions(+)
+file changed, 6 insertions(+), 6 deletions(-)
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/log.h"
- #include "qemu/main-loop.h"
- #include "cpu.h"
-+#include "pmu.h"
- #include "exec/exec-all.h"
- #include "instmap.h"
- #include "tcg/tcg-op.h"
- #include "trace.h"
- #include "semihosting/common-semi.h"
-+#include "cpu_bits.h"
- int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
- {
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
-     cpu_loop_exit_restore(cs, retaddr);
- }
-+
-+static void pmu_tlb_fill_incr_ctr(RISCVCPU *cpu, MMUAccessType access_type)
-+{
-+    enum riscv_pmu_event_idx pmu_event_type;
-+
-+    switch (access_type) {
-+    case MMU_INST_FETCH:
-+        pmu_event_type = RISCV_PMU_EVENT_CACHE_ITLB_PREFETCH_MISS;
-+        break;
-+    case MMU_DATA_LOAD:
-+        pmu_event_type = RISCV_PMU_EVENT_CACHE_DTLB_READ_MISS;
-+        break;
-+    case MMU_DATA_STORE:
-+        pmu_event_type = RISCV_PMU_EVENT_CACHE_DTLB_WRITE_MISS;
-+        break;
-+    default:
-+        return;
-+    }
-+
-+    riscv_pmu_incr_ctr(cpu, pmu_event_type);
-+}
-+
- bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
-                         MMUAccessType access_type, int mmu_idx,
-                         bool probe, uintptr_t retaddr)
 @@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+                               __func__, pa, ret, prot_pmp, tlb_size);
+                 prot &= prot_pmp;
+-            }
+-
+-            if (ret != TRANSLATE_SUCCESS) {
++            } else {
+                 /*
+                  * Guest physical address translation failed, this is a HS
+                  * level exception
+                  */
+                 first_stage_error = false;
+-                env->guest_phys_fault_addr = (im_address |
+-                                              (address &
+-                                               (TARGET_PAGE_SIZE - 1))) >> 2;
++                if (ret != TRANSLATE_PMP_FAIL) {
++                    env->guest_phys_fault_addr = (im_address |
++                                                  (address &
++                                                   (TARGET_PAGE_SIZE - 1))) >> 2;
++                }
              }
          }
      } else {
-+        pmu_tlb_fill_incr_ctr(cpu, access_type);
-         /* Single stage lookup */
-         ret = get_physical_address(env, &pa, &prot, address, NULL,
-                                    access_type, mmu_idx, true, false, false);
 --
-.37.2
+.45.1

-[PULL 24/44] target/riscv: rvv: Add option 'rvv_ma_all_1s' to enable optional mask agnostic behavior
+[PULL 23/28] target/riscv: Remove experimental prefix from "B" extension
-From: eopXD <eop.chen@sifive.com>
+From: Rob Bradford <rbradford@rivosinc.com>
-According to v-spec, mask agnostic behavior can be either kept as
+This extension has now been ratified:
-undisturbed or set elements' bits to all 1s. To distinguish the
+https://jira.riscv.org/browse/RVS-2006 so the "x-" prefix can be
-difference of mask policies, QEMU should be able to simulate the mask
+removed.
 agnostic behavior as "set mask elements' bits to all 1s".
-There are multiple possibility for agnostic elements according to
+Since this is now a ratified extension add it to the list of extensions
-v-spec. The main intent of this patch-set tries to add option that
+included in the "max" CPU variant.
 can distinguish between mask policies. Setting agnostic elements to
 all 1s allows QEMU to express this.
-This commit adds option 'rvv_ma_all_1s' is added to enable the
+Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
-behavior, it is default as disabled.
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Signed-off-by: eop Chen <eop.chen@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <165570784143.17634.35095816584573691-10@git.sr.ht>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Message-ID: <20240514110217.22516-1-rbradford@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 1 +
+ target/riscv/cpu.c         | 2 +-
-file changed, 1 insertion(+)
+ target/riscv/tcg/tcg-cpu.c | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_properties[] = {
+@@ -XXX,XX +XXX,XX @@ static const MISAExtInfo misa_ext_info_arr[] = {
-     DEFINE_PROP_BOOL("short-isa-string", RISCVCPU, cfg.short_isa_string, false),
+     MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
+     MISA_EXT_INFO(RVV, "v", "Vector operations"),
-     DEFINE_PROP_BOOL("rvv_ta_all_1s", RISCVCPU, cfg.rvv_ta_all_1s, false),
+     MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
-+    DEFINE_PROP_BOOL("rvv_ma_all_1s", RISCVCPU, cfg.rvv_ma_all_1s, false),
+-    MISA_EXT_INFO(RVB, "x-b", "Bit manipulation (Zba_Zbb_Zbs)")
-     DEFINE_PROP_END_OF_LIST(),
++    MISA_EXT_INFO(RVB, "b", "Bit manipulation (Zba_Zbb_Zbs)")
  };
+ static void riscv_cpu_validate_misa_mxl(RISCVCPUClass *mcc)
+diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/tcg/tcg-cpu.c
++++ b/target/riscv/tcg/tcg-cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
+     const RISCVCPUMultiExtConfig *prop;
+     /* Enable RVG, RVJ and RVV that are disabled by default */
+-    riscv_cpu_set_misa_ext(env, env->misa_ext | RVG | RVJ | RVV);
++    riscv_cpu_set_misa_ext(env, env->misa_ext | RVB | RVG | RVJ | RVV);
+     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
+         isa_ext_update_enabled(cpu, prop->offset, true);
 --
-.37.2
+.45.1

-[PULL 37/44] hw/intc: Move mtimer/mtimecmp to aclint
+[PULL 24/28] target/riscv: rvzicbo: Fixup CBO extension register calculation
-From: Atish Patra <atishp@rivosinc.com>
+From: Alistair Francis <alistair23@gmail.com>
-Historically, The mtime/mtimecmp has been part of the CPU because
+When running the instruction
 they are per hart entities. However, they actually belong to aclint
 which is a MMIO device.
-Move them to the ACLINT device. This also emulates the real hardware
+```
-more closely.
+    cbo.flush 0(x0)
 ```
-Reviewed-by: Anup Patel <anup@brainfault.org>
+QEMU would segfault.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+The issue was in cpu_gpr[a->rs1] as QEMU does not have cpu_gpr[0]
-Signed-off-by: Atish Patra <atishp@rivosinc.com>
+allocated.
-Message-Id: <20220824221357.41070-2-atishp@rivosinc.com>
 In order to fix this let's use the existing get_address()
 helper. This also has the benefit of performing pointer mask
 calculations on the address specified in rs1.
 The pointer masking specificiation specifically states:
 """
 Cache Management Operations: All instructions in Zicbom, Zicbop and Zicboz
 """
 So this is the correct behaviour and we previously have been incorrectly
 not masking the address.
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reported-by: Fabian Thomas <fabian.thomas@cispa.de>
 Fixes: e05da09b7cfd ("target/riscv: implement Zicbom extension")
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240514023910.301766-1-alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/intc/riscv_aclint.h |  2 ++
+ target/riscv/insn_trans/trans_rvzicbo.c.inc | 16 ++++++++++++----
- include/hw/timer/ibex_timer.h  |  2 ++
+file changed, 12 insertions(+), 4 deletions(-)
  target/riscv/cpu.h             |  2 --
  hw/intc/riscv_aclint.c         | 48 ++++++++++++++++++++++++----------
  hw/timer/ibex_timer.c          | 18 +++++--------
  target/riscv/machine.c         |  5 ++--
 files changed, 47 insertions(+), 30 deletions(-)
-diff --git a/include/hw/intc/riscv_aclint.h b/include/hw/intc/riscv_aclint.h
+diff --git a/target/riscv/insn_trans/trans_rvzicbo.c.inc b/target/riscv/insn_trans/trans_rvzicbo.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/riscv_aclint.h
+--- a/target/riscv/insn_trans/trans_rvzicbo.c.inc
-+++ b/include/hw/intc/riscv_aclint.h
++++ b/target/riscv/insn_trans/trans_rvzicbo.c.inc
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVAclintMTimerState {
      /*< private >*/
      SysBusDevice parent_obj;
      uint64_t time_delta;
 +    uint64_t *timecmp;
 +    QEMUTimer **timers;
      /*< public >*/
      MemoryRegion mmio;
 diff --git a/include/hw/timer/ibex_timer.h b/include/hw/timer/ibex_timer.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/timer/ibex_timer.h
 +++ b/include/hw/timer/ibex_timer.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(IbexTimerState, IBEX_TIMER)
  struct IbexTimerState {
      /* <private> */
      SysBusDevice parent_obj;
 +    uint64_t mtimecmp;
 +    QEMUTimer *mtimer; /* Internal timer for M-mode interrupt */
      /* <public> */
      MemoryRegion mmio;
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
      /* temporary htif regs */
      uint64_t mfromhost;
      uint64_t mtohost;
 -    uint64_t timecmp;
      /* physical memory protection */
      pmp_table_t pmp_state;
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
      float_status fp_status;
      /* Fields from here on are preserved across CPU reset. */
 -    QEMUTimer *timer; /* Internal timer */
      hwaddr kernel_addr;
      hwaddr fdt_addr;
 diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/riscv_aclint.c
 +++ b/hw/intc/riscv_aclint.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/intc/riscv_aclint.h"
+ static bool trans_cbo_clean(DisasContext *ctx, arg_cbo_clean *a)
- #include "qemu/timer.h"
+ {
- #include "hw/irq.h"
+     REQUIRE_ZICBOM(ctx);
-+#include "migration/vmstate.h"
+-    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
++    TCGv src = get_address(ctx, a->rs1, 0);
  typedef struct riscv_aclint_mtimer_callback {
      RISCVAclintMTimerState *s;
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
      uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
 -    cpu->env.timecmp = value;
 -    if (cpu->env.timecmp <= rtc_r) {
 +    /* Compute the relative hartid w.r.t the socket */
 +    hartid = hartid - mtimer->hartid_base;
 +
-+    mtimer->timecmp[hartid] = value;
++    gen_helper_cbo_clean_flush(tcg_env, src);
-+    if (mtimer->timecmp[hartid] <= rtc_r) {
+     return true;
          /*
           * If we're setting an MTIMECMP value in the "past",
           * immediately raise the timer interrupt
           */
 -        qemu_irq_raise(mtimer->timer_irqs[hartid - mtimer->hartid_base]);
 +        qemu_irq_raise(mtimer->timer_irqs[hartid]);
          return;
      }
      /* otherwise, set up the future timer interrupt */
 -    qemu_irq_lower(mtimer->timer_irqs[hartid - mtimer->hartid_base]);
 -    diff = cpu->env.timecmp - rtc_r;
 +    qemu_irq_lower(mtimer->timer_irqs[hartid]);
 +    diff = mtimer->timecmp[hartid] - rtc_r;
      /* back to ns (note args switched in muldiv64) */
      uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
          next = MIN(next, INT64_MAX);
      }
 -    timer_mod(cpu->env.timer, next);
 +    timer_mod(mtimer->timers[hartid], next);
  }
- /*
+ static bool trans_cbo_flush(DisasContext *ctx, arg_cbo_flush *a)
-@@ -XXX,XX +XXX,XX @@ static uint64_t riscv_aclint_mtimer_read(void *opaque, hwaddr addr,
+ {
-                           "aclint-mtimer: invalid hartid: %zu", hartid);
+     REQUIRE_ZICBOM(ctx);
-         } else if ((addr & 0x7) == 0) {
+-    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
-             /* timecmp_lo for RV32/RV64 or timecmp for RV64 */
++    TCGv src = get_address(ctx, a->rs1, 0);
--            uint64_t timecmp = env->timecmp;
++
-+            uint64_t timecmp = mtimer->timecmp[hartid];
++    gen_helper_cbo_clean_flush(tcg_env, src);
-             return (size == 4) ? (timecmp & 0xFFFFFFFF) : timecmp;
+     return true;
          } else if ((addr & 0x7) == 4) {
              /* timecmp_hi */
 -            uint64_t timecmp = env->timecmp;
 +            uint64_t timecmp = mtimer->timecmp[hartid];
              return (timecmp >> 32) & 0xFFFFFFFF;
          } else {
              qemu_log_mask(LOG_UNIMP,
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
          } else if ((addr & 0x7) == 0) {
              if (size == 4) {
                  /* timecmp_lo for RV32/RV64 */
 -                uint64_t timecmp_hi = env->timecmp >> 32;
 +                uint64_t timecmp_hi = mtimer->timecmp[hartid] >> 32;
                  riscv_aclint_mtimer_write_timecmp(mtimer, RISCV_CPU(cpu), hartid,
                      timecmp_hi << 32 | (value & 0xFFFFFFFF));
              } else {
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
          } else if ((addr & 0x7) == 4) {
              if (size == 4) {
                  /* timecmp_hi for RV32/RV64 */
 -                uint64_t timecmp_lo = env->timecmp;
 +                uint64_t timecmp_lo = mtimer->timecmp[hartid];
                  riscv_aclint_mtimer_write_timecmp(mtimer, RISCV_CPU(cpu), hartid,
                      value << 32 | (timecmp_lo & 0xFFFFFFFF));
              } else {
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
              }
              riscv_aclint_mtimer_write_timecmp(mtimer, RISCV_CPU(cpu),
                                                mtimer->hartid_base + i,
 -                                              env->timecmp);
 +                                              mtimer->timecmp[i]);
          }
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_realize(DeviceState *dev, Error **errp)
      s->timer_irqs = g_new(qemu_irq, s->num_harts);
      qdev_init_gpio_out(dev, s->timer_irqs, s->num_harts);
 +    s->timers = g_new0(QEMUTimer *, s->num_harts);
 +    s->timecmp = g_new0(uint64_t, s->num_harts);
      /* Claim timer interrupt bits */
      for (i = 0; i < s->num_harts; i++) {
          RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(s->hartid_base + i));
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_reset_enter(Object *obj, ResetType type)
      riscv_aclint_mtimer_write(mtimer, mtimer->time_base, 0, 8);
  }
-+static const VMStateDescription vmstate_riscv_mtimer = {
+ static bool trans_cbo_inval(DisasContext *ctx, arg_cbo_inval *a)
-+    .name = "riscv_mtimer",
+ {
-+    .version_id = 1,
+     REQUIRE_ZICBOM(ctx);
-+    .minimum_version_id = 1,
+-    gen_helper_cbo_inval(tcg_env, cpu_gpr[a->rs1]);
-+    .fields = (VMStateField[]) {
++    TCGv src = get_address(ctx, a->rs1, 0);
 +            VMSTATE_VARRAY_UINT32(timecmp, RISCVAclintMTimerState,
 +                                  num_harts, 0,
 +                                  vmstate_info_uint64, uint64_t),
 +            VMSTATE_END_OF_LIST()
 +        }
 +};
 +
- static void riscv_aclint_mtimer_class_init(ObjectClass *klass, void *data)
++    gen_helper_cbo_inval(tcg_env, src);
      return true;
  }
  static bool trans_cbo_zero(DisasContext *ctx, arg_cbo_zero *a)
  {
-     DeviceClass *dc = DEVICE_CLASS(klass);
+     REQUIRE_ZICBOZ(ctx);
-@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_class_init(ObjectClass *klass, void *data)
+-    gen_helper_cbo_zero(tcg_env, cpu_gpr[a->rs1]);
-     device_class_set_props(dc, riscv_aclint_mtimer_properties);
++    TCGv src = get_address(ctx, a->rs1, 0);
-     ResettableClass *rc = RESETTABLE_CLASS(klass);
++
-     rc->phases.enter = riscv_aclint_mtimer_reset_enter;
++    gen_helper_cbo_zero(tcg_env, src);
-+    dc->vmsd = &vmstate_riscv_mtimer;
+     return true;
  }
- static const TypeInfo riscv_aclint_mtimer_info = {
-@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aclint_mtimer_create(hwaddr addr, hwaddr size,
- {
-     int i;
-     DeviceState *dev = qdev_new(TYPE_RISCV_ACLINT_MTIMER);
-+    RISCVAclintMTimerState *s = RISCV_ACLINT_MTIMER(dev);
-     assert(num_harts <= RISCV_ACLINT_MAX_HARTS);
-     assert(!(addr & 0x7));
-@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aclint_mtimer_create(hwaddr addr, hwaddr size,
-             riscv_cpu_set_rdtime_fn(env, cpu_riscv_read_rtc, dev);
-         }
--        cb->s = RISCV_ACLINT_MTIMER(dev);
-+        cb->s = s;
-         cb->num = i;
--        env->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-+        s->timers[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                   &riscv_aclint_mtimer_cb, cb);
--        env->timecmp = 0;
-+        s->timecmp[i] = 0;
-         qdev_connect_gpio_out(dev, i,
-                               qdev_get_gpio_in(DEVICE(rvcpu), IRQ_M_TIMER));
-diff --git a/hw/timer/ibex_timer.c b/hw/timer/ibex_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/ibex_timer.c
-+++ b/hw/timer/ibex_timer.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
- static void ibex_timer_update_irqs(IbexTimerState *s)
- {
--    CPUState *cs = qemu_get_cpu(0);
--    RISCVCPU *cpu = RISCV_CPU(cs);
-     uint64_t value = s->timer_compare_lower0 |
-                          ((uint64_t)s->timer_compare_upper0 << 32);
-     uint64_t next, diff;
-@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
-     }
-     /* Update the CPUs mtimecmp */
--    cpu->env.timecmp = value;
-+    s->mtimecmp = value;
--    if (cpu->env.timecmp <= now) {
-+    if (s->mtimecmp <= now) {
-         /*
-          * If the mtimecmp was in the past raise the interrupt now.
-          */
-@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
-     qemu_irq_lower(s->m_timer_irq);
-     qemu_set_irq(s->irq, false);
--    diff = cpu->env.timecmp - now;
-+    diff = s->mtimecmp - now;
-     next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
-                                  muldiv64(diff,
-                                           NANOSECONDS_PER_SECOND,
-@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
-     if (next < qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)) {
-         /* We overflowed the timer, just set it as large as we can */
--        timer_mod(cpu->env.timer, 0x7FFFFFFFFFFFFFFF);
-+        timer_mod(s->mtimer, 0x7FFFFFFFFFFFFFFF);
-     } else {
--        timer_mod(cpu->env.timer, next);
-+        timer_mod(s->mtimer, next);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void ibex_timer_reset(DeviceState *dev)
- {
-     IbexTimerState *s = IBEX_TIMER(dev);
--    CPUState *cpu = qemu_get_cpu(0);
--    CPURISCVState *env = cpu->env_ptr;
--    env->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-+    s->mtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                               &ibex_timer_cb, s);
--    env->timecmp = 0;
-+    s->mtimecmp = 0;
-     s->timer_ctrl = 0x00000000;
-     s->timer_cfg0 = 0x00010000;
-diff --git a/target/riscv/machine.c b/target/riscv/machine.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/machine.c
-+++ b/target/riscv/machine.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pmu_ctr_state = {
- const VMStateDescription vmstate_riscv_cpu = {
-     .name = "cpu",
--    .version_id = 3,
--    .minimum_version_id = 3,
-+    .version_id = 4,
-+    .minimum_version_id = 4,
-     .post_load = riscv_cpu_post_load,
-     .fields = (VMStateField[]) {
-         VMSTATE_UINTTL_ARRAY(env.gpr, RISCVCPU, 32),
-@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
-         VMSTATE_UINTTL(env.mscratch, RISCVCPU),
-         VMSTATE_UINT64(env.mfromhost, RISCVCPU),
-         VMSTATE_UINT64(env.mtohost, RISCVCPU),
--        VMSTATE_UINT64(env.timecmp, RISCVCPU),
-         VMSTATE_END_OF_LIST()
-     },
 --
-.37.2
+.45.1

-[PULL 09/44] target/riscv: Add check for csrs existed with U extension
+[PULL 25/28] target/riscv/kvm.c: Fix the hart bit setting of AIA
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Add umode/umode32 predicate for mcounteren, menvcfg/menvcfgh
+In AIA spec, each hart (or each hart within a group) has a unique hart
 number to locate the memory pages of interrupt files in the address
 space. The number of bits required to represent any hart number is equal
 to ceil(log2(hmax + 1)), where hmax is the largest hart number among
 groups.
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+However, if the largest hart number among groups is a power of 2, QEMU
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+will pass an inaccurate hart-index-bit setting to Linux. For example, when
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+the guest OS has 4 harts, only ceil(log2(3 + 1)) = 2 bits are sufficient
 to represent 4 harts, but we passes 3 to Linux. The code needs to be
 updated to ensure accurate hart-index-bit settings.
 Additionally, a Linux patch[1] is necessary to correctly recover the hart
 index when the guest OS has only 1 hart, where the hart-index-bit is 0.
 [1] https://lore.kernel.org/lkml/20240415064905.25184-1-yongxuan.wang@sifive.com/t/
 Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-Id: <20220718130955.11899-5-liweiwei@iscas.ac.cn>
+Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240515091129.28116-1-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 24 +++++++++++++++++++++---
+ target/riscv/kvm/kvm-cpu.c | 9 ++++++++-
-file changed, 21 insertions(+), 3 deletions(-)
+file changed, 8 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/target/riscv/kvm/kvm-cpu.c
-+++ b/target/riscv/csr.c
++++ b/target/riscv/kvm/kvm-cpu.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException hmode32(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+         }
- }
+     }
-+static RISCVException umode(CPURISCVState *env, int csrno)
+-    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
-+{
++
-+    if (riscv_has_ext(env, RVU)) {
++    if (max_hart_per_socket > 1) {
-+        return RISCV_EXCP_NONE;
++        max_hart_per_socket--;
 +        hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
 +    } else {
 +        hart_bits = 0;
 +    }
 +
-+    return RISCV_EXCP_ILLEGAL_INST;
+     ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
-+}
+                             KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
-+
+                             &hart_bits, true, NULL);
 +static RISCVException umode32(CPURISCVState *env, int csrno)
 +{
 +    if (riscv_cpu_mxl(env) != MXL_RV32) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    return umode(env, csrno);
 +}
 +
  /* Checks if PointerMasking registers could be accessed */
  static RISCVException pointer_masking(CPURISCVState *env, int csrno)
  {
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg, write_medeleg },
      [CSR_MIE]         = { "mie",        any,   NULL, NULL,   rmw_mie       },
      [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,   write_mtvec   },
 -    [CSR_MCOUNTEREN]  = { "mcounteren", any,   read_mcounteren,
 +    [CSR_MCOUNTEREN]  = { "mcounteren", umode, read_mcounteren,
                            write_mcounteren                                 },
      [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
      [CSR_MIPH]     = { "miph",     aia_any32, NULL, NULL, rmw_miph     },
      /* Execution environment configuration */
 -    [CSR_MENVCFG]  = { "menvcfg",  any,   read_menvcfg,  write_menvcfg,
 +    [CSR_MENVCFG]  = { "menvcfg",  umode, read_menvcfg,  write_menvcfg,
                         .min_priv_ver = PRIV_VERSION_1_12_0              },
 -    [CSR_MENVCFGH] = { "menvcfgh", any32, read_menvcfgh, write_menvcfgh,
 +    [CSR_MENVCFGH] = { "menvcfgh", umode32, read_menvcfgh, write_menvcfgh,
                         .min_priv_ver = PRIV_VERSION_1_12_0              },
      [CSR_SENVCFG]  = { "senvcfg",  smode, read_senvcfg,  write_senvcfg,
                         .min_priv_ver = PRIV_VERSION_1_12_0              },
 --
-.37.2
+.45.1

-[PULL 11/44] target/riscv: Simplify the check in hmode to reuse the check in riscv_csrrw_check
+[PULL 26/28] riscv, gdbstub.c: fix reg_width in ricsv_gen_dynamic_vector_feature()
-From: Weiwei Li <liweiwei@iscas.ac.cn>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Just add 1 to the effective privledge level when in HS mode, then reuse
+Commit 33a24910ae changed 'reg_width' to use 'vlenb', i.e. vector length
-the check of 'effective_priv < csr_priv' in riscv_csrrw_check to replace
+in bytes, when in this context we want 'reg_width' as the length in
-the privilege level related check in hmode. Then, hmode will only check
+bits.
 whether H extension is supported.
-When accessing Hypervior CSRs:
+Fix 'reg_width' back to the value in bits like 7cb59921c05a
-) If accessing from M privilege level, the check of
+("target/riscv/gdbstub.c: use 'vlenb' instead of shifting 'vlen'") set
-'effective_priv< csr_priv' passes, returns hmode(...) which will return
+beforehand.
 RISCV_EXCP_ILLEGAL_INST when H extension is not supported and return
 RISCV_EXCP_NONE otherwise.
 ) If accessing from HS privilege level, effective_priv will add 1,
 the check passes and also returns hmode(...) too.
 ) If accessing from VS/VU privilege level, the check fails, and
 returns RISCV_EXCP_VIRT_INSTRUCTION_FAULT
 ) If accessing from U privilege level, the check fails, and returns
 RISCV_EXCP_ILLEGAL_INST
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
+While we're at it, rename 'reg_width' to 'bitsize' to provide a bit more
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
+clarity about what the variable represents. 'bitsize' is also used in
 riscv_gen_dynamic_csr_feature() with the same purpose, i.e. as an input to
 gdb_feature_builder_append_reg().
 Cc: Akihiko Odaki <akihiko.odaki@daynix.com>
 Cc: Alex Bennée <alex.bennee@linaro.org>
 Reported-by: Robin Dapp <rdapp.gcc@gmail.com>
 Fixes: 33a24910ae ("target/riscv: Use GDBFeature for dynamic XML")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Acked-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Cc: qemu-stable <qemu-stable@nongnu.org>
-Message-Id: <20220718130955.11899-7-liweiwei@iscas.ac.cn>
+Message-ID: <20240517203054.880861-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 18 +++++-------------
+ target/riscv/gdbstub.c | 6 +++---
-file changed, 5 insertions(+), 13 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
+diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
+--- a/target/riscv/gdbstub.c
-+++ b/target/riscv/csr.c
++++ b/target/riscv/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static int aia_smode32(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static GDBFeature *riscv_gen_dynamic_csr_feature(CPUState *cs, int base_reg)
- static RISCVException hmode(CPURISCVState *env, int csrno)
+ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
  {
-     if (riscv_has_ext(env, RVH)) {
+     RISCVCPU *cpu = RISCV_CPU(cs);
--        /* Hypervisor extension is supported */
+-    int reg_width = cpu->cfg.vlenb;
--        if ((env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
++    int bitsize = cpu->cfg.vlenb << 3;
--            env->priv == PRV_M) {
+     GDBFeatureBuilder builder;
--            return RISCV_EXCP_NONE;
+     int i;
--        } else {
--            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
--        }
-+        return RISCV_EXCP_NONE;
+     /* First define types and totals in a whole VL */
      for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
 -        int count = reg_width / vec_lanes[i].size;
 +        int count = bitsize / vec_lanes[i].size;
          gdb_feature_builder_append_tag(
              &builder, "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
              vec_lanes[i].id, vec_lanes[i].gdb_type, count);
@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
      /* Define vector registers */
      for (i = 0; i < 32; i++) {
          gdb_feature_builder_append_reg(&builder, g_strdup_printf("v%d", i),
 -                                       reg_width, i, "riscv_vector", "vector");
 +                                       bitsize, i, "riscv_vector", "vector");
      }
-     return RISCV_EXCP_ILLEGAL_INST;
+     gdb_feature_builder_end(&builder);
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
  #if !defined(CONFIG_USER_ONLY)
      int csr_priv, effective_priv = env->priv;
 -    if (riscv_has_ext(env, RVH) && env->priv == PRV_S) {
 +    if (riscv_has_ext(env, RVH) && env->priv == PRV_S &&
 +        !riscv_cpu_virt_enabled(env)) {
          /*
 -         * We are in either HS or VS mode.
 -         * Add 1 to the effective privledge level to allow us to access the
 -         * Hypervisor CSRs. The `hmode` predicate will determine if access
 -         * should be allowed(HS) or if a virtual instruction exception should be
 -         * raised(VS).
 +         * We are in HS mode. Add 1 to the effective privledge level to
 +         * allow us to access the Hypervisor CSRs.
           */
          effective_priv++;
      }
 --
-.37.2
+.45.1

-[PULL 03/44] target/riscv: fix shifts shamt value for rv128c
+[PULL 27/28] disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
-From: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr>
+From: Alistair Francis <alistair23@gmail.com>
-For rv128c shifts, a shamt of 0 is a shamt of 64, while for rv32c/rv64c
+Previously we only listed a single pmpcfg CSR and the first 16 pmpaddr
-it stays 0 and is a hint instruction that does not change processor state.
+CSRs. This patch fixes this to list all 16 pmpcfg and all 64 pmpaddr
-For rv128c right shifts, the 6-bit shamt is in addition sign extended to
+CSRs are part of the disassembly.
 bits.
-Signed-off-by: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr>
+Reported-by: Eric DeVolder <eric_devolder@yahoo.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Fixes: ea10325917 ("RISC-V Disassembler")
-Message-Id: <20220710110451.245567-1-frederic.petrot@univ-grenoble-alpes.fr>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Cc: qemu-stable <qemu-stable@nongnu.org>
 Message-ID: <20240514051615.330979-1-alistair.francis@wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/insn16.decode |  7 ++++---
+ disas/riscv.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++-
- disas/riscv.c              | 27 +++++++++++++++++++++------
+file changed, 64 insertions(+), 1 deletion(-)
  target/riscv/translate.c   | 20 ++++++++++++++++++--
 files changed, 43 insertions(+), 11 deletions(-)
-diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn16.decode
-+++ b/target/riscv/insn16.decode
-@@ -XXX,XX +XXX,XX @@
- %imm_cb        12:s1 5:2 2:1 10:2 3:2 !function=ex_shift_1
- %imm_cj        12:s1 8:1 9:2 6:1 7:1 2:1 11:1 3:3 !function=ex_shift_1
--%shimm_6bit   12:1 2:5               !function=ex_rvc_shifti
-+%shlimm_6bit  12:1 2:5               !function=ex_rvc_shiftli
-+%shrimm_6bit  12:1 2:5               !function=ex_rvc_shiftri
- %uimm_6bit_lq 2:4 12:1 6:1           !function=ex_shift_4
- %uimm_6bit_ld 2:3 12:1 5:2           !function=ex_shift_3
- %uimm_6bit_lw 2:2 12:1 4:3           !function=ex_shift_2
-@@ -XXX,XX +XXX,XX @@
- @c_addi16sp     ... .  ..... ..... .. &i imm=%imm_addi16sp rs1=2 rd=2
- @c_shift        ... . .. ... ..... .. \
--                &shift rd=%rs1_3 rs1=%rs1_3 shamt=%shimm_6bit
-+                &shift rd=%rs1_3 rs1=%rs1_3 shamt=%shrimm_6bit
- @c_shift2       ... . .. ... ..... .. \
--                &shift rd=%rd rs1=%rd shamt=%shimm_6bit
-+                &shift rd=%rd rs1=%rd shamt=%shlimm_6bit
- @c_andi         ... . .. ... ..... .. &i imm=%imm_ci rs1=%rs1_3 rd=%rs1_3
 diff --git a/disas/riscv.c b/disas/riscv.c
 index XXXXXXX..XXXXXXX 100644
 --- a/disas/riscv.c
 +++ b/disas/riscv.c
-@@ -XXX,XX +XXX,XX @@ static int32_t operand_sbimm12(rv_inst inst)
+@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
-         ((inst << 56) >> 63) << 11;
+     case 0x0383: return "mibound";
- }
+     case 0x0384: return "mdbase";
+     case 0x0385: return "mdbound";
--static uint32_t operand_cimmsh6(rv_inst inst)
+-    case 0x03a0: return "pmpcfg3";
-+static uint32_t operand_cimmshl6(rv_inst inst, rv_isa isa)
++    case 0x03a0: return "pmpcfg0";
- {
++    case 0x03a1: return "pmpcfg1";
--    return ((inst << 51) >> 63) << 5 |
++    case 0x03a2: return "pmpcfg2";
-+    int imm = ((inst << 51) >> 63) << 5 |
++    case 0x03a3: return "pmpcfg3";
-         (inst << 57) >> 59;
++    case 0x03a4: return "pmpcfg4";
-+    if (isa == rv128) {
++    case 0x03a5: return "pmpcfg5";
-+        imm = imm ? imm : 64;
++    case 0x03a6: return "pmpcfg6";
-+    }
++    case 0x03a7: return "pmpcfg7";
-+    return imm;
++    case 0x03a8: return "pmpcfg8";
-+}
++    case 0x03a9: return "pmpcfg9";
-+
++    case 0x03aa: return "pmpcfg10";
-+static uint32_t operand_cimmshr6(rv_inst inst, rv_isa isa)
++    case 0x03ab: return "pmpcfg11";
-+{
++    case 0x03ac: return "pmpcfg12";
-+    int imm = ((inst << 51) >> 63) << 5 |
++    case 0x03ad: return "pmpcfg13";
-+        (inst << 57) >> 59;
++    case 0x03ae: return "pmpcfg14";
-+    if (isa == rv128) {
++    case 0x03af: return "pmpcfg15";
-+        imm = imm | (imm & 32) << 1;
+     case 0x03b0: return "pmpaddr0";
-+        imm = imm ? imm : 64;
+     case 0x03b1: return "pmpaddr1";
-+    }
+     case 0x03b2: return "pmpaddr2";
-+    return imm;
+@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
- }
+     case 0x03bd: return "pmpaddr13";
+     case 0x03be: return "pmpaddr14";
- static int32_t operand_cimmi(rv_inst inst)
+     case 0x03bf: return "pmpaddr15";
-@@ -XXX,XX +XXX,XX @@ static uint32_t operand_rnum(rv_inst inst)
++    case 0x03c0: return "pmpaddr16";
++    case 0x03c1: return "pmpaddr17";
- /* decode operands */
++    case 0x03c2: return "pmpaddr18";
++    case 0x03c3: return "pmpaddr19";
--static void decode_inst_operands(rv_decode *dec)
++    case 0x03c4: return "pmpaddr20";
-+static void decode_inst_operands(rv_decode *dec, rv_isa isa)
++    case 0x03c5: return "pmpaddr21";
- {
++    case 0x03c6: return "pmpaddr22";
-     rv_inst inst = dec->inst;
++    case 0x03c7: return "pmpaddr23";
-     dec->codec = opcode_data[dec->op].codec;
++    case 0x03c8: return "pmpaddr24";
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec)
++    case 0x03c9: return "pmpaddr25";
-     case rv_codec_cb_sh6:
++    case 0x03ca: return "pmpaddr26";
-         dec->rd = dec->rs1 = operand_crs1rdq(inst) + 8;
++    case 0x03cb: return "pmpaddr27";
-         dec->rs2 = rv_ireg_zero;
++    case 0x03cc: return "pmpaddr28";
--        dec->imm = operand_cimmsh6(inst);
++    case 0x03cd: return "pmpaddr29";
-+        dec->imm = operand_cimmshr6(inst, isa);
++    case 0x03ce: return "pmpaddr30";
-         break;
++    case 0x03cf: return "pmpaddr31";
-     case rv_codec_ci:
++    case 0x03d0: return "pmpaddr32";
-         dec->rd = dec->rs1 = operand_crs1rd(inst);
++    case 0x03d1: return "pmpaddr33";
-@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec)
++    case 0x03d2: return "pmpaddr34";
-     case rv_codec_ci_sh6:
++    case 0x03d3: return "pmpaddr35";
-         dec->rd = dec->rs1 = operand_crs1rd(inst);
++    case 0x03d4: return "pmpaddr36";
-         dec->rs2 = rv_ireg_zero;
++    case 0x03d5: return "pmpaddr37";
--        dec->imm = operand_cimmsh6(inst);
++    case 0x03d6: return "pmpaddr38";
-+        dec->imm = operand_cimmshl6(inst, isa);
++    case 0x03d7: return "pmpaddr39";
-         break;
++    case 0x03d8: return "pmpaddr40";
-     case rv_codec_ci_16sp:
++    case 0x03d9: return "pmpaddr41";
-         dec->rd = rv_ireg_sp;
++    case 0x03da: return "pmpaddr42";
-@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst)
++    case 0x03db: return "pmpaddr43";
-     dec.pc = pc;
++    case 0x03dc: return "pmpaddr44";
-     dec.inst = inst;
++    case 0x03dd: return "pmpaddr45";
-     decode_inst_opcode(&dec, isa);
++    case 0x03de: return "pmpaddr46";
--    decode_inst_operands(&dec);
++    case 0x03df: return "pmpaddr47";
-+    decode_inst_operands(&dec, isa);
++    case 0x03e0: return "pmpaddr48";
-     decode_inst_decompress(&dec, isa);
++    case 0x03e1: return "pmpaddr49";
-     decode_inst_lift_pseudo(&dec);
++    case 0x03e2: return "pmpaddr50";
-     format_inst(buf, buflen, 16, &dec);
++    case 0x03e3: return "pmpaddr51";
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
++    case 0x03e4: return "pmpaddr52";
-index XXXXXXX..XXXXXXX 100644
++    case 0x03e5: return "pmpaddr53";
---- a/target/riscv/translate.c
++    case 0x03e6: return "pmpaddr54";
-+++ b/target/riscv/translate.c
++    case 0x03e7: return "pmpaddr55";
-@@ -XXX,XX +XXX,XX @@ static int ex_rvc_register(DisasContext *ctx, int reg)
++    case 0x03e8: return "pmpaddr56";
-     return 8 + reg;
++    case 0x03e9: return "pmpaddr57";
- }
++    case 0x03ea: return "pmpaddr58";
++    case 0x03eb: return "pmpaddr59";
--static int ex_rvc_shifti(DisasContext *ctx, int imm)
++    case 0x03ec: return "pmpaddr60";
-+static int ex_rvc_shiftli(DisasContext *ctx, int imm)
++    case 0x03ed: return "pmpaddr61";
- {
++    case 0x03ee: return "pmpaddr62";
-     /* For RV128 a shamt of 0 means a shift by 64. */
++    case 0x03ef: return "pmpaddr63";
--    return imm ? imm : 64;
+     case 0x0780: return "mtohost";
-+    if (get_ol(ctx) == MXL_RV128) {
+     case 0x0781: return "mfromhost";
-+        imm = imm ? imm : 64;
+     case 0x0782: return "mreset";
 +    }
 +    return imm;
 +}
 +
 +static int ex_rvc_shiftri(DisasContext *ctx, int imm)
 +{
 +    /*
 +     * For RV128 a shamt of 0 means a shift by 64, furthermore, for right
 +     * shifts, the shamt is sign-extended.
 +     */
 +    if (get_ol(ctx) == MXL_RV128) {
 +        imm = imm | (imm & 32) << 1;
 +        imm = imm ? imm : 64;
 +    }
 +    return imm;
  }
  /* Include the auto-generated decoder for 32 bit insn */
 --
-.37.2
+.45.1

-[PULL 04/44] target/riscv: move zmmul out of the experimental properties
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-- Zmmul is ratified and is now version 1.0
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220710101546.3907-1-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     DEFINE_PROP_BOOL("zhinx", RISCVCPU, cfg.ext_zhinx, false),
-     DEFINE_PROP_BOOL("zhinxmin", RISCVCPU, cfg.ext_zhinxmin, false),
-+    DEFINE_PROP_BOOL("zmmul", RISCVCPU, cfg.ext_zmmul, false),
-+
-     /* Vendor-specific custom extensions */
-     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
-     /* These are experimental so mark with 'x-' */
-     DEFINE_PROP_BOOL("x-j", RISCVCPU, cfg.ext_j, false),
--    DEFINE_PROP_BOOL("x-zmmul", RISCVCPU, cfg.ext_zmmul, false),
-     /* ePMP 0.9.3 */
-     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
-     DEFINE_PROP_BOOL("x-aia", RISCVCPU, cfg.aia, false),
---
-.37.2

-[PULL 06/44] target/riscv: Add check for supported privilege mode combinations
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-There are 3 suggested privilege mode combinations listed in section 1.2
-of the riscv-privileged spec(draft-20220717):
-) M, 2) M, U 3) M, S, U
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-Id: <20220718130955.11899-2-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 6 ++++++
-file changed, 6 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-             return;
-         }
-+        if (cpu->cfg.ext_s && !cpu->cfg.ext_u) {
-+            error_setg(errp,
-+                       "Setting S extension without U extension is illegal");
-+            return;
-+        }
-+
-         if (cpu->cfg.ext_f && !cpu->cfg.ext_icsr) {
-             error_setg(errp, "F extension requires Zicsr");
-             return;
---
-.37.2

-[PULL 07/44] target/riscv: H extension depends on I extension
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Add check for "H depends on an I base integer ISA with 32 x registers"
-which is stated at the beginning of chapter 8 of the riscv-privileged
-spec(draft-20220717)
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-Id: <20220718130955.11899-3-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/cpu.c | 6 ++++++
-file changed, 6 insertions(+)
-diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
-             return;
-         }
-+        if (cpu->cfg.ext_h && !cpu->cfg.ext_i) {
-+            error_setg(errp,
-+                       "H depends on an I base integer ISA with 32 x registers");
-+            return;
-+        }
-+
-         if (cpu->cfg.ext_f && !cpu->cfg.ext_icsr) {
-             error_setg(errp, "F extension requires Zicsr");
-             return;
---
-.37.2

-[PULL 08/44] target/riscv: Fix checkpatch warning may triggered in csr_ops table
+Deleted patch
-From: Weiwei Li <liweiwei@iscas.ac.cn>
-Fix the lines with over 80 characters
-Fix the lines which are obviously misalgined with other lines in the
-same group
-Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Message-Id: <20220718130955.11899-4-liweiwei@iscas.ac.cn>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/csr.c | 441 ++++++++++++++++++++++++---------------------
-file changed, 234 insertions(+), 207 deletions(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-     [CSR_FRM]      = { "frm",      fs,     read_frm,     write_frm    },
-     [CSR_FCSR]     = { "fcsr",     fs,     read_fcsr,    write_fcsr   },
-     /* Vector CSRs */
--    [CSR_VSTART]   = { "vstart",   vs,    read_vstart,  write_vstart,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VXSAT]    = { "vxsat",    vs,    read_vxsat,   write_vxsat,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VXRM]     = { "vxrm",     vs,    read_vxrm,    write_vxrm,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VCSR]     = { "vcsr",     vs,    read_vcsr,    write_vcsr,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VL]       = { "vl",       vs,    read_vl,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VTYPE]    = { "vtype",    vs,    read_vtype,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VLENB]    = { "vlenb",    vs,    read_vlenb,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_VSTART]   = { "vstart",   vs,     read_vstart,  write_vstart,
-+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
-+    [CSR_VXSAT]    = { "vxsat",    vs,     read_vxsat,   write_vxsat,
-+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
-+    [CSR_VXRM]     = { "vxrm",     vs,     read_vxrm,    write_vxrm,
-+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
-+    [CSR_VCSR]     = { "vcsr",     vs,     read_vcsr,    write_vcsr,
-+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
-+    [CSR_VL]       = { "vl",       vs,     read_vl,
-+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
-+    [CSR_VTYPE]    = { "vtype",    vs,     read_vtype,
-+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
-+    [CSR_VLENB]    = { "vlenb",    vs,     read_vlenb,
-+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
-     /* User Timers and Counters */
-     [CSR_CYCLE]    = { "cycle",    ctr,    read_hpmcounter  },
-     [CSR_INSTRET]  = { "instret",  ctr,    read_hpmcounter  },
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
- #if !defined(CONFIG_USER_ONLY)
-     /* Machine Timers and Counters */
--    [CSR_MCYCLE]    = { "mcycle",    any,   read_hpmcounter, write_mhpmcounter},
--    [CSR_MINSTRET]  = { "minstret",  any,   read_hpmcounter, write_mhpmcounter},
--    [CSR_MCYCLEH]   = { "mcycleh",   any32, read_hpmcounterh, write_mhpmcounterh},
--    [CSR_MINSTRETH] = { "minstreth", any32, read_hpmcounterh, write_mhpmcounterh},
-+    [CSR_MCYCLE]    = { "mcycle",    any,   read_hpmcounter,
-+                        write_mhpmcounter                    },
-+    [CSR_MINSTRET]  = { "minstret",  any,   read_hpmcounter,
-+                        write_mhpmcounter                    },
-+    [CSR_MCYCLEH]   = { "mcycleh",   any32, read_hpmcounterh,
-+                        write_mhpmcounterh                   },
-+    [CSR_MINSTRETH] = { "minstreth", any32, read_hpmcounterh,
-+                        write_mhpmcounterh                   },
-     /* Machine Information Registers */
-     [CSR_MVENDORID] = { "mvendorid", any,   read_mvendorid },
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-     [CSR_MHARTID]   = { "mhartid",   any,   read_mhartid   },
-     [CSR_MCONFIGPTR]  = { "mconfigptr", any,   read_zero,
--                                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-     /* Machine Trap Setup */
--    [CSR_MSTATUS]     = { "mstatus",    any,   read_mstatus,     write_mstatus, NULL,
--                                               read_mstatus_i128                   },
--    [CSR_MISA]        = { "misa",       any,   read_misa,        write_misa, NULL,
--                                               read_misa_i128                      },
--    [CSR_MIDELEG]     = { "mideleg",    any,   NULL,    NULL,    rmw_mideleg       },
--    [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg,     write_medeleg     },
--    [CSR_MIE]         = { "mie",        any,   NULL,    NULL,    rmw_mie           },
--    [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,       write_mtvec       },
--    [CSR_MCOUNTEREN]  = { "mcounteren", any,   read_mcounteren,  write_mcounteren  },
--
--    [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,    write_mstatush    },
-+    [CSR_MSTATUS]     = { "mstatus",    any,   read_mstatus, write_mstatus,
-+                          NULL,                read_mstatus_i128           },
-+    [CSR_MISA]        = { "misa",       any,   read_misa,    write_misa,
-+                          NULL,                read_misa_i128              },
-+    [CSR_MIDELEG]     = { "mideleg",    any,   NULL, NULL,   rmw_mideleg   },
-+    [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg, write_medeleg },
-+    [CSR_MIE]         = { "mie",        any,   NULL, NULL,   rmw_mie       },
-+    [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,   write_mtvec   },
-+    [CSR_MCOUNTEREN]  = { "mcounteren", any,   read_mcounteren,
-+                          write_mcounteren                                 },
-+
-+    [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,
-+                          write_mstatush                                   },
-     /* Machine Trap Handling */
--    [CSR_MSCRATCH] = { "mscratch", any,  read_mscratch,      write_mscratch, NULL,
--                                         read_mscratch_i128, write_mscratch_i128   },
-+    [CSR_MSCRATCH] = { "mscratch", any,  read_mscratch, write_mscratch,
-+                       NULL, read_mscratch_i128, write_mscratch_i128   },
-     [CSR_MEPC]     = { "mepc",     any,  read_mepc,     write_mepc     },
-     [CSR_MCAUSE]   = { "mcause",   any,  read_mcause,   write_mcause   },
-     [CSR_MTVAL]    = { "mtval",    any,  read_mtval,    write_mtval    },
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-     [CSR_MIREG]    = { "mireg",    aia_any,   NULL, NULL,    rmw_xireg },
-     /* Machine-Level Interrupts (AIA) */
--    [CSR_MTOPEI]     = { "mtopei",     aia_any, NULL, NULL, rmw_xtopei },
--    [CSR_MTOPI]    = { "mtopi",    aia_any,   read_mtopi },
-+    [CSR_MTOPEI]   = { "mtopei",   aia_any, NULL, NULL, rmw_xtopei },
-+    [CSR_MTOPI]    = { "mtopi",    aia_any, read_mtopi },
-     /* Virtual Interrupts for Supervisor Level (AIA) */
--    [CSR_MVIEN]      = { "mvien", aia_any, read_zero, write_ignore },
--    [CSR_MVIP]       = { "mvip",  aia_any, read_zero, write_ignore },
-+    [CSR_MVIEN]    = { "mvien",    aia_any, read_zero, write_ignore },
-+    [CSR_MVIP]     = { "mvip",     aia_any, read_zero, write_ignore },
-     /* Machine-Level High-Half CSRs (AIA) */
-     [CSR_MIDELEGH] = { "midelegh", aia_any32, NULL, NULL, rmw_midelegh },
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-     /* Execution environment configuration */
-     [CSR_MENVCFG]  = { "menvcfg",  any,   read_menvcfg,  write_menvcfg,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-+                       .min_priv_ver = PRIV_VERSION_1_12_0              },
-     [CSR_MENVCFGH] = { "menvcfgh", any32, read_menvcfgh, write_menvcfgh,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-+                       .min_priv_ver = PRIV_VERSION_1_12_0              },
-     [CSR_SENVCFG]  = { "senvcfg",  smode, read_senvcfg,  write_senvcfg,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-+                       .min_priv_ver = PRIV_VERSION_1_12_0              },
-     [CSR_HENVCFG]  = { "henvcfg",  hmode, read_henvcfg, write_henvcfg,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-+                       .min_priv_ver = PRIV_VERSION_1_12_0              },
-     [CSR_HENVCFGH] = { "henvcfgh", hmode32, read_henvcfgh, write_henvcfgh,
--                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-+                       .min_priv_ver = PRIV_VERSION_1_12_0              },
-     /* Supervisor Trap Setup */
--    [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus, NULL,
--                                              read_sstatus_i128                 },
--    [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie          },
--    [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec      },
--    [CSR_SCOUNTEREN] = { "scounteren", smode, read_scounteren, write_scounteren },
-+    [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
-+                         NULL,                read_sstatus_i128               },
-+    [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie        },
-+    [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec    },
-+    [CSR_SCOUNTEREN] = { "scounteren", smode, read_scounteren,
-+                         write_scounteren                                     },
-     /* Supervisor Trap Handling */
--    [CSR_SSCRATCH] = { "sscratch", smode, read_sscratch, write_sscratch, NULL,
--                                          read_sscratch_i128, write_sscratch_i128  },
-+    [CSR_SSCRATCH] = { "sscratch", smode, read_sscratch, write_sscratch,
-+                       NULL, read_sscratch_i128, write_sscratch_i128    },
-     [CSR_SEPC]     = { "sepc",     smode, read_sepc,     write_sepc     },
-     [CSR_SCAUSE]   = { "scause",   smode, read_scause,   write_scause   },
--    [CSR_STVAL]    = { "stval",    smode, read_stval,   write_stval   },
-+    [CSR_STVAL]    = { "stval",    smode, read_stval,    write_stval    },
-     [CSR_SIP]      = { "sip",      smode, NULL,    NULL, rmw_sip        },
-     /* Supervisor Protection and Translation */
--    [CSR_SATP]     = { "satp",     smode, read_satp,    write_satp      },
-+    [CSR_SATP]     = { "satp",     smode, read_satp,     write_satp     },
-     /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
-     [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-     [CSR_SIEH]       = { "sieh",   aia_smode32, NULL, NULL, rmw_sieh },
-     [CSR_SIPH]       = { "siph",   aia_smode32, NULL, NULL, rmw_siph },
--    [CSR_HSTATUS]     = { "hstatus",     hmode,   read_hstatus,   write_hstatus,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_HEDELEG]     = { "hedeleg",     hmode,   read_hedeleg,   write_hedeleg,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_HSTATUS]     = { "hstatus",     hmode,   read_hstatus, write_hstatus,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_HEDELEG]     = { "hedeleg",     hmode,   read_hedeleg, write_hedeleg,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-     [CSR_HIDELEG]     = { "hideleg",     hmode,   NULL,   NULL, rmw_hideleg,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_HVIP]        = { "hvip",        hmode,   NULL,   NULL,   rmw_hvip,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_HIP]         = { "hip",         hmode,   NULL,   NULL,   rmw_hip,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_HIE]         = { "hie",         hmode,   NULL,   NULL,    rmw_hie,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_HCOUNTEREN]  = { "hcounteren",  hmode,   read_hcounteren, write_hcounteren,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_HGEIE]       = { "hgeie",       hmode,   read_hgeie,       write_hgeie,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_HTVAL]       = { "htval",       hmode,   read_htval,     write_htval,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_HTINST]      = { "htinst",      hmode,   read_htinst,    write_htinst,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_HVIP]        = { "hvip",        hmode,   NULL,   NULL, rmw_hvip,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_HIP]         = { "hip",         hmode,   NULL,   NULL, rmw_hip,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_HIE]         = { "hie",         hmode,   NULL,   NULL, rmw_hie,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_HCOUNTEREN]  = { "hcounteren",  hmode,   read_hcounteren,
-+                          write_hcounteren,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_HGEIE]       = { "hgeie",       hmode,   read_hgeie,   write_hgeie,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_HTVAL]       = { "htval",       hmode,   read_htval,   write_htval,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_HTINST]      = { "htinst",      hmode,   read_htinst,  write_htinst,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-     [CSR_HGEIP]       = { "hgeip",       hmode,   read_hgeip,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_HGATP]       = { "hgatp",       hmode,   read_hgatp,     write_hgatp,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta, write_htimedelta,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_HTIMEDELTAH] = { "htimedeltah", hmode32, read_htimedeltah, write_htimedeltah,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--
--    [CSR_VSSTATUS]    = { "vsstatus",    hmode,   read_vsstatus,  write_vsstatus,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VSIP]        = { "vsip",        hmode,   NULL,    NULL,  rmw_vsip,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VSIE]        = { "vsie",        hmode,   NULL,    NULL,    rmw_vsie ,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VSTVEC]      = { "vstvec",      hmode,   read_vstvec,    write_vstvec,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VSSCRATCH]   = { "vsscratch",   hmode,   read_vsscratch, write_vsscratch,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VSEPC]       = { "vsepc",       hmode,   read_vsepc,     write_vsepc,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VSCAUSE]     = { "vscause",     hmode,   read_vscause,   write_vscause,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VSTVAL]      = { "vstval",      hmode,   read_vstval,    write_vstval,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_VSATP]       = { "vsatp",       hmode,   read_vsatp,     write_vsatp,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--
--    [CSR_MTVAL2]      = { "mtval2",      hmode,   read_mtval2,    write_mtval2,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
--    [CSR_MTINST]      = { "mtinst",      hmode,   read_mtinst,    write_mtinst,
--                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_HGATP]       = { "hgatp",       hmode,   read_hgatp,   write_hgatp,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta,
-+                          write_htimedelta,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_HTIMEDELTAH] = { "htimedeltah", hmode32, read_htimedeltah,
-+                          write_htimedeltah,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+
-+    [CSR_VSSTATUS]    = { "vsstatus",    hmode,   read_vsstatus,
-+                          write_vsstatus,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_VSIP]        = { "vsip",        hmode,   NULL,    NULL, rmw_vsip,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_VSIE]        = { "vsie",        hmode,   NULL,    NULL, rmw_vsie ,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_VSTVEC]      = { "vstvec",      hmode,   read_vstvec,   write_vstvec,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_VSSCRATCH]   = { "vsscratch",   hmode,   read_vsscratch,
-+                          write_vsscratch,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_VSEPC]       = { "vsepc",       hmode,   read_vsepc,    write_vsepc,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_VSCAUSE]     = { "vscause",     hmode,   read_vscause,  write_vscause,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_VSTVAL]      = { "vstval",      hmode,   read_vstval,   write_vstval,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_VSATP]       = { "vsatp",       hmode,   read_vsatp,    write_vsatp,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+
-+    [CSR_MTVAL2]      = { "mtval2",      hmode,   read_mtval2,   write_mtval2,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-+    [CSR_MTINST]      = { "mtinst",      hmode,   read_mtinst,   write_mtinst,
-+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
-     /* Virtual Interrupts and Interrupt Priorities (H-extension with AIA) */
-     [CSR_HVIEN]       = { "hvien",       aia_hmode, read_zero, write_ignore },
--    [CSR_HVICTL]      = { "hvictl",      aia_hmode, read_hvictl, write_hvictl },
--    [CSR_HVIPRIO1]    = { "hviprio1",    aia_hmode, read_hviprio1,   write_hviprio1 },
--    [CSR_HVIPRIO2]    = { "hviprio2",    aia_hmode, read_hviprio2,   write_hviprio2 },
-+    [CSR_HVICTL]      = { "hvictl",      aia_hmode, read_hvictl,
-+                          write_hvictl                                      },
-+    [CSR_HVIPRIO1]    = { "hviprio1",    aia_hmode, read_hviprio1,
-+                          write_hviprio1                                    },
-+    [CSR_HVIPRIO2]    = { "hviprio2",    aia_hmode, read_hviprio2,
-+                          write_hviprio2                                    },
-     /*
-      * VS-Level Window to Indirectly Accessed Registers (H-extension with AIA)
-      */
--    [CSR_VSISELECT]   = { "vsiselect",   aia_hmode, NULL, NULL,      rmw_xiselect },
--    [CSR_VSIREG]      = { "vsireg",      aia_hmode, NULL, NULL,      rmw_xireg },
-+    [CSR_VSISELECT]   = { "vsiselect",   aia_hmode, NULL, NULL,
-+                          rmw_xiselect                                     },
-+    [CSR_VSIREG]      = { "vsireg",      aia_hmode, NULL, NULL, rmw_xireg  },
-     /* VS-Level Interrupts (H-extension with AIA) */
-     [CSR_VSTOPEI]     = { "vstopei",     aia_hmode, NULL, NULL, rmw_xtopei },
-     [CSR_VSTOPI]      = { "vstopi",      aia_hmode, read_vstopi },
-     /* Hypervisor and VS-Level High-Half CSRs (H-extension with AIA) */
--    [CSR_HIDELEGH]    = { "hidelegh",    aia_hmode32, NULL, NULL, rmw_hidelegh },
--    [CSR_HVIENH]      = { "hvienh",      aia_hmode32, read_zero, write_ignore },
-+    [CSR_HIDELEGH]    = { "hidelegh",    aia_hmode32, NULL, NULL,
-+                          rmw_hidelegh                                      },
-+    [CSR_HVIENH]      = { "hvienh",      aia_hmode32, read_zero,
-+                          write_ignore                                      },
-     [CSR_HVIPH]       = { "hviph",       aia_hmode32, NULL, NULL, rmw_hviph },
--    [CSR_HVIPRIO1H]   = { "hviprio1h",   aia_hmode32, read_hviprio1h, write_hviprio1h },
--    [CSR_HVIPRIO2H]   = { "hviprio2h",   aia_hmode32, read_hviprio2h, write_hviprio2h },
-+    [CSR_HVIPRIO1H]   = { "hviprio1h",   aia_hmode32, read_hviprio1h,
-+                          write_hviprio1h                                   },
-+    [CSR_HVIPRIO2H]   = { "hviprio2h",   aia_hmode32, read_hviprio2h,
-+                          write_hviprio2h                                   },
-     [CSR_VSIEH]       = { "vsieh",       aia_hmode32, NULL, NULL, rmw_vsieh },
-     [CSR_VSIPH]       = { "vsiph",       aia_hmode32, NULL, NULL, rmw_vsiph },
-     /* Physical Memory Protection */
-     [CSR_MSECCFG]    = { "mseccfg",  epmp, read_mseccfg, write_mseccfg,
--                                     .min_priv_ver = PRIV_VERSION_1_11_0 },
-+                         .min_priv_ver = PRIV_VERSION_1_11_0           },
-     [CSR_PMPCFG0]    = { "pmpcfg0",   pmp, read_pmpcfg,  write_pmpcfg  },
-     [CSR_PMPCFG1]    = { "pmpcfg1",   pmp, read_pmpcfg,  write_pmpcfg  },
-     [CSR_PMPCFG2]    = { "pmpcfg2",   pmp, read_pmpcfg,  write_pmpcfg  },
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-     [CSR_TDATA3]    =  { "tdata3",  debug, read_tdata,   write_tdata   },
-     /* User Pointer Masking */
--    [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,    write_umte    },
--    [CSR_UPMMASK] =    { "upmmask", pointer_masking, read_upmmask, write_upmmask },
--    [CSR_UPMBASE] =    { "upmbase", pointer_masking, read_upmbase, write_upmbase },
-+    [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,  write_umte },
-+    [CSR_UPMMASK] =    { "upmmask", pointer_masking, read_upmmask,
-+                         write_upmmask                                      },
-+    [CSR_UPMBASE] =    { "upmbase", pointer_masking, read_upmbase,
-+                         write_upmbase                                      },
-     /* Machine Pointer Masking */
--    [CSR_MMTE]    =    { "mmte",    pointer_masking, read_mmte,    write_mmte    },
--    [CSR_MPMMASK] =    { "mpmmask", pointer_masking, read_mpmmask, write_mpmmask },
--    [CSR_MPMBASE] =    { "mpmbase", pointer_masking, read_mpmbase, write_mpmbase },
-+    [CSR_MMTE]    =    { "mmte",    pointer_masking, read_mmte,  write_mmte },
-+    [CSR_MPMMASK] =    { "mpmmask", pointer_masking, read_mpmmask,
-+                         write_mpmmask                                      },
-+    [CSR_MPMBASE] =    { "mpmbase", pointer_masking, read_mpmbase,
-+                         write_mpmbase                                      },
-     /* Supervisor Pointer Masking */
--    [CSR_SMTE]    =    { "smte",    pointer_masking, read_smte,    write_smte    },
--    [CSR_SPMMASK] =    { "spmmask", pointer_masking, read_spmmask, write_spmmask },
--    [CSR_SPMBASE] =    { "spmbase", pointer_masking, read_spmbase, write_spmbase },
-+    [CSR_SMTE]    =    { "smte",    pointer_masking, read_smte,  write_smte },
-+    [CSR_SPMMASK] =    { "spmmask", pointer_masking, read_spmmask,
-+                         write_spmmask                                      },
-+    [CSR_SPMBASE] =    { "spmbase", pointer_masking, read_spmbase,
-+                         write_spmbase                                      },
-     /* Performance Counters */
-     [CSR_HPMCOUNTER3]    = { "hpmcounter3",    ctr,    read_hpmcounter },
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-     [CSR_HPMCOUNTER31]   = { "hpmcounter31",   ctr,    read_hpmcounter },
-     [CSR_MHPMCOUNTER3]   = { "mhpmcounter3",   mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER4]   = { "mhpmcounter4",   mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER5]   = { "mhpmcounter5",   mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER6]   = { "mhpmcounter6",   mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER7]   = { "mhpmcounter7",   mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER8]   = { "mhpmcounter8",   mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER9]   = { "mhpmcounter9",   mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER10]  = { "mhpmcounter10",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER11]  = { "mhpmcounter11",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER12]  = { "mhpmcounter12",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER13]  = { "mhpmcounter13",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER14]  = { "mhpmcounter14",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER15]  = { "mhpmcounter15",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER16]  = { "mhpmcounter16",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER17]  = { "mhpmcounter17",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER18]  = { "mhpmcounter18",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER19]  = { "mhpmcounter19",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER20]  = { "mhpmcounter20",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER21]  = { "mhpmcounter21",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER22]  = { "mhpmcounter22",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER23]  = { "mhpmcounter23",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER24]  = { "mhpmcounter24",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER25]  = { "mhpmcounter25",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER26]  = { "mhpmcounter26",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER27]  = { "mhpmcounter27",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER28]  = { "mhpmcounter28",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER29]  = { "mhpmcounter29",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER30]  = { "mhpmcounter30",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MHPMCOUNTER31]  = { "mhpmcounter31",  mctr,    read_hpmcounter,
--                                                       write_mhpmcounter },
-+                             write_mhpmcounter                         },
-     [CSR_MCOUNTINHIBIT]  = { "mcountinhibit",  any, read_mcountinhibit,
--               write_mcountinhibit, .min_priv_ver = PRIV_VERSION_1_11_0  },
-+                             write_mcountinhibit,
-+                             .min_priv_ver = PRIV_VERSION_1_11_0       },
-     [CSR_MHPMEVENT3]     = { "mhpmevent3",     any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT4]     = { "mhpmevent4",     any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT5]     = { "mhpmevent5",     any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT6]     = { "mhpmevent6",     any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT7]     = { "mhpmevent7",     any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT8]     = { "mhpmevent8",     any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT9]     = { "mhpmevent9",     any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT10]    = { "mhpmevent10",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT11]    = { "mhpmevent11",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT12]    = { "mhpmevent12",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT13]    = { "mhpmevent13",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT14]    = { "mhpmevent14",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT15]    = { "mhpmevent15",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT16]    = { "mhpmevent16",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT17]    = { "mhpmevent17",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT18]    = { "mhpmevent18",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT19]    = { "mhpmevent19",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT20]    = { "mhpmevent20",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT21]    = { "mhpmevent21",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT22]    = { "mhpmevent22",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT23]    = { "mhpmevent23",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT24]    = { "mhpmevent24",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT25]    = { "mhpmevent25",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT26]    = { "mhpmevent26",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT27]    = { "mhpmevent27",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT28]    = { "mhpmevent28",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT29]    = { "mhpmevent29",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT30]    = { "mhpmevent30",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_MHPMEVENT31]    = { "mhpmevent31",    any,    read_mhpmevent,
--                                                       write_mhpmevent },
-+                             write_mhpmevent                           },
-     [CSR_HPMCOUNTER3H]   = { "hpmcounter3h",   ctr32,  read_hpmcounterh },
-     [CSR_HPMCOUNTER4H]   = { "hpmcounter4h",   ctr32,  read_hpmcounterh },
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-     [CSR_HPMCOUNTER31H]  = { "hpmcounter31h",  ctr32,  read_hpmcounterh },
-     [CSR_MHPMCOUNTER3H]  = { "mhpmcounter3h",  mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER4H]  = { "mhpmcounter4h",  mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER5H]  = { "mhpmcounter5h",  mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER6H]  = { "mhpmcounter6h",  mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER7H]  = { "mhpmcounter7h",  mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER8H]  = { "mhpmcounter8h",  mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER9H]  = { "mhpmcounter9h",  mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER10H] = { "mhpmcounter10h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER11H] = { "mhpmcounter11h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER12H] = { "mhpmcounter12h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER13H] = { "mhpmcounter13h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER14H] = { "mhpmcounter14h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER15H] = { "mhpmcounter15h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER16H] = { "mhpmcounter16h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER17H] = { "mhpmcounter17h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER18H] = { "mhpmcounter18h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER19H] = { "mhpmcounter19h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER20H] = { "mhpmcounter20h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER21H] = { "mhpmcounter21h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER22H] = { "mhpmcounter22h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER23H] = { "mhpmcounter23h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER24H] = { "mhpmcounter24h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER25H] = { "mhpmcounter25h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER26H] = { "mhpmcounter26h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER27H] = { "mhpmcounter27h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER28H] = { "mhpmcounter28h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER29H] = { "mhpmcounter29h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER30H] = { "mhpmcounter30h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
-     [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", mctr32,  read_hpmcounterh,
--                                                       write_mhpmcounterh },
-+                             write_mhpmcounterh                         },
- #endif /* !CONFIG_USER_ONLY */
- };
---
-.37.2

-[PULL 12/44] roms/opensbi: Upgrade from v1.0 to v1.1
+Deleted patch
-From: Bin Meng <bmeng.cn@gmail.com>
-Upgrade OpenSBI from v1.0 to v1.1 and the pre-built bios images.
-The v1.1 release includes the following commits:
-b99603 lib: utils/ipi: Fix size check in aclint_mswi_cold_init()
-dde435 lib: utils/sys: Extend HTIF library to allow custom base address
-8257262 platform: sifive_fu740: do not use a global in da9063_reset/shutdown
-fb688d9 platform: sifive_fu740: fix reset when watchdog is running
-d025eb lib: fix pointer of type 'void *' used in arithmetic
-f593 lib: sbi: Map only the counters enabled in hardware
-b7c204 lib: sbi: Disable interrupt during config matching
-a26dc60 lib: sbi: Disable interrupt and inhibit counting in M-mode during init
-d53b55 Makefile: fix build with binutils 2.38
-ad8917 lib: fix compilation when strings.h is included
-ce4c018 lib: utils/serial: Round UART8250 baud rate divisor to nearest integer
-d0 include: sbi: Add AIA related CSR defines
-f96070 lib: sbi: Detect AIA CSRs at boot-time
-b4c7c lib: sbi: Use AIA CSRs for local interrupts when available
-f lib: sbi: Add sbi_trap_set_external_irqfn() API
-f56314 lib: utils/irqchip: Allow multiple FDT irqchip drivers
-1050940 include: sbi: Introduce nascent_init() platform callback
-e79f8 lib: sbi: Enable mie.MEIE bit for IPIs based on external interrupts.
-f73669 lib: utils/irqchip: Add IMSIC library
-da5c lib: utils/irqchip: Add FDT based driver for IMSIC
-aaa lib: utils: Disable appropriate IMSIC DT nodes in fdt_fixups()
-9979265 lib: utils/irqchip: Add APLIC initialization library
-3461219 lib: utils/irqchip: Add FDT based driver for APLIC
-e2ef4f lib: utils: Disable appropriate APLIC DT nodes in fdt_fixups()
-a69cc1 lib: sbi: fix typo in is_region_subset
-f2ccf2f lib: sbi: verbose sbi_domain_root_add_memregion
-f3f4604 lib: sbi: Add a simple external interrupt handling framework
-a71 lib: utils: serial: Initial commit of xlnx-uartlite
-dfbd3c lib: pmp_set/pmp_get moved errors from runtime to compile time
-b6b7220 firmware: Fix code for accessing hart_count and stack_size
-d552fc8 lib: Add error messages via conditional compilation for the future
-bdb1 include: Use static asserts for SBI_PLATFORM_xxx_OFFSET defines
-b42d3a include: Use static asserts for SBI_SCRATCH_xxx_OFFSET defines
-a0b include: Use static asserts for FW_DYNAMIC_INFO_xxx_OFFSET defines
-f80d include: Add defines for [m|h|s]envcfg CSRs
-fecad lib: sbi: Detect menvcfg CSR at boot time
-d6765 lib: sbi: Enable Zicbo[m|z] extensions in the menvcfg CSR
-f lib: sbi: Enable Svpbmt extension in the menvcfg CSR
-a lib: sbi: Add Smstateen extension defines
-d44568a lib: sbi: Detect Smstateen CSRs at boot-time
-d6a lib: irqchip/imsic: configure mstateen
-c5cbb5 lib: utils/serial: support 'reg-offset' property
-c1e47d0 include: correct the definition of MSTATUS_VS
-cd95e1 lib: sbi/hart: preserve csr validation value
-ae9 docs: pmu: Improve the PMU DT bindings
-d62f6da lib: sbi: Implement Sstc extension
-a9d4 lib: sbi: Fix mstatus_init() for RV32 when Sscofpmf is not available
-e576b3e include: sbi: Define SBI_PMU_HW_EVENT_MAX to 256
-b0c9df5 lib: sbi: Fix mhpmeventh access for rv32 in absence of sscofpmf
-a754bb lib: sbi: Detect and print privileged spec version
-a6be99 lib: sbi: Remove 's' and 'u' from misa_string() output
-b8b377 lib: sbi: Update the name of ISA string printed at boot time
-d4b563c lib: sbi: Remove MCOUNTEREN and SCOUNTEREN hart features
-dbc3d8f lib: sbi: Remove MCOUNTINHIBT hart feature
-a17c2 lib: sbi: Remove MENVCFG hart feature
-a6ab94f lib: sbi: Fix AIA feature detection
-cad6c91 lib: sbi: Convert hart features into hart extensions
-be4903a lib: sbi: Detect hart features only once for each hart
-ace3 lib: sbi: Add sbi_hart_update_extension() function
-f0ad lib: sbi_platform: Add callback to populate HART extensions
-f726f2d Makefile: Allow generated C source to be anywhere in build directory
-fb474b Makefile: Add support for generating C array at compile time
-cf511 lib: utils/reset: Generate FDT reset driver list at compile-time
-e62705 lib: utils/serial: Generate FDT serial driver list at compile-time
-bfeb305 lib: utils/timer: Generate FDT timer driver list at compile-time
-a69d12 lib: utils/irqchip: Generate FDT irqchip driver list at compile-time
-ee0c57 lib: utils/ipi: Generate FDT ipi driver list at compile-time
-ed43 lib: utils/i2c: Generate FDT i2c adapter driver list at compile-time
-eacd82 lib: utils/gpio: Generate FDT gpio driver list at compile-time
-a3a3c60 platform: generic: Generate platform override module list at compile-time
-a7a677 platform: generic: Move Sifive platform overrides into own directory
-c14d lib: utils/irqchip: fix typo when checking for CPU node
-a9dd2 lib: utils/fdt: introduce fdt_node_is_enabled()
-da52 lib: utils: check if CPU node is enabled
-bb4e platform: generic: check if CPU node is enabled
-bc67db lib: utils/fdt: rename fdt_parse_max_hart_id
-f067bb8 lib: sbi: fix system_opcode_insn
-fab0379 lib: utils/fdt: Require match data to be const
-e5f3 lib: sbi_timer: Drop unnecessary get_platform_ticks wrapper
-ff65bfe lib: sbi_illegal_insn: Constify illegal_insn_table
-cb8271c lib: sbi_illegal_insn: Add emulation for fence.tso
-adc3388 lib: sbi_trap: Redirect exception based on hedeleg
-ce1d618 platform: generic: add overrides for vendor extensions
-b20ed9f lib: sbi_hsm: Call a device hook during hart resume
-e42eb lib: sbi_hsm: Assume a consistent resume address
-ea7799 lib: irqchip/plic: Constify plic_data pointers
-c362e7 lib: irqchip/plic: Factor out a context init function
-ecf2 lib: irqchip/plic: Add context save/restore helpers
-b79b69 lib: irqchip/plic: Add priority save/restore helpers
-be3df lib: utils/irqchip: Add FDT wrappers for PLIC save/restore functions
-e56758 lib: utils/irqchip: Add wrapper for T-HEAD PLIC delegation
-dc5ec5 platform: Add HSM implementation for Allwinner D1
-c70c include: sbi: Add mtinst/htinst psuedoinstructions
-f lib: sbi: Fixup tinst for exceptions in sbi_misaligned_*()
-a07402a lib: sbi: Fix tval and tinst for sbi_get_insn()
-c653001 lib: utils: Remove CSRs that set/clear an IMSIC interrupt file bits
-7738345 lib: utils/timer: Add a separate compatible for the D1 CLINT
-d76a196 lib: irqchip/plic: fix typo in plic_warm_irqchip_init
-f1fe98 lib: utils/timer: Remove Allwinner D1 CLINT compatibles
-c6fdbcf include: sbi: Change spec version to 1.0
-f66465 lib: pmu: allow to use the highest available counter
-4489876 include: Bump-up version to 1.1
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220713090613.204046-1-bmeng.cn@gmail.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 108504 -> 117704 bytes
- .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 105296 -> 115344 bytes
- roms/opensbi                                  |   2 +-
-files changed, 1 insertion(+), 1 deletion(-)
-diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
-index XXXXXXX..XXXXXXX 100644
-Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
-diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
-index XXXXXXX..XXXXXXX 100644
-Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
-diff --git a/roms/opensbi b/roms/opensbi
-index XXXXXXX..XXXXXXX 160000
---- a/roms/opensbi
-+++ b/roms/opensbi
-@@ -1 +1 @@
--Subproject commit 48f91ee9c960f048c4a7d1da4447d31e04931e38
-+Subproject commit 4489876e933d8ba0d8bc6c64bae71e295d45faac
---
-.37.2

-[PULL 14/44] docs: List kvm as a supported accelerator on RISC-V
+Deleted patch
-From: Bin Meng <bin.meng@windriver.com>
-Since commit fbf43c7dbf18 ("target/riscv: enable riscv kvm accel"),
-KVM accelerator is supported on RISC-V. Let's document it.
-Signed-off-by: Bin Meng <bin.meng@windriver.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220719082635.3741878-1-bin.meng@windriver.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- docs/about/build-platforms.rst | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/about/build-platforms.rst
-+++ b/docs/about/build-platforms.rst
-@@ -XXX,XX +XXX,XX @@ Those hosts are officially supported, with various accelerators:
-    * - PPC
-      - kvm, tcg
-    * - RISC-V
--     - tcg
-+     - kvm, tcg
-    * - s390x
-      - kvm, tcg
-    * - SPARC
---
-.37.2

-[PULL 17/44] target/riscv: rvv: Add mask agnostic for vx instructions
+Deleted patch
-From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>
-Signed-off-by: eop Chen <eop.chen@sifive.com>
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <165570784143.17634.35095816584573691-3@git.sr.ht>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/vector_helper.c            | 3 +++
- target/riscv/insn_trans/trans_rvv.c.inc | 2 ++
-files changed, 5 insertions(+)
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
-+++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
-     uint32_t vl = env->vl;
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-     uint32_t vta = vext_vta(desc);
-+    uint32_t vma = vext_vma(desc);
-     uint32_t i;
-     for (i = env->vstart; i < vl; i++) {
-         if (!vm && !vext_elem_mask(v0, i)) {
-+            /* set masked-off elements to 1s */
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-             continue;
-         }
-         fn(vd, s1, vs2, i);
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
-     data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
-     data = FIELD_DP32(data, VDATA, VTA, s->vta);
-     data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
-+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
-     desc = tcg_constant_i32(simd_desc(s->cfg_ptr->vlen / 8,
-                                       s->cfg_ptr->vlen / 8, data));
-@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
-     data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
-     data = FIELD_DP32(data, VDATA, VTA, s->vta);
-     data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
-+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
-     desc = tcg_constant_i32(simd_desc(s->cfg_ptr->vlen / 8,
-                                       s->cfg_ptr->vlen / 8, data));
---
-.37.2

-[PULL 18/44] target/riscv: rvv: Add mask agnostic for vector integer shift instructions
+Deleted patch
-From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>
-Signed-off-by: eop Chen <eop.chen@sifive.com>
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <165570784143.17634.35095816584573691-4@git.sr.ht>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/vector_helper.c            | 7 +++++++
- target/riscv/insn_trans/trans_rvv.c.inc | 1 +
-files changed, 8 insertions(+)
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
-+++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,                          \
-     uint32_t esz = sizeof(TS1);                                           \
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);          \
-     uint32_t vta = vext_vta(desc);                                        \
-+    uint32_t vma = vext_vma(desc);                                        \
-     uint32_t i;                                                           \
-                                                                           \
-     for (i = env->vstart; i < vl; i++) {                                  \
-         if (!vm && !vext_elem_mask(v0, i)) {                              \
-+            /* set masked-off elements to 1s */                           \
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);           \
-             continue;                                                     \
-         }                                                                 \
-         TS1 s1 = *((TS1 *)vs1 + HS1(i));                                  \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,      \
-     uint32_t total_elems =                                  \
-         vext_get_total_elems(env, desc, esz);               \
-     uint32_t vta = vext_vta(desc);                          \
-+    uint32_t vma = vext_vma(desc);                          \
-     uint32_t i;                                             \
-                                                             \
-     for (i = env->vstart; i < vl; i++) {                    \
-         if (!vm && !vext_elem_mask(v0, i)) {                \
-+            /* set masked-off elements to 1s */             \
-+            vext_set_elems_1s(vd, vma, i * esz,             \
-+                              (i + 1) * esz);               \
-             continue;                                       \
-         }                                                   \
-         TS2 s2 = *((TS2 *)vs2 + HS2(i));                    \
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
-         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
-         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
-         data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
-+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
-         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
-                            vreg_ofs(s, a->rs1),                    \
-                            vreg_ofs(s, a->rs2), cpu_env,           \
---
-.37.2

-[PULL 19/44] target/riscv: rvv: Add mask agnostic for vector integer comparison instructions
+Deleted patch
-From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>
-Signed-off-by: eop Chen <eop.chen@sifive.com>
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <165570784143.17634.35095816584573691-5@git.sr.ht>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/vector_helper.c            | 10 ++++++++++
- target/riscv/insn_trans/trans_rvv.c.inc |  1 +
-files changed, 11 insertions(+)
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
-+++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
-     uint32_t vl = env->vl;                                    \
-     uint32_t total_elems = env_archcpu(env)->cfg.vlen;        \
-     uint32_t vta_all_1s = vext_vta_all_1s(desc);              \
-+    uint32_t vma = vext_vma(desc);                            \
-     uint32_t i;                                               \
-                                                               \
-     for (i = env->vstart; i < vl; i++) {                      \
-         ETYPE s1 = *((ETYPE *)vs1 + H(i));                    \
-         ETYPE s2 = *((ETYPE *)vs2 + H(i));                    \
-         if (!vm && !vext_elem_mask(v0, i)) {                  \
-+            /* set masked-off elements to 1s */               \
-+            if (vma) {                                        \
-+                vext_set_elem_mask(vd, i, 1);                 \
-+            }                                                 \
-             continue;                                         \
-         }                                                     \
-         vext_set_elem_mask(vd, i, DO_OP(s2, s1));             \
-@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,   \
-     uint32_t vl = env->vl;                                          \
-     uint32_t total_elems = env_archcpu(env)->cfg.vlen;              \
-     uint32_t vta_all_1s = vext_vta_all_1s(desc);                    \
-+    uint32_t vma = vext_vma(desc);                                  \
-     uint32_t i;                                                     \
-                                                                     \
-     for (i = env->vstart; i < vl; i++) {                            \
-         ETYPE s2 = *((ETYPE *)vs2 + H(i));                          \
-         if (!vm && !vext_elem_mask(v0, i)) {                        \
-+            /* set masked-off elements to 1s */                     \
-+            if (vma) {                                              \
-+                vext_set_elem_mask(vd, i, 1);                       \
-+            }                                                       \
-             continue;                                               \
-         }                                                           \
-         vext_set_elem_mask(vd, i,                                   \
-diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
-         data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
-         data =                                                     \
-             FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);\
-+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
-         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
-                            vreg_ofs(s, a->rs1),                    \
-                            vreg_ofs(s, a->rs2), cpu_env,           \
---
-.37.2

-[PULL 20/44] target/riscv: rvv: Add mask agnostic for vector fix-point arithmetic instructions
+Deleted patch
-From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>
-Signed-off-by: eop Chen <eop.chen@sifive.com>
-Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <165570784143.17634.35095816584573691-6@git.sr.ht>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/vector_helper.c | 26 ++++++++++++++++----------
-file changed, 16 insertions(+), 10 deletions(-)
-diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/vector_helper.c
-+++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ static inline void
- vext_vv_rm_1(void *vd, void *v0, void *vs1, void *vs2,
-              CPURISCVState *env,
-              uint32_t vl, uint32_t vm, int vxrm,
--             opivv2_rm_fn *fn)
-+             opivv2_rm_fn *fn, uint32_t vma, uint32_t esz)
- {
-     for (uint32_t i = env->vstart; i < vl; i++) {
-         if (!vm && !vext_elem_mask(v0, i)) {
-+            /* set masked-off elements to 1s */
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-             continue;
-         }
-         fn(vd, vs1, vs2, i, env, vxrm);
-@@ -XXX,XX +XXX,XX @@ vext_vv_rm_2(void *vd, void *v0, void *vs1, void *vs2,
-     uint32_t vl = env->vl;
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-     uint32_t vta = vext_vta(desc);
-+    uint32_t vma = vext_vma(desc);
-     switch (env->vxrm) {
-     case 0: /* rnu */
-         vext_vv_rm_1(vd, v0, vs1, vs2,
--                     env, vl, vm, 0, fn);
-+                     env, vl, vm, 0, fn, vma, esz);
-         break;
-     case 1: /* rne */
-         vext_vv_rm_1(vd, v0, vs1, vs2,
--                     env, vl, vm, 1, fn);
-+                     env, vl, vm, 1, fn, vma, esz);
-         break;
-     case 2: /* rdn */
-         vext_vv_rm_1(vd, v0, vs1, vs2,
--                     env, vl, vm, 2, fn);
-+                     env, vl, vm, 2, fn, vma, esz);
-         break;
-     default: /* rod */
-         vext_vv_rm_1(vd, v0, vs1, vs2,
--                     env, vl, vm, 3, fn);
-+                     env, vl, vm, 3, fn, vma, esz);
-         break;
-     }
-     /* set tail elements to 1s */
-@@ -XXX,XX +XXX,XX @@ static inline void
- vext_vx_rm_1(void *vd, void *v0, target_long s1, void *vs2,
-              CPURISCVState *env,
-              uint32_t vl, uint32_t vm, int vxrm,
--             opivx2_rm_fn *fn)
-+             opivx2_rm_fn *fn, uint32_t vma, uint32_t esz)
- {
-     for (uint32_t i = env->vstart; i < vl; i++) {
-         if (!vm && !vext_elem_mask(v0, i)) {
-+            /* set masked-off elements to 1s */
-+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-             continue;
-         }
-         fn(vd, s1, vs2, i, env, vxrm);
-@@ -XXX,XX +XXX,XX @@ vext_vx_rm_2(void *vd, void *v0, target_long s1, void *vs2,
-     uint32_t vl = env->vl;
-     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-     uint32_t vta = vext_vta(desc);
-+    uint32_t vma = vext_vma(desc);
-     switch (env->vxrm) {
-     case 0: /* rnu */
-         vext_vx_rm_1(vd, v0, s1, vs2,
--                     env, vl, vm, 0, fn);
-+                     env, vl, vm, 0, fn, vma, esz);
-         break;
-     case 1: /* rne */
-         vext_vx_rm_1(vd, v0, s1, vs2,
--                     env, vl, vm, 1, fn);
-+                     env, vl, vm, 1, fn, vma, esz);
-         break;
-     case 2: /* rdn */
-         vext_vx_rm_1(vd, v0, s1, vs2,
--                     env, vl, vm, 2, fn);
-+                     env, vl, vm, 2, fn, vma, esz);
-         break;
-     default: /* rod */
-         vext_vx_rm_1(vd, v0, s1, vs2,
--                     env, vl, vm, 3, fn);
-+                     env, vl, vm, 3, fn, vma, esz);
-         break;
-     }
-     /* set tail elements to 1s */
---
-.37.2

-[PULL 28/44] hw/riscv: opentitan: bump opentitan version
+Deleted patch
-From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
-The following patch updates opentitan to match the new configuration,
-as per, lowRISC/opentitan@217a0168ba118503c166a9587819e3811eeb0c0c
-Note: with this patch we now skip the usage of the opentitan
-`boot_rom`. The Opentitan boot rom contains hw verification
-for devies which we are currently not supporting in qemu. As of now,
-the `boot_rom` has no major significance, however, would be good to
-support in the future.
-Tested by running utests from the latest tock [1]
-(that supports this version of OT).
-[1] https://github.com/tock/tock/pull/3056
-Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220812005229.358850-1-wilfred.mallawa@opensource.wdc.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/hw/riscv/opentitan.h | 11 ++++++-----
- hw/riscv/opentitan.c         | 12 ++++++++----
-files changed, 14 insertions(+), 9 deletions(-)
-diff --git a/include/hw/riscv/opentitan.h b/include/hw/riscv/opentitan.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/opentitan.h
-+++ b/include/hw/riscv/opentitan.h
-@@ -XXX,XX +XXX,XX @@ enum {
-     IBEX_DEV_TIMER,
-     IBEX_DEV_SENSOR_CTRL,
-     IBEX_DEV_OTP_CTRL,
-+    IBEX_DEV_LC_CTRL,
-     IBEX_DEV_PWRMGR,
-     IBEX_DEV_RSTMGR,
-     IBEX_DEV_CLKMGR,
-@@ -XXX,XX +XXX,XX @@ enum {
-     IBEX_UART0_RX_BREAK_ERR_IRQ   = 6,
-     IBEX_UART0_RX_TIMEOUT_IRQ     = 7,
-     IBEX_UART0_RX_PARITY_ERR_IRQ  = 8,
--    IBEX_TIMER_TIMEREXPIRED0_0    = 126,
--    IBEX_SPI_HOST0_ERR_IRQ        = 150,
--    IBEX_SPI_HOST0_SPI_EVENT_IRQ  = 151,
--    IBEX_SPI_HOST1_ERR_IRQ        = 152,
--    IBEX_SPI_HOST1_SPI_EVENT_IRQ  = 153,
-+    IBEX_TIMER_TIMEREXPIRED0_0    = 127,
-+    IBEX_SPI_HOST0_ERR_IRQ        = 151,
-+    IBEX_SPI_HOST0_SPI_EVENT_IRQ  = 152,
-+    IBEX_SPI_HOST1_ERR_IRQ        = 153,
-+    IBEX_SPI_HOST1_SPI_EVENT_IRQ  = 154,
- };
- #endif
-diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/opentitan.c
-+++ b/hw/riscv/opentitan.c
-@@ -XXX,XX +XXX,XX @@
- #include "sysemu/sysemu.h"
- static const MemMapEntry ibex_memmap[] = {
--    [IBEX_DEV_ROM] =            {  0x00008000, 16 * KiB },
--    [IBEX_DEV_RAM] =            {  0x10000000,  0x10000 },
--    [IBEX_DEV_FLASH] =          {  0x20000000,  0x80000 },
-+    [IBEX_DEV_ROM] =            {  0x00008000,   0x8000 },
-+    [IBEX_DEV_RAM] =            {  0x10000000,  0x20000 },
-+    [IBEX_DEV_FLASH] =          {  0x20000000,  0x100000 },
-     [IBEX_DEV_UART] =           {  0x40000000,  0x1000  },
-     [IBEX_DEV_GPIO] =           {  0x40040000,  0x1000  },
-     [IBEX_DEV_SPI_DEVICE] =     {  0x40050000,  0x1000  },
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry ibex_memmap[] = {
-     [IBEX_DEV_TIMER] =          {  0x40100000,  0x1000  },
-     [IBEX_DEV_SENSOR_CTRL] =    {  0x40110000,  0x1000  },
-     [IBEX_DEV_OTP_CTRL] =       {  0x40130000,  0x4000  },
-+    [IBEX_DEV_LC_CTRL] =        {  0x40140000,  0x1000  },
-     [IBEX_DEV_USBDEV] =         {  0x40150000,  0x1000  },
-     [IBEX_DEV_SPI_HOST0] =      {  0x40300000,  0x1000  },
-     [IBEX_DEV_SPI_HOST1] =      {  0x40310000,  0x1000  },
-@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
-                             &error_abort);
-     object_property_set_int(OBJECT(&s->cpus), "num-harts", ms->smp.cpus,
-                             &error_abort);
--    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x8080, &error_abort);
-+    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x20000490,
-+                            &error_abort);
-     sysbus_realize(SYS_BUS_DEVICE(&s->cpus), &error_fatal);
-     /* Boot ROM */
-@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
-         memmap[IBEX_DEV_SENSOR_CTRL].base, memmap[IBEX_DEV_SENSOR_CTRL].size);
-     create_unimplemented_device("riscv.lowrisc.ibex.otp_ctrl",
-         memmap[IBEX_DEV_OTP_CTRL].base, memmap[IBEX_DEV_OTP_CTRL].size);
-+    create_unimplemented_device("riscv.lowrisc.ibex.lc_ctrl",
-+        memmap[IBEX_DEV_LC_CTRL].base, memmap[IBEX_DEV_LC_CTRL].size);
-     create_unimplemented_device("riscv.lowrisc.ibex.pwrmgr",
-         memmap[IBEX_DEV_PWRMGR].base, memmap[IBEX_DEV_PWRMGR].size);
-     create_unimplemented_device("riscv.lowrisc.ibex.rstmgr",
---
-.37.2

-[PULL 29/44] hw/riscv: microchip_pfsoc: fix kernel panics due to missing peripherals
+Deleted patch
-From: Conor Dooley <conor.dooley@microchip.com>
-Booting using "Direct Kernel Boot" for PolarFire SoC & skipping u-boot
-entirely is probably not advisable, but it does at least show signs of
-life. Recent Linux kernel versions make use of peripherals that are
-missing definitions in QEMU and lead to kernel panics. These issues
-almost certain rear their head for other methods of booting, but I was
-unable to figure out a suitable HSS version that is recent enough to
-support these peripherals & works with QEMU.
-With these peripherals added, booting a kernel with the following hangs
-hangs waiting for the system controller's hwrng, but the kernel no
-longer panics. With the Linux driver for hwrng disabled, it boots to
-console.
-qemu-system-riscv64 -M microchip-icicle-kit \
-    -m 2G -smp 5 \
-    -kernel $(vmlinux_bin) \
-    -dtb  $(dtb)\
-    -initrd $(initramfs) \
-    -display none -serial null \
-    -serial stdio
-More peripherals are added than strictly required to fix the panics in
-the hopes of avoiding a replication of this problem in the future.
-Some of the peripherals which are in the device tree for recent kernels
-are implemented in the FPGA fabric. The eMMC/SD mux, which exists as
-an unimplemented device is replaced by a wider entry. This updated
-entry covers both the mux & the remainder of the FPGA fabric connected
-to the MSS using Fabric Interrconnect (FIC) 3.
-Link: https://github.com/polarfire-soc/icicle-kit-reference-design#fabric-memory-map
-Link: https://ww1.microchip.com/downloads/aemDocuments/documents/FPGA/ProductDocuments/SupportingCollateral/V1_4_Register_Map.zip
-Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20220813135127.2971754-1-mail@conchuod.ie>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/hw/riscv/microchip_pfsoc.h | 14 ++++++-
- hw/riscv/microchip_pfsoc.c         | 67 +++++++++++++++++++++++++++---
-files changed, 74 insertions(+), 7 deletions(-)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
-+++ b/include/hw/riscv/microchip_pfsoc.h
-@@ -XXX,XX +XXX,XX @@ enum {
-     MICROCHIP_PFSOC_L2LIM,
-     MICROCHIP_PFSOC_PLIC,
-     MICROCHIP_PFSOC_MMUART0,
-+    MICROCHIP_PFSOC_WDOG0,
-     MICROCHIP_PFSOC_SYSREG,
-+    MICROCHIP_PFSOC_AXISW,
-     MICROCHIP_PFSOC_MPUCFG,
-+    MICROCHIP_PFSOC_FMETER,
-     MICROCHIP_PFSOC_DDR_SGMII_PHY,
-     MICROCHIP_PFSOC_EMMC_SD,
-     MICROCHIP_PFSOC_DDR_CFG,
-@@ -XXX,XX +XXX,XX @@ enum {
-     MICROCHIP_PFSOC_MMUART2,
-     MICROCHIP_PFSOC_MMUART3,
-     MICROCHIP_PFSOC_MMUART4,
-+    MICROCHIP_PFSOC_WDOG1,
-+    MICROCHIP_PFSOC_WDOG2,
-+    MICROCHIP_PFSOC_WDOG3,
-+    MICROCHIP_PFSOC_WDOG4,
-     MICROCHIP_PFSOC_SPI0,
-     MICROCHIP_PFSOC_SPI1,
-+    MICROCHIP_PFSOC_I2C0,
-     MICROCHIP_PFSOC_I2C1,
-+    MICROCHIP_PFSOC_CAN0,
-+    MICROCHIP_PFSOC_CAN1,
-     MICROCHIP_PFSOC_GEM0,
-     MICROCHIP_PFSOC_GEM1,
-     MICROCHIP_PFSOC_GPIO0,
-     MICROCHIP_PFSOC_GPIO1,
-     MICROCHIP_PFSOC_GPIO2,
-+    MICROCHIP_PFSOC_RTC,
-     MICROCHIP_PFSOC_ENVM_CFG,
-     MICROCHIP_PFSOC_ENVM_DATA,
-+    MICROCHIP_PFSOC_USB,
-     MICROCHIP_PFSOC_QSPI_XIP,
-     MICROCHIP_PFSOC_IOSCB,
--    MICROCHIP_PFSOC_EMMC_SD_MUX,
-+    MICROCHIP_PFSOC_FABRIC_FIC3,
-     MICROCHIP_PFSOC_DRAM_LO,
-     MICROCHIP_PFSOC_DRAM_LO_ALIAS,
-     MICROCHIP_PFSOC_DRAM_HI,
-diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/microchip_pfsoc.c
-+++ b/hw/riscv/microchip_pfsoc.c
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
-     [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,  0x2000000 },
-     [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,  0x4000000 },
-     [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,     0x1000 },
-+    [MICROCHIP_PFSOC_WDOG0] =           { 0x20001000,     0x1000 },
-     [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,     0x2000 },
-+    [MICROCHIP_PFSOC_AXISW] =           { 0x20004000,     0x1000 },
-     [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,     0x1000 },
-+    [MICROCHIP_PFSOC_FMETER] =          { 0x20006000,     0x1000 },
-     [MICROCHIP_PFSOC_DDR_SGMII_PHY] =   { 0x20007000,     0x1000 },
-     [MICROCHIP_PFSOC_EMMC_SD] =         { 0x20008000,     0x1000 },
-     [MICROCHIP_PFSOC_DDR_CFG] =         { 0x20080000,    0x40000 },
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
-     [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,     0x1000 },
-     [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,     0x1000 },
-     [MICROCHIP_PFSOC_MMUART4] =         { 0x20106000,     0x1000 },
-+    [MICROCHIP_PFSOC_WDOG1] =           { 0x20101000,     0x1000 },
-+    [MICROCHIP_PFSOC_WDOG2] =           { 0x20103000,     0x1000 },
-+    [MICROCHIP_PFSOC_WDOG3] =           { 0x20105000,     0x1000 },
-+    [MICROCHIP_PFSOC_WDOG4] =           { 0x20106000,     0x1000 },
-     [MICROCHIP_PFSOC_SPI0] =            { 0x20108000,     0x1000 },
-     [MICROCHIP_PFSOC_SPI1] =            { 0x20109000,     0x1000 },
-+    [MICROCHIP_PFSOC_I2C0] =            { 0x2010a000,     0x1000 },
-     [MICROCHIP_PFSOC_I2C1] =            { 0x2010b000,     0x1000 },
-+    [MICROCHIP_PFSOC_CAN0] =            { 0x2010c000,     0x1000 },
-+    [MICROCHIP_PFSOC_CAN1] =            { 0x2010d000,     0x1000 },
-     [MICROCHIP_PFSOC_GEM0] =            { 0x20110000,     0x2000 },
-     [MICROCHIP_PFSOC_GEM1] =            { 0x20112000,     0x2000 },
-     [MICROCHIP_PFSOC_GPIO0] =           { 0x20120000,     0x1000 },
-     [MICROCHIP_PFSOC_GPIO1] =           { 0x20121000,     0x1000 },
-     [MICROCHIP_PFSOC_GPIO2] =           { 0x20122000,     0x1000 },
-+    [MICROCHIP_PFSOC_RTC] =             { 0x20124000,     0x1000 },
-     [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,     0x1000 },
-     [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
-+    [MICROCHIP_PFSOC_USB] =             { 0x20201000,     0x1000 },
-     [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,  0x1000000 },
-     [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000, 0x10000000 },
--    [MICROCHIP_PFSOC_EMMC_SD_MUX] =     { 0x4f000000,        0x4 },
-+    [MICROCHIP_PFSOC_FABRIC_FIC3] =     { 0x40000000, 0x20000000 },
-     [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000, 0x40000000 },
-     [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000, 0x40000000 },
-     [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,        0x0 },
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
-     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysreg), 0,
-                     memmap[MICROCHIP_PFSOC_SYSREG].base);
-+    /* AXISW */
-+    create_unimplemented_device("microchip.pfsoc.axisw",
-+        memmap[MICROCHIP_PFSOC_AXISW].base,
-+        memmap[MICROCHIP_PFSOC_AXISW].size);
-+
-     /* MPUCFG */
-     create_unimplemented_device("microchip.pfsoc.mpucfg",
-         memmap[MICROCHIP_PFSOC_MPUCFG].base,
-         memmap[MICROCHIP_PFSOC_MPUCFG].size);
-+    /* FMETER */
-+    create_unimplemented_device("microchip.pfsoc.fmeter",
-+        memmap[MICROCHIP_PFSOC_FMETER].base,
-+        memmap[MICROCHIP_PFSOC_FMETER].size);
-+
-     /* DDR SGMII PHY */
-     sysbus_realize(SYS_BUS_DEVICE(&s->ddr_sgmii_phy), errp);
-     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ddr_sgmii_phy), 0,
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
-         qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART4_IRQ),
-         serial_hd(4));
-+    /* Watchdogs */
-+    create_unimplemented_device("microchip.pfsoc.watchdog0",
-+        memmap[MICROCHIP_PFSOC_WDOG0].base,
-+        memmap[MICROCHIP_PFSOC_WDOG0].size);
-+    create_unimplemented_device("microchip.pfsoc.watchdog1",
-+        memmap[MICROCHIP_PFSOC_WDOG1].base,
-+        memmap[MICROCHIP_PFSOC_WDOG1].size);
-+    create_unimplemented_device("microchip.pfsoc.watchdog2",
-+        memmap[MICROCHIP_PFSOC_WDOG2].base,
-+        memmap[MICROCHIP_PFSOC_WDOG2].size);
-+    create_unimplemented_device("microchip.pfsoc.watchdog3",
-+        memmap[MICROCHIP_PFSOC_WDOG3].base,
-+        memmap[MICROCHIP_PFSOC_WDOG3].size);
-+    create_unimplemented_device("microchip.pfsoc.watchdog4",
-+        memmap[MICROCHIP_PFSOC_WDOG4].base,
-+        memmap[MICROCHIP_PFSOC_WDOG4].size);
-+
-     /* SPI */
-     create_unimplemented_device("microchip.pfsoc.spi0",
-         memmap[MICROCHIP_PFSOC_SPI0].base,
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
-         memmap[MICROCHIP_PFSOC_SPI1].base,
-         memmap[MICROCHIP_PFSOC_SPI1].size);
--    /* I2C1 */
-+    /* I2C */
-+    create_unimplemented_device("microchip.pfsoc.i2c0",
-+        memmap[MICROCHIP_PFSOC_I2C0].base,
-+        memmap[MICROCHIP_PFSOC_I2C0].size);
-     create_unimplemented_device("microchip.pfsoc.i2c1",
-         memmap[MICROCHIP_PFSOC_I2C1].base,
-         memmap[MICROCHIP_PFSOC_I2C1].size);
-+    /* CAN */
-+    create_unimplemented_device("microchip.pfsoc.can0",
-+        memmap[MICROCHIP_PFSOC_CAN0].base,
-+        memmap[MICROCHIP_PFSOC_CAN0].size);
-+    create_unimplemented_device("microchip.pfsoc.can1",
-+        memmap[MICROCHIP_PFSOC_CAN1].base,
-+        memmap[MICROCHIP_PFSOC_CAN1].size);
-+
-+    /* USB */
-+    create_unimplemented_device("microchip.pfsoc.usb",
-+        memmap[MICROCHIP_PFSOC_USB].base,
-+        memmap[MICROCHIP_PFSOC_USB].size);
-+
-     /* GEMs */
-     nd = &nd_table[0];
-@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
-     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ioscb), 0,
-                     memmap[MICROCHIP_PFSOC_IOSCB].base);
--    /* eMMC/SD mux */
--    create_unimplemented_device("microchip.pfsoc.emmc_sd_mux",
--        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].base,
--        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].size);
-+    /* FPGA Fabric */
-+    create_unimplemented_device("microchip.pfsoc.fabricfic3",
-+        memmap[MICROCHIP_PFSOC_FABRIC_FIC3].base,
-+        memmap[MICROCHIP_PFSOC_FABRIC_FIC3].size);
-     /* QSPI Flash */
-     memory_region_init_rom(qspi_xip_mem, OBJECT(dev),
---
-.37.2

-[PULL 30/44] target/riscv: Remove additional priv version check for mcountinhibit
+Deleted patch
-From: Atish Patra <atishp@rivosinc.com>
-With .min_priv_version, additiona priv version check is uncessary
-for mcountinhibit read/write functions.
-Reviewed-by: Heiko Stuebner <heiko@sntech.de>
-Tested-by: Heiko Stuebner <heiko@sntech.de>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Atish Patra <atishp@rivosinc.com>
-Message-Id: <20220816232321.558250-7-atishp@rivosinc.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- target/riscv/csr.c | 8 --------
-file changed, 8 deletions(-)
-diff --git a/target/riscv/csr.c b/target/riscv/csr.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/csr.c
-+++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mtvec(CPURISCVState *env, int csrno,
- static RISCVException read_mcountinhibit(CPURISCVState *env, int csrno,
-                                          target_ulong *val)
- {
--    if (env->priv_ver < PRIV_VERSION_1_11_0) {
--        return RISCV_EXCP_ILLEGAL_INST;
--    }
--
-     *val = env->mcountinhibit;
-     return RISCV_EXCP_NONE;
- }
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
-     int cidx;
-     PMUCTRState *counter;
--    if (env->priv_ver < PRIV_VERSION_1_11_0) {
--        return RISCV_EXCP_ILLEGAL_INST;
--    }
--
-     env->mcountinhibit = val;
-     /* Check if any other counter is also monitoring cycles/instructions */
---
-.37.2

-[PULL 31/44] hw/riscv: virt: fix uart node name
+Deleted patch
-From: Conor Dooley <conor.dooley@microchip.com>
-"uart" is not a node name that complies with the dt-schema.
-Change the node name to "serial" to ix warnings seen during
-dt-validate on a dtbdump of the virt machine such as:
-/stuff/qemu/qemu.dtb: uart@10000000: $nodename:0: 'uart@10000000' does not match '^serial(@.*)?$'
-        From schema: /stuff/linux/Documentation/devicetree/bindings/serial/8250.yaml
-Reported-by: Rob Herring <robh@kernel.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
-Message-id: 20220810184612.157317-2-mail@conchuod.ie
-Link: https://lore.kernel.org/linux-riscv/20220803170552.GA2250266-robh@kernel.org/
-Fixes: 04331d0b56 ("RISC-V VirtIO Machine")
-Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
-+++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_uart(RISCVVirtState *s, const MemMapEntry *memmap,
-     char *name;
-     MachineState *mc = MACHINE(s);
--    name = g_strdup_printf("/soc/uart@%lx", (long)memmap[VIRT_UART0].base);
-+    name = g_strdup_printf("/soc/serial@%lx", (long)memmap[VIRT_UART0].base);
-     qemu_fdt_add_subnode(mc->fdt, name);
-     qemu_fdt_setprop_string(mc->fdt, name, "compatible", "ns16550a");
-     qemu_fdt_setprop_cells(mc->fdt, name, "reg",
---
-.37.2

-[PULL 32/44] hw/riscv: virt: fix the plic's address cells
+Deleted patch
-From: Conor Dooley <conor.dooley@microchip.com>
-When optional AIA PLIC support was added the to the virt machine, the
-address cells property was removed leading the issues with dt-validate
-on a dump from the virt machine:
-/stuff/qemu/qemu.dtb: plic@c000000: '#address-cells' is a required property
-        From schema: /stuff/linux/Documentation/devicetree/bindings/interrupt-controller/sifive,plic-1.0.0.yaml
-Add back the property to suppress the warning.
-Reported-by: Rob Herring <robh@kernel.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
-Message-id: 20220810184612.157317-3-mail@conchuod.ie
-Link: https://lore.kernel.org/linux-riscv/20220803170552.GA2250266-robh@kernel.org/
-Fixes: e6faee6585 ("hw/riscv: virt: Add optional AIA APLIC support to virt machine")
-Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- include/hw/riscv/virt.h | 1 +
- hw/riscv/virt.c         | 2 ++
-files changed, 3 insertions(+)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
-+++ b/include/hw/riscv/virt.h
-@@ -XXX,XX +XXX,XX @@ enum {
- #define FDT_PCI_ADDR_CELLS    3
- #define FDT_PCI_INT_CELLS     1
-+#define FDT_PLIC_ADDR_CELLS   0
- #define FDT_PLIC_INT_CELLS    1
- #define FDT_APLIC_INT_CELLS   2
- #define FDT_IMSIC_INT_CELLS   0
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
-+++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
-     qemu_fdt_add_subnode(mc->fdt, plic_name);
-     qemu_fdt_setprop_cell(mc->fdt, plic_name,
-         "#interrupt-cells", FDT_PLIC_INT_CELLS);
-+    qemu_fdt_setprop_cell(mc->fdt, plic_name,
-+        "#address-cells", FDT_PLIC_ADDR_CELLS);
-     qemu_fdt_setprop_string_array(mc->fdt, plic_name, "compatible",
-                                   (char **)&plic_compat,
-                                   ARRAY_SIZE(plic_compat));
---
-.37.2

-[PULL 33/44] hw/riscv: virt: fix syscon subnode paths
+Deleted patch
-From: Conor Dooley <conor.dooley@microchip.com>
-The reset and poweroff features of the syscon were originally added to
-top level, which is a valid path for a syscon subnode. Subsequently a
-reorganisation was carried out while implementing NUMA in which the
-subnodes were moved into the /soc node. As /soc is a "simple-bus", this
-path is invalid, and so dt-validate produces the following warnings:
-/stuff/qemu/qemu.dtb: soc: poweroff: {'value': [[21845]], 'offset': [[0]], 'regmap': [[4]], 'compatible': ['syscon-poweroff']} should not be valid under {'type': 'object'}
-        From schema: /home/conor/.local/lib/python3.9/site-packages/dtschema/schemas/simple-bus.yaml
-/stuff/qemu/qemu.dtb: soc: reboot: {'value': [[30583]], 'offset': [[0]], 'regmap': [[4]], 'compatible': ['syscon-reboot']} should not be valid under {'type': 'object'}
-        From schema: /home/conor/.local/lib/python3.9/site-packages/dtschema/schemas/simple-bus.yaml
-Move the syscon subnodes back to the top level and silence the warnings.
-Reported-by: Rob Herring <robh@kernel.org>
-Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20220810184612.157317-4-mail@conchuod.ie
-Link: https://lore.kernel.org/linux-riscv/20220803170552.GA2250266-robh@kernel.org/
-Fixes: 18df0b4695 ("hw/riscv: virt: Allow creating multiple NUMA sockets")
-Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
----
- hw/riscv/virt.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/virt.c
-+++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_reset(RISCVVirtState *s, const MemMapEntry *memmap,
-     test_phandle = qemu_fdt_get_phandle(mc->fdt, name);
-     g_free(name);
--    name = g_strdup_printf("/soc/reboot");
-+    name = g_strdup_printf("/reboot");
-     qemu_fdt_add_subnode(mc->fdt, name);
-     qemu_fdt_setprop_string(mc->fdt, name, "compatible", "syscon-reboot");
-     qemu_fdt_setprop_cell(mc->fdt, name, "regmap", test_phandle);
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_reset(RISCVVirtState *s, const MemMapEntry *memmap,
-     qemu_fdt_setprop_cell(mc->fdt, name, "value", FINISHER_RESET);
-     g_free(name);
--    name = g_strdup_printf("/soc/poweroff");
-+    name = g_strdup_printf("/poweroff");
-     qemu_fdt_add_subnode(mc->fdt, name);
-     qemu_fdt_setprop_string(mc->fdt, name, "compatible", "syscon-poweroff");
-     qemu_fdt_setprop_cell(mc->fdt, name, "regmap", test_phandle);
---
-.37.2

-[PULL 39/44] target/riscv: Add vstimecmp support
+[PULL 28/28] target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR
-From: Atish Patra <atishp@rivosinc.com>
+From: Yu-Ming Chang <yumin686@andestech.com>
-vstimecmp CSR allows the guest OS or to program the next guest timer
+Both CSRRS and CSRRC always read the addressed CSR and cause any read side
-interrupt directly. Thus, hypervisor no longer need to inject the
+effects regardless of rs1 and rd fields. Note that if rs1 specifies a register
-timer interrupt to the guest if vstimecmp is used. This was ratified
+holding a zero value other than x0, the instruction will still attempt to write
-as a part of the Sstc extension.
+the unmodified value back to the CSR and will cause any attendant side effects.
+So if CSRRS or CSRRC tries to write a read-only CSR with rs1 which specifies
+a register holding a zero value, an illegal instruction exception should be
+raised.
+Signed-off-by: Yu-Ming Chang <yumin686@andestech.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Atish Patra <atishp@rivosinc.com>
+Message-ID: <20240403070823.80897-1-yumin686@andestech.com>
 Message-Id: <20220824221357.41070-4-atishp@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h         |  4 ++
+ target/riscv/cpu.h       |  4 ++++
- target/riscv/cpu_bits.h    |  4 ++
+ target/riscv/csr.c       | 51 ++++++++++++++++++++++++++++++++++++----
- target/riscv/cpu_helper.c  | 11 +++--
+ target/riscv/op_helper.c |  6 ++---
- target/riscv/csr.c         | 88 ++++++++++++++++++++++++++++++++++++--
+files changed, 53 insertions(+), 8 deletions(-)
  target/riscv/machine.c     |  1 +
  target/riscv/time_helper.c | 16 +++++++
 files changed, 118 insertions(+), 6 deletions(-)
 diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.h
 +++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
+@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
-     /* Sstc CSRs */
+ void riscv_cpu_update_mask(CPURISCVState *env);
-     uint64_t stimecmp;
+ bool riscv_cpu_is_32bit(RISCVCPU *cpu);
-+    uint64_t vstimecmp;
++RISCVException riscv_csrr(CPURISCVState *env, int csrno,
-+
++                          target_ulong *ret_value);
-     /* physical memory protection */
+ RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
-     pmp_table_t pmp_state;
+                            target_ulong *ret_value,
-     target_ulong mseccfg;
+                            target_ulong new_value, target_ulong write_mask);
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
+@@ -XXX,XX +XXX,XX @@ typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
+                                           target_ulong new_value,
-     /* Fields from here on are preserved across CPU reset. */
+                                           target_ulong write_mask);
-     QEMUTimer *stimer; /* Internal timer for S-mode interrupt */
-+    QEMUTimer *vstimer; /* Internal timer for VS-mode interrupt */
++RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
-+    bool vstime_irq;
++                               Int128 *ret_value);
+ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
-     hwaddr kernel_addr;
+                                 Int128 *ret_value,
-     hwaddr fdt_addr;
+                                 Int128 new_value, Int128 write_mask);
 diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_bits.h
 +++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
  #define CSR_VSIP            0x244
  #define CSR_VSATP           0x280
 +/* Sstc virtual CSRs */
 +#define CSR_VSTIMECMP       0x24D
 +#define CSR_VSTIMECMPH      0x25D
 +
  #define CSR_MTINST          0x34a
  #define CSR_MTVAL2          0x34b
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_cpu_all_pending(CPURISCVState *env)
  {
      uint32_t gein = get_field(env->hstatus, HSTATUS_VGEIN);
      uint64_t vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
 +    uint64_t vstip = (env->vstime_irq) ? MIP_VSTIP : 0;
 -    return (env->mip | vsgein) & env->mie;
 +    return (env->mip | vsgein | vstip) & env->mie;
  }
  int riscv_cpu_mirq_pending(CPURISCVState *env)
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value)
  {
      CPURISCVState *env = &cpu->env;
      CPUState *cs = CPU(cpu);
 -    uint64_t gein, vsgein = 0, old = env->mip;
 +    uint64_t gein, vsgein = 0, vstip = 0, old = env->mip;
      bool locked = false;
      if (riscv_cpu_virt_enabled(env)) {
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value)
          vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
      }
 +    /* No need to update mip for VSTIP */
 +    mask = ((mask == MIP_VSTIP) && env->vstime_irq) ? 0 : mask;
 +    vstip = env->vstime_irq ? MIP_VSTIP : 0;
 +
      if (!qemu_mutex_iothread_locked()) {
          locked = true;
          qemu_mutex_lock_iothread();
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value)
      env->mip = (env->mip & ~mask) | (value & mask);
 -    if (env->mip | vsgein) {
 +    if (env->mip | vsgein | vstip) {
          cpu_interrupt(cs, CPU_INTERRUPT_HARD);
      } else {
          cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException sstc(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
  static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
                                                 int csrno,
 -                                               bool write_mask)
 +                                               bool write)
  {
-     CPUState *cs = env_cpu(env);
+     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
-     RISCVCPU *cpu = RISCV_CPU(cs);
+     bool read_only = get_field(csrno, 0xC00) == 3;
-+    bool hmode_check = false;
+@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
+     }
-     if (!cpu->cfg.ext_sstc || !env->rdtime_fn) {
-         return RISCV_EXCP_ILLEGAL_INST;
+     /* read / write check */
-@@ -XXX,XX +XXX,XX @@ static RISCVException sstc(CPURISCVState *env, int csrno)
+-    if (write_mask && read_only) {
 +    if (write && read_only) {
          return RISCV_EXCP_ILLEGAL_INST;
      }
--    return smode(env, csrno);
+@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
-+    if (riscv_cpu_virt_enabled(env)) {
+     return RISCV_EXCP_NONE;
-+        if (!(get_field(env->hcounteren, COUNTEREN_TM) &
+ }
-+              get_field(env->henvcfg, HENVCFG_STCE))) {
-+            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
++RISCVException riscv_csrr(CPURISCVState *env, int csrno,
-+        }
++                           target_ulong *ret_value)
 +{
 +    RISCVException ret = riscv_csrrw_check(env, csrno, false);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
-+    if ((csrno == CSR_VSTIMECMP) || (csrno == CSR_VSTIMECMPH)) {
++    return riscv_csrrw_do64(env, csrno, ret_value, 0, 0);
-+        hmode_check = true;
++}
 +
  RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                             target_ulong *ret_value,
                             target_ulong new_value, target_ulong write_mask)
  {
 -    RISCVException ret = riscv_csrrw_check(env, csrno, write_mask);
 +    RISCVException ret = riscv_csrrw_check(env, csrno, true);
      if (ret != RISCV_EXCP_NONE) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
 +RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
 +                               Int128 *ret_value)
 +{
 +    RISCVException ret;
 +
 +    ret = riscv_csrrw_check(env, csrno, false);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
-+    return hmode_check ? hmode(env, csrno) : smode(env, csrno);
++    if (csr_ops[csrno].read128) {
- }
++        return riscv_csrrw_do128(env, csrno, ret_value,
++                                 int128_zero(), int128_zero());
- static RISCVException sstc_32(CPURISCVState *env, int csrno)
++    }
@@ -XXX,XX +XXX,XX @@ static RISCVException sstc_32(CPURISCVState *env, int csrno)
      return sstc(env, csrno);
  }
 +static RISCVException read_vstimecmp(CPURISCVState *env, int csrno,
 +                                    target_ulong *val)
 +{
 +    *val = env->vstimecmp;
 +
-+    return RISCV_EXCP_NONE;
++    /*
 +     * Fall back to 64-bit version for now, if the 128-bit alternative isn't
 +     * at all defined.
 +     * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
 +     * significant), for those, this fallback is correctly handling the
 +     * accesses
 +     */
 +    target_ulong old_value;
 +    ret = riscv_csrrw_do64(env, csrno, &old_value,
 +                           (target_ulong)0,
 +                           (target_ulong)0);
 +    if (ret == RISCV_EXCP_NONE && ret_value) {
 +        *ret_value = int128_make64(old_value);
 +    }
 +    return ret;
 +}
 +
-+static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
+ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
-+                                    target_ulong *val)
+                                 Int128 *ret_value,
-+{
+                                 Int128 new_value, Int128 write_mask)
 +    *val = env->vstimecmp >> 32;
 +
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
 +                                    target_ulong val)
 +{
 +    RISCVCPU *cpu = env_archcpu(env);
 +
 +    if (riscv_cpu_mxl(env) == MXL_RV32) {
 +        env->vstimecmp = deposit64(env->vstimecmp, 0, 32, (uint64_t)val);
 +    } else {
 +        env->vstimecmp = val;
 +    }
 +
 +    riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
 +                              env->htimedelta, MIP_VSTIP);
 +
 +    return RISCV_EXCP_NONE;
 +}
 +
 +static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
 +                                    target_ulong val)
 +{
 +    RISCVCPU *cpu = env_archcpu(env);
 +
 +    env->vstimecmp = deposit64(env->vstimecmp, 32, 32, (uint64_t)val);
 +    riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
 +                              env->htimedelta, MIP_VSTIP);
 +
 +    return RISCV_EXCP_NONE;
 +}
 +
  static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
                                      target_ulong *val)
  {
--    *val = env->stimecmp;
+     RISCVException ret;
-+    if (riscv_cpu_virt_enabled(env)) {
-+        *val = env->vstimecmp;
+-    ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask));
-+    } else {
++    ret = riscv_csrrw_check(env, csrno, true);
-+        *val = env->stimecmp;
+     if (ret != RISCV_EXCP_NONE) {
-+    }
+         return ret;
-+
+     }
-     return RISCV_EXCP_NONE;
+diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
- }
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/op_helper.c
- static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
++++ b/target/riscv/op_helper.c
-                                     target_ulong *val)
+@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
      }
      target_ulong val = 0;
 -    RISCVException ret = riscv_csrrw(env, csr, &val, 0, 0);
 +    RISCVException ret = riscv_csrr(env, csr, &val);
      if (ret != RISCV_EXCP_NONE) {
          riscv_raise_exception(env, ret, GETPC());
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrrw(CPURISCVState *env, int csr,
  target_ulong helper_csrr_i128(CPURISCVState *env, int csr)
  {
--    *val = env->stimecmp >> 32;
+     Int128 rv = int128_zero();
-+    if (riscv_cpu_virt_enabled(env)) {
+-    RISCVException ret = riscv_csrrw_i128(env, csr, &rv,
-+        *val = env->vstimecmp >> 32;
+-                                          int128_zero(),
-+    } else {
+-                                          int128_zero());
-+        *val = env->stimecmp >> 32;
++    RISCVException ret = riscv_csrr_i128(env, csr, &rv);
-+    }
-+
+     if (ret != RISCV_EXCP_NONE) {
-     return RISCV_EXCP_NONE;
+         riscv_raise_exception(env, ret, GETPC());
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
  {
      RISCVCPU *cpu = env_archcpu(env);
 +    if (riscv_cpu_virt_enabled(env)) {
 +        return write_vstimecmp(env, csrno, val);
 +    }
 +
      if (riscv_cpu_mxl(env) == MXL_RV32) {
          env->stimecmp = deposit64(env->stimecmp, 0, 32, (uint64_t)val);
      } else {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
  {
      RISCVCPU *cpu = env_archcpu(env);
 +    if (riscv_cpu_virt_enabled(env)) {
 +        return write_vstimecmph(env, csrno, val);
 +    }
 +
      env->stimecmp = deposit64(env->stimecmp, 32, 32, (uint64_t)val);
      riscv_timer_write_timecmp(cpu, env->stimer, env->stimecmp, 0, MIP_STIP);
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
      if (csrno != CSR_HVIP) {
          gin = get_field(env->hstatus, HSTATUS_VGEIN);
          old_mip |= (env->hgeip & ((target_ulong)1 << gin)) ? MIP_VSEIP : 0;
 +        old_mip |= env->vstime_irq ? MIP_VSTIP : 0;
      }
      if (ret_val) {
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                         .min_priv_ver = PRIV_VERSION_1_12_0 },
      [CSR_STIMECMPH] = { "stimecmph", sstc_32, read_stimecmph, write_stimecmph,
                          .min_priv_ver = PRIV_VERSION_1_12_0 },
 +    [CSR_VSTIMECMP] = { "vstimecmp", sstc, read_vstimecmp,
 +                        write_vstimecmp,
 +                        .min_priv_ver = PRIV_VERSION_1_12_0 },
 +    [CSR_VSTIMECMPH] = { "vstimecmph", sstc_32, read_vstimecmph,
 +                         write_vstimecmph,
 +                         .min_priv_ver = PRIV_VERSION_1_12_0 },
      /* Supervisor Protection and Translation */
      [CSR_SATP]     = { "satp",     smode, read_satp,     write_satp     },
 diff --git a/target/riscv/machine.c b/target/riscv/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/machine.c
 +++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_hyper = {
          VMSTATE_UINTTL(env.hgeie, RISCVCPU),
          VMSTATE_UINTTL(env.hgeip, RISCVCPU),
          VMSTATE_UINT64(env.htimedelta, RISCVCPU),
 +        VMSTATE_UINT64(env.vstimecmp, RISCVCPU),
          VMSTATE_UINTTL(env.hvictl, RISCVCPU),
          VMSTATE_UINT8_ARRAY(env.hviprio, RISCVCPU, 64),
 diff --git a/target/riscv/time_helper.c b/target/riscv/time_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/time_helper.c
 +++ b/target/riscv/time_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "time_helper.h"
  #include "hw/intc/riscv_aclint.h"
 +static void riscv_vstimer_cb(void *opaque)
 +{
 +    RISCVCPU *cpu = opaque;
 +    CPURISCVState *env = &cpu->env;
 +    env->vstime_irq = 1;
 +    riscv_cpu_update_mip(cpu, MIP_VSTIP, BOOL_TO_MASK(1));
 +}
 +
  static void riscv_stimer_cb(void *opaque)
  {
      RISCVCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
           * If we're setting an stimecmp value in the "past",
           * immediately raise the timer interrupt
           */
 +        if (timer_irq == MIP_VSTIP) {
 +            env->vstime_irq = 1;
 +        }
          riscv_cpu_update_mip(cpu, timer_irq, BOOL_TO_MASK(1));
          return;
      }
 +    if (timer_irq == MIP_VSTIP) {
 +        env->vstime_irq = 0;
 +    }
      /* Clear the [V]STIP bit in mip */
      riscv_cpu_update_mip(cpu, timer_irq, BOOL_TO_MASK(0));
@@ -XXX,XX +XXX,XX @@ void riscv_timer_init(RISCVCPU *cpu)
      env->stimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, &riscv_stimer_cb, cpu);
      env->stimecmp = 0;
 +    env->vstimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, &riscv_vstimer_cb, cpu);
 +    env->vstimecmp = 0;
  }
 --
-.37.2
+.45.1

The following changes since commit 946e9bccf12f2bcc3ca471b820738fb22d14fc80:

Merge tag 'samuel-thibault' of https://people.debian.org/~sthibault/qemu into staging (2022-09-06 08:31:24 -0400)

are available in the Git repository at:

git@github.com:alistair23/qemu.git tags/pull-riscv-to-apply-20220907

for you to fetch changes up to f0551560b5c01b1dcbed1ac46ca0bd1155330f5f:

target/riscv: Update the privilege field for sscofpmf CSRs (2022-09-07 09:19:15 +0200)

----------------------------------------------------------------
First RISC-V PR for QEMU 7.2

* Update [m|h]tinst CSR in interrupt handling
* Force disable extensions if priv spec version does not match
* fix shifts shamt value for rv128c
* move zmmul out of the experimental
* virt: pass random seed to fdt
* Add checks for supported extension combinations
* Upgrade OpenSBI to v1.1
* Fix typo and restore Pointer Masking functionality for RISC-V
* Add mask agnostic behaviour (rvv_ma_all_1s) for vector extension
* Add Zihintpause support
* opentitan: bump opentitan version
* microchip_pfsoc: fix kernel panics due to missing peripherals
* Remove additional priv version check for mcountinhibit
* virt machine device tree improvements
* Add xicondops in ISA entry
* Use official extension names for AIA CSRs

----------------------------------------------------------------
Alexey Baturo (1):
      target/riscv: Fix typo and restore Pointer Masking functionality for RISC-V

Anup Patel (3):
      target/riscv: Update [m|h]tinst CSR in riscv_cpu_do_interrupt()
      target/riscv: Force disable extensions if priv spec version does not match
      target/riscv: Use official extension names for AIA CSRs

Atish Patra (9):
      target/riscv: Remove additional priv version check for mcountinhibit
      hw/intc: Move mtimer/mtimecmp to aclint
      target/riscv: Add stimecmp support
      target/riscv: Add vstimecmp support
      target/riscv: Add sscofpmf extension support
      target/riscv: Simplify counter predicate function
      target/riscv: Add few cache related PMU events
      hw/riscv: virt: Add PMU DT node to the device tree
      target/riscv: Update the privilege field for sscofpmf CSRs

Bin Meng (2):
      roms/opensbi: Upgrade from v1.0 to v1.1
      docs: List kvm as a supported accelerator on RISC-V

Conor Dooley (5):
      hw/riscv: microchip_pfsoc: fix kernel panics due to missing peripherals
      hw/riscv: virt: fix uart node name
      hw/riscv: virt: fix the plic's address cells
      hw/riscv: virt: fix syscon subnode paths
      hw/core: fix platform bus node name

Daniel Henrique Barboza (1):
      hw/riscv: remove 'fdt' param from riscv_setup_rom_reset_vec()

Dao Lu (1):
      target/riscv: Add Zihintpause support

Frédéric Pétrot (1):
      target/riscv: fix shifts shamt value for rv128c

Jason A. Donenfeld (1):
      hw/riscv: virt: pass random seed to fdt

Rahul Pathak (1):
      target/riscv: Add xicondops in ISA entry

Weiwei Li (8):
      target/riscv: move zmmul out of the experimental properties
      target/riscv: Add check for supported privilege mode combinations
      target/riscv: H extension depends on I extension
      target/riscv: Fix checkpatch warning may triggered in csr_ops table
      target/riscv: Add check for csrs existed with U extension
      target/riscv: Fix checks in hmode/hmode32
      target/riscv: Simplify the check in hmode to reuse the check in riscv_csrrw_check
      target/riscv: Fix priority of csr related check in riscv_csrrw_check

Wilfred Mallawa (1):
      hw/riscv: opentitan: bump opentitan version

Yueh-Ting (eop) Chen (9):
      target/riscv: rvv: Add mask agnostic for vv instructions
      target/riscv: rvv: Add mask agnostic for vector load / store instructions
      target/riscv: rvv: Add mask agnostic for vx instructions
      target/riscv: rvv: Add mask agnostic for vector integer shift instructions
      target/riscv: rvv: Add mask agnostic for vector integer comparison instructions
      target/riscv: rvv: Add mask agnostic for vector fix-point arithmetic instructions
      target/riscv: rvv: Add mask agnostic for vector floating-point instructions
      target/riscv: rvv: Add mask agnostic for vector mask instructions
      target/riscv: rvv: Add mask agnostic for vector permutation instructions

eopXD (1):
      target/riscv: rvv: Add option 'rvv_ma_all_1s' to enable optional mask agnostic behavior

From: Anup Patel <apatel@ventanamicro.com>

We should write transformed instruction encoding of the trapped
instruction in [m|h]tinst CSR at time of taking trap as defined
by the RISC-V privileged specification v1.12.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Acked-by: dramforever <dramforever@live.com>
Message-Id: <20220630061150.905174-2-apatel@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |   5 +
 target/riscv/instmap.h    |  45 +++++++
 target/riscv/cpu_helper.c | 252 +++++++++++++++++++++++++++++++++++++-
 3 files changed, 296 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     /* Signals whether the current exception occurred with two-stage address
        translation active. */
     bool two_stage_lookup;
+    /*
+     * Signals whether the current exception occurred while doing two-stage
+     * address translation for the VS-stage page table walk.
+     */
+    bool two_stage_indirect_lookup;
 
     target_ulong scounteren;
     target_ulong mcounteren;
diff --git a/target/riscv/instmap.h b/target/riscv/instmap.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/instmap.h
+++ b/target/riscv/instmap.h
@@ -XXX,XX +XXX,XX @@ enum {
     OPC_RISC_CSRRWI      = OPC_RISC_SYSTEM | (0x5 << 12),
     OPC_RISC_CSRRSI      = OPC_RISC_SYSTEM | (0x6 << 12),
     OPC_RISC_CSRRCI      = OPC_RISC_SYSTEM | (0x7 << 12),
+
+    OPC_RISC_HLVHSV      = OPC_RISC_SYSTEM | (0x4 << 12),
 };
 
 #define MASK_OP_FP_LOAD(op)   (MASK_OP_MAJOR(op) | (op & (0x7 << 12)))
@@ -XXX,XX +XXX,XX @@ enum {
                            | (extract32(inst, 12, 8) << 12) \
                            | (sextract64(inst, 31, 1) << 20))
 
+#define GET_FUNCT3(inst) extract32(inst, 12, 3)
+#define GET_FUNCT7(inst) extract32(inst, 25, 7)
 #define GET_RM(inst)   extract32(inst, 12, 3)
 #define GET_RS3(inst)  extract32(inst, 27, 5)
 #define GET_RS1(inst)  extract32(inst, 15, 5)
 #define GET_RS2(inst)  extract32(inst, 20, 5)
 #define GET_RD(inst)   extract32(inst, 7, 5)
 #define GET_IMM(inst)  sextract64(inst, 20, 12)
+#define SET_RS1(inst, val)  deposit32(inst, 15, 5, val)
+#define SET_RS2(inst, val)  deposit32(inst, 20, 5, val)
+#define SET_RD(inst, val)   deposit32(inst, 7, 5, val)
+#define SET_I_IMM(inst, val)  deposit32(inst, 20, 12, val)
+#define SET_S_IMM(inst, val)  \
+    deposit32(deposit32(inst, 7, 5, val), 25, 7, (val) >> 5)
 
 /* RVC decoding macros */
 #define GET_C_IMM(inst)             (extract32(inst, 2, 5) \
@@ -XXX,XX +XXX,XX @@ enum {
                                     | (extract32(inst, 5, 1) << 6))
 #define GET_C_LD_IMM(inst)          ((extract16(inst, 10, 3) << 3) \
                                     | (extract16(inst, 5, 2) << 6))
+#define GET_C_SW_IMM(inst)          GET_C_LW_IMM(inst)
+#define GET_C_SD_IMM(inst)          GET_C_LD_IMM(inst)
 #define GET_C_J_IMM(inst)           ((extract32(inst, 3, 3) << 1) \
                                     | (extract32(inst, 11, 1) << 4) \
                                     | (extract32(inst, 2, 1) << 5) \
@@ -XXX,XX +XXX,XX @@ enum {
 #define GET_C_RS1S(inst)            (8 + extract16(inst, 7, 3))
 #define GET_C_RS2S(inst)            (8 + extract16(inst, 2, 3))
 
+#define GET_C_FUNC(inst)           extract32(inst, 13, 3)
+#define GET_C_OP(inst)             extract32(inst, 0, 2)
+
+enum {
+    /* RVC Quadrants */
+    OPC_RISC_C_OP_QUAD0 = 0x0,
+    OPC_RISC_C_OP_QUAD1 = 0x1,
+    OPC_RISC_C_OP_QUAD2 = 0x2
+};
+
+enum {
+    /* RVC Quadrant 0 */
+    OPC_RISC_C_FUNC_ADDI4SPN = 0x0,
+    OPC_RISC_C_FUNC_FLD_LQ = 0x1,
+    OPC_RISC_C_FUNC_LW = 0x2,
+    OPC_RISC_C_FUNC_FLW_LD = 0x3,
+    OPC_RISC_C_FUNC_FSD_SQ = 0x5,
+    OPC_RISC_C_FUNC_SW = 0x6,
+    OPC_RISC_C_FUNC_FSW_SD = 0x7
+};
+
+enum {
+    /* RVC Quadrant 2 */
+    OPC_RISC_C_FUNC_SLLI_SLLI64 = 0x0,
+    OPC_RISC_C_FUNC_FLDSP_LQSP = 0x1,
+    OPC_RISC_C_FUNC_LWSP = 0x2,
+    OPC_RISC_C_FUNC_FLWSP_LDSP = 0x3,
+    OPC_RISC_C_FUNC_JR_MV_EBREAK_JALR_ADD = 0x4,
+    OPC_RISC_C_FUNC_FSDSP_SQSP = 0x5,
+    OPC_RISC_C_FUNC_SWSP = 0x6,
+    OPC_RISC_C_FUNC_FSWSP_SDSP = 0x7
+};
+
 #endif
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/main-loop.h"
 #include "cpu.h"
 #include "exec/exec-all.h"
+#include "instmap.h"
 #include "tcg/tcg-op.h"
 #include "trace.h"
 #include "semihosting/common-semi.h"
@@ -XXX,XX +XXX,XX @@ restart:
 
 static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
                                 MMUAccessType access_type, bool pmp_violation,
-                                bool first_stage, bool two_stage)
+                                bool first_stage, bool two_stage,
+                                bool two_stage_indirect)
 {
     CPUState *cs = env_cpu(env);
     int page_fault_exceptions, vm;
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
     }
     env->badaddr = address;
     env->two_stage_lookup = two_stage;
+    env->two_stage_indirect_lookup = two_stage_indirect;
 }
 
 hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     env->badaddr = addr;
     env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
                             riscv_cpu_two_stage_lookup(mmu_idx);
+    env->two_stage_indirect_lookup = false;
     cpu_loop_exit_restore(cs, retaddr);
 }
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
     env->badaddr = addr;
     env->two_stage_lookup = riscv_cpu_virt_enabled(env) ||
                             riscv_cpu_two_stage_lookup(mmu_idx);
+    env->two_stage_indirect_lookup = false;
     cpu_loop_exit_restore(cs, retaddr);
 }
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     bool pmp_violation = false;
     bool first_stage_error = true;
     bool two_stage_lookup = false;
+    bool two_stage_indirect_error = false;
     int ret = TRANSLATE_FAIL;
     int mode = mmu_idx;
     /* default TLB page size */
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
          */
         if (ret == TRANSLATE_G_STAGE_FAIL) {
             first_stage_error = false;
+            two_stage_indirect_error = true;
             access_type = MMU_DATA_LOAD;
         }
 
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         raise_mmu_exception(env, address, access_type, pmp_violation,
                             first_stage_error,
                             riscv_cpu_virt_enabled(env) ||
-                                riscv_cpu_two_stage_lookup(mmu_idx));
+                                riscv_cpu_two_stage_lookup(mmu_idx),
+                            two_stage_indirect_error);
         cpu_loop_exit_restore(cs, retaddr);
     }
 
     return true;
 }
+
+static target_ulong riscv_transformed_insn(CPURISCVState *env,
+                                           target_ulong insn,
+                                           target_ulong taddr)
+{
+    target_ulong xinsn = 0;
+    target_ulong access_rs1 = 0, access_imm = 0, access_size = 0;
+
+    /*
+     * Only Quadrant 0 and Quadrant 2 of RVC instruction space need to
+     * be uncompressed. The Quadrant 1 of RVC instruction space need
+     * not be transformed because these instructions won't generate
+     * any load/store trap.
+     */
+
+    if ((insn & 0x3) != 0x3) {
+        /* Transform 16bit instruction into 32bit instruction */
+        switch (GET_C_OP(insn)) {
+        case OPC_RISC_C_OP_QUAD0: /* Quadrant 0 */
+            switch (GET_C_FUNC(insn)) {
+            case OPC_RISC_C_FUNC_FLD_LQ:
+                if (riscv_cpu_xlen(env) != 128) { /* C.FLD (RV32/64) */
+                    xinsn = OPC_RISC_FLD;
+                    xinsn = SET_RD(xinsn, GET_C_RS2S(insn));
+                    access_rs1 = GET_C_RS1S(insn);
+                    access_imm = GET_C_LD_IMM(insn);
+                    access_size = 8;
+                }
+                break;
+            case OPC_RISC_C_FUNC_LW: /* C.LW */
+                xinsn = OPC_RISC_LW;
+                xinsn = SET_RD(xinsn, GET_C_RS2S(insn));
+                access_rs1 = GET_C_RS1S(insn);
+                access_imm = GET_C_LW_IMM(insn);
+                access_size = 4;
+                break;
+            case OPC_RISC_C_FUNC_FLW_LD:
+                if (riscv_cpu_xlen(env) == 32) { /* C.FLW (RV32) */
+                    xinsn = OPC_RISC_FLW;
+                    xinsn = SET_RD(xinsn, GET_C_RS2S(insn));
+                    access_rs1 = GET_C_RS1S(insn);
+                    access_imm = GET_C_LW_IMM(insn);
+                    access_size = 4;
+                } else { /* C.LD (RV64/RV128) */
+                    xinsn = OPC_RISC_LD;
+                    xinsn = SET_RD(xinsn, GET_C_RS2S(insn));
+                    access_rs1 = GET_C_RS1S(insn);
+                    access_imm = GET_C_LD_IMM(insn);
+                    access_size = 8;
+                }
+                break;
+            case OPC_RISC_C_FUNC_FSD_SQ:
+                if (riscv_cpu_xlen(env) != 128) { /* C.FSD (RV32/64) */
+                    xinsn = OPC_RISC_FSD;
+                    xinsn = SET_RS2(xinsn, GET_C_RS2S(insn));
+                    access_rs1 = GET_C_RS1S(insn);
+                    access_imm = GET_C_SD_IMM(insn);
+                    access_size = 8;
+                }
+                break;
+            case OPC_RISC_C_FUNC_SW: /* C.SW */
+                xinsn = OPC_RISC_SW;
+                xinsn = SET_RS2(xinsn, GET_C_RS2S(insn));
+                access_rs1 = GET_C_RS1S(insn);
+                access_imm = GET_C_SW_IMM(insn);
+                access_size = 4;
+                break;
+            case OPC_RISC_C_FUNC_FSW_SD:
+                if (riscv_cpu_xlen(env) == 32) { /* C.FSW (RV32) */
+                    xinsn = OPC_RISC_FSW;
+                    xinsn = SET_RS2(xinsn, GET_C_RS2S(insn));
+                    access_rs1 = GET_C_RS1S(insn);
+                    access_imm = GET_C_SW_IMM(insn);
+                    access_size = 4;
+                } else { /* C.SD (RV64/RV128) */
+                    xinsn = OPC_RISC_SD;
+                    xinsn = SET_RS2(xinsn, GET_C_RS2S(insn));
+                    access_rs1 = GET_C_RS1S(insn);
+                    access_imm = GET_C_SD_IMM(insn);
+                    access_size = 8;
+                }
+                break;
+            default:
+                break;
+            }
+            break;
+        case OPC_RISC_C_OP_QUAD2: /* Quadrant 2 */
+            switch (GET_C_FUNC(insn)) {
+            case OPC_RISC_C_FUNC_FLDSP_LQSP:
+                if (riscv_cpu_xlen(env) != 128) { /* C.FLDSP (RV32/64) */
+                    xinsn = OPC_RISC_FLD;
+                    xinsn = SET_RD(xinsn, GET_C_RD(insn));
+                    access_rs1 = 2;
+                    access_imm = GET_C_LDSP_IMM(insn);
+                    access_size = 8;
+                }
+                break;
+            case OPC_RISC_C_FUNC_LWSP: /* C.LWSP */
+                xinsn = OPC_RISC_LW;
+                xinsn = SET_RD(xinsn, GET_C_RD(insn));
+                access_rs1 = 2;
+                access_imm = GET_C_LWSP_IMM(insn);
+                access_size = 4;
+                break;
+            case OPC_RISC_C_FUNC_FLWSP_LDSP:
+                if (riscv_cpu_xlen(env) == 32) { /* C.FLWSP (RV32) */
+                    xinsn = OPC_RISC_FLW;
+                    xinsn = SET_RD(xinsn, GET_C_RD(insn));
+                    access_rs1 = 2;
+                    access_imm = GET_C_LWSP_IMM(insn);
+                    access_size = 4;
+                } else { /* C.LDSP (RV64/RV128) */
+                    xinsn = OPC_RISC_LD;
+                    xinsn = SET_RD(xinsn, GET_C_RD(insn));
+                    access_rs1 = 2;
+                    access_imm = GET_C_LDSP_IMM(insn);
+                    access_size = 8;
+                }
+                break;
+            case OPC_RISC_C_FUNC_FSDSP_SQSP:
+                if (riscv_cpu_xlen(env) != 128) { /* C.FSDSP (RV32/64) */
+                    xinsn = OPC_RISC_FSD;
+                    xinsn = SET_RS2(xinsn, GET_C_RS2(insn));
+                    access_rs1 = 2;
+                    access_imm = GET_C_SDSP_IMM(insn);
+                    access_size = 8;
+                }
+                break;
+            case OPC_RISC_C_FUNC_SWSP: /* C.SWSP */
+                xinsn = OPC_RISC_SW;
+                xinsn = SET_RS2(xinsn, GET_C_RS2(insn));
+                access_rs1 = 2;
+                access_imm = GET_C_SWSP_IMM(insn);
+                access_size = 4;
+                break;
+            case 7:
+                if (riscv_cpu_xlen(env) == 32) { /* C.FSWSP (RV32) */
+                    xinsn = OPC_RISC_FSW;
+                    xinsn = SET_RS2(xinsn, GET_C_RS2(insn));
+                    access_rs1 = 2;
+                    access_imm = GET_C_SWSP_IMM(insn);
+                    access_size = 4;
+                } else { /* C.SDSP (RV64/RV128) */
+                    xinsn = OPC_RISC_SD;
+                    xinsn = SET_RS2(xinsn, GET_C_RS2(insn));
+                    access_rs1 = 2;
+                    access_imm = GET_C_SDSP_IMM(insn);
+                    access_size = 8;
+                }
+                break;
+            default:
+                break;
+            }
+            break;
+        default:
+            break;
+        }
+
+        /*
+         * Clear Bit1 of transformed instruction to indicate that
+         * original insruction was a 16bit instruction
+         */
+        xinsn &= ~((target_ulong)0x2);
+    } else {
+        /* Transform 32bit (or wider) instructions */
+        switch (MASK_OP_MAJOR(insn)) {
+        case OPC_RISC_ATOMIC:
+            xinsn = insn;
+            access_rs1 = GET_RS1(insn);
+            access_size = 1 << GET_FUNCT3(insn);
+            break;
+        case OPC_RISC_LOAD:
+        case OPC_RISC_FP_LOAD:
+            xinsn = SET_I_IMM(insn, 0);
+            access_rs1 = GET_RS1(insn);
+            access_imm = GET_IMM(insn);
+            access_size = 1 << GET_FUNCT3(insn);
+            break;
+        case OPC_RISC_STORE:
+        case OPC_RISC_FP_STORE:
+            xinsn = SET_S_IMM(insn, 0);
+            access_rs1 = GET_RS1(insn);
+            access_imm = GET_STORE_IMM(insn);
+            access_size = 1 << GET_FUNCT3(insn);
+            break;
+        case OPC_RISC_SYSTEM:
+            if (MASK_OP_SYSTEM(insn) == OPC_RISC_HLVHSV) {
+                xinsn = insn;
+                access_rs1 = GET_RS1(insn);
+                access_size = 1 << ((GET_FUNCT7(insn) >> 1) & 0x3);
+                access_size = 1 << access_size;
+            }
+            break;
+        default:
+            break;
+        }
+    }
+
+    if (access_size) {
+        xinsn = SET_RS1(xinsn, (taddr - (env->gpr[access_rs1] + access_imm)) &
+                               (access_size - 1));
+    }
+
+    return xinsn;
+}
 #endif /* !CONFIG_USER_ONLY */
 
 /*
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
     target_ulong cause = cs->exception_index & RISCV_EXCP_INT_MASK;
     uint64_t deleg = async ? env->mideleg : env->medeleg;
     target_ulong tval = 0;
+    target_ulong tinst = 0;
     target_ulong htval = 0;
     target_ulong mtval2 = 0;
 
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
     if (!async) {
         /* set tval to badaddr for traps with address information */
         switch (cause) {
-        case RISCV_EXCP_INST_GUEST_PAGE_FAULT:
         case RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT:
         case RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT:
-        case RISCV_EXCP_INST_ADDR_MIS:
-        case RISCV_EXCP_INST_ACCESS_FAULT:
         case RISCV_EXCP_LOAD_ADDR_MIS:
         case RISCV_EXCP_STORE_AMO_ADDR_MIS:
         case RISCV_EXCP_LOAD_ACCESS_FAULT:
         case RISCV_EXCP_STORE_AMO_ACCESS_FAULT:
-        case RISCV_EXCP_INST_PAGE_FAULT:
         case RISCV_EXCP_LOAD_PAGE_FAULT:
         case RISCV_EXCP_STORE_PAGE_FAULT:
             write_gva = env->two_stage_lookup;
             tval = env->badaddr;
+            if (env->two_stage_indirect_lookup) {
+                /*
+                 * special pseudoinstruction for G-stage fault taken while
+                 * doing VS-stage page table walk.
+                 */
+                tinst = (riscv_cpu_xlen(env) == 32) ? 0x00002000 : 0x00003000;
+            } else {
+                /*
+                 * The "Addr. Offset" field in transformed instruction is
+                 * non-zero only for misaligned access.
+                 */
+                tinst = riscv_transformed_insn(env, env->bins, tval);
+            }
+            break;
+        case RISCV_EXCP_INST_GUEST_PAGE_FAULT:
+        case RISCV_EXCP_INST_ADDR_MIS:
+        case RISCV_EXCP_INST_ACCESS_FAULT:
+        case RISCV_EXCP_INST_PAGE_FAULT:
+            write_gva = env->two_stage_lookup;
+            tval = env->badaddr;
+            if (env->two_stage_indirect_lookup) {
+                /*
+                 * special pseudoinstruction for G-stage fault taken while
+                 * doing VS-stage page table walk.
+                 */
+                tinst = (riscv_cpu_xlen(env) == 32) ? 0x00002000 : 0x00003000;
+            }
             break;
         case RISCV_EXCP_ILLEGAL_INST:
         case RISCV_EXCP_VIRT_INSTRUCTION_FAULT:
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         env->sepc = env->pc;
         env->stval = tval;
         env->htval = htval;
+        env->htinst = tinst;
         env->pc = (env->stvec >> 2 << 2) +
             ((async && (env->stvec & 3) == 1) ? cause * 4 : 0);
         riscv_cpu_set_mode(env, PRV_S);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
         env->mepc = env->pc;
         env->mtval = tval;
         env->mtval2 = mtval2;
+        env->mtinst = tinst;
         env->pc = (env->mtvec >> 2 << 2) +
             ((async && (env->mtvec & 3) == 1) ? cause * 4 : 0);
         riscv_cpu_set_mode(env, PRV_M);
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
      */
 
     env->two_stage_lookup = false;
+    env->two_stage_indirect_lookup = false;
 #endif
     cs->exception_index = RISCV_EXCP_NONE; /* mark handled to qemu */
 }
-- 
2.37.2

From: Anup Patel <apatel@ventanamicro.com>

We should disable extensions in riscv_cpu_realize() if minimum required
priv spec version is not satisfied. This also ensures that machines with
priv spec v1.11 (or lower) cannot enable H, V, and various multi-letter
extensions.

Fixes: a775398be2e9 ("target/riscv: Add isa extenstion strings to the device tree")
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Signed-off-by: Rahul Pathak <rpathak@ventanamicro.com>
Message-Id: <20220630061150.905174-3-apatel@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 150 ++++++++++++++++++++++++++++-----------------
 1 file changed, 94 insertions(+), 56 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const char riscv_single_letter_exts[] = "IEMAFDQCPVH";
 
 struct isa_ext_data {
     const char *name;
-    bool enabled;
+    bool multi_letter;
+    int min_version;
+    int ext_enable_offset;
 };
 
+#define ISA_EXT_DATA_ENTRY(_name, _m_letter, _min_ver, _prop) \
+{#_name, _m_letter, _min_ver, offsetof(struct RISCVCPUConfig, _prop)}
+
+/**
+ * Here are the ordering rules of extension naming defined by RISC-V
+ * specification :
+ * 1. All extensions should be separated from other multi-letter extensions
+ *    by an underscore.
+ * 2. The first letter following the 'Z' conventionally indicates the most
+ *    closely related alphabetical extension category, IMAFDQLCBKJTPVH.
+ *    If multiple 'Z' extensions are named, they should be ordered first
+ *    by category, then alphabetically within a category.
+ * 3. Standard supervisor-level extensions (starts with 'S') should be
+ *    listed after standard unprivileged extensions.  If multiple
+ *    supervisor-level extensions are listed, they should be ordered
+ *    alphabetically.
+ * 4. Non-standard extensions (starts with 'X') must be listed after all
+ *    standard extensions. They must be separated from other multi-letter
+ *    extensions by an underscore.
+ */
+static const struct isa_ext_data isa_edata_arr[] = {
+    ISA_EXT_DATA_ENTRY(h, false, PRIV_VERSION_1_12_0, ext_h),
+    ISA_EXT_DATA_ENTRY(v, false, PRIV_VERSION_1_12_0, ext_v),
+    ISA_EXT_DATA_ENTRY(zicsr, true, PRIV_VERSION_1_10_0, ext_icsr),
+    ISA_EXT_DATA_ENTRY(zifencei, true, PRIV_VERSION_1_10_0, ext_ifencei),
+    ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_12_0, ext_zfh),
+    ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_12_0, ext_zfhmin),
+    ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
+    ISA_EXT_DATA_ENTRY(zdinx, true, PRIV_VERSION_1_12_0, ext_zdinx),
+    ISA_EXT_DATA_ENTRY(zba, true, PRIV_VERSION_1_12_0, ext_zba),
+    ISA_EXT_DATA_ENTRY(zbb, true, PRIV_VERSION_1_12_0, ext_zbb),
+    ISA_EXT_DATA_ENTRY(zbc, true, PRIV_VERSION_1_12_0, ext_zbc),
+    ISA_EXT_DATA_ENTRY(zbkb, true, PRIV_VERSION_1_12_0, ext_zbkb),
+    ISA_EXT_DATA_ENTRY(zbkc, true, PRIV_VERSION_1_12_0, ext_zbkc),
+    ISA_EXT_DATA_ENTRY(zbkx, true, PRIV_VERSION_1_12_0, ext_zbkx),
+    ISA_EXT_DATA_ENTRY(zbs, true, PRIV_VERSION_1_12_0, ext_zbs),
+    ISA_EXT_DATA_ENTRY(zk, true, PRIV_VERSION_1_12_0, ext_zk),
+    ISA_EXT_DATA_ENTRY(zkn, true, PRIV_VERSION_1_12_0, ext_zkn),
+    ISA_EXT_DATA_ENTRY(zknd, true, PRIV_VERSION_1_12_0, ext_zknd),
+    ISA_EXT_DATA_ENTRY(zkne, true, PRIV_VERSION_1_12_0, ext_zkne),
+    ISA_EXT_DATA_ENTRY(zknh, true, PRIV_VERSION_1_12_0, ext_zknh),
+    ISA_EXT_DATA_ENTRY(zkr, true, PRIV_VERSION_1_12_0, ext_zkr),
+    ISA_EXT_DATA_ENTRY(zks, true, PRIV_VERSION_1_12_0, ext_zks),
+    ISA_EXT_DATA_ENTRY(zksed, true, PRIV_VERSION_1_12_0, ext_zksed),
+    ISA_EXT_DATA_ENTRY(zksh, true, PRIV_VERSION_1_12_0, ext_zksh),
+    ISA_EXT_DATA_ENTRY(zkt, true, PRIV_VERSION_1_12_0, ext_zkt),
+    ISA_EXT_DATA_ENTRY(zve32f, true, PRIV_VERSION_1_12_0, ext_zve32f),
+    ISA_EXT_DATA_ENTRY(zve64f, true, PRIV_VERSION_1_12_0, ext_zve64f),
+    ISA_EXT_DATA_ENTRY(zhinx, true, PRIV_VERSION_1_12_0, ext_zhinx),
+    ISA_EXT_DATA_ENTRY(zhinxmin, true, PRIV_VERSION_1_12_0, ext_zhinxmin),
+    ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
+    ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
+    ISA_EXT_DATA_ENTRY(svpbmt, true, PRIV_VERSION_1_12_0, ext_svpbmt),
+};
+
+static bool isa_ext_is_enabled(RISCVCPU *cpu,
+                               const struct isa_ext_data *edata)
+{
+    bool *ext_enabled = (void *)&cpu->cfg + edata->ext_enable_offset;
+
+    return *ext_enabled;
+}
+
+static void isa_ext_update_enabled(RISCVCPU *cpu,
+                                   const struct isa_ext_data *edata, bool en)
+{
+    bool *ext_enabled = (void *)&cpu->cfg + edata->ext_enable_offset;
+
+    *ext_enabled = en;
+}
+
 const char * const riscv_int_regnames[] = {
   "x0/zero", "x1/ra",  "x2/sp",  "x3/gp",  "x4/tp",  "x5/t0",   "x6/t1",
   "x7/t2",   "x8/s0",  "x9/s1",  "x10/a0", "x11/a1", "x12/a2",  "x13/a3",
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
     CPURISCVState *env = &cpu->env;
     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
     CPUClass *cc = CPU_CLASS(mcc);
-    int priv_version = -1;
+    int i, priv_version = -1;
     Error *local_err = NULL;
 
     cpu_exec_realizefn(cs, &local_err);
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         set_priv_version(env, priv_version);
     }
 
+    /* Force disable extensions if priv spec version does not match */
+    for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
+        if (isa_ext_is_enabled(cpu, &isa_edata_arr[i]) &&
+            (env->priv_ver < isa_edata_arr[i].min_version)) {
+            isa_ext_update_enabled(cpu, &isa_edata_arr[i], false);
+#ifndef CONFIG_USER_ONLY
+            warn_report("disabling %s extension for hart 0x%lx because "
+                        "privilege spec version does not match",
+                        isa_edata_arr[i].name, (unsigned long)env->mhartid);
+#else
+            warn_report("disabling %s extension because "
+                        "privilege spec version does not match",
+                        isa_edata_arr[i].name);
+#endif
+        }
+    }
+
     if (cpu->cfg.mmu) {
         riscv_set_feature(env, RISCV_FEATURE_MMU);
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_class_init(ObjectClass *c, void *data)
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
-#define ISA_EDATA_ENTRY(name, prop) {#name, cpu->cfg.prop}
-
 static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str, int max_str_len)
 {
     char *old = *isa_str;
     char *new = *isa_str;
     int i;
 
-    /**
-     * Here are the ordering rules of extension naming defined by RISC-V
-     * specification :
-     * 1. All extensions should be separated from other multi-letter extensions
-     *    by an underscore.
-     * 2. The first letter following the 'Z' conventionally indicates the most
-     *    closely related alphabetical extension category, IMAFDQLCBKJTPVH.
-     *    If multiple 'Z' extensions are named, they should be ordered first
-     *    by category, then alphabetically within a category.
-     * 3. Standard supervisor-level extensions (starts with 'S') should be
-     *    listed after standard unprivileged extensions.  If multiple
-     *    supervisor-level extensions are listed, they should be ordered
-     *    alphabetically.
-     * 4. Non-standard extensions (starts with 'X') must be listed after all
-     *    standard extensions. They must be separated from other multi-letter
-     *    extensions by an underscore.
-     */
-    struct isa_ext_data isa_edata_arr[] = {
-        ISA_EDATA_ENTRY(zicsr, ext_icsr),
-        ISA_EDATA_ENTRY(zifencei, ext_ifencei),
-        ISA_EDATA_ENTRY(zmmul, ext_zmmul),
-        ISA_EDATA_ENTRY(zfh, ext_zfh),
-        ISA_EDATA_ENTRY(zfhmin, ext_zfhmin),
-        ISA_EDATA_ENTRY(zfinx, ext_zfinx),
-        ISA_EDATA_ENTRY(zdinx, ext_zdinx),
-        ISA_EDATA_ENTRY(zba, ext_zba),
-        ISA_EDATA_ENTRY(zbb, ext_zbb),
-        ISA_EDATA_ENTRY(zbc, ext_zbc),
-        ISA_EDATA_ENTRY(zbkb, ext_zbkb),
-        ISA_EDATA_ENTRY(zbkc, ext_zbkc),
-        ISA_EDATA_ENTRY(zbkx, ext_zbkx),
-        ISA_EDATA_ENTRY(zbs, ext_zbs),
-        ISA_EDATA_ENTRY(zk, ext_zk),
-        ISA_EDATA_ENTRY(zkn, ext_zkn),
-        ISA_EDATA_ENTRY(zknd, ext_zknd),
-        ISA_EDATA_ENTRY(zkne, ext_zkne),
-        ISA_EDATA_ENTRY(zknh, ext_zknh),
-        ISA_EDATA_ENTRY(zkr, ext_zkr),
-        ISA_EDATA_ENTRY(zks, ext_zks),
-        ISA_EDATA_ENTRY(zksed, ext_zksed),
-        ISA_EDATA_ENTRY(zksh, ext_zksh),
-        ISA_EDATA_ENTRY(zkt, ext_zkt),
-        ISA_EDATA_ENTRY(zve32f, ext_zve32f),
-        ISA_EDATA_ENTRY(zve64f, ext_zve64f),
-        ISA_EDATA_ENTRY(zhinx, ext_zhinx),
-        ISA_EDATA_ENTRY(zhinxmin, ext_zhinxmin),
-        ISA_EDATA_ENTRY(svinval, ext_svinval),
-        ISA_EDATA_ENTRY(svnapot, ext_svnapot),
-        ISA_EDATA_ENTRY(svpbmt, ext_svpbmt),
-    };
-
     for (i = 0; i < ARRAY_SIZE(isa_edata_arr); i++) {
-        if (isa_edata_arr[i].enabled) {
+        if (isa_edata_arr[i].multi_letter &&
+            isa_ext_is_enabled(cpu, &isa_edata_arr[i])) {
             new = g_strconcat(old, "_", isa_edata_arr[i].name, NULL);
             g_free(old);
             old = new;
-- 
2.37.2

From: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr>

For rv128c shifts, a shamt of 0 is a shamt of 64, while for rv32c/rv64c
it stays 0 and is a hint instruction that does not change processor state.
For rv128c right shifts, the 6-bit shamt is in addition sign extended to
7 bits.

Signed-off-by: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20220710110451.245567-1-frederic.petrot@univ-grenoble-alpes.fr>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn16.decode |  7 ++++---
 disas/riscv.c              | 27 +++++++++++++++++++++------
 target/riscv/translate.c   | 20 ++++++++++++++++++--
 3 files changed, 43 insertions(+), 11 deletions(-)

diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn16.decode
+++ b/target/riscv/insn16.decode
@@ -XXX,XX +XXX,XX @@
 %imm_cb        12:s1 5:2 2:1 10:2 3:2 !function=ex_shift_1
 %imm_cj        12:s1 8:1 9:2 6:1 7:1 2:1 11:1 3:3 !function=ex_shift_1
 
-%shimm_6bit   12:1 2:5               !function=ex_rvc_shifti
+%shlimm_6bit  12:1 2:5               !function=ex_rvc_shiftli
+%shrimm_6bit  12:1 2:5               !function=ex_rvc_shiftri
 %uimm_6bit_lq 2:4 12:1 6:1           !function=ex_shift_4
 %uimm_6bit_ld 2:3 12:1 5:2           !function=ex_shift_3
 %uimm_6bit_lw 2:2 12:1 4:3           !function=ex_shift_2
@@ -XXX,XX +XXX,XX @@
 @c_addi16sp     ... .  ..... ..... .. &i imm=%imm_addi16sp rs1=2 rd=2
 
 @c_shift        ... . .. ... ..... .. \
-                &shift rd=%rs1_3 rs1=%rs1_3 shamt=%shimm_6bit
+                &shift rd=%rs1_3 rs1=%rs1_3 shamt=%shrimm_6bit
 @c_shift2       ... . .. ... ..... .. \
-                &shift rd=%rd rs1=%rd shamt=%shimm_6bit
+                &shift rd=%rd rs1=%rd shamt=%shlimm_6bit
 
 @c_andi         ... . .. ... ..... .. &i imm=%imm_ci rs1=%rs1_3 rd=%rs1_3
 
diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ static int32_t operand_sbimm12(rv_inst inst)
         ((inst << 56) >> 63) << 11;
 }
 
-static uint32_t operand_cimmsh6(rv_inst inst)
+static uint32_t operand_cimmshl6(rv_inst inst, rv_isa isa)
 {
-    return ((inst << 51) >> 63) << 5 |
+    int imm = ((inst << 51) >> 63) << 5 |
         (inst << 57) >> 59;
+    if (isa == rv128) {
+        imm = imm ? imm : 64;
+    }
+    return imm;
+}
+
+static uint32_t operand_cimmshr6(rv_inst inst, rv_isa isa)
+{
+    int imm = ((inst << 51) >> 63) << 5 |
+        (inst << 57) >> 59;
+    if (isa == rv128) {
+        imm = imm | (imm & 32) << 1;
+        imm = imm ? imm : 64;
+    }
+    return imm;
 }
 
 static int32_t operand_cimmi(rv_inst inst)
@@ -XXX,XX +XXX,XX @@ static uint32_t operand_rnum(rv_inst inst)
 
 /* decode operands */
 
-static void decode_inst_operands(rv_decode *dec)
+static void decode_inst_operands(rv_decode *dec, rv_isa isa)
 {
     rv_inst inst = dec->inst;
     dec->codec = opcode_data[dec->op].codec;
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec)
     case rv_codec_cb_sh6:
         dec->rd = dec->rs1 = operand_crs1rdq(inst) + 8;
         dec->rs2 = rv_ireg_zero;
-        dec->imm = operand_cimmsh6(inst);
+        dec->imm = operand_cimmshr6(inst, isa);
         break;
     case rv_codec_ci:
         dec->rd = dec->rs1 = operand_crs1rd(inst);
@@ -XXX,XX +XXX,XX @@ static void decode_inst_operands(rv_decode *dec)
     case rv_codec_ci_sh6:
         dec->rd = dec->rs1 = operand_crs1rd(inst);
         dec->rs2 = rv_ireg_zero;
-        dec->imm = operand_cimmsh6(inst);
+        dec->imm = operand_cimmshl6(inst, isa);
         break;
     case rv_codec_ci_16sp:
         dec->rd = rv_ireg_sp;
@@ -XXX,XX +XXX,XX @@ disasm_inst(char *buf, size_t buflen, rv_isa isa, uint64_t pc, rv_inst inst)
     dec.pc = pc;
     dec.inst = inst;
     decode_inst_opcode(&dec, isa);
-    decode_inst_operands(&dec);
+    decode_inst_operands(&dec, isa);
     decode_inst_decompress(&dec, isa);
     decode_inst_lift_pseudo(&dec);
     format_inst(buf, buflen, 16, &dec);
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static int ex_rvc_register(DisasContext *ctx, int reg)
     return 8 + reg;
 }
 
-static int ex_rvc_shifti(DisasContext *ctx, int imm)
+static int ex_rvc_shiftli(DisasContext *ctx, int imm)
 {
     /* For RV128 a shamt of 0 means a shift by 64. */
-    return imm ? imm : 64;
+    if (get_ol(ctx) == MXL_RV128) {
+        imm = imm ? imm : 64;
+    }
+    return imm;
+}
+
+static int ex_rvc_shiftri(DisasContext *ctx, int imm)
+{
+    /*
+     * For RV128 a shamt of 0 means a shift by 64, furthermore, for right
+     * shifts, the shamt is sign-extended.
+     */
+    if (get_ol(ctx) == MXL_RV128) {
+        imm = imm | (imm & 32) << 1;
+        imm = imm ? imm : 64;
+    }
+    return imm;
 }
 
 /* Include the auto-generated decoder for 32 bit insn */
-- 
2.37.2

From: Weiwei Li <liweiwei@iscas.ac.cn>

- Zmmul is ratified and is now version 1.0

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220710101546.3907-1-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("zhinx", RISCVCPU, cfg.ext_zhinx, false),
     DEFINE_PROP_BOOL("zhinxmin", RISCVCPU, cfg.ext_zhinxmin, false),
 
+    DEFINE_PROP_BOOL("zmmul", RISCVCPU, cfg.ext_zmmul, false),
+
     /* Vendor-specific custom extensions */
     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
 
     /* These are experimental so mark with 'x-' */
     DEFINE_PROP_BOOL("x-j", RISCVCPU, cfg.ext_j, false),
-    DEFINE_PROP_BOOL("x-zmmul", RISCVCPU, cfg.ext_zmmul, false),
     /* ePMP 0.9.3 */
     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
     DEFINE_PROP_BOOL("x-aia", RISCVCPU, cfg.aia, false),
-- 
2.37.2

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

If the FDT contains /chosen/rng-seed, then the Linux RNG will use it to
initialize early. Set this using the usual guest random number
generation function. This is confirmed to successfully initialize the
RNG on Linux 5.19-rc2.

Cc: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20220613115810.178210-1-Jason@zx2c4.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/units.h"
 #include "qemu/error-report.h"
+#include "qemu/guest-random.h"
 #include "qapi/error.h"
 #include "hw/boards.h"
 #include "hw/loader.h"
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
     MachineState *mc = MACHINE(s);
     uint32_t phandle = 1, irq_mmio_phandle = 1, msi_pcie_phandle = 1;
     uint32_t irq_pcie_phandle = 1, irq_virtio_phandle = 1;
+    uint8_t rng_seed[32];
 
     if (mc->dtb) {
         mc->fdt = load_device_tree(mc->dtb, &s->fdt_size);
@@ -XXX,XX +XXX,XX @@ update_bootargs:
     if (cmdline && *cmdline) {
         qemu_fdt_setprop_string(mc->fdt, "/chosen", "bootargs", cmdline);
     }
+
+    /* Pass seed to RNG */
+    qemu_guest_getrandom_nofail(rng_seed, sizeof(rng_seed));
+    qemu_fdt_setprop(mc->fdt, "/chosen", "rng-seed", rng_seed, sizeof(rng_seed));
 }
 
 static inline DeviceState *gpex_pcie_init(MemoryRegion *sys_mem,
-- 
2.37.2

From: Weiwei Li <liweiwei@iscas.ac.cn>

There are 3 suggested privilege mode combinations listed in section 1.2
of the riscv-privileged spec(draft-20220717):
1) M, 2) M, U 3) M, S, U

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-Id: <20220718130955.11899-2-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 6 ++++++
 1 file changed, 6 insertions(+)

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add check for "H depends on an I base integer ISA with 32 x registers"
which is stated at the beginning of chapter 8 of the riscv-privileged
spec(draft-20220717)

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-Id: <20220718130955.11899-3-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 6 ++++++
 1 file changed, 6 insertions(+)

From: Weiwei Li <liweiwei@iscas.ac.cn>

Fix the lines with over 80 characters

Fix the lines which are obviously misalgined with other lines in the
same group

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-Id: <20220718130955.11899-4-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 441 ++++++++++++++++++++++++---------------------
 1 file changed, 234 insertions(+), 207 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_FRM]      = { "frm",      fs,     read_frm,     write_frm    },
     [CSR_FCSR]     = { "fcsr",     fs,     read_fcsr,    write_fcsr   },
     /* Vector CSRs */
-    [CSR_VSTART]   = { "vstart",   vs,    read_vstart,  write_vstart,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VXSAT]    = { "vxsat",    vs,    read_vxsat,   write_vxsat,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VXRM]     = { "vxrm",     vs,    read_vxrm,    write_vxrm,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VCSR]     = { "vcsr",     vs,    read_vcsr,    write_vcsr,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VL]       = { "vl",       vs,    read_vl,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VTYPE]    = { "vtype",    vs,    read_vtype,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VLENB]    = { "vlenb",    vs,    read_vlenb,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_VSTART]   = { "vstart",   vs,     read_vstart,  write_vstart,
+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
+    [CSR_VXSAT]    = { "vxsat",    vs,     read_vxsat,   write_vxsat,
+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
+    [CSR_VXRM]     = { "vxrm",     vs,     read_vxrm,    write_vxrm,
+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
+    [CSR_VCSR]     = { "vcsr",     vs,     read_vcsr,    write_vcsr,
+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
+    [CSR_VL]       = { "vl",       vs,     read_vl,
+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
+    [CSR_VTYPE]    = { "vtype",    vs,     read_vtype,
+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
+    [CSR_VLENB]    = { "vlenb",    vs,     read_vlenb,
+                       .min_priv_ver = PRIV_VERSION_1_12_0            },
     /* User Timers and Counters */
     [CSR_CYCLE]    = { "cycle",    ctr,    read_hpmcounter  },
     [CSR_INSTRET]  = { "instret",  ctr,    read_hpmcounter  },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 
 #if !defined(CONFIG_USER_ONLY)
     /* Machine Timers and Counters */
-    [CSR_MCYCLE]    = { "mcycle",    any,   read_hpmcounter, write_mhpmcounter},
-    [CSR_MINSTRET]  = { "minstret",  any,   read_hpmcounter, write_mhpmcounter},
-    [CSR_MCYCLEH]   = { "mcycleh",   any32, read_hpmcounterh, write_mhpmcounterh},
-    [CSR_MINSTRETH] = { "minstreth", any32, read_hpmcounterh, write_mhpmcounterh},
+    [CSR_MCYCLE]    = { "mcycle",    any,   read_hpmcounter,
+                        write_mhpmcounter                    },
+    [CSR_MINSTRET]  = { "minstret",  any,   read_hpmcounter,
+                        write_mhpmcounter                    },
+    [CSR_MCYCLEH]   = { "mcycleh",   any32, read_hpmcounterh,
+                        write_mhpmcounterh                   },
+    [CSR_MINSTRETH] = { "minstreth", any32, read_hpmcounterh,
+                        write_mhpmcounterh                   },
 
     /* Machine Information Registers */
     [CSR_MVENDORID] = { "mvendorid", any,   read_mvendorid },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_MHARTID]   = { "mhartid",   any,   read_mhartid   },
 
     [CSR_MCONFIGPTR]  = { "mconfigptr", any,   read_zero,
-                                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+                          .min_priv_ver = PRIV_VERSION_1_12_0 },
     /* Machine Trap Setup */
-    [CSR_MSTATUS]     = { "mstatus",    any,   read_mstatus,     write_mstatus, NULL,
-                                               read_mstatus_i128                   },
-    [CSR_MISA]        = { "misa",       any,   read_misa,        write_misa, NULL,
-                                               read_misa_i128                      },
-    [CSR_MIDELEG]     = { "mideleg",    any,   NULL,    NULL,    rmw_mideleg       },
-    [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg,     write_medeleg     },
-    [CSR_MIE]         = { "mie",        any,   NULL,    NULL,    rmw_mie           },
-    [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,       write_mtvec       },
-    [CSR_MCOUNTEREN]  = { "mcounteren", any,   read_mcounteren,  write_mcounteren  },
-
-    [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,    write_mstatush    },
+    [CSR_MSTATUS]     = { "mstatus",    any,   read_mstatus, write_mstatus,
+                          NULL,                read_mstatus_i128           },
+    [CSR_MISA]        = { "misa",       any,   read_misa,    write_misa,
+                          NULL,                read_misa_i128              },
+    [CSR_MIDELEG]     = { "mideleg",    any,   NULL, NULL,   rmw_mideleg   },
+    [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg, write_medeleg },
+    [CSR_MIE]         = { "mie",        any,   NULL, NULL,   rmw_mie       },
+    [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,   write_mtvec   },
+    [CSR_MCOUNTEREN]  = { "mcounteren", any,   read_mcounteren,
+                          write_mcounteren                                 },
+
+    [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,
+                          write_mstatush                                   },
 
     /* Machine Trap Handling */
-    [CSR_MSCRATCH] = { "mscratch", any,  read_mscratch,      write_mscratch, NULL,
-                                         read_mscratch_i128, write_mscratch_i128   },
+    [CSR_MSCRATCH] = { "mscratch", any,  read_mscratch, write_mscratch,
+                       NULL, read_mscratch_i128, write_mscratch_i128   },
     [CSR_MEPC]     = { "mepc",     any,  read_mepc,     write_mepc     },
     [CSR_MCAUSE]   = { "mcause",   any,  read_mcause,   write_mcause   },
     [CSR_MTVAL]    = { "mtval",    any,  read_mtval,    write_mtval    },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_MIREG]    = { "mireg",    aia_any,   NULL, NULL,    rmw_xireg },
 
     /* Machine-Level Interrupts (AIA) */
-    [CSR_MTOPEI]     = { "mtopei",     aia_any, NULL, NULL, rmw_xtopei },
-    [CSR_MTOPI]    = { "mtopi",    aia_any,   read_mtopi },
+    [CSR_MTOPEI]   = { "mtopei",   aia_any, NULL, NULL, rmw_xtopei },
+    [CSR_MTOPI]    = { "mtopi",    aia_any, read_mtopi },
 
     /* Virtual Interrupts for Supervisor Level (AIA) */
-    [CSR_MVIEN]      = { "mvien", aia_any, read_zero, write_ignore },
-    [CSR_MVIP]       = { "mvip",  aia_any, read_zero, write_ignore },
+    [CSR_MVIEN]    = { "mvien",    aia_any, read_zero, write_ignore },
+    [CSR_MVIP]     = { "mvip",     aia_any, read_zero, write_ignore },
 
     /* Machine-Level High-Half CSRs (AIA) */
     [CSR_MIDELEGH] = { "midelegh", aia_any32, NULL, NULL, rmw_midelegh },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
 
     /* Execution environment configuration */
     [CSR_MENVCFG]  = { "menvcfg",  any,   read_menvcfg,  write_menvcfg,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
+                       .min_priv_ver = PRIV_VERSION_1_12_0              },
     [CSR_MENVCFGH] = { "menvcfgh", any32, read_menvcfgh, write_menvcfgh,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
+                       .min_priv_ver = PRIV_VERSION_1_12_0              },
     [CSR_SENVCFG]  = { "senvcfg",  smode, read_senvcfg,  write_senvcfg,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
+                       .min_priv_ver = PRIV_VERSION_1_12_0              },
     [CSR_HENVCFG]  = { "henvcfg",  hmode, read_henvcfg, write_henvcfg,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
+                       .min_priv_ver = PRIV_VERSION_1_12_0              },
     [CSR_HENVCFGH] = { "henvcfgh", hmode32, read_henvcfgh, write_henvcfgh,
-                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
+                       .min_priv_ver = PRIV_VERSION_1_12_0              },
 
     /* Supervisor Trap Setup */
-    [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus, NULL,
-                                              read_sstatus_i128                 },
-    [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie          },
-    [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec      },
-    [CSR_SCOUNTEREN] = { "scounteren", smode, read_scounteren, write_scounteren },
+    [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
+                         NULL,                read_sstatus_i128               },
+    [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie        },
+    [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec    },
+    [CSR_SCOUNTEREN] = { "scounteren", smode, read_scounteren,
+                         write_scounteren                                     },
 
     /* Supervisor Trap Handling */
-    [CSR_SSCRATCH] = { "sscratch", smode, read_sscratch, write_sscratch, NULL,
-                                          read_sscratch_i128, write_sscratch_i128  },
+    [CSR_SSCRATCH] = { "sscratch", smode, read_sscratch, write_sscratch,
+                       NULL, read_sscratch_i128, write_sscratch_i128    },
     [CSR_SEPC]     = { "sepc",     smode, read_sepc,     write_sepc     },
     [CSR_SCAUSE]   = { "scause",   smode, read_scause,   write_scause   },
-    [CSR_STVAL]    = { "stval",    smode, read_stval,   write_stval   },
+    [CSR_STVAL]    = { "stval",    smode, read_stval,    write_stval    },
     [CSR_SIP]      = { "sip",      smode, NULL,    NULL, rmw_sip        },
 
     /* Supervisor Protection and Translation */
-    [CSR_SATP]     = { "satp",     smode, read_satp,    write_satp      },
+    [CSR_SATP]     = { "satp",     smode, read_satp,     write_satp     },
 
     /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
     [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_SIEH]       = { "sieh",   aia_smode32, NULL, NULL, rmw_sieh },
     [CSR_SIPH]       = { "siph",   aia_smode32, NULL, NULL, rmw_siph },
 
-    [CSR_HSTATUS]     = { "hstatus",     hmode,   read_hstatus,   write_hstatus,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_HEDELEG]     = { "hedeleg",     hmode,   read_hedeleg,   write_hedeleg,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_HSTATUS]     = { "hstatus",     hmode,   read_hstatus, write_hstatus,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_HEDELEG]     = { "hedeleg",     hmode,   read_hedeleg, write_hedeleg,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
     [CSR_HIDELEG]     = { "hideleg",     hmode,   NULL,   NULL, rmw_hideleg,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_HVIP]        = { "hvip",        hmode,   NULL,   NULL,   rmw_hvip,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_HIP]         = { "hip",         hmode,   NULL,   NULL,   rmw_hip,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_HIE]         = { "hie",         hmode,   NULL,   NULL,    rmw_hie,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_HCOUNTEREN]  = { "hcounteren",  hmode,   read_hcounteren, write_hcounteren,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_HGEIE]       = { "hgeie",       hmode,   read_hgeie,       write_hgeie,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_HTVAL]       = { "htval",       hmode,   read_htval,     write_htval,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_HTINST]      = { "htinst",      hmode,   read_htinst,    write_htinst,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_HVIP]        = { "hvip",        hmode,   NULL,   NULL, rmw_hvip,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_HIP]         = { "hip",         hmode,   NULL,   NULL, rmw_hip,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_HIE]         = { "hie",         hmode,   NULL,   NULL, rmw_hie,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_HCOUNTEREN]  = { "hcounteren",  hmode,   read_hcounteren,
+                          write_hcounteren,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_HGEIE]       = { "hgeie",       hmode,   read_hgeie,   write_hgeie,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_HTVAL]       = { "htval",       hmode,   read_htval,   write_htval,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_HTINST]      = { "htinst",      hmode,   read_htinst,  write_htinst,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
     [CSR_HGEIP]       = { "hgeip",       hmode,   read_hgeip,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_HGATP]       = { "hgatp",       hmode,   read_hgatp,     write_hgatp,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta, write_htimedelta,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_HTIMEDELTAH] = { "htimedeltah", hmode32, read_htimedeltah, write_htimedeltah,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-
-    [CSR_VSSTATUS]    = { "vsstatus",    hmode,   read_vsstatus,  write_vsstatus,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VSIP]        = { "vsip",        hmode,   NULL,    NULL,  rmw_vsip,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VSIE]        = { "vsie",        hmode,   NULL,    NULL,    rmw_vsie ,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VSTVEC]      = { "vstvec",      hmode,   read_vstvec,    write_vstvec,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VSSCRATCH]   = { "vsscratch",   hmode,   read_vsscratch, write_vsscratch,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VSEPC]       = { "vsepc",       hmode,   read_vsepc,     write_vsepc,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VSCAUSE]     = { "vscause",     hmode,   read_vscause,   write_vscause,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VSTVAL]      = { "vstval",      hmode,   read_vstval,    write_vstval,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_VSATP]       = { "vsatp",       hmode,   read_vsatp,     write_vsatp,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-
-    [CSR_MTVAL2]      = { "mtval2",      hmode,   read_mtval2,    write_mtval2,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-    [CSR_MTINST]      = { "mtinst",      hmode,   read_mtinst,    write_mtinst,
-                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_HGATP]       = { "hgatp",       hmode,   read_hgatp,   write_hgatp,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta,
+                          write_htimedelta,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_HTIMEDELTAH] = { "htimedeltah", hmode32, read_htimedeltah,
+                          write_htimedeltah,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+
+    [CSR_VSSTATUS]    = { "vsstatus",    hmode,   read_vsstatus,
+                          write_vsstatus,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSIP]        = { "vsip",        hmode,   NULL,    NULL, rmw_vsip,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSIE]        = { "vsie",        hmode,   NULL,    NULL, rmw_vsie ,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSTVEC]      = { "vstvec",      hmode,   read_vstvec,   write_vstvec,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSSCRATCH]   = { "vsscratch",   hmode,   read_vsscratch,
+                          write_vsscratch,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSEPC]       = { "vsepc",       hmode,   read_vsepc,    write_vsepc,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSCAUSE]     = { "vscause",     hmode,   read_vscause,  write_vscause,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSTVAL]      = { "vstval",      hmode,   read_vstval,   write_vstval,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_VSATP]       = { "vsatp",       hmode,   read_vsatp,    write_vsatp,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+
+    [CSR_MTVAL2]      = { "mtval2",      hmode,   read_mtval2,   write_mtval2,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
+    [CSR_MTINST]      = { "mtinst",      hmode,   read_mtinst,   write_mtinst,
+                          .min_priv_ver = PRIV_VERSION_1_12_0                },
 
     /* Virtual Interrupts and Interrupt Priorities (H-extension with AIA) */
     [CSR_HVIEN]       = { "hvien",       aia_hmode, read_zero, write_ignore },
-    [CSR_HVICTL]      = { "hvictl",      aia_hmode, read_hvictl, write_hvictl },
-    [CSR_HVIPRIO1]    = { "hviprio1",    aia_hmode, read_hviprio1,   write_hviprio1 },
-    [CSR_HVIPRIO2]    = { "hviprio2",    aia_hmode, read_hviprio2,   write_hviprio2 },
+    [CSR_HVICTL]      = { "hvictl",      aia_hmode, read_hvictl,
+                          write_hvictl                                      },
+    [CSR_HVIPRIO1]    = { "hviprio1",    aia_hmode, read_hviprio1,
+                          write_hviprio1                                    },
+    [CSR_HVIPRIO2]    = { "hviprio2",    aia_hmode, read_hviprio2,
+                          write_hviprio2                                    },
 
     /*
      * VS-Level Window to Indirectly Accessed Registers (H-extension with AIA)
      */
-    [CSR_VSISELECT]   = { "vsiselect",   aia_hmode, NULL, NULL,      rmw_xiselect },
-    [CSR_VSIREG]      = { "vsireg",      aia_hmode, NULL, NULL,      rmw_xireg },
+    [CSR_VSISELECT]   = { "vsiselect",   aia_hmode, NULL, NULL,
+                          rmw_xiselect                                     },
+    [CSR_VSIREG]      = { "vsireg",      aia_hmode, NULL, NULL, rmw_xireg  },
 
     /* VS-Level Interrupts (H-extension with AIA) */
     [CSR_VSTOPEI]     = { "vstopei",     aia_hmode, NULL, NULL, rmw_xtopei },
     [CSR_VSTOPI]      = { "vstopi",      aia_hmode, read_vstopi },
 
     /* Hypervisor and VS-Level High-Half CSRs (H-extension with AIA) */
-    [CSR_HIDELEGH]    = { "hidelegh",    aia_hmode32, NULL, NULL, rmw_hidelegh },
-    [CSR_HVIENH]      = { "hvienh",      aia_hmode32, read_zero, write_ignore },
+    [CSR_HIDELEGH]    = { "hidelegh",    aia_hmode32, NULL, NULL,
+                          rmw_hidelegh                                      },
+    [CSR_HVIENH]      = { "hvienh",      aia_hmode32, read_zero,
+                          write_ignore                                      },
     [CSR_HVIPH]       = { "hviph",       aia_hmode32, NULL, NULL, rmw_hviph },
-    [CSR_HVIPRIO1H]   = { "hviprio1h",   aia_hmode32, read_hviprio1h, write_hviprio1h },
-    [CSR_HVIPRIO2H]   = { "hviprio2h",   aia_hmode32, read_hviprio2h, write_hviprio2h },
+    [CSR_HVIPRIO1H]   = { "hviprio1h",   aia_hmode32, read_hviprio1h,
+                          write_hviprio1h                                   },
+    [CSR_HVIPRIO2H]   = { "hviprio2h",   aia_hmode32, read_hviprio2h,
+                          write_hviprio2h                                   },
     [CSR_VSIEH]       = { "vsieh",       aia_hmode32, NULL, NULL, rmw_vsieh },
     [CSR_VSIPH]       = { "vsiph",       aia_hmode32, NULL, NULL, rmw_vsiph },
 
     /* Physical Memory Protection */
     [CSR_MSECCFG]    = { "mseccfg",  epmp, read_mseccfg, write_mseccfg,
-                                     .min_priv_ver = PRIV_VERSION_1_11_0 },
+                         .min_priv_ver = PRIV_VERSION_1_11_0           },
     [CSR_PMPCFG0]    = { "pmpcfg0",   pmp, read_pmpcfg,  write_pmpcfg  },
     [CSR_PMPCFG1]    = { "pmpcfg1",   pmp, read_pmpcfg,  write_pmpcfg  },
     [CSR_PMPCFG2]    = { "pmpcfg2",   pmp, read_pmpcfg,  write_pmpcfg  },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_TDATA3]    =  { "tdata3",  debug, read_tdata,   write_tdata   },
 
     /* User Pointer Masking */
-    [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,    write_umte    },
-    [CSR_UPMMASK] =    { "upmmask", pointer_masking, read_upmmask, write_upmmask },
-    [CSR_UPMBASE] =    { "upmbase", pointer_masking, read_upmbase, write_upmbase },
+    [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,  write_umte },
+    [CSR_UPMMASK] =    { "upmmask", pointer_masking, read_upmmask,
+                         write_upmmask                                      },
+    [CSR_UPMBASE] =    { "upmbase", pointer_masking, read_upmbase,
+                         write_upmbase                                      },
     /* Machine Pointer Masking */
-    [CSR_MMTE]    =    { "mmte",    pointer_masking, read_mmte,    write_mmte    },
-    [CSR_MPMMASK] =    { "mpmmask", pointer_masking, read_mpmmask, write_mpmmask },
-    [CSR_MPMBASE] =    { "mpmbase", pointer_masking, read_mpmbase, write_mpmbase },
+    [CSR_MMTE]    =    { "mmte",    pointer_masking, read_mmte,  write_mmte },
+    [CSR_MPMMASK] =    { "mpmmask", pointer_masking, read_mpmmask,
+                         write_mpmmask                                      },
+    [CSR_MPMBASE] =    { "mpmbase", pointer_masking, read_mpmbase,
+                         write_mpmbase                                      },
     /* Supervisor Pointer Masking */
-    [CSR_SMTE]    =    { "smte",    pointer_masking, read_smte,    write_smte    },
-    [CSR_SPMMASK] =    { "spmmask", pointer_masking, read_spmmask, write_spmmask },
-    [CSR_SPMBASE] =    { "spmbase", pointer_masking, read_spmbase, write_spmbase },
+    [CSR_SMTE]    =    { "smte",    pointer_masking, read_smte,  write_smte },
+    [CSR_SPMMASK] =    { "spmmask", pointer_masking, read_spmmask,
+                         write_spmmask                                      },
+    [CSR_SPMBASE] =    { "spmbase", pointer_masking, read_spmbase,
+                         write_spmbase                                      },
 
     /* Performance Counters */
     [CSR_HPMCOUNTER3]    = { "hpmcounter3",    ctr,    read_hpmcounter },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_HPMCOUNTER31]   = { "hpmcounter31",   ctr,    read_hpmcounter },
 
     [CSR_MHPMCOUNTER3]   = { "mhpmcounter3",   mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER4]   = { "mhpmcounter4",   mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER5]   = { "mhpmcounter5",   mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER6]   = { "mhpmcounter6",   mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER7]   = { "mhpmcounter7",   mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER8]   = { "mhpmcounter8",   mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER9]   = { "mhpmcounter9",   mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER10]  = { "mhpmcounter10",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER11]  = { "mhpmcounter11",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER12]  = { "mhpmcounter12",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER13]  = { "mhpmcounter13",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER14]  = { "mhpmcounter14",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER15]  = { "mhpmcounter15",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER16]  = { "mhpmcounter16",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER17]  = { "mhpmcounter17",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER18]  = { "mhpmcounter18",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER19]  = { "mhpmcounter19",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER20]  = { "mhpmcounter20",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER21]  = { "mhpmcounter21",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER22]  = { "mhpmcounter22",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER23]  = { "mhpmcounter23",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER24]  = { "mhpmcounter24",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER25]  = { "mhpmcounter25",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER26]  = { "mhpmcounter26",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER27]  = { "mhpmcounter27",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER28]  = { "mhpmcounter28",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER29]  = { "mhpmcounter29",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER30]  = { "mhpmcounter30",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
     [CSR_MHPMCOUNTER31]  = { "mhpmcounter31",  mctr,    read_hpmcounter,
-                                                       write_mhpmcounter },
+                             write_mhpmcounter                         },
 
     [CSR_MCOUNTINHIBIT]  = { "mcountinhibit",  any, read_mcountinhibit,
-               write_mcountinhibit, .min_priv_ver = PRIV_VERSION_1_11_0  },
+                             write_mcountinhibit,
+                             .min_priv_ver = PRIV_VERSION_1_11_0       },
 
     [CSR_MHPMEVENT3]     = { "mhpmevent3",     any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT4]     = { "mhpmevent4",     any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT5]     = { "mhpmevent5",     any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT6]     = { "mhpmevent6",     any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT7]     = { "mhpmevent7",     any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT8]     = { "mhpmevent8",     any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT9]     = { "mhpmevent9",     any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT10]    = { "mhpmevent10",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT11]    = { "mhpmevent11",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT12]    = { "mhpmevent12",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT13]    = { "mhpmevent13",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT14]    = { "mhpmevent14",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT15]    = { "mhpmevent15",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT16]    = { "mhpmevent16",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT17]    = { "mhpmevent17",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT18]    = { "mhpmevent18",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT19]    = { "mhpmevent19",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT20]    = { "mhpmevent20",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT21]    = { "mhpmevent21",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT22]    = { "mhpmevent22",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT23]    = { "mhpmevent23",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT24]    = { "mhpmevent24",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT25]    = { "mhpmevent25",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT26]    = { "mhpmevent26",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT27]    = { "mhpmevent27",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT28]    = { "mhpmevent28",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT29]    = { "mhpmevent29",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT30]    = { "mhpmevent30",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
     [CSR_MHPMEVENT31]    = { "mhpmevent31",    any,    read_mhpmevent,
-                                                       write_mhpmevent },
+                             write_mhpmevent                           },
 
     [CSR_HPMCOUNTER3H]   = { "hpmcounter3h",   ctr32,  read_hpmcounterh },
     [CSR_HPMCOUNTER4H]   = { "hpmcounter4h",   ctr32,  read_hpmcounterh },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_HPMCOUNTER31H]  = { "hpmcounter31h",  ctr32,  read_hpmcounterh },
 
     [CSR_MHPMCOUNTER3H]  = { "mhpmcounter3h",  mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER4H]  = { "mhpmcounter4h",  mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER5H]  = { "mhpmcounter5h",  mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER6H]  = { "mhpmcounter6h",  mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER7H]  = { "mhpmcounter7h",  mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER8H]  = { "mhpmcounter8h",  mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER9H]  = { "mhpmcounter9h",  mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER10H] = { "mhpmcounter10h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER11H] = { "mhpmcounter11h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER12H] = { "mhpmcounter12h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER13H] = { "mhpmcounter13h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER14H] = { "mhpmcounter14h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER15H] = { "mhpmcounter15h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER16H] = { "mhpmcounter16h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER17H] = { "mhpmcounter17h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER18H] = { "mhpmcounter18h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER19H] = { "mhpmcounter19h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER20H] = { "mhpmcounter20h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER21H] = { "mhpmcounter21h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER22H] = { "mhpmcounter22h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER23H] = { "mhpmcounter23h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER24H] = { "mhpmcounter24h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER25H] = { "mhpmcounter25h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER26H] = { "mhpmcounter26h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER27H] = { "mhpmcounter27h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER28H] = { "mhpmcounter28h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER29H] = { "mhpmcounter29h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER30H] = { "mhpmcounter30h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", mctr32,  read_hpmcounterh,
-                                                       write_mhpmcounterh },
+                             write_mhpmcounterh                         },
 #endif /* !CONFIG_USER_ONLY */
 };
-- 
2.37.2

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add umode/umode32 predicate for mcounteren, menvcfg/menvcfgh

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-Id: <20220718130955.11899-5-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException hmode32(CPURISCVState *env, int csrno)
 
 }
 
+static RISCVException umode(CPURISCVState *env, int csrno)
+{
+    if (riscv_has_ext(env, RVU)) {
+        return RISCV_EXCP_NONE;
+    }
+
+    return RISCV_EXCP_ILLEGAL_INST;
+}
+
+static RISCVException umode32(CPURISCVState *env, int csrno)
+{
+    if (riscv_cpu_mxl(env) != MXL_RV32) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return umode(env, csrno);
+}
+
 /* Checks if PointerMasking registers could be accessed */
 static RISCVException pointer_masking(CPURISCVState *env, int csrno)
 {
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg, write_medeleg },
     [CSR_MIE]         = { "mie",        any,   NULL, NULL,   rmw_mie       },
     [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,   write_mtvec   },
-    [CSR_MCOUNTEREN]  = { "mcounteren", any,   read_mcounteren,
+    [CSR_MCOUNTEREN]  = { "mcounteren", umode, read_mcounteren,
                           write_mcounteren                                 },
 
     [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_MIPH]     = { "miph",     aia_any32, NULL, NULL, rmw_miph     },
 
     /* Execution environment configuration */
-    [CSR_MENVCFG]  = { "menvcfg",  any,   read_menvcfg,  write_menvcfg,
+    [CSR_MENVCFG]  = { "menvcfg",  umode, read_menvcfg,  write_menvcfg,
                        .min_priv_ver = PRIV_VERSION_1_12_0              },
-    [CSR_MENVCFGH] = { "menvcfgh", any32, read_menvcfgh, write_menvcfgh,
+    [CSR_MENVCFGH] = { "menvcfgh", umode32, read_menvcfgh, write_menvcfgh,
                        .min_priv_ver = PRIV_VERSION_1_12_0              },
     [CSR_SENVCFG]  = { "senvcfg",  smode, read_senvcfg,  write_senvcfg,
                        .min_priv_ver = PRIV_VERSION_1_12_0              },
-- 
2.37.2

From: Weiwei Li <liweiwei@iscas.ac.cn>

Add check for the implicit dependence between H and S

Csrs only existed in RV32 will not trigger virtual instruction fault
when not in RV32 based on section 8.6.1 of riscv-privileged spec
(draft-20220717)

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220718130955.11899-6-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 5 +++++
 target/riscv/csr.c | 9 ++-------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
             return;
         }
 
+        if (cpu->cfg.ext_h && !cpu->cfg.ext_s) {
+            error_setg(errp, "H extension implicitly requires S-mode");
+            return;
+        }
+
         if (cpu->cfg.ext_f && !cpu->cfg.ext_icsr) {
             error_setg(errp, "F extension requires Zicsr");
             return;
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int aia_smode32(CPURISCVState *env, int csrno)
 
 static RISCVException hmode(CPURISCVState *env, int csrno)
 {
-    if (riscv_has_ext(env, RVS) &&
-        riscv_has_ext(env, RVH)) {
+    if (riscv_has_ext(env, RVH)) {
         /* Hypervisor extension is supported */
         if ((env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
             env->priv == PRV_M) {
@@ -XXX,XX +XXX,XX @@ static RISCVException hmode(CPURISCVState *env, int csrno)
 static RISCVException hmode32(CPURISCVState *env, int csrno)
 {
     if (riscv_cpu_mxl(env) != MXL_RV32) {
-        if (!riscv_cpu_virt_enabled(env)) {
-            return RISCV_EXCP_ILLEGAL_INST;
-        } else {
-            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-        }
+        return RISCV_EXCP_ILLEGAL_INST;
     }
 
     return hmode(env, csrno);
-- 
2.37.2

From: Weiwei Li <liweiwei@iscas.ac.cn>

Just add 1 to the effective privledge level when in HS mode, then reuse
the check of 'effective_priv < csr_priv' in riscv_csrrw_check to replace
the privilege level related check in hmode. Then, hmode will only check
whether H extension is supported.

When accessing Hypervior CSRs:
   1) If accessing from M privilege level, the check of
'effective_priv< csr_priv' passes, returns hmode(...) which will return
RISCV_EXCP_ILLEGAL_INST when H extension is not supported and return
RISCV_EXCP_NONE otherwise.
   2) If accessing from HS privilege level, effective_priv will add 1,
the check passes and also returns hmode(...) too.
   3) If accessing from VS/VU privilege level, the check fails, and
returns RISCV_EXCP_VIRT_INSTRUCTION_FAULT
   4) If accessing from U privilege level, the check fails, and returns
RISCV_EXCP_ILLEGAL_INST

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-Id: <20220718130955.11899-7-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int aia_smode32(CPURISCVState *env, int csrno)
 static RISCVException hmode(CPURISCVState *env, int csrno)
 {
     if (riscv_has_ext(env, RVH)) {
-        /* Hypervisor extension is supported */
-        if ((env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
-            env->priv == PRV_M) {
-            return RISCV_EXCP_NONE;
-        } else {
-            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-        }
+        return RISCV_EXCP_NONE;
     }
 
     return RISCV_EXCP_ILLEGAL_INST;
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
 #if !defined(CONFIG_USER_ONLY)
     int csr_priv, effective_priv = env->priv;
 
-    if (riscv_has_ext(env, RVH) && env->priv == PRV_S) {
+    if (riscv_has_ext(env, RVH) && env->priv == PRV_S &&
+        !riscv_cpu_virt_enabled(env)) {
         /*
-         * We are in either HS or VS mode.
-         * Add 1 to the effective privledge level to allow us to access the
-         * Hypervisor CSRs. The `hmode` predicate will determine if access
-         * should be allowed(HS) or if a virtual instruction exception should be
-         * raised(VS).
+         * We are in HS mode. Add 1 to the effective privledge level to
+         * allow us to access the Hypervisor CSRs.
          */
         effective_priv++;
     }
-- 
2.37.2

From: Bin Meng <bmeng.cn@gmail.com>

Upgrade OpenSBI from v1.0 to v1.1 and the pre-built bios images.

The v1.1 release includes the following commits:

5b99603 lib: utils/ipi: Fix size check in aclint_mswi_cold_init()
6dde435 lib: utils/sys: Extend HTIF library to allow custom base address
8257262 platform: sifive_fu740: do not use a global in da9063_reset/shutdown
fb688d9 platform: sifive_fu740: fix reset when watchdog is running
5d025eb lib: fix pointer of type 'void *' used in arithmetic
632f593 lib: sbi: Map only the counters enabled in hardware
3b7c204 lib: sbi: Disable interrupt during config matching
a26dc60 lib: sbi: Disable interrupt and inhibit counting in M-mode during init
5d53b55 Makefile: fix build with binutils 2.38
6ad8917 lib: fix compilation when strings.h is included
ce4c018 lib: utils/serial: Round UART8250 baud rate divisor to nearest integer
01250d0 include: sbi: Add AIA related CSR defines
8f96070 lib: sbi: Detect AIA CSRs at boot-time
65b4c7c lib: sbi: Use AIA CSRs for local interrupts when available
222132f lib: sbi: Add sbi_trap_set_external_irqfn() API
5f56314 lib: utils/irqchip: Allow multiple FDT irqchip drivers
1050940 include: sbi: Introduce nascent_init() platform callback
55e79f8 lib: sbi: Enable mie.MEIE bit for IPIs based on external interrupts.
9f73669 lib: utils/irqchip: Add IMSIC library
811da5c lib: utils/irqchip: Add FDT based driver for IMSIC
7127aaa lib: utils: Disable appropriate IMSIC DT nodes in fdt_fixups()
9979265 lib: utils/irqchip: Add APLIC initialization library
3461219 lib: utils/irqchip: Add FDT based driver for APLIC
8e2ef4f lib: utils: Disable appropriate APLIC DT nodes in fdt_fixups()
3a69cc1 lib: sbi: fix typo in is_region_subset
f2ccf2f lib: sbi: verbose sbi_domain_root_add_memregion
f3f4604 lib: sbi: Add a simple external interrupt handling framework
4998a71 lib: utils: serial: Initial commit of xlnx-uartlite
2dfbd3c lib: pmp_set/pmp_get moved errors from runtime to compile time
b6b7220 firmware: Fix code for accessing hart_count and stack_size
d552fc8 lib: Add error messages via conditional compilation for the future
555bdb1 include: Use static asserts for SBI_PLATFORM_xxx_OFFSET defines
1b42d3a include: Use static asserts for SBI_SCRATCH_xxx_OFFSET defines
7924a0b include: Use static asserts for FW_DYNAMIC_INFO_xxx_OFFSET defines
722f80d include: Add defines for [m|h|s]envcfg CSRs
31fecad lib: sbi: Detect menvcfg CSR at boot time
47d6765 lib: sbi: Enable Zicbo[m|z] extensions in the menvcfg CSR
794986f lib: sbi: Enable Svpbmt extension in the menvcfg CSR
499601a lib: sbi: Add Smstateen extension defines
d44568a lib: sbi: Detect Smstateen CSRs at boot-time
3383d6a lib: irqchip/imsic: configure mstateen
5c5cbb5 lib: utils/serial: support 'reg-offset' property
c1e47d0 include: correct the definition of MSTATUS_VS
9cd95e1 lib: sbi/hart: preserve csr validation value
4035ae9 docs: pmu: Improve the PMU DT bindings
d62f6da lib: sbi: Implement Sstc extension
474a9d4 lib: sbi: Fix mstatus_init() for RV32 when Sscofpmf is not available
e576b3e include: sbi: Define SBI_PMU_HW_EVENT_MAX to 256
b0c9df5 lib: sbi: Fix mhpmeventh access for rv32 in absence of sscofpmf
1a754bb lib: sbi: Detect and print privileged spec version
5a6be99 lib: sbi: Remove 's' and 'u' from misa_string() output
5b8b377 lib: sbi: Update the name of ISA string printed at boot time
d4b563c lib: sbi: Remove MCOUNTEREN and SCOUNTEREN hart features
dbc3d8f lib: sbi: Remove MCOUNTINHIBT hart feature
97a17c2 lib: sbi: Remove MENVCFG hart feature
a6ab94f lib: sbi: Fix AIA feature detection
cad6c91 lib: sbi: Convert hart features into hart extensions
be4903a lib: sbi: Detect hart features only once for each hart
994ace3 lib: sbi: Add sbi_hart_update_extension() function
023f0ad lib: sbi_platform: Add callback to populate HART extensions
f726f2d Makefile: Allow generated C source to be anywhere in build directory
7fb474b Makefile: Add support for generating C array at compile time
73cf511 lib: utils/reset: Generate FDT reset driver list at compile-time
1e62705 lib: utils/serial: Generate FDT serial driver list at compile-time
bfeb305 lib: utils/timer: Generate FDT timer driver list at compile-time
3a69d12 lib: utils/irqchip: Generate FDT irqchip driver list at compile-time
4ee0c57 lib: utils/ipi: Generate FDT ipi driver list at compile-time
998ed43 lib: utils/i2c: Generate FDT i2c adapter driver list at compile-time
4eacd82 lib: utils/gpio: Generate FDT gpio driver list at compile-time
a3a3c60 platform: generic: Generate platform override module list at compile-time
9a7a677 platform: generic: Move Sifive platform overrides into own directory
851c14d lib: utils/irqchip: fix typo when checking for CPU node
90a9dd2 lib: utils/fdt: introduce fdt_node_is_enabled()
616da52 lib: utils: check if CPU node is enabled
575bb4e platform: generic: check if CPU node is enabled
1bc67db lib: utils/fdt: rename fdt_parse_max_hart_id
f067bb8 lib: sbi: fix system_opcode_insn
fab0379 lib: utils/fdt: Require match data to be const
295e5f3 lib: sbi_timer: Drop unnecessary get_platform_ticks wrapper
ff65bfe lib: sbi_illegal_insn: Constify illegal_insn_table
cb8271c lib: sbi_illegal_insn: Add emulation for fence.tso
adc3388 lib: sbi_trap: Redirect exception based on hedeleg
ce1d618 platform: generic: add overrides for vendor extensions
b20ed9f lib: sbi_hsm: Call a device hook during hart resume
79e42eb lib: sbi_hsm: Assume a consistent resume address
2ea7799 lib: irqchip/plic: Constify plic_data pointers
8c362e7 lib: irqchip/plic: Factor out a context init function
415ecf2 lib: irqchip/plic: Add context save/restore helpers
2b79b69 lib: irqchip/plic: Add priority save/restore helpers
69be3df lib: utils/irqchip: Add FDT wrappers for PLIC save/restore functions
5e56758 lib: utils/irqchip: Add wrapper for T-HEAD PLIC delegation
9dc5ec5 platform: Add HSM implementation for Allwinner D1
551c70c include: sbi: Add mtinst/htinst psuedoinstructions
187127f lib: sbi: Fixup tinst for exceptions in sbi_misaligned_*()
a07402a lib: sbi: Fix tval and tinst for sbi_get_insn()
c653001 lib: utils: Remove CSRs that set/clear an IMSIC interrupt file bits
7738345 lib: utils/timer: Add a separate compatible for the D1 CLINT
d76a196 lib: irqchip/plic: fix typo in plic_warm_irqchip_init
6f1fe98 lib: utils/timer: Remove Allwinner D1 CLINT compatibles
c6fdbcf include: sbi: Change spec version to 1.0
3f66465 lib: pmu: allow to use the highest available counter
4489876 include: Bump-up version to 1.1

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220713090613.204046-1-bmeng.cn@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 108504 -> 117704 bytes
 .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 105296 -> 115344 bytes
 roms/opensbi                                  |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin differ
diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
index XXXXXXX..XXXXXXX 100644
Binary files a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin and b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin differ
diff --git a/roms/opensbi b/roms/opensbi
index XXXXXXX..XXXXXXX 160000
--- a/roms/opensbi
+++ b/roms/opensbi
@@ -1 +1 @@
-Subproject commit 48f91ee9c960f048c4a7d1da4447d31e04931e38
+Subproject commit 4489876e933d8ba0d8bc6c64bae71e295d45faac
-- 
2.37.2

From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>

According to v-spec, mask agnostic behavior can be either kept as
undisturbed or set elements' bits to all 1s. To distinguish the
difference of mask policies, QEMU should be able to simulate the mask
agnostic behavior as "set mask elements' bits to all 1s".

There are multiple possibility for agnostic elements according to
v-spec. The main intent of this patch-set tries to add option that
can distinguish between mask policies. Setting agnostic elements to
all 1s allows QEMU to express this.

This is the first commit regarding the optional mask agnostic
behavior. Follow-up commits will add this optional behavior
for all rvv instructions.

Signed-off-by: eop Chen <eop.chen@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <165570784143.17634.35095816584573691-1@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                      | 2 ++
 target/riscv/internals.h                | 5 +++--
 target/riscv/cpu_helper.c               | 2 ++
 target/riscv/translate.c                | 2 ++
 target/riscv/vector_helper.c            | 8 ++++++++
 target/riscv/insn_trans/trans_rvv.c.inc | 3 +++
 6 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve64f;
     bool ext_zmmul;
     bool rvv_ta_all_1s;
+    bool rvv_ma_all_1s;
 
     uint32_t mvendorid;
     uint64_t marchid;
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, XL, 20, 2)
 FIELD(TB_FLAGS, PM_MASK_ENABLED, 22, 1)
 FIELD(TB_FLAGS, PM_BASE_ENABLED, 23, 1)
 FIELD(TB_FLAGS, VTA, 24, 1)
+FIELD(TB_FLAGS, VMA, 25, 1)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(VDATA, VM, 0, 1)
 FIELD(VDATA, LMUL, 1, 3)
 FIELD(VDATA, VTA, 4, 1)
 FIELD(VDATA, VTA_ALL_1S, 5, 1)
-FIELD(VDATA, NF, 6, 4)
-FIELD(VDATA, WD, 6, 1)
+FIELD(VDATA, VMA, 6, 1)
+FIELD(VDATA, NF, 7, 4)
+FIELD(VDATA, WD, 7, 1)
 
 /* float point classify helpers */
 target_ulong fclass_h(uint64_t frs1);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
         flags = FIELD_DP32(flags, TB_FLAGS, VL_EQ_VLMAX, vl_eq_vlmax);
         flags = FIELD_DP32(flags, TB_FLAGS, VTA,
                     FIELD_EX64(env->vtype, VTYPE, VTA));
+        flags = FIELD_DP32(flags, TB_FLAGS, VMA,
+                    FIELD_EX64(env->vtype, VTYPE, VMA));
     } else {
         flags = FIELD_DP32(flags, TB_FLAGS, VILL, 1);
     }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     int8_t lmul;
     uint8_t sew;
     uint8_t vta;
+    uint8_t vma;
     bool cfg_vta_all_1s;
     target_ulong vstart;
     bool vl_eq_vlmax;
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->sew = FIELD_EX32(tb_flags, TB_FLAGS, SEW);
     ctx->lmul = sextract32(FIELD_EX32(tb_flags, TB_FLAGS, LMUL), 0, 3);
     ctx->vta = FIELD_EX32(tb_flags, TB_FLAGS, VTA) && cpu->cfg.rvv_ta_all_1s;
+    ctx->vma = FIELD_EX32(tb_flags, TB_FLAGS, VMA) && cpu->cfg.rvv_ma_all_1s;
     ctx->cfg_vta_all_1s = cpu->cfg.rvv_ta_all_1s;
     ctx->vstart = env->vstart;
     ctx->vl_eq_vlmax = FIELD_EX32(tb_flags, TB_FLAGS, VL_EQ_VLMAX);
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_vta(uint32_t desc)
     return FIELD_EX32(simd_data(desc), VDATA, VTA);
 }
 
+static inline uint32_t vext_vma(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VMA);
+}
+
 static inline uint32_t vext_vta_all_1s(uint32_t desc)
 {
     return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
@@ -XXX,XX +XXX,XX @@ static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
     uint32_t vl = env->vl;
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
     uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
     uint32_t i;
 
     for (i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
             continue;
         }
         fn(vd, vs1, vs2, i);
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
         data = FIELD_DP32(data, VDATA, VM, a->vm);
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
         data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                            vreg_ofs(s, a->rs1), vreg_ofs(s, a->rs2),
                            cpu_env, s->cfg_ptr->vlen / 8,
@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
         data = FIELD_DP32(data, VDATA, VM, a->vm);
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
         data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                            vreg_ofs(s, a->rs1),
                            vreg_ofs(s, a->rs2),
@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
         data = FIELD_DP32(data, VDATA, VM, a->vm);
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
         data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                            vreg_ofs(s, a->rs1),
                            vreg_ofs(s, a->rs2),
-- 
2.37.2

From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>

Signed-off-by: eop Chen <eop.chen@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <165570784143.17634.35095816584573691-2@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c            | 35 +++++++++++++++++--------
 target/riscv/insn_trans/trans_rvv.c.inc |  5 ++++
 2 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldst_stride(void *vd, void *v0, target_ulong base,
     uint32_t esz = 1 << log2_esz;
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
     uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
 
     for (i = env->vstart; i < env->vl; i++, env->vstart++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            continue;
-        }
-
         k = 0;
         while (k < nf) {
+            if (!vm && !vext_elem_mask(v0, i)) {
+                /* set masked-off elements to 1s */
+                vext_set_elems_1s(vd, vma, (i + k * max_elems) * esz,
+                                  (i + k * max_elems + 1) * esz);
+                k++;
+                continue;
+            }
             target_ulong addr = base + stride * i + (k << log2_esz);
             ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
             k++;
@@ -XXX,XX +XXX,XX @@ vext_ldst_index(void *vd, void *v0, target_ulong base,
     uint32_t esz = 1 << log2_esz;
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
     uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
 
     /* load bytes from guest memory */
     for (i = env->vstart; i < env->vl; i++, env->vstart++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            continue;
-        }
-
         k = 0;
         while (k < nf) {
+            if (!vm && !vext_elem_mask(v0, i)) {
+                /* set masked-off elements to 1s */
+                vext_set_elems_1s(vd, vma, (i + k * max_elems) * esz,
+                                  (i + k * max_elems + 1) * esz);
+                k++;
+                continue;
+            }
             abi_ptr addr = get_index_addr(base, i, vs2) + (k << log2_esz);
             ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
             k++;
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
     uint32_t esz = 1 << log2_esz;
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
     uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
     target_ulong addr, offset, remain;
 
     /* probe every access*/
@@ -XXX,XX +XXX,XX @@ ProbeSuccess:
     }
     for (i = env->vstart; i < env->vl; i++) {
         k = 0;
-        if (!vm && !vext_elem_mask(v0, i)) {
-            continue;
-        }
         while (k < nf) {
+            if (!vm && !vext_elem_mask(v0, i)) {
+                /* set masked-off elements to 1s */
+                vext_set_elems_1s(vd, vma, (i + k * max_elems) * esz,
+                                  (i + k * max_elems + 1) * esz);
+                k++;
+                continue;
+            }
             target_ulong addr = base + ((i * nf + k) << log2_esz);
             ldst_elem(env, adjust_addr(env, addr), i + k * max_elems, vd, ra);
             k++;
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool ld_us_op(DisasContext *s, arg_r2nfvm *a, uint8_t eew)
     data = FIELD_DP32(data, VDATA, LMUL, emul);
     data = FIELD_DP32(data, VDATA, NF, a->nf);
     data = FIELD_DP32(data, VDATA, VTA, s->vta);
+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
     return ldst_us_trans(a->rd, a->rs1, data, fn, s, false);
 }
 
@@ -XXX,XX +XXX,XX @@ static bool ld_us_mask_op(DisasContext *s, arg_vlm_v *a, uint8_t eew)
     data = FIELD_DP32(data, VDATA, NF, 1);
     /* Mask destination register are always tail-agnostic */
     data = FIELD_DP32(data, VDATA, VTA, s->cfg_vta_all_1s);
+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
     return ldst_us_trans(a->rd, a->rs1, data, fn, s, false);
 }
 
@@ -XXX,XX +XXX,XX @@ static bool ld_stride_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
     data = FIELD_DP32(data, VDATA, LMUL, emul);
     data = FIELD_DP32(data, VDATA, NF, a->nf);
     data = FIELD_DP32(data, VDATA, VTA, s->vta);
+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
     return ldst_stride_trans(a->rd, a->rs1, a->rs2, data, fn, s, false);
 }
 
@@ -XXX,XX +XXX,XX @@ static bool ld_index_op(DisasContext *s, arg_rnfvm *a, uint8_t eew)
     data = FIELD_DP32(data, VDATA, LMUL, emul);
     data = FIELD_DP32(data, VDATA, NF, a->nf);
     data = FIELD_DP32(data, VDATA, VTA, s->vta);
+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
     return ldst_index_trans(a->rd, a->rs1, a->rs2, data, fn, s, false);
 }
 
@@ -XXX,XX +XXX,XX @@ static bool ldff_op(DisasContext *s, arg_r2nfvm *a, uint8_t eew)
     data = FIELD_DP32(data, VDATA, LMUL, emul);
     data = FIELD_DP32(data, VDATA, NF, a->nf);
     data = FIELD_DP32(data, VDATA, VTA, s->vta);
+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
     return ldff_trans(a->rd, a->rs1, data, fn, s);
 }
 
-- 
2.37.2

From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>

Signed-off-by: eop Chen <eop.chen@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <165570784143.17634.35095816584573691-3@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c            | 3 +++
 target/riscv/insn_trans/trans_rvv.c.inc | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
     uint32_t vl = env->vl;
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
     uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
     uint32_t i;
 
     for (i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
             continue;
         }
         fn(vd, s1, vs2, i);
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
     data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
     data = FIELD_DP32(data, VDATA, VTA, s->vta);
     data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
     desc = tcg_constant_i32(simd_desc(s->cfg_ptr->vlen / 8,
                                       s->cfg_ptr->vlen / 8, data));
 
@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
     data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
     data = FIELD_DP32(data, VDATA, VTA, s->vta);
     data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+    data = FIELD_DP32(data, VDATA, VMA, s->vma);
     desc = tcg_constant_i32(simd_desc(s->cfg_ptr->vlen / 8,
                                       s->cfg_ptr->vlen / 8, data));
 
-- 
2.37.2

From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>

Signed-off-by: eop Chen <eop.chen@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <165570784143.17634.35095816584573691-4@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c            | 7 +++++++
 target/riscv/insn_trans/trans_rvv.c.inc | 1 +
 2 files changed, 8 insertions(+)

From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>

Signed-off-by: eop Chen <eop.chen@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <165570784143.17634.35095816584573691-5@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c            | 10 ++++++++++
 target/riscv/insn_trans/trans_rvv.c.inc |  1 +
 2 files changed, 11 insertions(+)

From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>

Signed-off-by: eop Chen <eop.chen@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <165570784143.17634.35095816584573691-6@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static inline void
 vext_vv_rm_1(void *vd, void *v0, void *vs1, void *vs2,
              CPURISCVState *env,
              uint32_t vl, uint32_t vm, int vxrm,
-             opivv2_rm_fn *fn)
+             opivv2_rm_fn *fn, uint32_t vma, uint32_t esz)
 {
     for (uint32_t i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
             continue;
         }
         fn(vd, vs1, vs2, i, env, vxrm);
@@ -XXX,XX +XXX,XX @@ vext_vv_rm_2(void *vd, void *v0, void *vs1, void *vs2,
     uint32_t vl = env->vl;
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
     uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
 
     switch (env->vxrm) {
     case 0: /* rnu */
         vext_vv_rm_1(vd, v0, vs1, vs2,
-                     env, vl, vm, 0, fn);
+                     env, vl, vm, 0, fn, vma, esz);
         break;
     case 1: /* rne */
         vext_vv_rm_1(vd, v0, vs1, vs2,
-                     env, vl, vm, 1, fn);
+                     env, vl, vm, 1, fn, vma, esz);
         break;
     case 2: /* rdn */
         vext_vv_rm_1(vd, v0, vs1, vs2,
-                     env, vl, vm, 2, fn);
+                     env, vl, vm, 2, fn, vma, esz);
         break;
     default: /* rod */
         vext_vv_rm_1(vd, v0, vs1, vs2,
-                     env, vl, vm, 3, fn);
+                     env, vl, vm, 3, fn, vma, esz);
         break;
     }
     /* set tail elements to 1s */
@@ -XXX,XX +XXX,XX @@ static inline void
 vext_vx_rm_1(void *vd, void *v0, target_long s1, void *vs2,
              CPURISCVState *env,
              uint32_t vl, uint32_t vm, int vxrm,
-             opivx2_rm_fn *fn)
+             opivx2_rm_fn *fn, uint32_t vma, uint32_t esz)
 {
     for (uint32_t i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
             continue;
         }
         fn(vd, s1, vs2, i, env, vxrm);
@@ -XXX,XX +XXX,XX @@ vext_vx_rm_2(void *vd, void *v0, target_long s1, void *vs2,
     uint32_t vl = env->vl;
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);
     uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
 
     switch (env->vxrm) {
     case 0: /* rnu */
         vext_vx_rm_1(vd, v0, s1, vs2,
-                     env, vl, vm, 0, fn);
+                     env, vl, vm, 0, fn, vma, esz);
         break;
     case 1: /* rne */
         vext_vx_rm_1(vd, v0, s1, vs2,
-                     env, vl, vm, 1, fn);
+                     env, vl, vm, 1, fn, vma, esz);
         break;
     case 2: /* rdn */
         vext_vx_rm_1(vd, v0, s1, vs2,
-                     env, vl, vm, 2, fn);
+                     env, vl, vm, 2, fn, vma, esz);
         break;
     default: /* rod */
         vext_vx_rm_1(vd, v0, s1, vs2,
-                     env, vl, vm, 3, fn);
+                     env, vl, vm, 3, fn, vma, esz);
         break;
     }
     /* set tail elements to 1s */
-- 
2.37.2

From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>

Signed-off-by: eop Chen <eop.chen@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <165570784143.17634.35095816584573691-7@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c            | 26 +++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvv.c.inc | 12 ++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
     uint32_t total_elems =                                \
         vext_get_total_elems(env, desc, ESZ);             \
     uint32_t vta = vext_vta(desc);                        \
+    uint32_t vma = vext_vma(desc);                        \
     uint32_t i;                                           \
                                                           \
     for (i = env->vstart; i < vl; i++) {                  \
         if (!vm && !vext_elem_mask(v0, i)) {              \
+            /* set masked-off elements to 1s */           \
+            vext_set_elems_1s(vd, vma, i * ESZ,           \
+                              (i + 1) * ESZ);             \
             continue;                                     \
         }                                                 \
         do_##NAME(vd, vs1, vs2, i, env);                  \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1,        \
     uint32_t total_elems =                                \
         vext_get_total_elems(env, desc, ESZ);              \
     uint32_t vta = vext_vta(desc);                        \
+    uint32_t vma = vext_vma(desc);                        \
     uint32_t i;                                           \
                                                           \
     for (i = env->vstart; i < vl; i++) {                  \
         if (!vm && !vext_elem_mask(v0, i)) {              \
+            /* set masked-off elements to 1s */           \
+            vext_set_elems_1s(vd, vma, i * ESZ,           \
+                              (i + 1) * ESZ);             \
             continue;                                     \
         }                                                 \
         do_##NAME(vd, s1, vs2, i, env);                   \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
     uint32_t total_elems =                             \
         vext_get_total_elems(env, desc, ESZ);          \
     uint32_t vta = vext_vta(desc);                     \
+    uint32_t vma = vext_vma(desc);                     \
     uint32_t i;                                        \
                                                        \
     if (vl == 0) {                                     \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
     }                                                  \
     for (i = env->vstart; i < vl; i++) {               \
         if (!vm && !vext_elem_mask(v0, i)) {           \
+            /* set masked-off elements to 1s */        \
+            vext_set_elems_1s(vd, vma, i * ESZ,        \
+                              (i + 1) * ESZ);          \
             continue;                                  \
         }                                              \
         do_##NAME(vd, vs2, i, env);                    \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs1, void *vs2,   \
     uint32_t vl = env->vl;                                    \
     uint32_t total_elems = env_archcpu(env)->cfg.vlen;        \
     uint32_t vta_all_1s = vext_vta_all_1s(desc);              \
+    uint32_t vma = vext_vma(desc);                            \
     uint32_t i;                                               \
                                                               \
     for (i = env->vstart; i < vl; i++) {                      \
         ETYPE s1 = *((ETYPE *)vs1 + H(i));                    \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                    \
         if (!vm && !vext_elem_mask(v0, i)) {                  \
+            /* set masked-off elements to 1s */               \
+            if (vma) {                                        \
+                vext_set_elem_mask(vd, i, 1);                 \
+            }                                                 \
             continue;                                         \
         }                                                     \
         vext_set_elem_mask(vd, i,                             \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2,       \
     uint32_t vl = env->vl;                                          \
     uint32_t total_elems = env_archcpu(env)->cfg.vlen;              \
     uint32_t vta_all_1s = vext_vta_all_1s(desc);                    \
+    uint32_t vma = vext_vma(desc);                                  \
     uint32_t i;                                                     \
                                                                     \
     for (i = env->vstart; i < vl; i++) {                            \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                          \
         if (!vm && !vext_elem_mask(v0, i)) {                        \
+            /* set masked-off elements to 1s */                     \
+            if (vma) {                                              \
+                vext_set_elem_mask(vd, i, 1);                       \
+            }                                                       \
             continue;                                               \
         }                                                           \
         vext_set_elem_mask(vd, i,                                   \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
     uint32_t total_elems =                             \
         vext_get_total_elems(env, desc, ESZ);          \
     uint32_t vta = vext_vta(desc);                     \
+    uint32_t vma = vext_vma(desc);                     \
     uint32_t i;                                        \
                                                        \
     for (i = env->vstart; i < vl; i++) {               \
         if (!vm && !vext_elem_mask(v0, i)) {           \
+            /* set masked-off elements to 1s */        \
+            vext_set_elems_1s(vd, vma, i * ESZ,        \
+                              (i + 1) * ESZ);          \
             continue;                                  \
         }                                              \
         do_##NAME(vd, vs2, i);                         \
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
         data =                                                     \
             FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);\
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                            vreg_ofs(s, a->rs1),                    \
                            vreg_ofs(s, a->rs2), cpu_env,           \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)            \
         data = FIELD_DP32(data, VDATA, VTA, s->vta);              \
         data = FIELD_DP32(data, VDATA, VTA_ALL_1S,                \
                           s->cfg_vta_all_1s);                     \
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);              \
         return opfvf_trans(a->rd, a->rs1, a->rs2, data,           \
                            fns[s->sew - 1], s);                   \
     }                                                             \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);           \
         data = FIELD_DP32(data, VDATA, VTA, s->vta);             \
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);             \
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),   \
                            vreg_ofs(s, a->rs1),                  \
                            vreg_ofs(s, a->rs2), cpu_env,         \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);           \
         data = FIELD_DP32(data, VDATA, VTA, s->vta);             \
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);             \
         return opfvf_trans(a->rd, a->rs1, a->rs2, data,          \
                            fns[s->sew - 1], s);                  \
     }                                                            \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
         tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                            vreg_ofs(s, a->rs1),                    \
                            vreg_ofs(s, a->rs2), cpu_env,           \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);           \
         data = FIELD_DP32(data, VDATA, VTA, s->vta);             \
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);             \
         return opfvf_trans(a->rd, a->rs1, a->rs2, data,          \
                            fns[s->sew - 1], s);                  \
     }                                                            \
@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
         data = FIELD_DP32(data, VDATA, VM, a->vm);
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
         data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),
                            vreg_ofs(s, a->rs2), cpu_env,
                            s->cfg_ptr->vlen / 8,
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
             TCGv_i32 desc;
             uint32_t data = FIELD_DP32(0, VDATA, LMUL, s->lmul);
             data = FIELD_DP32(data, VDATA, VTA, s->vta);
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);
             static gen_helper_vmv_vx * const fns[3] = {
                 gen_helper_vmv_v_x_h,
                 gen_helper_vmv_v_x_w,
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                            vreg_ofs(s, a->rs2), cpu_env,           \
                            s->cfg_ptr->vlen / 8,                   \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                            vreg_ofs(s, a->rs2), cpu_env,           \
                            s->cfg_ptr->vlen / 8,                   \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                            vreg_ofs(s, a->rs2), cpu_env,           \
                            s->cfg_ptr->vlen / 8,                   \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
                            vreg_ofs(s, a->rs2), cpu_env,           \
                            s->cfg_ptr->vlen / 8,                   \
-- 
2.37.2

From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>

Signed-off-by: eop Chen <eop.chen@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <165570784143.17634.35095816584573691-8@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c            | 11 +++++++++++
 target/riscv/insn_trans/trans_rvv.c.inc |  3 +++
 2 files changed, 14 insertions(+)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ static void vmsetm(void *vd, void *v0, void *vs2, CPURISCVState *env,
     uint32_t vl = env->vl;
     uint32_t total_elems = env_archcpu(env)->cfg.vlen;
     uint32_t vta_all_1s = vext_vta_all_1s(desc);
+    uint32_t vma = vext_vma(desc);
     int i;
     bool first_mask_bit = false;
 
     for (i = env->vstart; i < vl; i++) {
         if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            if (vma) {
+                vext_set_elem_mask(vd, i, 1);
+            }
             continue;
         }
         /* write a zero to all following active elements */
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, void *vs2, CPURISCVState *env,      \
     uint32_t esz = sizeof(ETYPE);                                         \
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);          \
     uint32_t vta = vext_vta(desc);                                        \
+    uint32_t vma = vext_vma(desc);                                        \
     uint32_t sum = 0;                                                     \
     int i;                                                                \
                                                                           \
     for (i = env->vstart; i < vl; i++) {                                  \
         if (!vm && !vext_elem_mask(v0, i)) {                              \
+            /* set masked-off elements to 1s */                           \
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);           \
             continue;                                                     \
         }                                                                 \
         *((ETYPE *)vd + H(i)) = sum;                                      \
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, CPURISCVState *env, uint32_t desc)  \
     uint32_t esz = sizeof(ETYPE);                                         \
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);          \
     uint32_t vta = vext_vta(desc);                                        \
+    uint32_t vma = vext_vma(desc);                                        \
     int i;                                                                \
                                                                           \
     for (i = env->vstart; i < vl; i++) {                                  \
         if (!vm && !vext_elem_mask(v0, i)) {                              \
+            /* set masked-off elements to 1s */                           \
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);           \
             continue;                                                     \
         }                                                                 \
         *((ETYPE *)vd + H(i)) = i;                                        \
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
         data =                                                     \
             FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);\
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
         tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd),                     \
                            vreg_ofs(s, 0), vreg_ofs(s, a->rs2),    \
                            cpu_env, s->cfg_ptr->vlen / 8,          \
@@ -XXX,XX +XXX,XX @@ static bool trans_viota_m(DisasContext *s, arg_viota_m *a)
         data = FIELD_DP32(data, VDATA, VM, a->vm);
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
         data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
         static gen_helper_gvec_3_ptr * const fns[4] = {
             gen_helper_viota_m_b, gen_helper_viota_m_h,
             gen_helper_viota_m_w, gen_helper_viota_m_d,
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
         data = FIELD_DP32(data, VDATA, VM, a->vm);
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
         data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
         static gen_helper_gvec_2_ptr * const fns[4] = {
             gen_helper_vid_v_b, gen_helper_vid_v_h,
             gen_helper_vid_v_w, gen_helper_vid_v_d,
-- 
2.37.2

From: "Yueh-Ting (eop) Chen" <eop.chen@sifive.com>

Signed-off-by: eop Chen <eop.chen@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <165570784143.17634.35095816584573691-9@git.sr.ht>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c            | 26 +++++++++++++++++++++++--
 target/riscv/insn_trans/trans_rvv.c.inc |  1 +
 2 files changed, 25 insertions(+), 2 deletions(-)

From: eopXD <eop.chen@sifive.com>

This commit adds option 'rvv_ma_all_1s' is added to enable the
behavior, it is default as disabled.

From: Dao Lu <daolu@rivosinc.com>

Added support for RISC-V PAUSE instruction from Zihintpause extension,
enabled by default.

Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Dao Lu <daolu@rivosinc.com>
Message-Id: <20220725034728.2620750-2-daolu@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                      |  1 +
 target/riscv/insn32.decode              |  7 ++++++-
 target/riscv/cpu.c                      |  2 ++
 target/riscv/insn_trans/trans_rvi.c.inc | 16 ++++++++++++++++
 4 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zkt;
     bool ext_ifencei;
     bool ext_icsr;
+    bool ext_zihintpause;
     bool ext_svinval;
     bool ext_svnapot;
     bool ext_svpbmt;
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ srl      0000000 .....    ..... 101 ..... 0110011 @r
 sra      0100000 .....    ..... 101 ..... 0110011 @r
 or       0000000 .....    ..... 110 ..... 0110011 @r
 and      0000000 .....    ..... 111 ..... 0110011 @r
-fence    ---- pred:4 succ:4 ----- 000 ----- 0001111
+
+{
+  pause  0000 0001   0000   00000 000 00000 0001111
+  fence  ---- pred:4 succ:4 ----- 000 ----- 0001111
+}
+
 fence_i  ---- ----   ----   ----- 001 ----- 0001111
 csrrw    ............     ..... 001 ..... 1110011 @csr
 csrrs    ............     ..... 010 ..... 1110011 @csr
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(v, false, PRIV_VERSION_1_12_0, ext_v),
     ISA_EXT_DATA_ENTRY(zicsr, true, PRIV_VERSION_1_10_0, ext_icsr),
     ISA_EXT_DATA_ENTRY(zifencei, true, PRIV_VERSION_1_10_0, ext_ifencei),
+    ISA_EXT_DATA_ENTRY(zihintpause, true, PRIV_VERSION_1_10_0, ext_zihintpause),
     ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_12_0, ext_zfh),
     ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_12_0, ext_zfhmin),
     ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
+    DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
     DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
     DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
     DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_srad(DisasContext *ctx, arg_srad *a)
     return gen_shift(ctx, a, EXT_SIGN, tcg_gen_sar_tl, NULL);
 }
 
+static bool trans_pause(DisasContext *ctx, arg_pause *a)
+{
+    if (!ctx->cfg_ptr->ext_zihintpause) {
+        return false;
+    }
+
+    /*
+     * PAUSE is a no-op in QEMU,
+     * end the TB and return to main loop
+     */
+    gen_set_pc_imm(ctx, ctx->pc_succ_insn);
+    tcg_gen_exit_tb(NULL, 0);
+    ctx->base.is_jmp = DISAS_NORETURN;
+
+    return true;
+}
 
 static bool trans_fence(DisasContext *ctx, arg_fence *a)
 {
-- 
2.37.2

From: Daniel Henrique Barboza <danielhb413@gmail.com>

The 'fdt' param is not being used in riscv_setup_rom_reset_vec().
Simplify the API by removing it. While we're at it, remove the redundant
'return' statement at the end of function.

Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Alistair Francis <alistair.francis@wdc.com>
Cc: Bin Meng <bin.meng@windriver.com>
Cc: Vijai Kumar K <vijai@behindbytes.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220728181926.2123771-1-danielhb413@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/boot.h    | 2 +-
 hw/riscv/boot.c            | 4 +---
 hw/riscv/microchip_pfsoc.c | 2 +-
 hw/riscv/shakti_c.c        | 3 +--
 hw/riscv/spike.c           | 2 +-
 hw/riscv/virt.c            | 2 +-
 6 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts
                                hwaddr saddr,
                                hwaddr rom_base, hwaddr rom_size,
                                uint64_t kernel_entry,
-                               uint64_t fdt_load_addr, void *fdt);
+                               uint64_t fdt_load_addr);
 void riscv_rom_copy_firmware_info(MachineState *machine, hwaddr rom_base,
                                   hwaddr rom_size,
                                   uint32_t reset_vec_size,
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts
                                hwaddr start_addr,
                                hwaddr rom_base, hwaddr rom_size,
                                uint64_t kernel_entry,
-                               uint64_t fdt_load_addr, void *fdt)
+                               uint64_t fdt_load_addr)
 {
     int i;
     uint32_t start_addr_hi32 = 0x00000000;
@@ -XXX,XX +XXX,XX @@ void riscv_setup_rom_reset_vec(MachineState *machine, RISCVHartArrayState *harts
                           rom_base, &address_space_memory);
     riscv_rom_copy_firmware_info(machine, rom_base, rom_size, sizeof(reset_vec),
                                  kernel_entry);
-
-    return;
 }
 
 void riscv_setup_direct_kernel(hwaddr kernel_addr, hwaddr fdt_addr)
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
         riscv_setup_rom_reset_vec(machine, &s->soc.u_cpus, firmware_load_addr,
                                   memmap[MICROCHIP_PFSOC_ENVM_DATA].base,
                                   memmap[MICROCHIP_PFSOC_ENVM_DATA].size,
-                                  kernel_entry, fdt_load_addr, machine->fdt);
+                                  kernel_entry, fdt_load_addr);
     }
 }
 
diff --git a/hw/riscv/shakti_c.c b/hw/riscv/shakti_c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/shakti_c.c
+++ b/hw/riscv/shakti_c.c
@@ -XXX,XX +XXX,XX @@ static void shakti_c_machine_state_init(MachineState *mstate)
     riscv_setup_rom_reset_vec(mstate, &sms->soc.cpus,
                               shakti_c_memmap[SHAKTI_C_RAM].base,
                               shakti_c_memmap[SHAKTI_C_ROM].base,
-                              shakti_c_memmap[SHAKTI_C_ROM].size, 0, 0,
-                              NULL);
+                              shakti_c_memmap[SHAKTI_C_ROM].size, 0, 0);
     if (mstate->firmware) {
         riscv_load_firmware(mstate->firmware,
                             shakti_c_memmap[SHAKTI_C_RAM].base,
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -XXX,XX +XXX,XX @@ static void spike_board_init(MachineState *machine)
     riscv_setup_rom_reset_vec(machine, &s->soc[0], memmap[SPIKE_DRAM].base,
                               memmap[SPIKE_MROM].base,
                               memmap[SPIKE_MROM].size, kernel_entry,
-                              fdt_load_addr, s->fdt);
+                              fdt_load_addr);
 
     /* initialize HTIF using symbols found in load_kernel */
     htif_mm_init(system_memory, mask_rom,
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_done(Notifier *notifier, void *data)
     riscv_setup_rom_reset_vec(machine, &s->soc[0], start_addr,
                               virt_memmap[VIRT_MROM].base,
                               virt_memmap[VIRT_MROM].size, kernel_entry,
-                              fdt_load_addr, machine->fdt);
+                              fdt_load_addr);
 
     /*
      * Only direct boot kernel is currently supported for KVM VM,
-- 
2.37.2

From: Weiwei Li <liweiwei@iscas.ac.cn>

Normally, riscv_csrrw_check is called when executing Zicsr instructions.
And we can only do access control for existed CSRs. So the priority of
CSR related check, from highest to lowest, should be as follows:
1) check whether Zicsr is supported: raise RISCV_EXCP_ILLEGAL_INST if not
2) check whether csr is existed: raise RISCV_EXCP_ILLEGAL_INST if not
3) do access control: raise RISCV_EXCP_ILLEGAL_INST or RISCV_EXCP_VIRT_
INSTRUCTION_FAULT if not allowed

The predicates contain parts of function of both 2) and 3), So they need
to be placed in the middle of riscv_csrrw_check

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220803123652.3700-1-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 44 +++++++++++++++++++++++++-------------------
 1 file changed, 25 insertions(+), 19 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
     int read_only = get_field(csrno, 0xC00) == 3;
     int csr_min_priv = csr_ops[csrno].min_priv_ver;
+
+    /* ensure the CSR extension is enabled. */
+    if (!cpu->cfg.ext_icsr) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    if (env->priv_ver < csr_min_priv) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    /* check predicate */
+    if (!csr_ops[csrno].predicate) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    if (write_mask && read_only) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    RISCVException ret = csr_ops[csrno].predicate(env, csrno);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
 #if !defined(CONFIG_USER_ONLY)
     int csr_priv, effective_priv = env->priv;
 
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
         return RISCV_EXCP_ILLEGAL_INST;
     }
 #endif
-    if (write_mask && read_only) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-
-    /* ensure the CSR extension is enabled. */
-    if (!cpu->cfg.ext_icsr) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-
-    /* check predicate */
-    if (!csr_ops[csrno].predicate) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-
-    if (env->priv_ver < csr_min_priv) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-
-    return csr_ops[csrno].predicate(env, csrno);
+    return RISCV_EXCP_NONE;
 }
 
 static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
-- 
2.37.2

From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

The following patch updates opentitan to match the new configuration,
as per, lowRISC/opentitan@217a0168ba118503c166a9587819e3811eeb0c0c

Note: with this patch we now skip the usage of the opentitan
`boot_rom`. The Opentitan boot rom contains hw verification
for devies which we are currently not supporting in qemu. As of now,
the `boot_rom` has no major significance, however, would be good to
support in the future.

Tested by running utests from the latest tock [1]
(that supports this version of OT).

[1] https://github.com/tock/tock/pull/3056

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220812005229.358850-1-wilfred.mallawa@opensource.wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/opentitan.h | 11 ++++++-----
 hw/riscv/opentitan.c         | 12 ++++++++----
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/include/hw/riscv/opentitan.h b/include/hw/riscv/opentitan.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/opentitan.h
+++ b/include/hw/riscv/opentitan.h
@@ -XXX,XX +XXX,XX @@ enum {
     IBEX_DEV_TIMER,
     IBEX_DEV_SENSOR_CTRL,
     IBEX_DEV_OTP_CTRL,
+    IBEX_DEV_LC_CTRL,
     IBEX_DEV_PWRMGR,
     IBEX_DEV_RSTMGR,
     IBEX_DEV_CLKMGR,
@@ -XXX,XX +XXX,XX @@ enum {
     IBEX_UART0_RX_BREAK_ERR_IRQ   = 6,
     IBEX_UART0_RX_TIMEOUT_IRQ     = 7,
     IBEX_UART0_RX_PARITY_ERR_IRQ  = 8,
-    IBEX_TIMER_TIMEREXPIRED0_0    = 126,
-    IBEX_SPI_HOST0_ERR_IRQ        = 150,
-    IBEX_SPI_HOST0_SPI_EVENT_IRQ  = 151,
-    IBEX_SPI_HOST1_ERR_IRQ        = 152,
-    IBEX_SPI_HOST1_SPI_EVENT_IRQ  = 153,
+    IBEX_TIMER_TIMEREXPIRED0_0    = 127,
+    IBEX_SPI_HOST0_ERR_IRQ        = 151,
+    IBEX_SPI_HOST0_SPI_EVENT_IRQ  = 152,
+    IBEX_SPI_HOST1_ERR_IRQ        = 153,
+    IBEX_SPI_HOST1_SPI_EVENT_IRQ  = 154,
 };
 
 #endif
diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 
 static const MemMapEntry ibex_memmap[] = {
-    [IBEX_DEV_ROM] =            {  0x00008000, 16 * KiB },
-    [IBEX_DEV_RAM] =            {  0x10000000,  0x10000 },
-    [IBEX_DEV_FLASH] =          {  0x20000000,  0x80000 },
+    [IBEX_DEV_ROM] =            {  0x00008000,   0x8000 },
+    [IBEX_DEV_RAM] =            {  0x10000000,  0x20000 },
+    [IBEX_DEV_FLASH] =          {  0x20000000,  0x100000 },
     [IBEX_DEV_UART] =           {  0x40000000,  0x1000  },
     [IBEX_DEV_GPIO] =           {  0x40040000,  0x1000  },
     [IBEX_DEV_SPI_DEVICE] =     {  0x40050000,  0x1000  },
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry ibex_memmap[] = {
     [IBEX_DEV_TIMER] =          {  0x40100000,  0x1000  },
     [IBEX_DEV_SENSOR_CTRL] =    {  0x40110000,  0x1000  },
     [IBEX_DEV_OTP_CTRL] =       {  0x40130000,  0x4000  },
+    [IBEX_DEV_LC_CTRL] =        {  0x40140000,  0x1000  },
     [IBEX_DEV_USBDEV] =         {  0x40150000,  0x1000  },
     [IBEX_DEV_SPI_HOST0] =      {  0x40300000,  0x1000  },
     [IBEX_DEV_SPI_HOST1] =      {  0x40310000,  0x1000  },
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
                             &error_abort);
     object_property_set_int(OBJECT(&s->cpus), "num-harts", ms->smp.cpus,
                             &error_abort);
-    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x8080, &error_abort);
+    object_property_set_int(OBJECT(&s->cpus), "resetvec", 0x20000490,
+                            &error_abort);
     sysbus_realize(SYS_BUS_DEVICE(&s->cpus), &error_fatal);
 
     /* Boot ROM */
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
         memmap[IBEX_DEV_SENSOR_CTRL].base, memmap[IBEX_DEV_SENSOR_CTRL].size);
     create_unimplemented_device("riscv.lowrisc.ibex.otp_ctrl",
         memmap[IBEX_DEV_OTP_CTRL].base, memmap[IBEX_DEV_OTP_CTRL].size);
+    create_unimplemented_device("riscv.lowrisc.ibex.lc_ctrl",
+        memmap[IBEX_DEV_LC_CTRL].base, memmap[IBEX_DEV_LC_CTRL].size);
     create_unimplemented_device("riscv.lowrisc.ibex.pwrmgr",
         memmap[IBEX_DEV_PWRMGR].base, memmap[IBEX_DEV_PWRMGR].size);
     create_unimplemented_device("riscv.lowrisc.ibex.rstmgr",
-- 
2.37.2

From: Conor Dooley <conor.dooley@microchip.com>

Booting using "Direct Kernel Boot" for PolarFire SoC & skipping u-boot
entirely is probably not advisable, but it does at least show signs of
life. Recent Linux kernel versions make use of peripherals that are
missing definitions in QEMU and lead to kernel panics. These issues
almost certain rear their head for other methods of booting, but I was
unable to figure out a suitable HSS version that is recent enough to
support these peripherals & works with QEMU.

With these peripherals added, booting a kernel with the following hangs
hangs waiting for the system controller's hwrng, but the kernel no
longer panics. With the Linux driver for hwrng disabled, it boots to
console.

qemu-system-riscv64 -M microchip-icicle-kit \
	-m 2G -smp 5 \
	-kernel $(vmlinux_bin) \
	-dtb  $(dtb)\
	-initrd $(initramfs) \
	-display none -serial null \
	-serial stdio

More peripherals are added than strictly required to fix the panics in
the hopes of avoiding a replication of this problem in the future.
Some of the peripherals which are in the device tree for recent kernels
are implemented in the FPGA fabric. The eMMC/SD mux, which exists as
an unimplemented device is replaced by a wider entry. This updated
entry covers both the mux & the remainder of the FPGA fabric connected
to the MSS using Fabric Interrconnect (FIC) 3.

Link: https://github.com/polarfire-soc/icicle-kit-reference-design#fabric-memory-map
Link: https://ww1.microchip.com/downloads/aemDocuments/documents/FPGA/ProductDocuments/SupportingCollateral/V1_4_Register_Map.zip
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20220813135127.2971754-1-mail@conchuod.ie>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h | 14 ++++++-
 hw/riscv/microchip_pfsoc.c         | 67 +++++++++++++++++++++++++++---
 2 files changed, 74 insertions(+), 7 deletions(-)

diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_L2LIM,
     MICROCHIP_PFSOC_PLIC,
     MICROCHIP_PFSOC_MMUART0,
+    MICROCHIP_PFSOC_WDOG0,
     MICROCHIP_PFSOC_SYSREG,
+    MICROCHIP_PFSOC_AXISW,
     MICROCHIP_PFSOC_MPUCFG,
+    MICROCHIP_PFSOC_FMETER,
     MICROCHIP_PFSOC_DDR_SGMII_PHY,
     MICROCHIP_PFSOC_EMMC_SD,
     MICROCHIP_PFSOC_DDR_CFG,
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_MMUART2,
     MICROCHIP_PFSOC_MMUART3,
     MICROCHIP_PFSOC_MMUART4,
+    MICROCHIP_PFSOC_WDOG1,
+    MICROCHIP_PFSOC_WDOG2,
+    MICROCHIP_PFSOC_WDOG3,
+    MICROCHIP_PFSOC_WDOG4,
     MICROCHIP_PFSOC_SPI0,
     MICROCHIP_PFSOC_SPI1,
+    MICROCHIP_PFSOC_I2C0,
     MICROCHIP_PFSOC_I2C1,
+    MICROCHIP_PFSOC_CAN0,
+    MICROCHIP_PFSOC_CAN1,
     MICROCHIP_PFSOC_GEM0,
     MICROCHIP_PFSOC_GEM1,
     MICROCHIP_PFSOC_GPIO0,
     MICROCHIP_PFSOC_GPIO1,
     MICROCHIP_PFSOC_GPIO2,
+    MICROCHIP_PFSOC_RTC,
     MICROCHIP_PFSOC_ENVM_CFG,
     MICROCHIP_PFSOC_ENVM_DATA,
+    MICROCHIP_PFSOC_USB,
     MICROCHIP_PFSOC_QSPI_XIP,
     MICROCHIP_PFSOC_IOSCB,
-    MICROCHIP_PFSOC_EMMC_SD_MUX,
+    MICROCHIP_PFSOC_FABRIC_FIC3,
     MICROCHIP_PFSOC_DRAM_LO,
     MICROCHIP_PFSOC_DRAM_LO_ALIAS,
     MICROCHIP_PFSOC_DRAM_HI,
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
     [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,  0x2000000 },
     [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,  0x4000000 },
     [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,     0x1000 },
+    [MICROCHIP_PFSOC_WDOG0] =           { 0x20001000,     0x1000 },
     [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,     0x2000 },
+    [MICROCHIP_PFSOC_AXISW] =           { 0x20004000,     0x1000 },
     [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,     0x1000 },
+    [MICROCHIP_PFSOC_FMETER] =          { 0x20006000,     0x1000 },
     [MICROCHIP_PFSOC_DDR_SGMII_PHY] =   { 0x20007000,     0x1000 },
     [MICROCHIP_PFSOC_EMMC_SD] =         { 0x20008000,     0x1000 },
     [MICROCHIP_PFSOC_DDR_CFG] =         { 0x20080000,    0x40000 },
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
     [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,     0x1000 },
     [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,     0x1000 },
     [MICROCHIP_PFSOC_MMUART4] =         { 0x20106000,     0x1000 },
+    [MICROCHIP_PFSOC_WDOG1] =           { 0x20101000,     0x1000 },
+    [MICROCHIP_PFSOC_WDOG2] =           { 0x20103000,     0x1000 },
+    [MICROCHIP_PFSOC_WDOG3] =           { 0x20105000,     0x1000 },
+    [MICROCHIP_PFSOC_WDOG4] =           { 0x20106000,     0x1000 },
     [MICROCHIP_PFSOC_SPI0] =            { 0x20108000,     0x1000 },
     [MICROCHIP_PFSOC_SPI1] =            { 0x20109000,     0x1000 },
+    [MICROCHIP_PFSOC_I2C0] =            { 0x2010a000,     0x1000 },
     [MICROCHIP_PFSOC_I2C1] =            { 0x2010b000,     0x1000 },
+    [MICROCHIP_PFSOC_CAN0] =            { 0x2010c000,     0x1000 },
+    [MICROCHIP_PFSOC_CAN1] =            { 0x2010d000,     0x1000 },
     [MICROCHIP_PFSOC_GEM0] =            { 0x20110000,     0x2000 },
     [MICROCHIP_PFSOC_GEM1] =            { 0x20112000,     0x2000 },
     [MICROCHIP_PFSOC_GPIO0] =           { 0x20120000,     0x1000 },
     [MICROCHIP_PFSOC_GPIO1] =           { 0x20121000,     0x1000 },
     [MICROCHIP_PFSOC_GPIO2] =           { 0x20122000,     0x1000 },
+    [MICROCHIP_PFSOC_RTC] =             { 0x20124000,     0x1000 },
     [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,     0x1000 },
     [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
+    [MICROCHIP_PFSOC_USB] =             { 0x20201000,     0x1000 },
     [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,  0x1000000 },
     [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000, 0x10000000 },
-    [MICROCHIP_PFSOC_EMMC_SD_MUX] =     { 0x4f000000,        0x4 },
+    [MICROCHIP_PFSOC_FABRIC_FIC3] =     { 0x40000000, 0x20000000 },
     [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000, 0x40000000 },
     [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000, 0x40000000 },
     [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,        0x0 },
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysreg), 0,
                     memmap[MICROCHIP_PFSOC_SYSREG].base);
 
+    /* AXISW */
+    create_unimplemented_device("microchip.pfsoc.axisw",
+        memmap[MICROCHIP_PFSOC_AXISW].base,
+        memmap[MICROCHIP_PFSOC_AXISW].size);
+
     /* MPUCFG */
     create_unimplemented_device("microchip.pfsoc.mpucfg",
         memmap[MICROCHIP_PFSOC_MPUCFG].base,
         memmap[MICROCHIP_PFSOC_MPUCFG].size);
 
+    /* FMETER */
+    create_unimplemented_device("microchip.pfsoc.fmeter",
+        memmap[MICROCHIP_PFSOC_FMETER].base,
+        memmap[MICROCHIP_PFSOC_FMETER].size);
+
     /* DDR SGMII PHY */
     sysbus_realize(SYS_BUS_DEVICE(&s->ddr_sgmii_phy), errp);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ddr_sgmii_phy), 0,
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
         qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_MMUART4_IRQ),
         serial_hd(4));
 
+    /* Watchdogs */
+    create_unimplemented_device("microchip.pfsoc.watchdog0",
+        memmap[MICROCHIP_PFSOC_WDOG0].base,
+        memmap[MICROCHIP_PFSOC_WDOG0].size);
+    create_unimplemented_device("microchip.pfsoc.watchdog1",
+        memmap[MICROCHIP_PFSOC_WDOG1].base,
+        memmap[MICROCHIP_PFSOC_WDOG1].size);
+    create_unimplemented_device("microchip.pfsoc.watchdog2",
+        memmap[MICROCHIP_PFSOC_WDOG2].base,
+        memmap[MICROCHIP_PFSOC_WDOG2].size);
+    create_unimplemented_device("microchip.pfsoc.watchdog3",
+        memmap[MICROCHIP_PFSOC_WDOG3].base,
+        memmap[MICROCHIP_PFSOC_WDOG3].size);
+    create_unimplemented_device("microchip.pfsoc.watchdog4",
+        memmap[MICROCHIP_PFSOC_WDOG4].base,
+        memmap[MICROCHIP_PFSOC_WDOG4].size);
+
     /* SPI */
     create_unimplemented_device("microchip.pfsoc.spi0",
         memmap[MICROCHIP_PFSOC_SPI0].base,
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
         memmap[MICROCHIP_PFSOC_SPI1].base,
         memmap[MICROCHIP_PFSOC_SPI1].size);
 
-    /* I2C1 */
+    /* I2C */
+    create_unimplemented_device("microchip.pfsoc.i2c0",
+        memmap[MICROCHIP_PFSOC_I2C0].base,
+        memmap[MICROCHIP_PFSOC_I2C0].size);
     create_unimplemented_device("microchip.pfsoc.i2c1",
         memmap[MICROCHIP_PFSOC_I2C1].base,
         memmap[MICROCHIP_PFSOC_I2C1].size);
 
+    /* CAN */
+    create_unimplemented_device("microchip.pfsoc.can0",
+        memmap[MICROCHIP_PFSOC_CAN0].base,
+        memmap[MICROCHIP_PFSOC_CAN0].size);
+    create_unimplemented_device("microchip.pfsoc.can1",
+        memmap[MICROCHIP_PFSOC_CAN1].base,
+        memmap[MICROCHIP_PFSOC_CAN1].size);
+
+    /* USB */
+    create_unimplemented_device("microchip.pfsoc.usb",
+        memmap[MICROCHIP_PFSOC_USB].base,
+        memmap[MICROCHIP_PFSOC_USB].size);
+
     /* GEMs */
 
     nd = &nd_table[0];
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ioscb), 0,
                     memmap[MICROCHIP_PFSOC_IOSCB].base);
 
-    /* eMMC/SD mux */
-    create_unimplemented_device("microchip.pfsoc.emmc_sd_mux",
-        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].base,
-        memmap[MICROCHIP_PFSOC_EMMC_SD_MUX].size);
+    /* FPGA Fabric */
+    create_unimplemented_device("microchip.pfsoc.fabricfic3",
+        memmap[MICROCHIP_PFSOC_FABRIC_FIC3].base,
+        memmap[MICROCHIP_PFSOC_FABRIC_FIC3].size);
 
     /* QSPI Flash */
     memory_region_init_rom(qspi_xip_mem, OBJECT(dev),
-- 
2.37.2

From: Atish Patra <atishp@rivosinc.com>

With .min_priv_version, additiona priv version check is uncessary
for mcountinhibit read/write functions.

Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-Id: <20220816232321.558250-7-atishp@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mtvec(CPURISCVState *env, int csrno,
 static RISCVException read_mcountinhibit(CPURISCVState *env, int csrno,
                                          target_ulong *val)
 {
-    if (env->priv_ver < PRIV_VERSION_1_11_0) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-
     *val = env->mcountinhibit;
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
     int cidx;
     PMUCTRState *counter;
 
-    if (env->priv_ver < PRIV_VERSION_1_11_0) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-
     env->mcountinhibit = val;
 
     /* Check if any other counter is also monitoring cycles/instructions */
-- 
2.37.2

From: Conor Dooley <conor.dooley@microchip.com>

"uart" is not a node name that complies with the dt-schema.
Change the node name to "serial" to ix warnings seen during
dt-validate on a dtbdump of the virt machine such as:
/stuff/qemu/qemu.dtb: uart@10000000: $nodename:0: 'uart@10000000' does not match '^serial(@.*)?$'
        From schema: /stuff/linux/Documentation/devicetree/bindings/serial/8250.yaml

Reported-by: Rob Herring <robh@kernel.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Message-id: 20220810184612.157317-2-mail@conchuod.ie
Link: https://lore.kernel.org/linux-riscv/20220803170552.GA2250266-robh@kernel.org/
Fixes: 04331d0b56 ("RISC-V VirtIO Machine")
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_uart(RISCVVirtState *s, const MemMapEntry *memmap,
     char *name;
     MachineState *mc = MACHINE(s);
 
-    name = g_strdup_printf("/soc/uart@%lx", (long)memmap[VIRT_UART0].base);
+    name = g_strdup_printf("/soc/serial@%lx", (long)memmap[VIRT_UART0].base);
     qemu_fdt_add_subnode(mc->fdt, name);
     qemu_fdt_setprop_string(mc->fdt, name, "compatible", "ns16550a");
     qemu_fdt_setprop_cells(mc->fdt, name, "reg",
-- 
2.37.2

From: Conor Dooley <conor.dooley@microchip.com>

When optional AIA PLIC support was added the to the virt machine, the
address cells property was removed leading the issues with dt-validate
on a dump from the virt machine:
/stuff/qemu/qemu.dtb: plic@c000000: '#address-cells' is a required property
        From schema: /stuff/linux/Documentation/devicetree/bindings/interrupt-controller/sifive,plic-1.0.0.yaml
Add back the property to suppress the warning.

Reported-by: Rob Herring <robh@kernel.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Message-id: 20220810184612.157317-3-mail@conchuod.ie
Link: https://lore.kernel.org/linux-riscv/20220803170552.GA2250266-robh@kernel.org/
Fixes: e6faee6585 ("hw/riscv: virt: Add optional AIA APLIC support to virt machine")
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h | 1 +
 hw/riscv/virt.c         | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ enum {
 
 #define FDT_PCI_ADDR_CELLS    3
 #define FDT_PCI_INT_CELLS     1
+#define FDT_PLIC_ADDR_CELLS   0
 #define FDT_PLIC_INT_CELLS    1
 #define FDT_APLIC_INT_CELLS   2
 #define FDT_IMSIC_INT_CELLS   0
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
     qemu_fdt_add_subnode(mc->fdt, plic_name);
     qemu_fdt_setprop_cell(mc->fdt, plic_name,
         "#interrupt-cells", FDT_PLIC_INT_CELLS);
+    qemu_fdt_setprop_cell(mc->fdt, plic_name,
+        "#address-cells", FDT_PLIC_ADDR_CELLS);
     qemu_fdt_setprop_string_array(mc->fdt, plic_name, "compatible",
                                   (char **)&plic_compat,
                                   ARRAY_SIZE(plic_compat));
-- 
2.37.2

From: Conor Dooley <conor.dooley@microchip.com>

The reset and poweroff features of the syscon were originally added to
top level, which is a valid path for a syscon subnode. Subsequently a
reorganisation was carried out while implementing NUMA in which the
subnodes were moved into the /soc node. As /soc is a "simple-bus", this
path is invalid, and so dt-validate produces the following warnings:

/stuff/qemu/qemu.dtb: soc: poweroff: {'value': [[21845]], 'offset': [[0]], 'regmap': [[4]], 'compatible': ['syscon-poweroff']} should not be valid under {'type': 'object'}
        From schema: /home/conor/.local/lib/python3.9/site-packages/dtschema/schemas/simple-bus.yaml
/stuff/qemu/qemu.dtb: soc: reboot: {'value': [[30583]], 'offset': [[0]], 'regmap': [[4]], 'compatible': ['syscon-reboot']} should not be valid under {'type': 'object'}
        From schema: /home/conor/.local/lib/python3.9/site-packages/dtschema/schemas/simple-bus.yaml

Move the syscon subnodes back to the top level and silence the warnings.

Reported-by: Rob Herring <robh@kernel.org>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220810184612.157317-4-mail@conchuod.ie
Link: https://lore.kernel.org/linux-riscv/20220803170552.GA2250266-robh@kernel.org/
Fixes: 18df0b4695 ("hw/riscv: virt: Allow creating multiple NUMA sockets")
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_reset(RISCVVirtState *s, const MemMapEntry *memmap,
     test_phandle = qemu_fdt_get_phandle(mc->fdt, name);
     g_free(name);
 
-    name = g_strdup_printf("/soc/reboot");
+    name = g_strdup_printf("/reboot");
     qemu_fdt_add_subnode(mc->fdt, name);
     qemu_fdt_setprop_string(mc->fdt, name, "compatible", "syscon-reboot");
     qemu_fdt_setprop_cell(mc->fdt, name, "regmap", test_phandle);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_reset(RISCVVirtState *s, const MemMapEntry *memmap,
     qemu_fdt_setprop_cell(mc->fdt, name, "value", FINISHER_RESET);
     g_free(name);
 
-    name = g_strdup_printf("/soc/poweroff");
+    name = g_strdup_printf("/poweroff");
     qemu_fdt_add_subnode(mc->fdt, name);
     qemu_fdt_setprop_string(mc->fdt, name, "compatible", "syscon-poweroff");
     qemu_fdt_setprop_cell(mc->fdt, name, "regmap", test_phandle);
-- 
2.37.2

From: Conor Dooley <conor.dooley@microchip.com>

"platform" is not a valid name for a bus node in dt-schema, so warnings
can be see in dt-validate on a dump of the riscv virt dtb:

/stuff/qemu/qemu.dtb: platform@4000000: $nodename:0: 'platform@4000000' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
        From schema: /home/conor/.local/lib/python3.9/site-packages/dtschema/schemas/simple-bus.yaml
"platform-bus" is a valid name, so use that instead.

CC: Rob Herring <robh@kernel.org>
Fixes: 11d306b9df ("hw/arm/sysbus-fdt: helpers for platform bus nodes addition")
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Message-id: 20220810184612.157317-5-mail@conchuod.ie
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/core/sysbus-fdt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/core/sysbus-fdt.c b/hw/core/sysbus-fdt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/sysbus-fdt.c
+++ b/hw/core/sysbus-fdt.c
@@ -XXX,XX +XXX,XX @@ void platform_bus_add_all_fdt_nodes(void *fdt, const char *intc, hwaddr addr,
 
     assert(fdt);
 
-    node = g_strdup_printf("/platform@%"PRIx64, addr);
+    node = g_strdup_printf("/platform-bus@%"PRIx64, addr);
 
     /* Create a /platform node that we can put all devices into */
     qemu_fdt_add_subnode(fdt, node);
-- 
2.37.2

From: Rahul Pathak <rpathak@ventanamicro.com>

XVentanaCondOps is Ventana custom extension. Add
its extension entry in the ISA Ext array

Signed-off-by: Rahul Pathak <rpathak@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220816045408.1231135-1-rpathak@ventanamicro.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
     ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
     ISA_EXT_DATA_ENTRY(svpbmt, true, PRIV_VERSION_1_12_0, ext_svpbmt),
+    ISA_EXT_DATA_ENTRY(xventanacondops, true, PRIV_VERSION_1_12_0, ext_XVentanaCondOps),
 };
 
 static bool isa_ext_is_enabled(RISCVCPU *cpu,
-- 
2.37.2

From: Anup Patel <apatel@ventanamicro.com>

The arch review of AIA spec is completed and we now have official
extension names for AIA: Smaia (M-mode AIA CSRs) and Ssaia (S-mode
AIA CSRs).

Refer, section 1.6 of the latest AIA v0.3.1 stable specification at
https://github.com/riscv/riscv-aia/releases/download/0.3.1-draft.32/riscv-interrupts-032.pdf)

Based on above, we update QEMU RISC-V to:
1) Have separate config options for Smaia and Ssaia extensions
   which replace RISCV_FEATURE_AIA in CPU features
2) Not generate AIA INTC compatible string in virt machine

Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220820042958.377018-1-apatel@ventanamicro.com
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  4 ++--
 hw/intc/riscv_imsic.c     |  4 +++-
 hw/riscv/virt.c           | 13 ++-----------
 target/riscv/cpu.c        |  9 ++++-----
 target/riscv/cpu_helper.c |  3 ++-
 target/riscv/csr.c        | 24 ++++++++++++++++++------
 6 files changed, 31 insertions(+), 26 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ enum {
     RISCV_FEATURE_PMP,
     RISCV_FEATURE_EPMP,
     RISCV_FEATURE_MISA,
-    RISCV_FEATURE_AIA,
     RISCV_FEATURE_DEBUG
 };
 
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve32f;
     bool ext_zve64f;
     bool ext_zmmul;
+    bool ext_smaia;
+    bool ext_ssaia;
     bool rvv_ta_all_1s;
     bool rvv_ma_all_1s;
 
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool mmu;
     bool pmp;
     bool epmp;
-    bool aia;
     bool debug;
     uint64_t resetvec;
 
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
 
     /* Force select AIA feature and setup CSR read-modify-write callback */
     if (env) {
-        riscv_set_feature(env, RISCV_FEATURE_AIA);
         if (!imsic->mmode) {
+            rcpu->cfg.ext_ssaia = true;
             riscv_cpu_set_geilen(env, imsic->num_pages - 1);
+        } else {
+            rcpu->cfg.ext_smaia = true;
         }
         riscv_cpu_set_aia_ireg_rmw_fn(env, (imsic->mmode) ? PRV_M : PRV_S,
                                       riscv_imsic_rmw, imsic);
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_cpus(RISCVVirtState *s, int socket,
         qemu_fdt_add_subnode(mc->fdt, intc_name);
         qemu_fdt_setprop_cell(mc->fdt, intc_name, "phandle",
             intc_phandles[cpu]);
-        if (riscv_feature(&s->soc[socket].harts[cpu].env,
-                          RISCV_FEATURE_AIA)) {
-            static const char * const compat[2] = {
-                "riscv,cpu-intc-aia", "riscv,cpu-intc"
-            };
-            qemu_fdt_setprop_string_array(mc->fdt, intc_name, "compatible",
-                                      (char **)&compat, ARRAY_SIZE(compat));
-        } else {
-            qemu_fdt_setprop_string(mc->fdt, intc_name, "compatible",
-                "riscv,cpu-intc");
-        }
+        qemu_fdt_setprop_string(mc->fdt, intc_name, "compatible",
+            "riscv,cpu-intc");
         qemu_fdt_setprop(mc->fdt, intc_name, "interrupt-controller", NULL, 0);
         qemu_fdt_setprop_cell(mc->fdt, intc_name, "#interrupt-cells", 1);
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zve64f, true, PRIV_VERSION_1_12_0, ext_zve64f),
     ISA_EXT_DATA_ENTRY(zhinx, true, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, true, PRIV_VERSION_1_12_0, ext_zhinxmin),
+    ISA_EXT_DATA_ENTRY(smaia, true, PRIV_VERSION_1_12_0, ext_smaia),
+    ISA_EXT_DATA_ENTRY(ssaia, true, PRIV_VERSION_1_12_0, ext_ssaia),
     ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
     ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
     ISA_EXT_DATA_ENTRY(svpbmt, true, PRIV_VERSION_1_12_0, ext_svpbmt),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         }
     }
 
-    if (cpu->cfg.aia) {
-        riscv_set_feature(env, RISCV_FEATURE_AIA);
-    }
-
     if (cpu->cfg.debug) {
         riscv_set_feature(env, RISCV_FEATURE_DEBUG);
     }
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-j", RISCVCPU, cfg.ext_j, false),
     /* ePMP 0.9.3 */
     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
-    DEFINE_PROP_BOOL("x-aia", RISCVCPU, cfg.aia, false),
+    DEFINE_PROP_BOOL("x-smaia", RISCVCPU, cfg.ext_smaia, false),
+    DEFINE_PROP_BOOL("x-ssaia", RISCVCPU, cfg.ext_ssaia, false),
 
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_pending_to_irq(CPURISCVState *env,
                                     int extirq, unsigned int extirq_def_prio,
                                     uint64_t pending, uint8_t *iprio)
 {
+    RISCVCPU *cpu = env_archcpu(env);
     int irq, best_irq = RISCV_EXCP_NONE;
     unsigned int prio, best_prio = UINT_MAX;
 
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_pending_to_irq(CPURISCVState *env,
     }
 
     irq = ctz64(pending);
-    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+    if (!((extirq == IRQ_M_EXT) ? cpu->cfg.ext_smaia : cpu->cfg.ext_ssaia)) {
         return irq;
     }
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException any32(CPURISCVState *env, int csrno)
 
 static int aia_any(CPURISCVState *env, int csrno)
 {
-    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+    RISCVCPU *cpu = env_archcpu(env);
+
+    if (!cpu->cfg.ext_smaia) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static int aia_any(CPURISCVState *env, int csrno)
 
 static int aia_any32(CPURISCVState *env, int csrno)
 {
-    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+    RISCVCPU *cpu = env_archcpu(env);
+
+    if (!cpu->cfg.ext_smaia) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static int smode32(CPURISCVState *env, int csrno)
 
 static int aia_smode(CPURISCVState *env, int csrno)
 {
-    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+    RISCVCPU *cpu = env_archcpu(env);
+
+    if (!cpu->cfg.ext_ssaia) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static int aia_smode(CPURISCVState *env, int csrno)
 
 static int aia_smode32(CPURISCVState *env, int csrno)
 {
-    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+    RISCVCPU *cpu = env_archcpu(env);
+
+    if (!cpu->cfg.ext_ssaia) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException pointer_masking(CPURISCVState *env, int csrno)
 
 static int aia_hmode(CPURISCVState *env, int csrno)
 {
-    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+    RISCVCPU *cpu = env_archcpu(env);
+
+    if (!cpu->cfg.ext_ssaia) {
         return RISCV_EXCP_ILLEGAL_INST;
      }
 
@@ -XXX,XX +XXX,XX @@ static int aia_hmode(CPURISCVState *env, int csrno)
 
 static int aia_hmode32(CPURISCVState *env, int csrno)
 {
-    if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
+    RISCVCPU *cpu = env_archcpu(env);
+
+    if (!cpu->cfg.ext_ssaia) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
-- 
2.37.2

From: Atish Patra <atishp@rivosinc.com>

Historically, The mtime/mtimecmp has been part of the CPU because
they are per hart entities. However, they actually belong to aclint
which is a MMIO device.

Move them to the ACLINT device. This also emulates the real hardware
more closely.

Reviewed-by: Anup Patel <anup@brainfault.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-Id: <20220824221357.41070-2-atishp@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/intc/riscv_aclint.h |  2 ++
 include/hw/timer/ibex_timer.h  |  2 ++
 target/riscv/cpu.h             |  2 --
 hw/intc/riscv_aclint.c         | 48 ++++++++++++++++++++++++----------
 hw/timer/ibex_timer.c          | 18 +++++--------
 target/riscv/machine.c         |  5 ++--
 6 files changed, 47 insertions(+), 30 deletions(-)

diff --git a/include/hw/intc/riscv_aclint.h b/include/hw/intc/riscv_aclint.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/riscv_aclint.h
+++ b/include/hw/intc/riscv_aclint.h
@@ -XXX,XX +XXX,XX @@ typedef struct RISCVAclintMTimerState {
     /*< private >*/
     SysBusDevice parent_obj;
     uint64_t time_delta;
+    uint64_t *timecmp;
+    QEMUTimer **timers;
 
     /*< public >*/
     MemoryRegion mmio;
diff --git a/include/hw/timer/ibex_timer.h b/include/hw/timer/ibex_timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/ibex_timer.h
+++ b/include/hw/timer/ibex_timer.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(IbexTimerState, IBEX_TIMER)
 struct IbexTimerState {
     /* <private> */
     SysBusDevice parent_obj;
+    uint64_t mtimecmp;
+    QEMUTimer *mtimer; /* Internal timer for M-mode interrupt */
 
     /* <public> */
     MemoryRegion mmio;
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     /* temporary htif regs */
     uint64_t mfromhost;
     uint64_t mtohost;
-    uint64_t timecmp;
 
     /* physical memory protection */
     pmp_table_t pmp_state;
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     float_status fp_status;
 
     /* Fields from here on are preserved across CPU reset. */
-    QEMUTimer *timer; /* Internal timer */
 
     hwaddr kernel_addr;
     hwaddr fdt_addr;
diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/riscv_aclint.h"
 #include "qemu/timer.h"
 #include "hw/irq.h"
+#include "migration/vmstate.h"
 
 typedef struct riscv_aclint_mtimer_callback {
     RISCVAclintMTimerState *s;
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
 
     uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
 
-    cpu->env.timecmp = value;
-    if (cpu->env.timecmp <= rtc_r) {
+    /* Compute the relative hartid w.r.t the socket */
+    hartid = hartid - mtimer->hartid_base;
+
+    mtimer->timecmp[hartid] = value;
+    if (mtimer->timecmp[hartid] <= rtc_r) {
         /*
          * If we're setting an MTIMECMP value in the "past",
          * immediately raise the timer interrupt
          */
-        qemu_irq_raise(mtimer->timer_irqs[hartid - mtimer->hartid_base]);
+        qemu_irq_raise(mtimer->timer_irqs[hartid]);
         return;
     }
 
     /* otherwise, set up the future timer interrupt */
-    qemu_irq_lower(mtimer->timer_irqs[hartid - mtimer->hartid_base]);
-    diff = cpu->env.timecmp - rtc_r;
+    qemu_irq_lower(mtimer->timer_irqs[hartid]);
+    diff = mtimer->timecmp[hartid] - rtc_r;
     /* back to ns (note args switched in muldiv64) */
     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
 
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
         next = MIN(next, INT64_MAX);
     }
 
-    timer_mod(cpu->env.timer, next);
+    timer_mod(mtimer->timers[hartid], next);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static uint64_t riscv_aclint_mtimer_read(void *opaque, hwaddr addr,
                           "aclint-mtimer: invalid hartid: %zu", hartid);
         } else if ((addr & 0x7) == 0) {
             /* timecmp_lo for RV32/RV64 or timecmp for RV64 */
-            uint64_t timecmp = env->timecmp;
+            uint64_t timecmp = mtimer->timecmp[hartid];
             return (size == 4) ? (timecmp & 0xFFFFFFFF) : timecmp;
         } else if ((addr & 0x7) == 4) {
             /* timecmp_hi */
-            uint64_t timecmp = env->timecmp;
+            uint64_t timecmp = mtimer->timecmp[hartid];
             return (timecmp >> 32) & 0xFFFFFFFF;
         } else {
             qemu_log_mask(LOG_UNIMP,
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         } else if ((addr & 0x7) == 0) {
             if (size == 4) {
                 /* timecmp_lo for RV32/RV64 */
-                uint64_t timecmp_hi = env->timecmp >> 32;
+                uint64_t timecmp_hi = mtimer->timecmp[hartid] >> 32;
                 riscv_aclint_mtimer_write_timecmp(mtimer, RISCV_CPU(cpu), hartid,
                     timecmp_hi << 32 | (value & 0xFFFFFFFF));
             } else {
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         } else if ((addr & 0x7) == 4) {
             if (size == 4) {
                 /* timecmp_hi for RV32/RV64 */
-                uint64_t timecmp_lo = env->timecmp;
+                uint64_t timecmp_lo = mtimer->timecmp[hartid];
                 riscv_aclint_mtimer_write_timecmp(mtimer, RISCV_CPU(cpu), hartid,
                     value << 32 | (timecmp_lo & 0xFFFFFFFF));
             } else {
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
             }
             riscv_aclint_mtimer_write_timecmp(mtimer, RISCV_CPU(cpu),
                                               mtimer->hartid_base + i,
-                                              env->timecmp);
+                                              mtimer->timecmp[i]);
         }
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_realize(DeviceState *dev, Error **errp)
     s->timer_irqs = g_new(qemu_irq, s->num_harts);
     qdev_init_gpio_out(dev, s->timer_irqs, s->num_harts);
 
+    s->timers = g_new0(QEMUTimer *, s->num_harts);
+    s->timecmp = g_new0(uint64_t, s->num_harts);
     /* Claim timer interrupt bits */
     for (i = 0; i < s->num_harts; i++) {
         RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(s->hartid_base + i));
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_reset_enter(Object *obj, ResetType type)
     riscv_aclint_mtimer_write(mtimer, mtimer->time_base, 0, 8);
 }
 
+static const VMStateDescription vmstate_riscv_mtimer = {
+    .name = "riscv_mtimer",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+            VMSTATE_VARRAY_UINT32(timecmp, RISCVAclintMTimerState,
+                                  num_harts, 0,
+                                  vmstate_info_uint64, uint64_t),
+            VMSTATE_END_OF_LIST()
+        }
+};
+
 static void riscv_aclint_mtimer_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_class_init(ObjectClass *klass, void *data)
     device_class_set_props(dc, riscv_aclint_mtimer_properties);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
     rc->phases.enter = riscv_aclint_mtimer_reset_enter;
+    dc->vmsd = &vmstate_riscv_mtimer;
 }
 
 static const TypeInfo riscv_aclint_mtimer_info = {
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aclint_mtimer_create(hwaddr addr, hwaddr size,
 {
     int i;
     DeviceState *dev = qdev_new(TYPE_RISCV_ACLINT_MTIMER);
+    RISCVAclintMTimerState *s = RISCV_ACLINT_MTIMER(dev);
 
     assert(num_harts <= RISCV_ACLINT_MAX_HARTS);
     assert(!(addr & 0x7));
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aclint_mtimer_create(hwaddr addr, hwaddr size,
             riscv_cpu_set_rdtime_fn(env, cpu_riscv_read_rtc, dev);
         }
 
-        cb->s = RISCV_ACLINT_MTIMER(dev);
+        cb->s = s;
         cb->num = i;
-        env->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+        s->timers[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
                                   &riscv_aclint_mtimer_cb, cb);
-        env->timecmp = 0;
+        s->timecmp[i] = 0;
 
         qdev_connect_gpio_out(dev, i,
                               qdev_get_gpio_in(DEVICE(rvcpu), IRQ_M_TIMER));
diff --git a/hw/timer/ibex_timer.c b/hw/timer/ibex_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/ibex_timer.c
+++ b/hw/timer/ibex_timer.c
@@ -XXX,XX +XXX,XX @@ static uint64_t cpu_riscv_read_rtc(uint32_t timebase_freq)
 
 static void ibex_timer_update_irqs(IbexTimerState *s)
 {
-    CPUState *cs = qemu_get_cpu(0);
-    RISCVCPU *cpu = RISCV_CPU(cs);
     uint64_t value = s->timer_compare_lower0 |
                          ((uint64_t)s->timer_compare_upper0 << 32);
     uint64_t next, diff;
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
     }
 
     /* Update the CPUs mtimecmp */
-    cpu->env.timecmp = value;
+    s->mtimecmp = value;
 
-    if (cpu->env.timecmp <= now) {
+    if (s->mtimecmp <= now) {
         /*
          * If the mtimecmp was in the past raise the interrupt now.
          */
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
     qemu_irq_lower(s->m_timer_irq);
     qemu_set_irq(s->irq, false);
 
-    diff = cpu->env.timecmp - now;
+    diff = s->mtimecmp - now;
     next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
                                  muldiv64(diff,
                                           NANOSECONDS_PER_SECOND,
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_update_irqs(IbexTimerState *s)
 
     if (next < qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)) {
         /* We overflowed the timer, just set it as large as we can */
-        timer_mod(cpu->env.timer, 0x7FFFFFFFFFFFFFFF);
+        timer_mod(s->mtimer, 0x7FFFFFFFFFFFFFFF);
     } else {
-        timer_mod(cpu->env.timer, next);
+        timer_mod(s->mtimer, next);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void ibex_timer_reset(DeviceState *dev)
 {
     IbexTimerState *s = IBEX_TIMER(dev);
 
-    CPUState *cpu = qemu_get_cpu(0);
-    CPURISCVState *env = cpu->env_ptr;
-    env->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+    s->mtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
                               &ibex_timer_cb, s);
-    env->timecmp = 0;
+    s->mtimecmp = 0;
 
     s->timer_ctrl = 0x00000000;
     s->timer_cfg0 = 0x00010000;
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pmu_ctr_state = {
 
 const VMStateDescription vmstate_riscv_cpu = {
     .name = "cpu",
-    .version_id = 3,
-    .minimum_version_id = 3,
+    .version_id = 4,
+    .minimum_version_id = 4,
     .post_load = riscv_cpu_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINTTL_ARRAY(env.gpr, RISCVCPU, 32),
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
         VMSTATE_UINTTL(env.mscratch, RISCVCPU),
         VMSTATE_UINT64(env.mfromhost, RISCVCPU),
         VMSTATE_UINT64(env.mtohost, RISCVCPU),
-        VMSTATE_UINT64(env.timecmp, RISCVCPU),
 
         VMSTATE_END_OF_LIST()
     },
-- 
2.37.2

From: Atish Patra <atishp@rivosinc.com>

stimecmp allows the supervisor mode to update stimecmp CSR directly
to program the next timer interrupt. This CSR is part of the Sstc
extension which was ratified recently.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-Id: <20220824221357.41070-3-atishp@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  5 ++
 target/riscv/cpu_bits.h    |  4 ++
 target/riscv/time_helper.h | 30 ++++++++++++
 target/riscv/cpu.c         |  9 ++++
 target/riscv/csr.c         | 86 +++++++++++++++++++++++++++++++++
 target/riscv/machine.c     |  1 +
 target/riscv/time_helper.c | 98 ++++++++++++++++++++++++++++++++++++++
 target/riscv/meson.build   |  3 +-
 8 files changed, 235 insertions(+), 1 deletion(-)
 create mode 100644 target/riscv/time_helper.h
 create mode 100644 target/riscv/time_helper.c

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     uint64_t mfromhost;
     uint64_t mtohost;
 
+    /* Sstc CSRs */
+    uint64_t stimecmp;
+
     /* physical memory protection */
     pmp_table_t pmp_state;
     target_ulong mseccfg;
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     float_status fp_status;
 
     /* Fields from here on are preserved across CPU reset. */
+    QEMUTimer *stimer; /* Internal timer for S-mode interrupt */
 
     hwaddr kernel_addr;
     hwaddr fdt_addr;
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_ifencei;
     bool ext_icsr;
     bool ext_zihintpause;
+    bool ext_sstc;
     bool ext_svinval;
     bool ext_svnapot;
     bool ext_svpbmt;
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define CSR_STVAL           0x143
 #define CSR_SIP             0x144
 
+/* Sstc supervisor CSRs */
+#define CSR_STIMECMP        0x14D
+#define CSR_STIMECMPH       0x15D
+
 /* Supervisor Protection and Translation */
 #define CSR_SPTBR           0x180
 #define CSR_SATP            0x180
diff --git a/target/riscv/time_helper.h b/target/riscv/time_helper.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/time_helper.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V timer header file.
+ *
+ * Copyright (c) 2022 Rivos Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef RISCV_TIME_HELPER_H
+#define RISCV_TIME_HELPER_H
+
+#include "cpu.h"
+#include "qemu/timer.h"
+
+void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
+                               uint64_t timecmp, uint64_t delta,
+                               uint32_t timer_irq);
+void riscv_timer_init(RISCVCPU *cpu);
+
+#endif
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "internals.h"
+#include "time_helper.h"
 #include "exec/exec-all.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zhinxmin, true, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, true, PRIV_VERSION_1_12_0, ext_smaia),
     ISA_EXT_DATA_ENTRY(ssaia, true, PRIV_VERSION_1_12_0, ext_ssaia),
+    ISA_EXT_DATA_ENTRY(sstc, true, PRIV_VERSION_1_12_0, ext_sstc),
     ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
     ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
     ISA_EXT_DATA_ENTRY(svpbmt, true, PRIV_VERSION_1_12_0, ext_svpbmt),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 
     set_resetvec(env, cpu->cfg.resetvec);
 
+#ifndef CONFIG_USER_ONLY
+    if (cpu->cfg.ext_sstc) {
+        riscv_timer_init(cpu);
+    }
+#endif /* CONFIG_USER_ONLY */
+
     /* Validate that MISA_MXL is set properly. */
     switch (env->misa_mxl_max) {
 #ifdef TARGET_RISCV64
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("Zve64f", RISCVCPU, cfg.ext_zve64f, false),
     DEFINE_PROP_BOOL("mmu", RISCVCPU, cfg.mmu, true),
     DEFINE_PROP_BOOL("pmp", RISCVCPU, cfg.pmp, true),
+    DEFINE_PROP_BOOL("sstc", RISCVCPU, cfg.ext_sstc, true),
 
     DEFINE_PROP_STRING("priv_spec", RISCVCPU, cfg.priv_spec),
     DEFINE_PROP_STRING("vext_spec", RISCVCPU, cfg.vext_spec),
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "cpu.h"
 #include "pmu.h"
+#include "time_helper.h"
 #include "qemu/main-loop.h"
 #include "exec/exec-all.h"
 #include "sysemu/cpu-timers.h"
@@ -XXX,XX +XXX,XX @@ static RISCVException read_timeh(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+static RISCVException sstc(CPURISCVState *env, int csrno)
+{
+    CPUState *cs = env_cpu(env);
+    RISCVCPU *cpu = RISCV_CPU(cs);
+
+    if (!cpu->cfg.ext_sstc || !env->rdtime_fn) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    if (env->priv == PRV_M) {
+        return RISCV_EXCP_NONE;
+    }
+
+    /*
+     * No need of separate function for rv32 as menvcfg stores both menvcfg
+     * menvcfgh for RV32.
+     */
+    if (!(get_field(env->mcounteren, COUNTEREN_TM) &&
+          get_field(env->menvcfg, MENVCFG_STCE))) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return smode(env, csrno);
+}
+
+static RISCVException sstc_32(CPURISCVState *env, int csrno)
+{
+    if (riscv_cpu_mxl(env) != MXL_RV32) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return sstc(env, csrno);
+}
+
+static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
+                                    target_ulong *val)
+{
+    *val = env->stimecmp;
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
+                                    target_ulong *val)
+{
+    *val = env->stimecmp >> 32;
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
+                                    target_ulong val)
+{
+    RISCVCPU *cpu = env_archcpu(env);
+
+    if (riscv_cpu_mxl(env) == MXL_RV32) {
+        env->stimecmp = deposit64(env->stimecmp, 0, 32, (uint64_t)val);
+    } else {
+        env->stimecmp = val;
+    }
+
+    riscv_timer_write_timecmp(cpu, env->stimer, env->stimecmp, 0, MIP_STIP);
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
+                                    target_ulong val)
+{
+    RISCVCPU *cpu = env_archcpu(env);
+
+    env->stimecmp = deposit64(env->stimecmp, 32, 32, (uint64_t)val);
+    riscv_timer_write_timecmp(cpu, env->stimer, env->stimecmp, 0, MIP_STIP);
+
+    return RISCV_EXCP_NONE;
+}
+
 /* Machine constants */
 
 #define M_MODE_INTERRUPTS  ((uint64_t)(MIP_MSIP | MIP_MTIP | MIP_MEIP))
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
         new_val |= env->external_seip * MIP_SEIP;
     }
 
+    if (cpu->cfg.ext_sstc && (env->priv == PRV_M) &&
+        get_field(env->menvcfg, MENVCFG_STCE)) {
+        /* sstc extension forbids STIP & VSTIP to be writeable in mip */
+        mask = mask & ~(MIP_STIP | MIP_VSTIP);
+    }
+
     if (mask) {
         old_mip = riscv_cpu_update_mip(cpu, mask, (new_val & mask));
     } else {
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_SCAUSE]   = { "scause",   smode, read_scause,   write_scause   },
     [CSR_STVAL]    = { "stval",    smode, read_stval,    write_stval    },
     [CSR_SIP]      = { "sip",      smode, NULL,    NULL, rmw_sip        },
+    [CSR_STIMECMP] = { "stimecmp", sstc, read_stimecmp, write_stimecmp,
+                       .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_STIMECMPH] = { "stimecmph", sstc_32, read_stimecmph, write_stimecmph,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
 
     /* Supervisor Protection and Translation */
     [CSR_SATP]     = { "satp",     smode, read_satp,     write_satp     },
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
         VMSTATE_UINTTL(env.mscratch, RISCVCPU),
         VMSTATE_UINT64(env.mfromhost, RISCVCPU),
         VMSTATE_UINT64(env.mtohost, RISCVCPU),
+        VMSTATE_UINT64(env.stimecmp, RISCVCPU),
 
         VMSTATE_END_OF_LIST()
     },
diff --git a/target/riscv/time_helper.c b/target/riscv/time_helper.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/time_helper.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V timer helper implementation.
+ *
+ * Copyright (c) 2022 Rivos Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "cpu_bits.h"
+#include "time_helper.h"
+#include "hw/intc/riscv_aclint.h"
+
+static void riscv_stimer_cb(void *opaque)
+{
+    RISCVCPU *cpu = opaque;
+    riscv_cpu_update_mip(cpu, MIP_STIP, BOOL_TO_MASK(1));
+}
+
+/*
+ * Called when timecmp is written to update the QEMU timer or immediately
+ * trigger timer interrupt if mtimecmp <= current timer value.
+ */
+void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
+                               uint64_t timecmp, uint64_t delta,
+                               uint32_t timer_irq)
+{
+    uint64_t diff, ns_diff, next;
+    CPURISCVState *env = &cpu->env;
+    RISCVAclintMTimerState *mtimer = env->rdtime_fn_arg;
+    uint32_t timebase_freq = mtimer->timebase_freq;
+    uint64_t rtc_r = env->rdtime_fn(env->rdtime_fn_arg) + delta;
+
+    if (timecmp <= rtc_r) {
+        /*
+         * If we're setting an stimecmp value in the "past",
+         * immediately raise the timer interrupt
+         */
+        riscv_cpu_update_mip(cpu, timer_irq, BOOL_TO_MASK(1));
+        return;
+    }
+
+    /* Clear the [V]STIP bit in mip */
+    riscv_cpu_update_mip(cpu, timer_irq, BOOL_TO_MASK(0));
+
+    /* otherwise, set up the future timer interrupt */
+    diff = timecmp - rtc_r;
+    /* back to ns (note args switched in muldiv64) */
+    ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
+
+    /*
+     * check if ns_diff overflowed and check if the addition would potentially
+     * overflow
+     */
+    if ((NANOSECONDS_PER_SECOND > timebase_freq && ns_diff < diff) ||
+        ns_diff > INT64_MAX) {
+        next = INT64_MAX;
+    } else {
+        /*
+         * as it is very unlikely qemu_clock_get_ns will return a value
+         * greater than INT64_MAX, no additional check is needed for an
+         * unsigned integer overflow.
+         */
+        next = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + ns_diff;
+        /*
+         * if ns_diff is INT64_MAX next may still be outside the range
+         * of a signed integer.
+         */
+        next = MIN(next, INT64_MAX);
+    }
+
+    timer_mod(timer, next);
+}
+
+void riscv_timer_init(RISCVCPU *cpu)
+{
+    CPURISCVState *env;
+
+    if (!cpu) {
+        return;
+    }
+
+    env = &cpu->env;
+    env->stimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, &riscv_stimer_cb, cpu);
+    env->stimecmp = 0;
+
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_softmmu_ss.add(files(
   'debug.c',
   'monitor.c',
   'machine.c',
-  'pmu.c'
+  'pmu.c',
+  'time_helper.c'
 ))
 
 target_arch += {'riscv': riscv_ss}
-- 
2.37.2

From: Atish Patra <atishp@rivosinc.com>

vstimecmp CSR allows the guest OS or to program the next guest timer
interrupt directly. Thus, hypervisor no longer need to inject the
timer interrupt to the guest if vstimecmp is used. This was ratified
as a part of the Sstc extension.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-Id: <20220824221357.41070-4-atishp@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  4 ++
 target/riscv/cpu_bits.h    |  4 ++
 target/riscv/cpu_helper.c  | 11 +++--
 target/riscv/csr.c         | 88 ++++++++++++++++++++++++++++++++++++--
 target/riscv/machine.c     |  1 +
 target/riscv/time_helper.c | 16 +++++++
 6 files changed, 118 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     /* Sstc CSRs */
     uint64_t stimecmp;
 
+    uint64_t vstimecmp;
+
     /* physical memory protection */
     pmp_table_t pmp_state;
     target_ulong mseccfg;
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
 
     /* Fields from here on are preserved across CPU reset. */
     QEMUTimer *stimer; /* Internal timer for S-mode interrupt */
+    QEMUTimer *vstimer; /* Internal timer for VS-mode interrupt */
+    bool vstime_irq;
 
     hwaddr kernel_addr;
     hwaddr fdt_addr;
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define CSR_VSIP            0x244
 #define CSR_VSATP           0x280
 
+/* Sstc virtual CSRs */
+#define CSR_VSTIMECMP       0x24D
+#define CSR_VSTIMECMPH      0x25D
+
 #define CSR_MTINST          0x34a
 #define CSR_MTVAL2          0x34b
 
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_cpu_all_pending(CPURISCVState *env)
 {
     uint32_t gein = get_field(env->hstatus, HSTATUS_VGEIN);
     uint64_t vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
+    uint64_t vstip = (env->vstime_irq) ? MIP_VSTIP : 0;
 
-    return (env->mip | vsgein) & env->mie;
+    return (env->mip | vsgein | vstip) & env->mie;
 }
 
 int riscv_cpu_mirq_pending(CPURISCVState *env)
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value)
 {
     CPURISCVState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
-    uint64_t gein, vsgein = 0, old = env->mip;
+    uint64_t gein, vsgein = 0, vstip = 0, old = env->mip;
     bool locked = false;
 
     if (riscv_cpu_virt_enabled(env)) {
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value)
         vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
     }
 
+    /* No need to update mip for VSTIP */
+    mask = ((mask == MIP_VSTIP) && env->vstime_irq) ? 0 : mask;
+    vstip = env->vstime_irq ? MIP_VSTIP : 0;
+
     if (!qemu_mutex_iothread_locked()) {
         locked = true;
         qemu_mutex_lock_iothread();
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_cpu_update_mip(RISCVCPU *cpu, uint64_t mask, uint64_t value)
 
     env->mip = (env->mip & ~mask) | (value & mask);
 
-    if (env->mip | vsgein) {
+    if (env->mip | vsgein | vstip) {
         cpu_interrupt(cs, CPU_INTERRUPT_HARD);
     } else {
         cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException sstc(CPURISCVState *env, int csrno)
 {
     CPUState *cs = env_cpu(env);
     RISCVCPU *cpu = RISCV_CPU(cs);
+    bool hmode_check = false;
 
     if (!cpu->cfg.ext_sstc || !env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -XXX,XX +XXX,XX @@ static RISCVException sstc(CPURISCVState *env, int csrno)
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
-    return smode(env, csrno);
+    if (riscv_cpu_virt_enabled(env)) {
+        if (!(get_field(env->hcounteren, COUNTEREN_TM) &
+              get_field(env->henvcfg, HENVCFG_STCE))) {
+            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+        }
+    }
+
+    if ((csrno == CSR_VSTIMECMP) || (csrno == CSR_VSTIMECMPH)) {
+        hmode_check = true;
+    }
+
+    return hmode_check ? hmode(env, csrno) : smode(env, csrno);
 }
 
 static RISCVException sstc_32(CPURISCVState *env, int csrno)
@@ -XXX,XX +XXX,XX @@ static RISCVException sstc_32(CPURISCVState *env, int csrno)
     return sstc(env, csrno);
 }
 
+static RISCVException read_vstimecmp(CPURISCVState *env, int csrno,
+                                    target_ulong *val)
+{
+    *val = env->vstimecmp;
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
+                                    target_ulong *val)
+{
+    *val = env->vstimecmp >> 32;
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
+                                    target_ulong val)
+{
+    RISCVCPU *cpu = env_archcpu(env);
+
+    if (riscv_cpu_mxl(env) == MXL_RV32) {
+        env->vstimecmp = deposit64(env->vstimecmp, 0, 32, (uint64_t)val);
+    } else {
+        env->vstimecmp = val;
+    }
+
+    riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
+                              env->htimedelta, MIP_VSTIP);
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
+                                    target_ulong val)
+{
+    RISCVCPU *cpu = env_archcpu(env);
+
+    env->vstimecmp = deposit64(env->vstimecmp, 32, 32, (uint64_t)val);
+    riscv_timer_write_timecmp(cpu, env->vstimer, env->vstimecmp,
+                              env->htimedelta, MIP_VSTIP);
+
+    return RISCV_EXCP_NONE;
+}
+
 static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
                                     target_ulong *val)
 {
-    *val = env->stimecmp;
+    if (riscv_cpu_virt_enabled(env)) {
+        *val = env->vstimecmp;
+    } else {
+        *val = env->stimecmp;
+    }
+
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
                                     target_ulong *val)
 {
-    *val = env->stimecmp >> 32;
+    if (riscv_cpu_virt_enabled(env)) {
+        *val = env->vstimecmp >> 32;
+    } else {
+        *val = env->stimecmp >> 32;
+    }
+
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
 {
     RISCVCPU *cpu = env_archcpu(env);
 
+    if (riscv_cpu_virt_enabled(env)) {
+        return write_vstimecmp(env, csrno, val);
+    }
+
     if (riscv_cpu_mxl(env) == MXL_RV32) {
         env->stimecmp = deposit64(env->stimecmp, 0, 32, (uint64_t)val);
     } else {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
 {
     RISCVCPU *cpu = env_archcpu(env);
 
+    if (riscv_cpu_virt_enabled(env)) {
+        return write_vstimecmph(env, csrno, val);
+    }
+
     env->stimecmp = deposit64(env->stimecmp, 32, 32, (uint64_t)val);
     riscv_timer_write_timecmp(cpu, env->stimer, env->stimecmp, 0, MIP_STIP);
 
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
     if (csrno != CSR_HVIP) {
         gin = get_field(env->hstatus, HSTATUS_VGEIN);
         old_mip |= (env->hgeip & ((target_ulong)1 << gin)) ? MIP_VSEIP : 0;
+        old_mip |= env->vstime_irq ? MIP_VSTIP : 0;
     }
 
     if (ret_val) {
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                        .min_priv_ver = PRIV_VERSION_1_12_0 },
     [CSR_STIMECMPH] = { "stimecmph", sstc_32, read_stimecmph, write_stimecmph,
                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_VSTIMECMP] = { "vstimecmp", sstc, read_vstimecmp,
+                        write_vstimecmp,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_VSTIMECMPH] = { "vstimecmph", sstc_32, read_vstimecmph,
+                         write_vstimecmph,
+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
 
     /* Supervisor Protection and Translation */
     [CSR_SATP]     = { "satp",     smode, read_satp,     write_satp     },
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_hyper = {
         VMSTATE_UINTTL(env.hgeie, RISCVCPU),
         VMSTATE_UINTTL(env.hgeip, RISCVCPU),
         VMSTATE_UINT64(env.htimedelta, RISCVCPU),
+        VMSTATE_UINT64(env.vstimecmp, RISCVCPU),
 
         VMSTATE_UINTTL(env.hvictl, RISCVCPU),
         VMSTATE_UINT8_ARRAY(env.hviprio, RISCVCPU, 64),
diff --git a/target/riscv/time_helper.c b/target/riscv/time_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/time_helper.c
+++ b/target/riscv/time_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "time_helper.h"
 #include "hw/intc/riscv_aclint.h"
 
+static void riscv_vstimer_cb(void *opaque)
+{
+    RISCVCPU *cpu = opaque;
+    CPURISCVState *env = &cpu->env;
+    env->vstime_irq = 1;
+    riscv_cpu_update_mip(cpu, MIP_VSTIP, BOOL_TO_MASK(1));
+}
+
 static void riscv_stimer_cb(void *opaque)
 {
     RISCVCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ void riscv_timer_write_timecmp(RISCVCPU *cpu, QEMUTimer *timer,
          * If we're setting an stimecmp value in the "past",
          * immediately raise the timer interrupt
          */
+        if (timer_irq == MIP_VSTIP) {
+            env->vstime_irq = 1;
+        }
         riscv_cpu_update_mip(cpu, timer_irq, BOOL_TO_MASK(1));
         return;
     }
 
+    if (timer_irq == MIP_VSTIP) {
+        env->vstime_irq = 0;
+    }
     /* Clear the [V]STIP bit in mip */
     riscv_cpu_update_mip(cpu, timer_irq, BOOL_TO_MASK(0));
 
@@ -XXX,XX +XXX,XX @@ void riscv_timer_init(RISCVCPU *cpu)
     env->stimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, &riscv_stimer_cb, cpu);
     env->stimecmp = 0;
 
+    env->vstimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, &riscv_vstimer_cb, cpu);
+    env->vstimecmp = 0;
 }
-- 
2.37.2

From: Atish Patra <atishp@rivosinc.com>

The Sscofpmf ('Ss' for Privileged arch and Supervisor-level extensions,
and 'cofpmf' for Count OverFlow and Privilege Mode Filtering)
extension allows the perf to handle overflow interrupts and filtering
support. This patch provides a framework for programmable
counters to leverage the extension. As the extension doesn't have any
provision for the overflow bit for fixed counters, the fixed events
can also be monitoring using programmable counters. The underlying
counters for cycle and instruction counters are always running. Thus,
a separate timer device is programmed to handle the overflow.

Tested-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atish.patra@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-Id: <20220824221701.41932-2-atishp@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h      |  25 +++
 target/riscv/cpu_bits.h |  55 ++++++
 target/riscv/pmu.h      |   7 +
 target/riscv/cpu.c      |  12 ++
 target/riscv/csr.c      | 166 +++++++++++++++++-
 target/riscv/machine.c  |   1 +
 target/riscv/pmu.c      | 368 +++++++++++++++++++++++++++++++++++++++-
 7 files changed, 623 insertions(+), 11 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct PMUCTRState {
     /* Snapshort value of a counter in RV32 */
     target_ulong mhpmcounterh_prev;
     bool started;
+    /* Value beyond UINT32_MAX/UINT64_MAX before overflow interrupt trigger */
+    target_ulong irq_overflow_left;
 } PMUCTRState;
 
 struct CPUArchState {
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     /* PMU event selector configured values. First three are unused*/
     target_ulong mhpmevent_val[RV_MAX_MHPMEVENTS];
 
+    /* PMU event selector configured values for RV32*/
+    target_ulong mhpmeventh_val[RV_MAX_MHPMEVENTS];
+
     target_ulong sscratch;
     target_ulong mscratch;
 
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zmmul;
     bool ext_smaia;
     bool ext_ssaia;
+    bool ext_sscofpmf;
     bool rvv_ta_all_1s;
     bool rvv_ma_all_1s;
 
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
 
     /* Configuration Settings */
     RISCVCPUConfig cfg;
+
+    QEMUTimer *pmu_timer;
+    /* A bitmask of Available programmable counters */
+    uint32_t pmu_avail_ctrs;
+    /* Mapping of events to counters */
+    GHashTable *pmu_event_ctr_map;
 };
 
 static inline int riscv_has_ext(CPURISCVState *env, target_ulong ext)
@@ -XXX,XX +XXX,XX @@ enum {
     CSR_TABLE_SIZE = 0x1000
 };
 
+/**
+ * The event id are encoded based on the encoding specified in the
+ * SBI specification v0.3
+ */
+
+enum riscv_pmu_event_idx {
+    RISCV_PMU_EVENT_HW_CPU_CYCLES = 0x01,
+    RISCV_PMU_EVENT_HW_INSTRUCTIONS = 0x02,
+    RISCV_PMU_EVENT_CACHE_DTLB_READ_MISS = 0x10019,
+    RISCV_PMU_EVENT_CACHE_DTLB_WRITE_MISS = 0x1001B,
+    RISCV_PMU_EVENT_CACHE_ITLB_PREFETCH_MISS = 0x10021,
+};
+
 /* CSR function table */
 extern riscv_csr_operations csr_ops[CSR_TABLE_SIZE];
 
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 #define CSR_MHPMEVENT29     0x33d
 #define CSR_MHPMEVENT30     0x33e
 #define CSR_MHPMEVENT31     0x33f
+
+#define CSR_MHPMEVENT3H     0x723
+#define CSR_MHPMEVENT4H     0x724
+#define CSR_MHPMEVENT5H     0x725
+#define CSR_MHPMEVENT6H     0x726
+#define CSR_MHPMEVENT7H     0x727
+#define CSR_MHPMEVENT8H     0x728
+#define CSR_MHPMEVENT9H     0x729
+#define CSR_MHPMEVENT10H    0x72a
+#define CSR_MHPMEVENT11H    0x72b
+#define CSR_MHPMEVENT12H    0x72c
+#define CSR_MHPMEVENT13H    0x72d
+#define CSR_MHPMEVENT14H    0x72e
+#define CSR_MHPMEVENT15H    0x72f
+#define CSR_MHPMEVENT16H    0x730
+#define CSR_MHPMEVENT17H    0x731
+#define CSR_MHPMEVENT18H    0x732
+#define CSR_MHPMEVENT19H    0x733
+#define CSR_MHPMEVENT20H    0x734
+#define CSR_MHPMEVENT21H    0x735
+#define CSR_MHPMEVENT22H    0x736
+#define CSR_MHPMEVENT23H    0x737
+#define CSR_MHPMEVENT24H    0x738
+#define CSR_MHPMEVENT25H    0x739
+#define CSR_MHPMEVENT26H    0x73a
+#define CSR_MHPMEVENT27H    0x73b
+#define CSR_MHPMEVENT28H    0x73c
+#define CSR_MHPMEVENT29H    0x73d
+#define CSR_MHPMEVENT30H    0x73e
+#define CSR_MHPMEVENT31H    0x73f
+
 #define CSR_MHPMCOUNTER3H   0xb83
 #define CSR_MHPMCOUNTER4H   0xb84
 #define CSR_MHPMCOUNTER5H   0xb85
@@ -XXX,XX +XXX,XX @@
 #define CSR_VSMTE           0x2c0
 #define CSR_VSPMMASK        0x2c1
 #define CSR_VSPMBASE        0x2c2
+#define CSR_SCOUNTOVF       0xda0
 
 /* Crypto Extension */
 #define CSR_SEED            0x015
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define IRQ_VS_EXT                         10
 #define IRQ_M_EXT                          11
 #define IRQ_S_GEXT                         12
+#define IRQ_PMU_OVF                        13
 #define IRQ_LOCAL_MAX                      16
 #define IRQ_LOCAL_GUEST_MAX                (TARGET_LONG_BITS - 1)
 
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MIP_VSEIP                          (1 << IRQ_VS_EXT)
 #define MIP_MEIP                           (1 << IRQ_M_EXT)
 #define MIP_SGEIP                          (1 << IRQ_S_GEXT)
+#define MIP_LCOFIP                         (1 << IRQ_PMU_OVF)
 
 /* sip masks */
 #define SIP_SSIP                           MIP_SSIP
 #define SIP_STIP                           MIP_STIP
 #define SIP_SEIP                           MIP_SEIP
+#define SIP_LCOFIP                         MIP_LCOFIP
 
 /* MIE masks */
 #define MIE_SEIE                           (1 << IRQ_S_EXT)
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define SEED_OPST_WAIT                   (0b01 << 30)
 #define SEED_OPST_ES16                   (0b10 << 30)
 #define SEED_OPST_DEAD                   (0b11 << 30)
+/* PMU related bits */
+#define MIE_LCOFIE                         (1 << IRQ_PMU_OVF)
+
+#define MHPMEVENT_BIT_OF                   BIT_ULL(63)
+#define MHPMEVENTH_BIT_OF                  BIT(31)
+#define MHPMEVENT_BIT_MINH                 BIT_ULL(62)
+#define MHPMEVENTH_BIT_MINH                BIT(30)
+#define MHPMEVENT_BIT_SINH                 BIT_ULL(61)
+#define MHPMEVENTH_BIT_SINH                BIT(29)
+#define MHPMEVENT_BIT_UINH                 BIT_ULL(60)
+#define MHPMEVENTH_BIT_UINH                BIT(28)
+#define MHPMEVENT_BIT_VSINH                BIT_ULL(59)
+#define MHPMEVENTH_BIT_VSINH               BIT(27)
+#define MHPMEVENT_BIT_VUINH                BIT_ULL(58)
+#define MHPMEVENTH_BIT_VUINH               BIT(26)
+
+#define MHPMEVENT_SSCOF_MASK               _ULL(0xFFFF000000000000)
+#define MHPMEVENT_IDX_MASK                 0xFFFFF
+#define MHPMEVENT_SSCOF_RESVD              16
+
 #endif
diff --git a/target/riscv/pmu.h b/target/riscv/pmu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmu.h
+++ b/target/riscv/pmu.h
@@ -XXX,XX +XXX,XX @@ bool riscv_pmu_ctr_monitor_instructions(CPURISCVState *env,
                                         uint32_t target_ctr);
 bool riscv_pmu_ctr_monitor_cycles(CPURISCVState *env,
                                   uint32_t target_ctr);
+void riscv_pmu_timer_cb(void *priv);
+int riscv_pmu_init(RISCVCPU *cpu, int num_counters);
+int riscv_pmu_update_event_map(CPURISCVState *env, uint64_t value,
+                               uint32_t ctr_idx);
+int riscv_pmu_incr_ctr(RISCVCPU *cpu, enum riscv_pmu_event_idx event_idx);
+int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value,
+                          uint32_t ctr_idx);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/ctype.h"
 #include "qemu/log.h"
 #include "cpu.h"
+#include "pmu.h"
 #include "internals.h"
 #include "time_helper.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zhinxmin, true, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, true, PRIV_VERSION_1_12_0, ext_smaia),
     ISA_EXT_DATA_ENTRY(ssaia, true, PRIV_VERSION_1_12_0, ext_ssaia),
+    ISA_EXT_DATA_ENTRY(sscofpmf, true, PRIV_VERSION_1_12_0, ext_sscofpmf),
     ISA_EXT_DATA_ENTRY(sstc, true, PRIV_VERSION_1_12_0, ext_sstc),
     ISA_EXT_DATA_ENTRY(svinval, true, PRIV_VERSION_1_12_0, ext_svinval),
     ISA_EXT_DATA_ENTRY(svnapot, true, PRIV_VERSION_1_12_0, ext_svnapot),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
         set_misa(env, env->misa_mxl, ext);
     }
 
+#ifndef CONFIG_USER_ONLY
+    if (cpu->cfg.pmu_num) {
+        if (!riscv_pmu_init(cpu, cpu->cfg.pmu_num) && cpu->cfg.ext_sscofpmf) {
+            cpu->pmu_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                          riscv_pmu_timer_cb, cpu);
+        }
+     }
+#endif
+
     riscv_cpu_register_gdb_regs_for_features(cs);
 
     qemu_init_vcpu(cs);
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("v", RISCVCPU, cfg.ext_v, false),
     DEFINE_PROP_BOOL("h", RISCVCPU, cfg.ext_h, true),
     DEFINE_PROP_UINT8("pmu-num", RISCVCPU, cfg.pmu_num, 16),
+    DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
     CPUState *cs = env_cpu(env);
     RISCVCPU *cpu = RISCV_CPU(cs);
     int ctr_index;
-    int base_csrno = CSR_HPMCOUNTER3;
+    int base_csrno = CSR_CYCLE;
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
 
     if (rv32 && csrno >= CSR_CYCLEH) {
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
     }
     ctr_index = csrno - base_csrno;
 
-    if (!cpu->cfg.pmu_num || ctr_index >= (cpu->cfg.pmu_num)) {
+    if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) ||
+        (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) {
+        goto skip_ext_pmu_check;
+    }
+
+    if ((!cpu->cfg.pmu_num || !(cpu->pmu_avail_ctrs & BIT(ctr_index)))) {
         /* No counter is enabled in PMU or the counter is out of range */
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
+skip_ext_pmu_check:
+
     if (env->priv == PRV_S) {
         switch (csrno) {
         case CSR_CYCLE:
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
             }
             break;
         case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
-            ctr_index = csrno - CSR_CYCLE;
             if (!get_field(env->mcounteren, 1 << ctr_index)) {
                 return RISCV_EXCP_ILLEGAL_INST;
             }
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
                 }
                 break;
             case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
-                ctr_index = csrno - CSR_CYCLEH;
                 if (!get_field(env->mcounteren, 1 << ctr_index)) {
                     return RISCV_EXCP_ILLEGAL_INST;
                 }
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
             }
             break;
         case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
-            ctr_index = csrno - CSR_CYCLE;
             if (!get_field(env->hcounteren, 1 << ctr_index) &&
                  get_field(env->mcounteren, 1 << ctr_index)) {
                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
                 }
                 break;
             case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
-                ctr_index = csrno - CSR_CYCLEH;
                 if (!get_field(env->hcounteren, 1 << ctr_index) &&
                      get_field(env->mcounteren, 1 << ctr_index)) {
                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
@@ -XXX,XX +XXX,XX @@ static RISCVException mctr32(CPURISCVState *env, int csrno)
     return mctr(env, csrno);
 }
 
+static RISCVException sscofpmf(CPURISCVState *env, int csrno)
+{
+    CPUState *cs = env_cpu(env);
+    RISCVCPU *cpu = RISCV_CPU(cs);
+
+    if (!cpu->cfg.ext_sscofpmf) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return RISCV_EXCP_NONE;
+}
+
 static RISCVException any(CPURISCVState *env, int csrno)
 {
     return RISCV_EXCP_NONE;
@@ -XXX,XX +XXX,XX @@ static int read_mhpmevent(CPURISCVState *env, int csrno, target_ulong *val)
 static int write_mhpmevent(CPURISCVState *env, int csrno, target_ulong val)
 {
     int evt_index = csrno - CSR_MCOUNTINHIBIT;
+    uint64_t mhpmevt_val = val;
 
     env->mhpmevent_val[evt_index] = val;
 
+    if (riscv_cpu_mxl(env) == MXL_RV32) {
+        mhpmevt_val = mhpmevt_val |
+                      ((uint64_t)env->mhpmeventh_val[evt_index] << 32);
+    }
+    riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
+
+    return RISCV_EXCP_NONE;
+}
+
+static int read_mhpmeventh(CPURISCVState *env, int csrno, target_ulong *val)
+{
+    int evt_index = csrno - CSR_MHPMEVENT3H + 3;
+
+    *val = env->mhpmeventh_val[evt_index];
+
+    return RISCV_EXCP_NONE;
+}
+
+static int write_mhpmeventh(CPURISCVState *env, int csrno, target_ulong val)
+{
+    int evt_index = csrno - CSR_MHPMEVENT3H + 3;
+    uint64_t mhpmevth_val = val;
+    uint64_t mhpmevt_val = env->mhpmevent_val[evt_index];
+
+    mhpmevt_val = mhpmevt_val | (mhpmevth_val << 32);
+    env->mhpmeventh_val[evt_index] = val;
+
+    riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
+
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static int write_mhpmcounter(CPURISCVState *env, int csrno, target_ulong val)
 {
     int ctr_idx = csrno - CSR_MCYCLE;
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
+    uint64_t mhpmctr_val = val;
 
     counter->mhpmcounter_val = val;
     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
         counter->mhpmcounter_prev = get_ticks(false);
-    } else {
+        if (ctr_idx > 2) {
+            if (riscv_cpu_mxl(env) == MXL_RV32) {
+                mhpmctr_val = mhpmctr_val |
+                              ((uint64_t)counter->mhpmcounterh_val << 32);
+            }
+            riscv_pmu_setup_timer(env, mhpmctr_val, ctr_idx);
+        }
+     } else {
         /* Other counters can keep incrementing from the given value */
         counter->mhpmcounter_prev = val;
     }
@@ -XXX,XX +XXX,XX @@ static int write_mhpmcounterh(CPURISCVState *env, int csrno, target_ulong val)
 {
     int ctr_idx = csrno - CSR_MCYCLEH;
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
+    uint64_t mhpmctr_val = counter->mhpmcounter_val;
+    uint64_t mhpmctrh_val = val;
 
     counter->mhpmcounterh_val = val;
+    mhpmctr_val = mhpmctr_val | (mhpmctrh_val << 32);
     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
         counter->mhpmcounterh_prev = get_ticks(true);
+        if (ctr_idx > 2) {
+            riscv_pmu_setup_timer(env, mhpmctr_val, ctr_idx);
+        }
     } else {
         counter->mhpmcounterh_prev = val;
     }
@@ -XXX,XX +XXX,XX @@ static int read_hpmcounterh(CPURISCVState *env, int csrno, target_ulong *val)
     return riscv_pmu_read_ctr(env, val, true, ctr_index);
 }
 
+static int read_scountovf(CPURISCVState *env, int csrno, target_ulong *val)
+{
+    int mhpmevt_start = CSR_MHPMEVENT3 - CSR_MCOUNTINHIBIT;
+    int i;
+    *val = 0;
+    target_ulong *mhpm_evt_val;
+    uint64_t of_bit_mask;
+
+    if (riscv_cpu_mxl(env) == MXL_RV32) {
+        mhpm_evt_val = env->mhpmeventh_val;
+        of_bit_mask = MHPMEVENTH_BIT_OF;
+    } else {
+        mhpm_evt_val = env->mhpmevent_val;
+        of_bit_mask = MHPMEVENT_BIT_OF;
+    }
+
+    for (i = mhpmevt_start; i < RV_MAX_MHPMEVENTS; i++) {
+        if ((get_field(env->mcounteren, BIT(i))) &&
+            (mhpm_evt_val[i] & of_bit_mask)) {
+                    *val |= BIT(i);
+            }
+    }
+
+    return RISCV_EXCP_NONE;
+}
+
 static RISCVException read_time(CPURISCVState *env, int csrno,
                                 target_ulong *val)
 {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
 /* Machine constants */
 
 #define M_MODE_INTERRUPTS  ((uint64_t)(MIP_MSIP | MIP_MTIP | MIP_MEIP))
-#define S_MODE_INTERRUPTS  ((uint64_t)(MIP_SSIP | MIP_STIP | MIP_SEIP))
+#define S_MODE_INTERRUPTS  ((uint64_t)(MIP_SSIP | MIP_STIP | MIP_SEIP | \
+                                      MIP_LCOFIP))
 #define VS_MODE_INTERRUPTS ((uint64_t)(MIP_VSSIP | MIP_VSTIP | MIP_VSEIP))
 #define HS_MODE_INTERRUPTS ((uint64_t)(MIP_SGEIP | VS_MODE_INTERRUPTS))
 
@@ -XXX,XX +XXX,XX @@ static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
 static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS;
-static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
+static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP |
+                                              SIP_LCOFIP;
 static const target_ulong hip_writable_mask = MIP_VSSIP;
 static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
 static const target_ulong vsip_writable_mask = MIP_VSSIP;
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_MHPMEVENT31]    = { "mhpmevent31",    any,    read_mhpmevent,
                              write_mhpmevent                           },
 
+    [CSR_MHPMEVENT3H]    = { "mhpmevent3h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT4H]    = { "mhpmevent4h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT5H]    = { "mhpmevent5h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT6H]    = { "mhpmevent6h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT7H]    = { "mhpmevent7h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT8H]    = { "mhpmevent8h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT9H]    = { "mhpmevent9h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT10H]   = { "mhpmevent10h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT11H]   = { "mhpmevent11h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT12H]   = { "mhpmevent12h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT13H]   = { "mhpmevent13h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT14H]   = { "mhpmevent14h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT15H]   = { "mhpmevent15h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT16H]   = { "mhpmevent16h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT17H]   = { "mhpmevent17h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT18H]   = { "mhpmevent18h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT19H]   = { "mhpmevent19h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT20H]   = { "mhpmevent20h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT21H]   = { "mhpmevent21h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT22H]   = { "mhpmevent22h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT23H]   = { "mhpmevent23h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT24H]   = { "mhpmevent24h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT25H]   = { "mhpmevent25h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT26H]   = { "mhpmevent26h",    sscofpmf,  read_mhpmeventh,
+                              write_mhpmeventh                          },
+    [CSR_MHPMEVENT27H]   = { "mhpmevent27h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT28H]   = { "mhpmevent28h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT29H]   = { "mhpmevent29h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT30H]   = { "mhpmevent30h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+    [CSR_MHPMEVENT31H]   = { "mhpmevent31h",    sscofpmf,  read_mhpmeventh,
+                             write_mhpmeventh                           },
+
     [CSR_HPMCOUNTER3H]   = { "hpmcounter3h",   ctr32,  read_hpmcounterh },
     [CSR_HPMCOUNTER4H]   = { "hpmcounter4h",   ctr32,  read_hpmcounterh },
     [CSR_HPMCOUNTER5H]   = { "hpmcounter5h",   ctr32,  read_hpmcounterh },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                              write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", mctr32,  read_hpmcounterh,
                              write_mhpmcounterh                         },
+    [CSR_SCOUNTOVF]      = { "scountovf", sscofpmf,  read_scountovf },
+
 #endif /* !CONFIG_USER_ONLY */
 };
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
         VMSTATE_STRUCT_ARRAY(env.pmu_ctrs, RISCVCPU, RV_MAX_MHPMCOUNTERS, 0,
                              vmstate_pmu_ctr_state, PMUCTRState),
         VMSTATE_UINTTL_ARRAY(env.mhpmevent_val, RISCVCPU, RV_MAX_MHPMEVENTS),
+        VMSTATE_UINTTL_ARRAY(env.mhpmeventh_val, RISCVCPU, RV_MAX_MHPMEVENTS),
         VMSTATE_UINTTL(env.sscratch, RISCVCPU),
         VMSTATE_UINTTL(env.mscratch, RISCVCPU),
         VMSTATE_UINT64(env.mfromhost, RISCVCPU),
diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "pmu.h"
+#include "sysemu/cpu-timers.h"
+
+#define RISCV_TIMEBASE_FREQ 1000000000 /* 1Ghz */
+#define MAKE_32BIT_MASK(shift, length) \
+        (((uint32_t)(~0UL) >> (32 - (length))) << (shift))
+
+static bool riscv_pmu_counter_valid(RISCVCPU *cpu, uint32_t ctr_idx)
+{
+    if (ctr_idx < 3 || ctr_idx >= RV_MAX_MHPMCOUNTERS ||
+        !(cpu->pmu_avail_ctrs & BIT(ctr_idx))) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
+static bool riscv_pmu_counter_enabled(RISCVCPU *cpu, uint32_t ctr_idx)
+{
+    CPURISCVState *env = &cpu->env;
+
+    if (riscv_pmu_counter_valid(cpu, ctr_idx) &&
+        !get_field(env->mcountinhibit, BIT(ctr_idx))) {
+        return true;
+    } else {
+        return false;
+    }
+}
+
+static int riscv_pmu_incr_ctr_rv32(RISCVCPU *cpu, uint32_t ctr_idx)
+{
+    CPURISCVState *env = &cpu->env;
+    target_ulong max_val = UINT32_MAX;
+    PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
+    bool virt_on = riscv_cpu_virt_enabled(env);
+
+    /* Privilege mode filtering */
+    if ((env->priv == PRV_M &&
+        (env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_MINH)) ||
+        (env->priv == PRV_S && virt_on &&
+        (env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_VSINH)) ||
+        (env->priv == PRV_U && virt_on &&
+        (env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_VUINH)) ||
+        (env->priv == PRV_S && !virt_on &&
+        (env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_SINH)) ||
+        (env->priv == PRV_U && !virt_on &&
+        (env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_UINH))) {
+        return 0;
+    }
+
+    /* Handle the overflow scenario */
+    if (counter->mhpmcounter_val == max_val) {
+        if (counter->mhpmcounterh_val == max_val) {
+            counter->mhpmcounter_val = 0;
+            counter->mhpmcounterh_val = 0;
+            /* Generate interrupt only if OF bit is clear */
+            if (!(env->mhpmeventh_val[ctr_idx] & MHPMEVENTH_BIT_OF)) {
+                env->mhpmeventh_val[ctr_idx] |= MHPMEVENTH_BIT_OF;
+                riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
+            }
+        } else {
+            counter->mhpmcounterh_val++;
+        }
+    } else {
+        counter->mhpmcounter_val++;
+    }
+
+    return 0;
+}
+
+static int riscv_pmu_incr_ctr_rv64(RISCVCPU *cpu, uint32_t ctr_idx)
+{
+    CPURISCVState *env = &cpu->env;
+    PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
+    uint64_t max_val = UINT64_MAX;
+    bool virt_on = riscv_cpu_virt_enabled(env);
+
+    /* Privilege mode filtering */
+    if ((env->priv == PRV_M &&
+        (env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_MINH)) ||
+        (env->priv == PRV_S && virt_on &&
+        (env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_VSINH)) ||
+        (env->priv == PRV_U && virt_on &&
+        (env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_VUINH)) ||
+        (env->priv == PRV_S && !virt_on &&
+        (env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_SINH)) ||
+        (env->priv == PRV_U && !virt_on &&
+        (env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_UINH))) {
+        return 0;
+    }
+
+    /* Handle the overflow scenario */
+    if (counter->mhpmcounter_val == max_val) {
+        counter->mhpmcounter_val = 0;
+        /* Generate interrupt only if OF bit is clear */
+        if (!(env->mhpmevent_val[ctr_idx] & MHPMEVENT_BIT_OF)) {
+            env->mhpmevent_val[ctr_idx] |= MHPMEVENT_BIT_OF;
+            riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
+        }
+    } else {
+        counter->mhpmcounter_val++;
+    }
+    return 0;
+}
+
+int riscv_pmu_incr_ctr(RISCVCPU *cpu, enum riscv_pmu_event_idx event_idx)
+{
+    uint32_t ctr_idx;
+    int ret;
+    CPURISCVState *env = &cpu->env;
+    gpointer value;
+
+    if (!cpu->cfg.pmu_num) {
+        return 0;
+    }
+    value = g_hash_table_lookup(cpu->pmu_event_ctr_map,
+                                GUINT_TO_POINTER(event_idx));
+    if (!value) {
+        return -1;
+    }
+
+    ctr_idx = GPOINTER_TO_UINT(value);
+    if (!riscv_pmu_counter_enabled(cpu, ctr_idx) ||
+        get_field(env->mcountinhibit, BIT(ctr_idx))) {
+        return -1;
+    }
+
+    if (riscv_cpu_mxl(env) == MXL_RV32) {
+        ret = riscv_pmu_incr_ctr_rv32(cpu, ctr_idx);
+    } else {
+        ret = riscv_pmu_incr_ctr_rv64(cpu, ctr_idx);
+    }
+
+    return ret;
+}
 
 bool riscv_pmu_ctr_monitor_instructions(CPURISCVState *env,
                                         uint32_t target_ctr)
 {
-    return (target_ctr == 0) ? true : false;
+    RISCVCPU *cpu;
+    uint32_t event_idx;
+    uint32_t ctr_idx;
+
+    /* Fixed instret counter */
+    if (target_ctr == 2) {
+        return true;
+    }
+
+    cpu = RISCV_CPU(env_cpu(env));
+    if (!cpu->pmu_event_ctr_map) {
+        return false;
+    }
+
+    event_idx = RISCV_PMU_EVENT_HW_INSTRUCTIONS;
+    ctr_idx = GPOINTER_TO_UINT(g_hash_table_lookup(cpu->pmu_event_ctr_map,
+                               GUINT_TO_POINTER(event_idx)));
+    if (!ctr_idx) {
+        return false;
+    }
+
+    return target_ctr == ctr_idx ? true : false;
 }
 
 bool riscv_pmu_ctr_monitor_cycles(CPURISCVState *env, uint32_t target_ctr)
 {
-    return (target_ctr == 2) ? true : false;
+    RISCVCPU *cpu;
+    uint32_t event_idx;
+    uint32_t ctr_idx;
+
+    /* Fixed mcycle counter */
+    if (target_ctr == 0) {
+        return true;
+    }
+
+    cpu = RISCV_CPU(env_cpu(env));
+    if (!cpu->pmu_event_ctr_map) {
+        return false;
+    }
+
+    event_idx = RISCV_PMU_EVENT_HW_CPU_CYCLES;
+    ctr_idx = GPOINTER_TO_UINT(g_hash_table_lookup(cpu->pmu_event_ctr_map,
+                               GUINT_TO_POINTER(event_idx)));
+
+    /* Counter zero is not used for event_ctr_map */
+    if (!ctr_idx) {
+        return false;
+    }
+
+    return (target_ctr == ctr_idx) ? true : false;
+}
+
+static gboolean pmu_remove_event_map(gpointer key, gpointer value,
+                                     gpointer udata)
+{
+    return (GPOINTER_TO_UINT(value) == GPOINTER_TO_UINT(udata)) ? true : false;
+}
+
+static int64_t pmu_icount_ticks_to_ns(int64_t value)
+{
+    int64_t ret = 0;
+
+    if (icount_enabled()) {
+        ret = icount_to_ns(value);
+    } else {
+        ret = (NANOSECONDS_PER_SECOND / RISCV_TIMEBASE_FREQ) * value;
+    }
+
+    return ret;
+}
+
+int riscv_pmu_update_event_map(CPURISCVState *env, uint64_t value,
+                               uint32_t ctr_idx)
+{
+    uint32_t event_idx;
+    RISCVCPU *cpu = RISCV_CPU(env_cpu(env));
+
+    if (!riscv_pmu_counter_valid(cpu, ctr_idx) || !cpu->pmu_event_ctr_map) {
+        return -1;
+    }
+
+    /*
+     * Expected mhpmevent value is zero for reset case. Remove the current
+     * mapping.
+     */
+    if (!value) {
+        g_hash_table_foreach_remove(cpu->pmu_event_ctr_map,
+                                    pmu_remove_event_map,
+                                    GUINT_TO_POINTER(ctr_idx));
+        return 0;
+    }
+
+    event_idx = value & MHPMEVENT_IDX_MASK;
+    if (g_hash_table_lookup(cpu->pmu_event_ctr_map,
+                            GUINT_TO_POINTER(event_idx))) {
+        return 0;
+    }
+
+    switch (event_idx) {
+    case RISCV_PMU_EVENT_HW_CPU_CYCLES:
+    case RISCV_PMU_EVENT_HW_INSTRUCTIONS:
+    case RISCV_PMU_EVENT_CACHE_DTLB_READ_MISS:
+    case RISCV_PMU_EVENT_CACHE_DTLB_WRITE_MISS:
+    case RISCV_PMU_EVENT_CACHE_ITLB_PREFETCH_MISS:
+        break;
+    default:
+        /* We don't support any raw events right now */
+        return -1;
+    }
+    g_hash_table_insert(cpu->pmu_event_ctr_map, GUINT_TO_POINTER(event_idx),
+                        GUINT_TO_POINTER(ctr_idx));
+
+    return 0;
+}
+
+static void pmu_timer_trigger_irq(RISCVCPU *cpu,
+                                  enum riscv_pmu_event_idx evt_idx)
+{
+    uint32_t ctr_idx;
+    CPURISCVState *env = &cpu->env;
+    PMUCTRState *counter;
+    target_ulong *mhpmevent_val;
+    uint64_t of_bit_mask;
+    int64_t irq_trigger_at;
+
+    if (evt_idx != RISCV_PMU_EVENT_HW_CPU_CYCLES &&
+        evt_idx != RISCV_PMU_EVENT_HW_INSTRUCTIONS) {
+        return;
+    }
+
+    ctr_idx = GPOINTER_TO_UINT(g_hash_table_lookup(cpu->pmu_event_ctr_map,
+                               GUINT_TO_POINTER(evt_idx)));
+    if (!riscv_pmu_counter_enabled(cpu, ctr_idx)) {
+        return;
+    }
+
+    if (riscv_cpu_mxl(env) == MXL_RV32) {
+        mhpmevent_val = &env->mhpmeventh_val[ctr_idx];
+        of_bit_mask = MHPMEVENTH_BIT_OF;
+     } else {
+        mhpmevent_val = &env->mhpmevent_val[ctr_idx];
+        of_bit_mask = MHPMEVENT_BIT_OF;
+    }
+
+    counter = &env->pmu_ctrs[ctr_idx];
+    if (counter->irq_overflow_left > 0) {
+        irq_trigger_at = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+                        counter->irq_overflow_left;
+        timer_mod_anticipate_ns(cpu->pmu_timer, irq_trigger_at);
+        counter->irq_overflow_left = 0;
+        return;
+    }
+
+    if (cpu->pmu_avail_ctrs & BIT(ctr_idx)) {
+        /* Generate interrupt only if OF bit is clear */
+        if (!(*mhpmevent_val & of_bit_mask)) {
+            *mhpmevent_val |= of_bit_mask;
+            riscv_cpu_update_mip(cpu, MIP_LCOFIP, BOOL_TO_MASK(1));
+        }
+    }
+}
+
+/* Timer callback for instret and cycle counter overflow */
+void riscv_pmu_timer_cb(void *priv)
+{
+    RISCVCPU *cpu = priv;
+
+    /* Timer event was triggered only for these events */
+    pmu_timer_trigger_irq(cpu, RISCV_PMU_EVENT_HW_CPU_CYCLES);
+    pmu_timer_trigger_irq(cpu, RISCV_PMU_EVENT_HW_INSTRUCTIONS);
+}
+
+int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value, uint32_t ctr_idx)
+{
+    uint64_t overflow_delta, overflow_at;
+    int64_t overflow_ns, overflow_left = 0;
+    RISCVCPU *cpu = RISCV_CPU(env_cpu(env));
+    PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
+
+    if (!riscv_pmu_counter_valid(cpu, ctr_idx) || !cpu->cfg.ext_sscofpmf) {
+        return -1;
+    }
+
+    if (value) {
+        overflow_delta = UINT64_MAX - value + 1;
+    } else {
+        overflow_delta = UINT64_MAX;
+    }
+
+    /*
+     * QEMU supports only int64_t timers while RISC-V counters are uint64_t.
+     * Compute the leftover and save it so that it can be reprogrammed again
+     * when timer expires.
+     */
+    if (overflow_delta > INT64_MAX) {
+        overflow_left = overflow_delta - INT64_MAX;
+    }
+
+    if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
+        riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
+        overflow_ns = pmu_icount_ticks_to_ns((int64_t)overflow_delta);
+        overflow_left = pmu_icount_ticks_to_ns(overflow_left) ;
+    } else {
+        return -1;
+    }
+    overflow_at = (uint64_t)qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + overflow_ns;
+
+    if (overflow_at > INT64_MAX) {
+        overflow_left += overflow_at - INT64_MAX;
+        counter->irq_overflow_left = overflow_left;
+        overflow_at = INT64_MAX;
+    }
+    timer_mod_anticipate_ns(cpu->pmu_timer, overflow_at);
+
+    return 0;
+}
+
+
+int riscv_pmu_init(RISCVCPU *cpu, int num_counters)
+{
+    if (num_counters > (RV_MAX_MHPMCOUNTERS - 3)) {
+        return -1;
+    }
+
+    cpu->pmu_event_ctr_map = g_hash_table_new(g_direct_hash, g_direct_equal);
+    if (!cpu->pmu_event_ctr_map) {
+        /* PMU support can not be enabled */
+        qemu_log_mask(LOG_UNIMP, "PMU events can't be supported\n");
+        cpu->cfg.pmu_num = 0;
+        return -1;
+    }
+
+    /* Create a bitmask of available programmable counters */
+    cpu->pmu_avail_ctrs = MAKE_32BIT_MASK(3, num_counters);
+
+    return 0;
 }
-- 
2.37.2

From: Atish Patra <atishp@rivosinc.com>

All the hpmcounters and the fixed counters (CY, IR, TM) can be represented
as a unified counter. Thus, the predicate function doesn't need handle each
case separately.

Simplify the predicate function so that we just handle things differently
between RV32/RV64 and S/HS mode.

Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-Id: <20220824221701.41932-3-atishp@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 110 ++++-----------------------------------------
 1 file changed, 9 insertions(+), 101 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
     CPUState *cs = env_cpu(env);
     RISCVCPU *cpu = RISCV_CPU(cs);
     int ctr_index;
+    target_ulong ctr_mask;
     int base_csrno = CSR_CYCLE;
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
 
@@ -XXX,XX +XXX,XX @@ static RISCVException ctr(CPURISCVState *env, int csrno)
         base_csrno += 0x80;
     }
     ctr_index = csrno - base_csrno;
+    ctr_mask = BIT(ctr_index);
 
     if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) ||
         (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) {
         goto skip_ext_pmu_check;
     }
 
-    if ((!cpu->cfg.pmu_num || !(cpu->pmu_avail_ctrs & BIT(ctr_index)))) {
+    if (!(cpu->pmu_avail_ctrs & ctr_mask)) {
         /* No counter is enabled in PMU or the counter is out of range */
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
 skip_ext_pmu_check:
 
-    if (env->priv == PRV_S) {
-        switch (csrno) {
-        case CSR_CYCLE:
-            if (!get_field(env->mcounteren, COUNTEREN_CY)) {
-                return RISCV_EXCP_ILLEGAL_INST;
-            }
-            break;
-        case CSR_TIME:
-            if (!get_field(env->mcounteren, COUNTEREN_TM)) {
-                return RISCV_EXCP_ILLEGAL_INST;
-            }
-            break;
-        case CSR_INSTRET:
-            if (!get_field(env->mcounteren, COUNTEREN_IR)) {
-                return RISCV_EXCP_ILLEGAL_INST;
-            }
-            break;
-        case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
-            if (!get_field(env->mcounteren, 1 << ctr_index)) {
-                return RISCV_EXCP_ILLEGAL_INST;
-            }
-            break;
-        }
-        if (rv32) {
-            switch (csrno) {
-            case CSR_CYCLEH:
-                if (!get_field(env->mcounteren, COUNTEREN_CY)) {
-                    return RISCV_EXCP_ILLEGAL_INST;
-                }
-                break;
-            case CSR_TIMEH:
-                if (!get_field(env->mcounteren, COUNTEREN_TM)) {
-                    return RISCV_EXCP_ILLEGAL_INST;
-                }
-                break;
-            case CSR_INSTRETH:
-                if (!get_field(env->mcounteren, COUNTEREN_IR)) {
-                    return RISCV_EXCP_ILLEGAL_INST;
-                }
-                break;
-            case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
-                if (!get_field(env->mcounteren, 1 << ctr_index)) {
-                    return RISCV_EXCP_ILLEGAL_INST;
-                }
-                break;
-            }
-        }
+    if (((env->priv == PRV_S) && (!get_field(env->mcounteren, ctr_mask))) ||
+        ((env->priv == PRV_U) && (!get_field(env->scounteren, ctr_mask)))) {
+        return RISCV_EXCP_ILLEGAL_INST;
     }
 
     if (riscv_cpu_virt_enabled(env)) {
-        switch (csrno) {
-        case CSR_CYCLE:
-            if (!get_field(env->hcounteren, COUNTEREN_CY) &&
-                get_field(env->mcounteren, COUNTEREN_CY)) {
-                return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-            }
-            break;
-        case CSR_TIME:
-            if (!get_field(env->hcounteren, COUNTEREN_TM) &&
-                get_field(env->mcounteren, COUNTEREN_TM)) {
-                return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-            }
-            break;
-        case CSR_INSTRET:
-            if (!get_field(env->hcounteren, COUNTEREN_IR) &&
-                get_field(env->mcounteren, COUNTEREN_IR)) {
-                return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-            }
-            break;
-        case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
-            if (!get_field(env->hcounteren, 1 << ctr_index) &&
-                 get_field(env->mcounteren, 1 << ctr_index)) {
-                return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-            }
-            break;
-        }
-        if (rv32) {
-            switch (csrno) {
-            case CSR_CYCLEH:
-                if (!get_field(env->hcounteren, COUNTEREN_CY) &&
-                    get_field(env->mcounteren, COUNTEREN_CY)) {
-                    return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-                }
-                break;
-            case CSR_TIMEH:
-                if (!get_field(env->hcounteren, COUNTEREN_TM) &&
-                    get_field(env->mcounteren, COUNTEREN_TM)) {
-                    return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-                }
-                break;
-            case CSR_INSTRETH:
-                if (!get_field(env->hcounteren, COUNTEREN_IR) &&
-                    get_field(env->mcounteren, COUNTEREN_IR)) {
-                    return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-                }
-                break;
-            case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
-                if (!get_field(env->hcounteren, 1 << ctr_index) &&
-                     get_field(env->mcounteren, 1 << ctr_index)) {
-                    return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
-                }
-                break;
-            }
+        if (!get_field(env->hcounteren, ctr_mask) &&
+            get_field(env->mcounteren, ctr_mask)) {
+            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
     }
 #endif
-- 
2.37.2

From: Atish Patra <atish.patra@wdc.com>

Qemu can monitor the following cache related PMU events through
tlb_fill functions.

1. DTLB load/store miss
3. ITLB prefetch miss

Increment the PMU counter in tlb_fill function.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Atish Patra <atish.patra@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-Id: <20220824221701.41932-4-atishp@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
 #include "cpu.h"
+#include "pmu.h"
 #include "exec/exec-all.h"
 #include "instmap.h"
 #include "tcg/tcg-op.h"
 #include "trace.h"
 #include "semihosting/common-semi.h"
+#include "cpu_bits.h"
 
 int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
     cpu_loop_exit_restore(cs, retaddr);
 }
 
+
+static void pmu_tlb_fill_incr_ctr(RISCVCPU *cpu, MMUAccessType access_type)
+{
+    enum riscv_pmu_event_idx pmu_event_type;
+
+    switch (access_type) {
+    case MMU_INST_FETCH:
+        pmu_event_type = RISCV_PMU_EVENT_CACHE_ITLB_PREFETCH_MISS;
+        break;
+    case MMU_DATA_LOAD:
+        pmu_event_type = RISCV_PMU_EVENT_CACHE_DTLB_READ_MISS;
+        break;
+    case MMU_DATA_STORE:
+        pmu_event_type = RISCV_PMU_EVENT_CACHE_DTLB_WRITE_MISS;
+        break;
+    default:
+        return;
+    }
+
+    riscv_pmu_incr_ctr(cpu, pmu_event_type);
+}
+
 bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                         MMUAccessType access_type, int mmu_idx,
                         bool probe, uintptr_t retaddr)
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
             }
         }
     } else {
+        pmu_tlb_fill_incr_ctr(cpu, access_type);
         /* Single stage lookup */
         ret = get_physical_address(env, &pa, &prot, address, NULL,
                                    access_type, mmu_idx, true, false, false);
-- 
2.37.2

From: Atish Patra <atishp@rivosinc.com>

Qemu virt machine can support few cache events and cycle/instret counters.
It also supports counter overflow for these events.

Add a DT node so that OpenSBI/Linux kernel is aware of the virt machine
capabilities. There are some dummy nodes added for testing as well.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atish.patra@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-Id: <20220824221701.41932-5-atishp@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmu.h |  1 +
 hw/riscv/virt.c    | 16 +++++++++++++
 target/riscv/pmu.c | 57 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 74 insertions(+)

diff --git a/target/riscv/pmu.h b/target/riscv/pmu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmu.h
+++ b/target/riscv/pmu.h
@@ -XXX,XX +XXX,XX @@ int riscv_pmu_init(RISCVCPU *cpu, int num_counters);
 int riscv_pmu_update_event_map(CPURISCVState *env, uint64_t value,
                                uint32_t ctr_idx);
 int riscv_pmu_incr_ctr(RISCVCPU *cpu, enum riscv_pmu_event_idx event_idx);
+void riscv_pmu_generate_fdt_node(void *fdt, int num_counters, char *pmu_name);
 int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value,
                           uint32_t ctr_idx);
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/char/serial.h"
 #include "target/riscv/cpu.h"
 #include "hw/core/sysbus-fdt.h"
+#include "target/riscv/pmu.h"
 #include "hw/riscv/riscv_hart.h"
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
     aplic_phandles[socket] = aplic_s_phandle;
 }
 
+static void create_fdt_pmu(RISCVVirtState *s)
+{
+    char *pmu_name;
+    MachineState *mc = MACHINE(s);
+    RISCVCPU hart = s->soc[0].harts[0];
+
+    pmu_name = g_strdup_printf("/soc/pmu");
+    qemu_fdt_add_subnode(mc->fdt, pmu_name);
+    qemu_fdt_setprop_string(mc->fdt, pmu_name, "compatible", "riscv,pmu");
+    riscv_pmu_generate_fdt_node(mc->fdt, hart.cfg.pmu_num, pmu_name);
+
+    g_free(pmu_name);
+}
+
 static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
                                bool is_32_bit, uint32_t *phandle,
                                uint32_t *irq_mmio_phandle,
@@ -XXX,XX +XXX,XX @@ static void create_fdt(RISCVVirtState *s, const MemMapEntry *memmap,
 
     create_fdt_flash(s, memmap);
     create_fdt_fw_cfg(s, memmap);
+    create_fdt_pmu(s);
 
 update_bootargs:
     if (cmdline && *cmdline) {
diff --git a/target/riscv/pmu.c b/target/riscv/pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmu.c
+++ b/target/riscv/pmu.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "pmu.h"
 #include "sysemu/cpu-timers.h"
+#include "sysemu/device_tree.h"
 
 #define RISCV_TIMEBASE_FREQ 1000000000 /* 1Ghz */
 #define MAKE_32BIT_MASK(shift, length) \
         (((uint32_t)(~0UL) >> (32 - (length))) << (shift))
 
+/*
+ * To keep it simple, any event can be mapped to any programmable counters in
+ * QEMU. The generic cycle & instruction count events can also be monitored
+ * using programmable counters. In that case, mcycle & minstret must continue
+ * to provide the correct value as well. Heterogeneous PMU per hart is not
+ * supported yet. Thus, number of counters are same across all harts.
+ */
+void riscv_pmu_generate_fdt_node(void *fdt, int num_ctrs, char *pmu_name)
+{
+    uint32_t fdt_event_ctr_map[20] = {};
+    uint32_t cmask;
+
+    /* All the programmable counters can map to any event */
+    cmask = MAKE_32BIT_MASK(3, num_ctrs);
+
+   /*
+    * The event encoding is specified in the SBI specification
+    * Event idx is a 20bits wide number encoded as follows:
+    * event_idx[19:16] = type
+    * event_idx[15:0] = code
+    * The code field in cache events are encoded as follows:
+    * event_idx.code[15:3] = cache_id
+    * event_idx.code[2:1] = op_id
+    * event_idx.code[0:0] = result_id
+    */
+
+   /* SBI_PMU_HW_CPU_CYCLES: 0x01 : type(0x00) */
+   fdt_event_ctr_map[0] = cpu_to_be32(0x00000001);
+   fdt_event_ctr_map[1] = cpu_to_be32(0x00000001);
+   fdt_event_ctr_map[2] = cpu_to_be32(cmask | 1 << 0);
+
+   /* SBI_PMU_HW_INSTRUCTIONS: 0x02 : type(0x00) */
+   fdt_event_ctr_map[3] = cpu_to_be32(0x00000002);
+   fdt_event_ctr_map[4] = cpu_to_be32(0x00000002);
+   fdt_event_ctr_map[5] = cpu_to_be32(cmask | 1 << 2);
+
+   /* SBI_PMU_HW_CACHE_DTLB : 0x03 READ : 0x00 MISS : 0x00 type(0x01) */
+   fdt_event_ctr_map[6] = cpu_to_be32(0x00010019);
+   fdt_event_ctr_map[7] = cpu_to_be32(0x00010019);
+   fdt_event_ctr_map[8] = cpu_to_be32(cmask);
+
+   /* SBI_PMU_HW_CACHE_DTLB : 0x03 WRITE : 0x01 MISS : 0x00 type(0x01) */
+   fdt_event_ctr_map[9] = cpu_to_be32(0x0001001B);
+   fdt_event_ctr_map[10] = cpu_to_be32(0x0001001B);
+   fdt_event_ctr_map[11] = cpu_to_be32(cmask);
+
+   /* SBI_PMU_HW_CACHE_ITLB : 0x04 READ : 0x00 MISS : 0x00 type(0x01) */
+   fdt_event_ctr_map[12] = cpu_to_be32(0x00010021);
+   fdt_event_ctr_map[13] = cpu_to_be32(0x00010021);
+   fdt_event_ctr_map[14] = cpu_to_be32(cmask);
+
+   /* This a OpenSBI specific DT property documented in OpenSBI docs */
+   qemu_fdt_setprop(fdt, pmu_name, "riscv,event-to-mhpmcounters",
+                    fdt_event_ctr_map, sizeof(fdt_event_ctr_map));
+}
+
 static bool riscv_pmu_counter_valid(RISCVCPU *cpu, uint32_t ctr_idx)
 {
     if (ctr_idx < 3 || ctr_idx >= RV_MAX_MHPMCOUNTERS ||
-- 
2.37.2

From: Atish Patra <atishp@rivosinc.com>

The sscofpmf extension was ratified as a part of priv spec v1.12.
Mark the csr_ops accordingly.

Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Atish Patra <atishp@rivosinc.com>
Message-Id: <20220824221701.41932-6-atishp@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 90 ++++++++++++++++++++++++++++++----------------
 1 file changed, 60 insertions(+), 30 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                              write_mhpmevent                           },
 
     [CSR_MHPMEVENT3H]    = { "mhpmevent3h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT4H]    = { "mhpmevent4h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT5H]    = { "mhpmevent5h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT6H]    = { "mhpmevent6h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT7H]    = { "mhpmevent7h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT8H]    = { "mhpmevent8h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT9H]    = { "mhpmevent9h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT10H]   = { "mhpmevent10h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT11H]   = { "mhpmevent11h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT12H]   = { "mhpmevent12h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT13H]   = { "mhpmevent13h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT14H]   = { "mhpmevent14h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT15H]   = { "mhpmevent15h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT16H]   = { "mhpmevent16h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT17H]   = { "mhpmevent17h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT18H]   = { "mhpmevent18h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT19H]   = { "mhpmevent19h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT20H]   = { "mhpmevent20h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT21H]   = { "mhpmevent21h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT22H]   = { "mhpmevent22h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT23H]   = { "mhpmevent23h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT24H]   = { "mhpmevent24h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT25H]   = { "mhpmevent25h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT26H]   = { "mhpmevent26h",    sscofpmf,  read_mhpmeventh,
-                              write_mhpmeventh                          },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT27H]   = { "mhpmevent27h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT28H]   = { "mhpmevent28h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT29H]   = { "mhpmevent29h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT30H]   = { "mhpmevent30h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
     [CSR_MHPMEVENT31H]   = { "mhpmevent31h",    sscofpmf,  read_mhpmeventh,
-                             write_mhpmeventh                           },
+                             write_mhpmeventh,
+                             .min_priv_ver = PRIV_VERSION_1_12_0        },
 
     [CSR_HPMCOUNTER3H]   = { "hpmcounter3h",   ctr32,  read_hpmcounterh },
     [CSR_HPMCOUNTER4H]   = { "hpmcounter4h",   ctr32,  read_hpmcounterh },
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
                              write_mhpmcounterh                         },
     [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", mctr32,  read_hpmcounterh,
                              write_mhpmcounterh                         },
-    [CSR_SCOUNTOVF]      = { "scountovf", sscofpmf,  read_scountovf },
+    [CSR_SCOUNTOVF]      = { "scountovf", sscofpmf,  read_scountovf,
+                             .min_priv_ver = PRIV_VERSION_1_12_0 },
 
 #endif /* !CONFIG_USER_ONLY */
 };
-- 
2.37.2

The following changes since commit ad10b4badc1dd5b28305f9b9f1168cf0aa3ae946:

Merge tag 'pull-error-2024-05-27' of https://repo.or.cz/qemu/armbru into staging (2024-05-27 06:40:42 -0700)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20240528

for you to fetch changes up to 1806da76cb81088ea026ca3441551782b850e393:

target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR (2024-05-28 12:20:27 +1000)

----------------------------------------------------------------
RISC-V PR for 9.1

* APLICs add child earlier than realize
* Fix exposure of Zkr
* Raise exceptions on wrs.nto
* Implement SBI debug console (DBCN) calls for KVM
* Support 64-bit addresses for initrd
* Change RISCV_EXCP_SEMIHOST exception number to 63
* Tolerate KVM disable ext errors
* Set tval in breakpoints
* Add support for Zve32x extension
* Add support for Zve64x extension
* Relax vector register check in RISCV gdbstub
* Fix the element agnostic Vector function problem
* Fix Zvkb extension config
* Implement dynamic establishment of custom decoder
* Add th.sxstatus CSR emulation
* Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
* Check single width operator for vector fp widen instructions
* Check single width operator for vfncvt.rod.f.f.w
* Remove redudant SEW checking for vector fp narrow/widen instructions
* Prioritize pmp errors in raise_mmu_exception()
* Do not set mtval2 for non guest-page faults
* Remove experimental prefix from "B" extension
* Fixup CBO extension register calculation
* Fix the hart bit setting of AIA
* Fix reg_width in ricsv_gen_dynamic_vector_feature()
* Decode all of the pmpcfg and pmpaddr CSRs
* Raise an exception when CSRRS/CSRRC writes a read-only CSR

----------------------------------------------------------------
Alexei Filippov (1):
      target/riscv: do not set mtval2 for non guest-page faults

Alistair Francis (2):
      target/riscv: rvzicbo: Fixup CBO extension register calculation
      disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs

Andrew Jones (2):
      target/riscv/kvm: Fix exposure of Zkr
      target/riscv: Raise exceptions on wrs.nto

Cheng Yang (1):
      hw/riscv/boot.c: Support 64-bit address for initrd

Christoph Müllner (1):
      riscv: thead: Add th.sxstatus CSR emulation

Clément Léger (1):
      target/riscv: change RISCV_EXCP_SEMIHOST exception number to 63

Daniel Henrique Barboza (6):
      target/riscv/kvm: implement SBI debug console (DBCN) calls
      target/riscv/kvm: tolerate KVM disable ext errors
      target/riscv/debug: set tval=pc in breakpoint exceptions
      trans_privileged.c.inc: set (m|s)tval on ebreak breakpoint
      target/riscv: prioritize pmp errors in raise_mmu_exception()
      riscv, gdbstub.c: fix reg_width in ricsv_gen_dynamic_vector_feature()

Huang Tao (2):
      target/riscv: Fix the element agnostic function problem
      target/riscv: Implement dynamic establishment of custom decoder

Jason Chien (3):
      target/riscv: Add support for Zve32x extension
      target/riscv: Add support for Zve64x extension
      target/riscv: Relax vector register check in RISCV gdbstub

Max Chou (4):
      target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
      target/riscv: rvv: Check single width operator for vector fp widen instructions
      target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
      target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions

Rob Bradford (1):
      target/riscv: Remove experimental prefix from "B" extension

Yangyu Chen (1):
      target/riscv/cpu.c: fix Zvkb extension config

Yong-Xuan Wang (1):
      target/riscv/kvm.c: Fix the hart bit setting of AIA

Yu-Ming Chang (1):
      target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR

yang.zhang (1):
      hw/intc/riscv_aplic: APLICs should add child earlier than realize

From: "yang.zhang" <yang.zhang@hexintek.com>

Since only root APLICs can have hw IRQ lines, aplic->parent should
be initialized first.

Fixes: e8f79343cf ("hw/intc: Add RISC-V AIA APLIC device emulation")
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: yang.zhang <yang.zhang@hexintek.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240409014445.278-1-gaoshanliukou@163.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
     qdev_prop_set_bit(dev, "msimode", msimode);
     qdev_prop_set_bit(dev, "mmode", mmode);
 
+    if (parent) {
+        riscv_aplic_add_child(parent, dev);
+    }
+
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     if (!is_kvm_aia(msimode)) {
         sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
     }
 
-    if (parent) {
-        riscv_aplic_add_child(parent, dev);
-    }
-
     if (!msimode) {
         for (i = 0; i < num_harts; i++) {
             CPUState *cpu = cpu_by_arch_id(hartid_base + i);
-- 
2.45.1

From: Andrew Jones <ajones@ventanamicro.com>

The Zkr extension may only be exposed to KVM guests if the VMM
implements the SEED CSR. Use the same implementation as TCG.

Without this patch, running with a KVM which does not forward the
SEED CSR access to QEMU will result in an ILL exception being
injected into the guest (this results in Linux guests crashing on
boot). And, when running with a KVM which does forward the access,
QEMU will crash, since QEMU doesn't know what to do with the exit.

Fixes: 3108e2f1c69d ("target/riscv/kvm: update KVM exts to Linux 6.8")
Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240422134605.534207-2-ajones@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  3 +++
 target/riscv/csr.c         | 18 ++++++++++++++----
 target/riscv/kvm/kvm-cpu.c | 25 +++++++++++++++++++++++++
 3 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops);
 
 void riscv_cpu_register_gdb_regs_for_features(CPUState *cs);
 
+target_ulong riscv_new_csr_seed(target_ulong new_value,
+                                target_ulong write_mask);
+
 uint8_t satp_mode_max_from_map(uint32_t map);
 const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_upmbase(CPURISCVState *env, int csrno,
 #endif
 
 /* Crypto Extension */
-static RISCVException rmw_seed(CPURISCVState *env, int csrno,
-                               target_ulong *ret_value,
-                               target_ulong new_value,
-                               target_ulong write_mask)
+target_ulong riscv_new_csr_seed(target_ulong new_value,
+                                target_ulong write_mask)
 {
     uint16_t random_v;
     Error *random_e = NULL;
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
         rval = random_v | SEED_OPST_ES16;
     }
 
+    return rval;
+}
+
+static RISCVException rmw_seed(CPURISCVState *env, int csrno,
+                               target_ulong *ret_value,
+                               target_ulong new_value,
+                               target_ulong write_mask)
+{
+    target_ulong rval;
+
+    rval = riscv_new_csr_seed(new_value, write_mask);
+
     if (ret_value) {
         *ret_value = rval;
     }
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
     return ret;
 }
 
+static int kvm_riscv_handle_csr(CPUState *cs, struct kvm_run *run)
+{
+    target_ulong csr_num = run->riscv_csr.csr_num;
+    target_ulong new_value = run->riscv_csr.new_value;
+    target_ulong write_mask = run->riscv_csr.write_mask;
+    int ret = 0;
+
+    switch (csr_num) {
+    case CSR_SEED:
+        run->riscv_csr.ret_value = riscv_new_csr_seed(new_value, write_mask);
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: un-handled CSR EXIT for CSR %lx\n",
+                      __func__, csr_num);
+        ret = -1;
+        break;
+    }
+
+    return ret;
+}
+
 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
     case KVM_EXIT_RISCV_SBI:
         ret = kvm_riscv_handle_sbi(cs, run);
         break;
+    case KVM_EXIT_RISCV_CSR:
+        ret = kvm_riscv_handle_csr(cs, run);
+        break;
     default:
         qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",
                       __func__, run->exit_reason);
-- 
2.45.1

From: Andrew Jones <ajones@ventanamicro.com>

Implementing wrs.nto to always just return is consistent with the
specification, as the instruction is permitted to terminate the
stall for any reason, but it's not useful for virtualization, where
we'd like the guest to trap to the hypervisor in order to allow
scheduling of the lock holding VCPU. Change to always immediately
raise exceptions when the appropriate conditions are present,
otherwise continue to just return. Note, immediately raising
exceptions is also consistent with the specification since the
time limit that should expire prior to the exception is
implementation-specific.

Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240424142808.62936-2-ajones@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                       |  1 +
 target/riscv/op_helper.c                    | 11 ++++++++
 target/riscv/insn_trans/trans_rvzawrs.c.inc | 29 ++++++++++++++-------
 3 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(csrrw_i128, tl, env, int, tl, tl, tl, tl)
 DEF_HELPER_1(sret, tl, env)
 DEF_HELPER_1(mret, tl, env)
 DEF_HELPER_1(wfi, void, env)
+DEF_HELPER_1(wrs_nto, void, env)
 DEF_HELPER_1(tlb_flush, void, env)
 DEF_HELPER_1(tlb_flush_all, void, env)
 /* Native Debug */
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_wfi(CPURISCVState *env)
     }
 }
 
+void helper_wrs_nto(CPURISCVState *env)
+{
+    if (env->virt_enabled && (env->priv == PRV_S || env->priv == PRV_U) &&
+        get_field(env->hstatus, HSTATUS_VTW) &&
+        !get_field(env->mstatus, MSTATUS_TW)) {
+        riscv_raise_exception(env, RISCV_EXCP_VIRT_INSTRUCTION_FAULT, GETPC());
+    } else if (env->priv != PRV_M && get_field(env->mstatus, MSTATUS_TW)) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+    }
+}
+
 void helper_tlb_flush(CPURISCVState *env)
 {
     CPUState *cs = env_cpu(env);
diff --git a/target/riscv/insn_trans/trans_rvzawrs.c.inc b/target/riscv/insn_trans/trans_rvzawrs.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzawrs.c.inc
+++ b/target/riscv/insn_trans/trans_rvzawrs.c.inc
@@ -XXX,XX +XXX,XX @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-static bool trans_wrs(DisasContext *ctx)
+static bool trans_wrs_sto(DisasContext *ctx, arg_wrs_sto *a)
 {
     if (!ctx->cfg_ptr->ext_zawrs) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_wrs(DisasContext *ctx)
     return true;
 }
 
-#define GEN_TRANS_WRS(insn)                                     \
-static bool trans_ ## insn(DisasContext *ctx, arg_ ## insn *a)  \
-{                                                               \
-    (void)a;                                                    \
-    return trans_wrs(ctx);                                      \
-}
+static bool trans_wrs_nto(DisasContext *ctx, arg_wrs_nto *a)
+{
+    if (!ctx->cfg_ptr->ext_zawrs) {
+        return false;
+    }
 
-GEN_TRANS_WRS(wrs_nto)
-GEN_TRANS_WRS(wrs_sto)
+    /*
+     * Depending on the mode of execution, mstatus.TW and hstatus.VTW, wrs.nto
+     * should raise an exception when the implementation-specific bounded time
+     * limit has expired. Our time limit is zero, so we either return
+     * immediately, as does our implementation of wrs.sto, or raise an
+     * exception, as handled by the wrs.nto helper.
+     */
+#ifndef CONFIG_USER_ONLY
+    gen_helper_wrs_nto(tcg_env);
+#endif
+
+    /* We only get here when helper_wrs_nto() doesn't raise an exception. */
+    return trans_wrs_sto(ctx, NULL);
+}
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

SBI defines a Debug Console extension "DBCN" that will, in time, replace
the legacy console putchar and getchar SBI extensions.

The appeal of the DBCN extension is that it allows multiple bytes to be
read/written in the SBI console in a single SBI call.

As far as KVM goes, the DBCN calls are forwarded by an in-kernel KVM
module to userspace. But this will only happens if the KVM module
actually supports this SBI extension and we activate it.

We'll check for DBCN support during init time, checking if get-reg-list
is advertising KVM_RISCV_SBI_EXT_DBCN. In that case, we'll enable it via
kvm_set_one_reg() during kvm_arch_init_vcpu().

Finally, change kvm_riscv_handle_sbi() to handle the incoming calls for
SBI_EXT_DBCN, reading and writing as required.

A simple KVM guest with 'earlycon=sbi', running in an emulated RISC-V
host, takes around 20 seconds to boot without using DBCN. With this
patch we're taking around 14 seconds to boot due to the speed-up in the
terminal output.  There's no change in boot time if the guest isn't
using earlycon.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20240425155012.581366-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/sbi_ecall_interface.h |  17 +++++
 target/riscv/kvm/kvm-cpu.c         | 111 +++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+)

diff --git a/target/riscv/sbi_ecall_interface.h b/target/riscv/sbi_ecall_interface.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/sbi_ecall_interface.h
+++ b/target/riscv/sbi_ecall_interface.h
@@ -XXX,XX +XXX,XX @@
 
 /* clang-format off */
 
+#define SBI_SUCCESS                      0
+#define SBI_ERR_FAILED                  -1
+#define SBI_ERR_NOT_SUPPORTED           -2
+#define SBI_ERR_INVALID_PARAM           -3
+#define SBI_ERR_DENIED                  -4
+#define SBI_ERR_INVALID_ADDRESS         -5
+#define SBI_ERR_ALREADY_AVAILABLE       -6
+#define SBI_ERR_ALREADY_STARTED         -7
+#define SBI_ERR_ALREADY_STOPPED         -8
+#define SBI_ERR_NO_SHMEM                -9
+
 /* SBI Extension IDs */
 #define SBI_EXT_0_1_SET_TIMER           0x0
 #define SBI_EXT_0_1_CONSOLE_PUTCHAR     0x1
@@ -XXX,XX +XXX,XX @@
 #define SBI_EXT_IPI                     0x735049
 #define SBI_EXT_RFENCE                  0x52464E43
 #define SBI_EXT_HSM                     0x48534D
+#define SBI_EXT_DBCN                    0x4442434E
 
 /* SBI function IDs for BASE extension */
 #define SBI_EXT_BASE_GET_SPEC_VERSION   0x0
@@ -XXX,XX +XXX,XX @@
 #define SBI_EXT_HSM_HART_STOP           0x1
 #define SBI_EXT_HSM_HART_GET_STATUS     0x2
 
+/* SBI function IDs for DBCN extension */
+#define SBI_EXT_DBCN_CONSOLE_WRITE      0x0
+#define SBI_EXT_DBCN_CONSOLE_READ       0x1
+#define SBI_EXT_DBCN_CONSOLE_WRITE_BYTE 0x2
+
 #define SBI_HSM_HART_STATUS_STARTED     0x0
 #define SBI_HSM_HART_STATUS_STOPPED     0x1
 #define SBI_HSM_HART_STATUS_START_PENDING   0x2
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static KVMCPUConfig kvm_v_vlenb = {
                    KVM_REG_RISCV_VECTOR_CSR_REG(vlenb)
 };
 
+static KVMCPUConfig kvm_sbi_dbcn = {
+    .name = "sbi_dbcn",
+    .kvm_reg_id = KVM_REG_RISCV | KVM_REG_SIZE_U64 |
+                  KVM_REG_RISCV_SBI_EXT | KVM_RISCV_SBI_EXT_DBCN
+};
+
 static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
 {
     CPURISCVState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ static int uint64_cmp(const void *a, const void *b)
     return 0;
 }
 
+static void kvm_riscv_check_sbi_dbcn_support(RISCVCPU *cpu,
+                                             KVMScratchCPU *kvmcpu,
+                                             struct kvm_reg_list *reglist)
+{
+    struct kvm_reg_list *reg_search;
+
+    reg_search = bsearch(&kvm_sbi_dbcn.kvm_reg_id, reglist->reg, reglist->n,
+                         sizeof(uint64_t), uint64_cmp);
+
+    if (reg_search) {
+        kvm_sbi_dbcn.supported = true;
+    }
+}
+
 static void kvm_riscv_read_vlenb(RISCVCPU *cpu, KVMScratchCPU *kvmcpu,
                                  struct kvm_reg_list *reglist)
 {
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_init_multiext_cfg(RISCVCPU *cpu, KVMScratchCPU *kvmcpu)
     if (riscv_has_ext(&cpu->env, RVV)) {
         kvm_riscv_read_vlenb(cpu, kvmcpu, reglist);
     }
+
+    kvm_riscv_check_sbi_dbcn_support(cpu, kvmcpu, reglist);
 }
 
 static void riscv_init_kvm_registers(Object *cpu_obj)
@@ -XXX,XX +XXX,XX @@ static int kvm_vcpu_set_machine_ids(RISCVCPU *cpu, CPUState *cs)
     return ret;
 }
 
+static int kvm_vcpu_enable_sbi_dbcn(RISCVCPU *cpu, CPUState *cs)
+{
+    target_ulong reg = 1;
+
+    if (!kvm_sbi_dbcn.supported) {
+        return 0;
+    }
+
+    return kvm_set_one_reg(cs, kvm_sbi_dbcn.kvm_reg_id, &reg);
+}
+
 int kvm_arch_init_vcpu(CPUState *cs)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
     kvm_riscv_update_cpu_misa_ext(cpu, cs);
     kvm_riscv_update_cpu_cfg_isa_ext(cpu, cs);
 
+    ret = kvm_vcpu_enable_sbi_dbcn(cpu, cs);
+
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
     return true;
 }
 
+static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
+{
+    g_autofree uint8_t *buf = NULL;
+    RISCVCPU *cpu = RISCV_CPU(cs);
+    target_ulong num_bytes;
+    uint64_t addr;
+    unsigned char ch;
+    int ret;
+
+    switch (run->riscv_sbi.function_id) {
+    case SBI_EXT_DBCN_CONSOLE_READ:
+    case SBI_EXT_DBCN_CONSOLE_WRITE:
+        num_bytes = run->riscv_sbi.args[0];
+
+        if (num_bytes == 0) {
+            run->riscv_sbi.ret[0] = SBI_SUCCESS;
+            run->riscv_sbi.ret[1] = 0;
+            break;
+        }
+
+        addr = run->riscv_sbi.args[1];
+
+        /*
+         * Handle the case where a 32 bit CPU is running in a
+         * 64 bit addressing env.
+         */
+        if (riscv_cpu_mxl(&cpu->env) == MXL_RV32) {
+            addr |= (uint64_t)run->riscv_sbi.args[2] << 32;
+        }
+
+        buf = g_malloc0(num_bytes);
+
+        if (run->riscv_sbi.function_id == SBI_EXT_DBCN_CONSOLE_READ) {
+            ret = qemu_chr_fe_read_all(serial_hd(0)->be, buf, num_bytes);
+            if (ret < 0) {
+                error_report("SBI_EXT_DBCN_CONSOLE_READ: error when "
+                             "reading chardev");
+                exit(1);
+            }
+
+            cpu_physical_memory_write(addr, buf, ret);
+        } else {
+            cpu_physical_memory_read(addr, buf, num_bytes);
+
+            ret = qemu_chr_fe_write_all(serial_hd(0)->be, buf, num_bytes);
+            if (ret < 0) {
+                error_report("SBI_EXT_DBCN_CONSOLE_WRITE: error when "
+                             "writing chardev");
+                exit(1);
+            }
+        }
+
+        run->riscv_sbi.ret[0] = SBI_SUCCESS;
+        run->riscv_sbi.ret[1] = ret;
+        break;
+    case SBI_EXT_DBCN_CONSOLE_WRITE_BYTE:
+        ch = run->riscv_sbi.args[0];
+        ret = qemu_chr_fe_write(serial_hd(0)->be, &ch, sizeof(ch));
+
+        if (ret < 0) {
+            error_report("SBI_EXT_DBCN_CONSOLE_WRITE_BYTE: error when "
+                         "writing chardev");
+            exit(1);
+        }
+
+        run->riscv_sbi.ret[0] = SBI_SUCCESS;
+        run->riscv_sbi.ret[1] = 0;
+        break;
+    default:
+        run->riscv_sbi.ret[0] = SBI_ERR_NOT_SUPPORTED;
+    }
+}
+
 static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
 {
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
         }
         ret = 0;
         break;
+    case SBI_EXT_DBCN:
+        kvm_riscv_handle_sbi_dbcn(cs, run);
+        break;
     default:
         qemu_log_mask(LOG_UNIMP,
                       "%s: un-handled SBI EXIT, specific reasons is %lu\n",
-- 
2.45.1

From: Cheng Yang <yangcheng.work@foxmail.com>

Use qemu_fdt_setprop_u64() instead of qemu_fdt_setprop_cell()
to set the address of initrd in FDT to support 64-bit address.

Signed-off-by: Cheng Yang <yangcheng.work@foxmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <tencent_A4482251DD0890F312758FA6B33F60815609@qq.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/boot.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@ static void riscv_load_initrd(MachineState *machine, uint64_t kernel_entry)
     /* Some RISC-V machines (e.g. opentitan) don't have a fdt. */
     if (fdt) {
         end = start + size;
-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start", start);
-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end", end);
+        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-start", start);
+        qemu_fdt_setprop_u64(fdt, "/chosen", "linux,initrd-end", end);
     }
 }
 
-- 
2.45.1

From: Clément Léger <cleger@rivosinc.com>

The current semihost exception number (16) is a reserved number (range
[16-17]). The upcoming double trap specification uses that number for
the double trap exception. Since the privileged spec (Table 22) defines
ranges for custom uses change the semihosting exception number to 63
which belongs to the range [48-63] in order to avoid any future
collisions with reserved exception.

Signed-off-by: Clément Léger <cleger@rivosinc.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240422135840.1959967-1-cleger@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
     RISCV_EXCP_INST_PAGE_FAULT = 0xc, /* since: priv-1.10.0 */
     RISCV_EXCP_LOAD_PAGE_FAULT = 0xd, /* since: priv-1.10.0 */
     RISCV_EXCP_STORE_PAGE_FAULT = 0xf, /* since: priv-1.10.0 */
-    RISCV_EXCP_SEMIHOST = 0x10,
     RISCV_EXCP_INST_GUEST_PAGE_FAULT = 0x14,
     RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT = 0x15,
     RISCV_EXCP_VIRT_INSTRUCTION_FAULT = 0x16,
     RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT = 0x17,
+    RISCV_EXCP_SEMIHOST = 0x3f,
 } RISCVException;
 
 #define RISCV_EXCP_INT_FLAG                0x80000000
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Running a KVM guest using a 6.9-rc3 kernel, in a 6.8 host that has zkr
enabled, will fail with a kernel oops SIGILL right at the start. The
reason is that we can't expose zkr without implementing the SEED CSR.
Disabling zkr in the guest would be a workaround, but if the KVM doesn't
allow it we'll error out and never boot.

In hindsight this is too strict. If we keep proceeding, despite not
disabling the extension in the KVM vcpu, we'll not add the extension in
the riscv,isa. The guest kernel will be unaware of the extension, i.e.
it doesn't matter if the KVM vcpu has it enabled underneath or not. So
it's ok to keep booting in this case.

Change our current logic to not error out if we fail to disable an
extension in kvm_set_one_reg(), but show a warning and keep booting. It
is important to throw a warning because we must make the user aware that
the extension is still available in the vcpu, meaning that an
ill-behaved guest can ignore the riscv,isa settings and  use the
extension.

The case we're handling happens with an EINVAL error code. If we fail to
disable the extension in KVM for any other reason, error out.

We'll also keep erroring out when we fail to enable an extension in KVM,
since adding the extension in riscv,isa at this point will cause a guest
malfunction because the extension isn't enabled in the vcpu.

Suggested-by: Andrew Jones <ajones@ventanamicro.com>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240422171425.333037-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ static void kvm_riscv_update_cpu_cfg_isa_ext(RISCVCPU *cpu, CPUState *cs)
         reg = kvm_cpu_cfg_get(cpu, multi_ext_cfg);
         ret = kvm_set_one_reg(cs, id, &reg);
         if (ret != 0) {
-            error_report("Unable to %s extension %s in KVM, error %d",
-                         reg ? "enable" : "disable",
-                         multi_ext_cfg->name, ret);
-            exit(EXIT_FAILURE);
+            if (!reg && ret == -EINVAL) {
+                warn_report("KVM cannot disable extension %s",
+                            multi_ext_cfg->name);
+            } else {
+                error_report("Unable to enable extension %s in KVM, error %d",
+                             multi_ext_cfg->name, ret);
+                exit(EXIT_FAILURE);
+            }
         }
     }
 }
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

We're not setting (s/m)tval when triggering breakpoints of type 2
(mcontrol) and 6 (mcontrol6). According to the debug spec section
5.7.12, "Match Control Type 6":

"The Privileged Spec says that breakpoint exceptions that occur on
instruction fetches, loads, or stores update the tval CSR with either
zero or the faulting virtual address. The faulting virtual address for
an mcontrol6 trigger with action = 0 is the address being accessed and
which caused that trigger to fire."

A similar text is also found in the Debug spec section 5.7.11 w.r.t.
mcontrol.

Note that what we're doing ATM is not violating the spec, but it's
simple enough to set mtval/stval and it makes life easier for any
software that relies on this info.

Given that we always use action = 0, save the faulting address for the
mcontrol and mcontrol6 trigger breakpoints into env->badaddr, which is
used as as scratch area for traps with address information. 'tval' is
then set during riscv_cpu_do_interrupt().

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20240416230437.1869024-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 1 +
 target/riscv/debug.c      | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_do_interrupt(CPUState *cs)
             tval = env->bins;
             break;
         case RISCV_EXCP_BREAKPOINT:
+            tval = env->badaddr;
             if (cs->watchpoint_hit) {
                 tval = cs->watchpoint_hit->hitaddr;
                 cs->watchpoint_hit = NULL;
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
                     /* check U/S/M bit against current privilege level */
                     if ((ctrl >> 3) & BIT(env->priv)) {
+                        env->badaddr = pc;
                         return true;
                     }
                 }
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
                     if (env->virt_enabled) {
                         /* check VU/VS bit against current privilege level */
                         if ((ctrl >> 23) & BIT(env->priv)) {
+                            env->badaddr = pc;
                             return true;
                         }
                     } else {
                         /* check U/S/M bit against current privilege level */
                         if ((ctrl >> 3) & BIT(env->priv)) {
+                            env->badaddr = pc;
                             return true;
                         }
                     }
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Privileged spec section 4.1.9 mentions:

"When a trap is taken into S-mode, stval is written with
exception-specific information to assist software in handling the trap.
(...)

If stval is written with a nonzero value when a breakpoint,
address-misaligned, access-fault, or page-fault exception occurs on an
instruction fetch, load, or store, then stval will contain the faulting
virtual address."

A similar text is found for mtval in section 3.1.16.

Setting mtval/stval in this scenario is optional, but some softwares read
these regs when handling ebreaks.

Write 'badaddr' in all ebreak breakpoints to write the appropriate
'tval' during riscv_do_cpu_interrrupt().

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240416230437.1869024-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_privileged.c.inc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_ebreak(DisasContext *ctx, arg_ebreak *a)
     if (pre == 0x01f01013 && ebreak == 0x00100073 && post == 0x40705013) {
         generate_exception(ctx, RISCV_EXCP_SEMIHOST);
     } else {
+        tcg_gen_st_tl(tcg_constant_tl(ebreak_addr), tcg_env,
+                      offsetof(CPURISCVState, badaddr));
         generate_exception(ctx, RISCV_EXCP_BREAKPOINT);
     }
     return true;
-- 
2.45.1

From: Jason Chien <jason.chien@sifive.com>

Add support for Zve32x extension and replace some checks for Zve32f with
Zve32x, since Zve32f depends on Zve32x.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240328022343.6871-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                  |  1 +
 target/riscv/cpu.c                      |  2 ++
 target/riscv/cpu_helper.c               |  2 +-
 target/riscv/csr.c                      |  2 +-
 target/riscv/tcg/tcg-cpu.c              | 16 ++++++++--------
 target/riscv/insn_trans/trans_rvv.c.inc |  4 ++--
 6 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zhinx;
     bool ext_zhinxmin;
     bool ext_zve32f;
+    bool ext_zve32x;
     bool ext_zve64f;
     bool ext_zve64d;
     bool ext_zvbb;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVIsaExtData isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
+    ISA_EXT_DATA_ENTRY(zve32x, PRIV_VERSION_1_10_0, ext_zve32x),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
     ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
     MULTI_EXT_CFG_BOOL("zfhmin", ext_zfhmin, false),
     MULTI_EXT_CFG_BOOL("zve32f", ext_zve32f, false),
+    MULTI_EXT_CFG_BOOL("zve32x", ext_zve32x, false),
     MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
     MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
     MULTI_EXT_CFG_BOOL("zvfbfmin", ext_zvfbfmin, false),
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
     *pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc;
     *cs_base = 0;
 
-    if (cpu->cfg.ext_zve32f) {
+    if (cpu->cfg.ext_zve32x) {
         /*
          * If env->vl equals to VLMAX, we can use generic vector operation
          * expanders (GVEC) to accerlate the vector operations.
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException fs(CPURISCVState *env, int csrno)
 
 static RISCVException vs(CPURISCVState *env, int csrno)
 {
-    if (riscv_cpu_cfg(env)->ext_zve32f) {
+    if (riscv_cpu_cfg(env)->ext_zve32x) {
 #if !defined(CONFIG_USER_ONLY)
         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
             return RISCV_EXCP_ILLEGAL_INST;
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (cpu->cfg.ext_zve32f && !riscv_has_ext(env, RVF)) {
-        error_setg(errp, "Zve32f/Zve64f extensions require F extension");
-        return;
+    /* The Zve32f extension depends on the Zve32x extension */
+    if (cpu->cfg.ext_zve32f) {
+        if (!riscv_has_ext(env, RVF)) {
+            error_setg(errp, "Zve32f/Zve64f extensions require F extension");
+            return;
+        }
+        cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zve32x), true);
     }
 
     if (cpu->cfg.ext_zvfh) {
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         cpu_cfg_ext_auto_update(cpu, CPU_CFG_OFFSET(ext_zvbc), true);
     }
 
-    /*
-     * In principle Zve*x would also suffice here, were they supported
-     * in qemu
-     */
     if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkb || cpu->cfg.ext_zvkg ||
          cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksed ||
-         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
+         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32x) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
 {
     TCGv s1, dst;
 
-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
+    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
 {
     TCGv dst;
 
-    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32f) {
+    if (!require_rvv(s) || !s->cfg_ptr->ext_zve32x) {
         return false;
     }
 
-- 
2.45.1

From: Jason Chien <jason.chien@sifive.com>

Add support for Zve64x extension. Enabling Zve64f enables Zve64x and
enabling Zve64x enables Zve32x according to their dependency.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2107
Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240328022343.6871-3-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h     |  1 +
 target/riscv/cpu.c         |  2 ++
 target/riscv/tcg/tcg-cpu.c | 17 +++++++++++------
 3 files changed, 14 insertions(+), 6 deletions(-)

From: Jason Chien <jason.chien@sifive.com>

In current implementation, the gdbstub allows reading vector registers
only if V extension is supported. However, all vector extensions and
vector crypto extensions have the vector registers and they all depend
on Zve32x. The gdbstub should check for Zve32x instead.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Message-ID: <20240328022343.6871-4-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/gdbstub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_register_gdb_regs_for_features(CPUState *cs)
                                  gdb_find_static_feature("riscv-32bit-fpu.xml"),
                                  0);
     }
-    if (env->misa_ext & RVV) {
+    if (cpu->cfg.ext_zve32x) {
         gdb_register_coprocessor(cs, riscv_gdb_get_vector,
                                  riscv_gdb_set_vector,
                                  ricsv_gen_dynamic_vector_feature(cs, cs->gdb_num_regs),
-- 
2.45.1

From: Huang Tao <eric.huang@linux.alibaba.com>

In RVV and vcrypto instructions, the masked and tail elements are set to 1s
using vext_set_elems_1s function if the vma/vta bit is set. It is the element
agnostic policy.

However, this function can't deal the big endian situation. This patch fixes
the problem by adding handling of such case.

Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240325021654.6594-1-eric.huang@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_internals.c
+++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
     if (tot - cnt == 0) {
         return ;
     }
+
+    if (HOST_BIG_ENDIAN) {
+        /*
+         * Deal the situation when the elements are insdie
+         * only one uint64 block including setting the
+         * masked-off element.
+         */
+        if (((tot - 1) ^ cnt) < 8) {
+            memset(base + H1(tot - 1), -1, tot - cnt);
+            return;
+        }
+        /*
+         * Otherwise, at least cross two uint64_t blocks.
+         * Set first unaligned block.
+         */
+        if (cnt % 8 != 0) {
+            uint32_t j = ROUND_UP(cnt, 8);
+            memset(base + H1(j - 1), -1, j - cnt);
+            cnt = j;
+        }
+        /* Set other 64bit aligend blocks */
+    }
     memset(base + cnt, -1, tot - cnt);
 }
 
-- 
2.45.1

From: Yangyu Chen <cyy@cyyself.name>

This code has a typo that writes zvkb to zvkg, causing users can't
enable zvkb through the config. This patch gets this fixed.

Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Fixes: ea61ef7097d0 ("target/riscv: Move vector crypto extensions to riscv_cpu_extensions")
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Max Chou <max.chou@sifive.com>
Reviewed-by:  Weiwei Li <liwei1518@gmail.com>
Message-ID: <tencent_7E34EEF0F90B9A68BF38BEE09EC6D4877C0A@qq.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
     /* Vector cryptography extensions */
     MULTI_EXT_CFG_BOOL("zvbb", ext_zvbb, false),
     MULTI_EXT_CFG_BOOL("zvbc", ext_zvbc, false),
-    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkg, false),
+    MULTI_EXT_CFG_BOOL("zvkb", ext_zvkb, false),
     MULTI_EXT_CFG_BOOL("zvkg", ext_zvkg, false),
     MULTI_EXT_CFG_BOOL("zvkned", ext_zvkned, false),
     MULTI_EXT_CFG_BOOL("zvknha", ext_zvknha, false),
-- 
2.45.1

From: Huang Tao <eric.huang@linux.alibaba.com>

In this patch, we modify the decoder to be a freely composable data
structure instead of a hardcoded one. It can be dynamically builded up
according to the extensions.
This approach has several benefits:
1. Provides support for heterogeneous cpu architectures. As we add decoder in
   RISCVCPU, each cpu can have their own decoder, and the decoders can be
   different due to cpu's features.
2. Improve the decoding efficiency. We run the guard_func to see if the decoder
   can be added to the dynamic_decoder when building up the decoder. Therefore,
   there is no need to run the guard_func when decoding each instruction. It can
   improve the decoding efficiency
3. For vendor or dynamic cpus, it allows them to customize their own decoder
   functions to improve decoding efficiency, especially when vendor-defined
   instruction sets increase. Because of dynamic building up, it can skip the other
   decoder guard functions when decoding.
4. Pre patch for allowing adding a vendor decoder before decode_insn32() with minimal
   overhead for users that don't need this particular vendor decoder.

Signed-off-by: Huang Tao <eric.huang@linux.alibaba.com>
Suggested-by: Christoph Muellner <christoph.muellner@vrull.eu>
Co-authored-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240506023607.29544-1-eric.huang@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h         |  1 +
 target/riscv/tcg/tcg-cpu.h | 15 +++++++++++++++
 target/riscv/cpu.c         |  1 +
 target/riscv/tcg/tcg-cpu.c | 15 +++++++++++++++
 target/riscv/translate.c   | 31 +++++++++++++++----------------
 5 files changed, 47 insertions(+), 16 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
     uint32_t pmu_avail_ctrs;
     /* Mapping of events to counters */
     GHashTable *pmu_event_ctr_map;
+    const GPtrArray *decoders;
 };
 
 /**
diff --git a/target/riscv/tcg/tcg-cpu.h b/target/riscv/tcg/tcg-cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.h
+++ b/target/riscv/tcg/tcg-cpu.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp);
 void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp);
 bool riscv_cpu_tcg_compatible(RISCVCPU *cpu);
 
+struct DisasContext;
+struct RISCVCPUConfig;
+typedef struct RISCVDecoder {
+    bool (*guard_func)(const struct RISCVCPUConfig *);
+    bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
+} RISCVDecoder;
+
+typedef bool (*riscv_cpu_decode_fn)(struct DisasContext *, uint32_t);
+
+extern const size_t decoder_table_size;
+
+extern const RISCVDecoder decoder_table[];
+
+void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu);
+
 #endif
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
             error_propagate(errp, local_err);
             return;
         }
+        riscv_tcg_cpu_finalize_dynamic_decoder(cpu);
     } else if (kvm_enabled()) {
         riscv_kvm_cpu_finalize_features(cpu, &local_err);
         if (local_err != NULL) {
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ void riscv_tcg_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
     }
 }
 
+void riscv_tcg_cpu_finalize_dynamic_decoder(RISCVCPU *cpu)
+{
+    GPtrArray *dynamic_decoders;
+    dynamic_decoders = g_ptr_array_sized_new(decoder_table_size);
+    for (size_t i = 0; i < decoder_table_size; ++i) {
+        if (decoder_table[i].guard_func &&
+            decoder_table[i].guard_func(&cpu->cfg)) {
+            g_ptr_array_add(dynamic_decoders,
+                            (gpointer)decoder_table[i].riscv_cpu_decode_fn);
+        }
+    }
+
+    cpu->decoders = dynamic_decoders;
+}
+
 bool riscv_cpu_tcg_compatible(RISCVCPU *cpu)
 {
     return object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_CPU_HOST) == NULL;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-info.c.inc"
 #undef  HELPER_H
 
+#include "tcg/tcg-cpu.h"
+
 /* global register indices */
 static TCGv cpu_gpr[32], cpu_gprh[32], cpu_pc, cpu_vl, cpu_vstart;
 static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     /* FRM is known to contain a valid value. */
     bool frm_valid;
     bool insn_start_updated;
+    const GPtrArray *decoders;
 } DisasContext;
 
 static inline bool has_ext(DisasContext *ctx, uint32_t ext)
@@ -XXX,XX +XXX,XX @@ static inline int insn_len(uint16_t first_word)
     return (first_word & 3) == 3 ? 4 : 2;
 }
 
+const RISCVDecoder decoder_table[] = {
+    { always_true_p, decode_insn32 },
+    { has_xthead_p, decode_xthead},
+    { has_XVentanaCondOps_p, decode_XVentanaCodeOps},
+};
+
+const size_t decoder_table_size = ARRAY_SIZE(decoder_table);
+
 static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
 {
-    /*
-     * A table with predicate (i.e., guard) functions and decoder functions
-     * that are tested in-order until a decoder matches onto the opcode.
-     */
-    static const struct {
-        bool (*guard_func)(const RISCVCPUConfig *);
-        bool (*decode_func)(DisasContext *, uint32_t);
-    } decoders[] = {
-        { always_true_p,  decode_insn32 },
-        { has_xthead_p, decode_xthead },
-        { has_XVentanaCondOps_p,  decode_XVentanaCodeOps },
-    };
-
     ctx->virt_inst_excp = false;
     ctx->cur_insn_len = insn_len(opcode);
     /* Check for compressed insn */
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
                                              ctx->base.pc_next + 2));
         ctx->opcode = opcode32;
 
-        for (size_t i = 0; i < ARRAY_SIZE(decoders); ++i) {
-            if (decoders[i].guard_func(ctx->cfg_ptr) &&
-                decoders[i].decode_func(ctx, opcode32)) {
+        for (guint i = 0; i < ctx->decoders->len; ++i) {
+            riscv_cpu_decode_fn func = g_ptr_array_index(ctx->decoders, i);
+            if (func(ctx, opcode32)) {
                 return;
             }
         }
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
     ctx->zero = tcg_constant_tl(0);
     ctx->virt_inst_excp = false;
+    ctx->decoders = cpu->decoders;
 }
 
 static void riscv_tr_tb_start(DisasContextBase *db, CPUState *cpu)
-- 
2.45.1

From: Christoph Müllner <christoph.muellner@vrull.eu>

The th.sxstatus CSR can be used to identify available custom extension
on T-Head CPUs. The CSR is documented here:
  https://github.com/T-head-Semi/thead-extension-spec/blob/master/xtheadsxstatus.adoc

An important property of this patch is, that the th.sxstatus MAEE field
is not set (indicating that XTheadMae is not available).
XTheadMae is a memory attribute extension (similar to Svpbmt) which is
implemented in many T-Head CPUs (C906, C910, etc.) and utilizes bits
in PTEs that are marked as reserved. QEMU maintainers prefer to not
implement XTheadMae, so we need give kernels a mechanism to identify
if XTheadMae is available in a system or not. And this patch introduces
this mechanism in QEMU in a way that's compatible with real HW
(i.e., probing the th.sxstatus.MAEE bit).

Further context can be found on the list:
https://lists.gnu.org/archive/html/qemu-devel/2024-02/msg00775.html

Reviewed-by: LIU Zhiwei <zhiwe_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Message-ID: <20240429073656.2486732-1-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 MAINTAINERS              |  1 +
 target/riscv/cpu.h       |  3 ++
 target/riscv/cpu.c       |  1 +
 target/riscv/th_csr.c    | 79 ++++++++++++++++++++++++++++++++++++++++
 target/riscv/meson.build |  1 +
 5 files changed, 85 insertions(+)
 create mode 100644 target/riscv/th_csr.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ L: qemu-riscv@nongnu.org
 S: Supported
 F: target/riscv/insn_trans/trans_xthead.c.inc
 F: target/riscv/xthead*.decode
+F: target/riscv/th_*
 F: disas/riscv-xthead*
 
 RISC-V XVentanaCondOps extension
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ target_ulong riscv_new_csr_seed(target_ulong new_value,
 uint8_t satp_mode_max_from_map(uint32_t map);
 const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit);
 
+/* Implemented in th_csr.c */
+void th_register_custom_csrs(RISCVCPU *cpu);
+
 #endif /* RISCV_CPU_H */
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rv64_thead_c906_cpu_init(Object *obj)
     cpu->cfg.mvendorid = THEAD_VENDOR_ID;
 #ifndef CONFIG_USER_ONLY
     set_satp_mode_max_supported(cpu, VM_1_10_SV39);
+    th_register_custom_csrs(cpu);
 #endif
 
     /* inherited from parent obj via riscv_cpu_init() */
diff --git a/target/riscv/th_csr.c b/target/riscv/th_csr.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/th_csr.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * T-Head-specific CSRs.
+ *
+ * Copyright (c) 2024 VRULL GmbH
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "cpu_vendorid.h"
+
+#define CSR_TH_SXSTATUS 0x5c0
+
+/* TH_SXSTATUS bits */
+#define TH_SXSTATUS_UCME        BIT(16)
+#define TH_SXSTATUS_MAEE        BIT(21)
+#define TH_SXSTATUS_THEADISAEE  BIT(22)
+
+typedef struct {
+    int csrno;
+    int (*insertion_test)(RISCVCPU *cpu);
+    riscv_csr_operations csr_ops;
+} riscv_csr;
+
+static RISCVException smode(CPURISCVState *env, int csrno)
+{
+    if (riscv_has_ext(env, RVS)) {
+        return RISCV_EXCP_NONE;
+    }
+
+    return RISCV_EXCP_ILLEGAL_INST;
+}
+
+static int test_thead_mvendorid(RISCVCPU *cpu)
+{
+    if (cpu->cfg.mvendorid != THEAD_VENDOR_ID) {
+        return -1;
+    }
+
+    return 0;
+}
+
+static RISCVException read_th_sxstatus(CPURISCVState *env, int csrno,
+                                       target_ulong *val)
+{
+    /* We don't set MAEE here, because QEMU does not implement MAEE. */
+    *val = TH_SXSTATUS_UCME | TH_SXSTATUS_THEADISAEE;
+    return RISCV_EXCP_NONE;
+}
+
+static riscv_csr th_csr_list[] = {
+    {
+        .csrno = CSR_TH_SXSTATUS,
+        .insertion_test = test_thead_mvendorid,
+        .csr_ops = { "th.sxstatus", smode, read_th_sxstatus }
+    }
+};
+
+void th_register_custom_csrs(RISCVCPU *cpu)
+{
+    for (size_t i = 0; i < ARRAY_SIZE(th_csr_list); i++) {
+        int csrno = th_csr_list[i].csrno;
+        riscv_csr_operations *csr_ops = &th_csr_list[i].csr_ops;
+        if (!th_csr_list[i].insertion_test(cpu)) {
+            riscv_set_csr_ops(csrno, csr_ops);
+        }
+    }
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_system_ss.add(files(
   'monitor.c',
   'machine.c',
   'pmu.c',
+  'th_csr.c',
   'time_helper.c',
   'riscv-qmp-cmds.c',
 ))
-- 
2.45.1

From: Max Chou <max.chou@sifive.com>

According v spec 18.4, only the vfwcvt.f.f.v and vfncvt.f.f.w
instructions will be affected by Zvfhmin extension.
And the vfwcvt.f.f.v and vfncvt.f.f.w instructions only support the
conversions of

* From 1*SEW(16/32) to 2*SEW(32/64)
* From 2*SEW(32/64) to 1*SEW(16/32)

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240322092600.1198921-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

From: Max Chou <max.chou@sifive.com>

The require_scale_rvf function only checks the double width operator for
the vector floating point widen instructions, so most of the widen
checking functions need to add require_rvf for single width operator.

The vfwcvt.f.x.v and vfwcvt.f.xu.v instructions convert single width
integer to double width float, so the opfxv_widen_check function doesn’t
need require_rvf for the single width operator(integer).

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240322092600.1198921-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 5 +++++
 1 file changed, 5 insertions(+)

From: Max Chou <max.chou@sifive.com>

If the checking functions check both the single and double width
operators at the same time, then the single width operator checking
functions (require_rvf[min]) will check whether the SEW is 8.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240322092600.1198921-5-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool opfvv_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_dss(s, a->rd, a->rs1, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opfvf_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_ds(s, a->rd, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opfwv_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_dds(s, a->rd, a->rs1, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opfwf_widen_check(DisasContext *s, arg_rmrr *a)
     return require_rvv(s) &&
            require_rvf(s) &&
            require_scale_rvf(s) &&
-           (s->sew != MO_8) &&
            vext_check_isa_ill(s) &&
            vext_check_dd(s, a->rd, a->rs2, a->vm);
 }
@@ -XXX,XX +XXX,XX @@ static bool opffv_widen_check(DisasContext *s, arg_rmr *a)
 {
     return opfv_widen_check(s, a) &&
            require_rvfmin(s) &&
-           require_scale_rvfmin(s) &&
-           (s->sew != MO_8);
+           require_scale_rvfmin(s);
 }
 
 #define GEN_OPFV_WIDEN_TRANS(NAME, CHECK, HELPER, FRM)             \
@@ -XXX,XX +XXX,XX @@ static bool opffv_narrow_check(DisasContext *s, arg_rmr *a)
 {
     return opfv_narrow_check(s, a) &&
            require_rvfmin(s) &&
-           require_scale_rvfmin(s) &&
-           (s->sew != MO_8);
+           require_scale_rvfmin(s);
 }
 
 static bool opffv_rod_narrow_check(DisasContext *s, arg_rmr *a)
 {
     return opfv_narrow_check(s, a) &&
            require_rvf(s) &&
-           require_scale_rvf(s) &&
-           (s->sew != MO_8);
+           require_scale_rvf(s);
 }
 
 #define GEN_OPFV_NARROW_TRANS(NAME, CHECK, HELPER, FRM)            \
@@ -XXX,XX +XXX,XX @@ static bool freduction_widen_check(DisasContext *s, arg_rmrr *a)
 {
     return reduction_widen_check(s, a) &&
            require_rvf(s) &&
-           require_scale_rvf(s) &&
-           (s->sew != MO_8);
+           require_scale_rvf(s);
 }
 
 GEN_OPFVV_WIDEN_TRANS(vfwredusum_vs, freduction_widen_check)
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

raise_mmu_exception(), as is today, is prioritizing guest page faults by
checking first if virt_enabled && !first_stage, and then considering the
regular inst/load/store faults.

There's no mention in the spec about guest page fault being a higher
priority that PMP faults. In fact, privileged spec section 3.7.1 says:

"Attempting to fetch an instruction from a PMP region that does not have
execute permissions raises an instruction access-fault exception.
Attempting to execute a load or load-reserved instruction which accesses
a physical address within a PMP region without read permissions raises a
load access-fault exception. Attempting to execute a store,
store-conditional, or AMO instruction which accesses a physical address
within a PMP region without write permissions raises a store
access-fault exception."

So, in fact, we're doing it wrong - PMP faults should always be thrown,
regardless of also being a first or second stage fault.

The way riscv_cpu_tlb_fill() and get_physical_address() work is
adequate: a TRANSLATE_PMP_FAIL error is immediately reported and
reflected in the 'pmp_violation' flag. What we need is to change
raise_mmu_exception() to prioritize it.

Reported-by: Joseph Chan <jchan@ventanamicro.com>
Fixes: 82d53adfbb ("target/riscv/cpu_helper.c: Invalid exception on MMU translation stage")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240413105929.7030-1-alexei.filippov@syntacore.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
 
     switch (access_type) {
     case MMU_INST_FETCH:
-        if (env->virt_enabled && !first_stage) {
+        if (pmp_violation) {
+            cs->exception_index = RISCV_EXCP_INST_ACCESS_FAULT;
+        } else if (env->virt_enabled && !first_stage) {
             cs->exception_index = RISCV_EXCP_INST_GUEST_PAGE_FAULT;
         } else {
-            cs->exception_index = pmp_violation ?
-                RISCV_EXCP_INST_ACCESS_FAULT : RISCV_EXCP_INST_PAGE_FAULT;
+            cs->exception_index = RISCV_EXCP_INST_PAGE_FAULT;
         }
         break;
     case MMU_DATA_LOAD:
-        if (two_stage && !first_stage) {
+        if (pmp_violation) {
+            cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT;
+        } else if (two_stage && !first_stage) {
             cs->exception_index = RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT;
         } else {
-            cs->exception_index = pmp_violation ?
-                RISCV_EXCP_LOAD_ACCESS_FAULT : RISCV_EXCP_LOAD_PAGE_FAULT;
+            cs->exception_index = RISCV_EXCP_LOAD_PAGE_FAULT;
         }
         break;
     case MMU_DATA_STORE:
-        if (two_stage && !first_stage) {
+        if (pmp_violation) {
+            cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
+        } else if (two_stage && !first_stage) {
             cs->exception_index = RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT;
         } else {
-            cs->exception_index = pmp_violation ?
-                RISCV_EXCP_STORE_AMO_ACCESS_FAULT :
-                RISCV_EXCP_STORE_PAGE_FAULT;
+            cs->exception_index = RISCV_EXCP_STORE_PAGE_FAULT;
         }
         break;
     default:
-- 
2.45.1

From: Alexei Filippov <alexei.filippov@syntacore.com>

Previous patch fixed the PMP priority in raise_mmu_exception() but we're still
setting mtval2 incorrectly. In riscv_cpu_tlb_fill(), after pmp check in 2 stage
translation part, mtval2 will be set in case of successes 2 stage translation but
failed pmp check.

In this case we gonna set mtval2 via env->guest_phys_fault_addr in context of
riscv_cpu_tlb_fill(), as this was a guest-page-fault, but it didn't and mtval2
should be zero, according to RISCV privileged spec sect. 9.4.4: When a guest
page-fault is taken into M-mode, mtval2 is written with either zero or guest
physical address that faulted, shifted by 2 bits. *For other traps, mtval2
is set to zero...*

Signed-off-by: Alexei Filippov <alexei.filippov@syntacore.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240503103052.6819-1-alexei.filippov@syntacore.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                               __func__, pa, ret, prot_pmp, tlb_size);
 
                 prot &= prot_pmp;
-            }
-
-            if (ret != TRANSLATE_SUCCESS) {
+            } else {
                 /*
                  * Guest physical address translation failed, this is a HS
                  * level exception
                  */
                 first_stage_error = false;
-                env->guest_phys_fault_addr = (im_address |
-                                              (address &
-                                               (TARGET_PAGE_SIZE - 1))) >> 2;
+                if (ret != TRANSLATE_PMP_FAIL) {
+                    env->guest_phys_fault_addr = (im_address |
+                                                  (address &
+                                                   (TARGET_PAGE_SIZE - 1))) >> 2;
+                }
             }
         }
     } else {
-- 
2.45.1

From: Rob Bradford <rbradford@rivosinc.com>

This extension has now been ratified:
https://jira.riscv.org/browse/RVS-2006 so the "x-" prefix can be
removed.

Since this is now a ratified extension add it to the list of extensions
included in the "max" CPU variant.

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Message-ID: <20240514110217.22516-1-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c         | 2 +-
 target/riscv/tcg/tcg-cpu.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const MISAExtInfo misa_ext_info_arr[] = {
     MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
     MISA_EXT_INFO(RVV, "v", "Vector operations"),
     MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
-    MISA_EXT_INFO(RVB, "x-b", "Bit manipulation (Zba_Zbb_Zbs)")
+    MISA_EXT_INFO(RVB, "b", "Bit manipulation (Zba_Zbb_Zbs)")
 };
 
 static void riscv_cpu_validate_misa_mxl(RISCVCPUClass *mcc)
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_init_max_cpu_extensions(Object *obj)
     const RISCVCPUMultiExtConfig *prop;
 
     /* Enable RVG, RVJ and RVV that are disabled by default */
-    riscv_cpu_set_misa_ext(env, env->misa_ext | RVG | RVJ | RVV);
+    riscv_cpu_set_misa_ext(env, env->misa_ext | RVB | RVG | RVJ | RVV);
 
     for (prop = riscv_cpu_extensions; prop && prop->name; prop++) {
         isa_ext_update_enabled(cpu, prop->offset, true);
-- 
2.45.1

From: Alistair Francis <alistair23@gmail.com>

When running the instruction

```
    cbo.flush 0(x0)
```

QEMU would segfault.

The issue was in cpu_gpr[a->rs1] as QEMU does not have cpu_gpr[0]
allocated.

In order to fix this let's use the existing get_address()
helper. This also has the benefit of performing pointer mask
calculations on the address specified in rs1.

The pointer masking specificiation specifically states:

"""
Cache Management Operations: All instructions in Zicbom, Zicbop and Zicboz
"""

So this is the correct behaviour and we previously have been incorrectly
not masking the address.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reported-by: Fabian Thomas <fabian.thomas@cispa.de>
Fixes: e05da09b7cfd ("target/riscv: implement Zicbom extension")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240514023910.301766-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzicbo.c.inc | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvzicbo.c.inc b/target/riscv/insn_trans/trans_rvzicbo.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzicbo.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicbo.c.inc
@@ -XXX,XX +XXX,XX @@
 static bool trans_cbo_clean(DisasContext *ctx, arg_cbo_clean *a)
 {
     REQUIRE_ZICBOM(ctx);
-    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_clean_flush(tcg_env, src);
     return true;
 }
 
 static bool trans_cbo_flush(DisasContext *ctx, arg_cbo_flush *a)
 {
     REQUIRE_ZICBOM(ctx);
-    gen_helper_cbo_clean_flush(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_clean_flush(tcg_env, src);
     return true;
 }
 
 static bool trans_cbo_inval(DisasContext *ctx, arg_cbo_inval *a)
 {
     REQUIRE_ZICBOM(ctx);
-    gen_helper_cbo_inval(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_inval(tcg_env, src);
     return true;
 }
 
 static bool trans_cbo_zero(DisasContext *ctx, arg_cbo_zero *a)
 {
     REQUIRE_ZICBOZ(ctx);
-    gen_helper_cbo_zero(tcg_env, cpu_gpr[a->rs1]);
+    TCGv src = get_address(ctx, a->rs1, 0);
+
+    gen_helper_cbo_zero(tcg_env, src);
     return true;
 }
-- 
2.45.1

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

In AIA spec, each hart (or each hart within a group) has a unique hart
number to locate the memory pages of interrupt files in the address
space. The number of bits required to represent any hart number is equal
to ceil(log2(hmax + 1)), where hmax is the largest hart number among
groups.

However, if the largest hart number among groups is a power of 2, QEMU
will pass an inaccurate hart-index-bit setting to Linux. For example, when
the guest OS has 4 harts, only ceil(log2(3 + 1)) = 2 bits are sufficient
to represent 4 harts, but we passes 3 to Linux. The code needs to be
updated to ensure accurate hart-index-bit settings.

Additionally, a Linux patch[1] is necessary to correctly recover the hart
index when the guest OS has only 1 hart, where the hart-index-bit is 0.

[1] https://lore.kernel.org/lkml/20240415064905.25184-1-yongxuan.wang@sifive.com/t/

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240515091129.28116-1-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
         }
     }
 
-    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
+
+    if (max_hart_per_socket > 1) {
+        max_hart_per_socket--;
+        hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
+    } else {
+        hart_bits = 0;
+    }
+
     ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
                             KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
                             &hart_bits, true, NULL);
-- 
2.45.1

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 33a24910ae changed 'reg_width' to use 'vlenb', i.e. vector length
in bytes, when in this context we want 'reg_width' as the length in
bits.

Fix 'reg_width' back to the value in bits like 7cb59921c05a
("target/riscv/gdbstub.c: use 'vlenb' instead of shifting 'vlen'") set
beforehand.

While we're at it, rename 'reg_width' to 'bitsize' to provide a bit more
clarity about what the variable represents. 'bitsize' is also used in
riscv_gen_dynamic_csr_feature() with the same purpose, i.e. as an input to
gdb_feature_builder_append_reg().

Cc: Akihiko Odaki <akihiko.odaki@daynix.com>
Cc: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Robin Dapp <rdapp.gcc@gmail.com>
Fixes: 33a24910ae ("target/riscv: Use GDBFeature for dynamic XML")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240517203054.880861-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/gdbstub.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static GDBFeature *riscv_gen_dynamic_csr_feature(CPUState *cs, int base_reg)
 static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
-    int reg_width = cpu->cfg.vlenb;
+    int bitsize = cpu->cfg.vlenb << 3;
     GDBFeatureBuilder builder;
     int i;
 
@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
 
     /* First define types and totals in a whole VL */
     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
-        int count = reg_width / vec_lanes[i].size;
+        int count = bitsize / vec_lanes[i].size;
         gdb_feature_builder_append_tag(
             &builder, "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
             vec_lanes[i].id, vec_lanes[i].gdb_type, count);
@@ -XXX,XX +XXX,XX @@ static GDBFeature *ricsv_gen_dynamic_vector_feature(CPUState *cs, int base_reg)
     /* Define vector registers */
     for (i = 0; i < 32; i++) {
         gdb_feature_builder_append_reg(&builder, g_strdup_printf("v%d", i),
-                                       reg_width, i, "riscv_vector", "vector");
+                                       bitsize, i, "riscv_vector", "vector");
     }
 
     gdb_feature_builder_end(&builder);
-- 
2.45.1

From: Alistair Francis <alistair23@gmail.com>

Previously we only listed a single pmpcfg CSR and the first 16 pmpaddr
CSRs. This patch fixes this to list all 16 pmpcfg and all 64 pmpaddr
CSRs are part of the disassembly.

Reported-by: Eric DeVolder <eric_devolder@yahoo.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Fixes: ea10325917 ("RISC-V Disassembler")
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Message-ID: <20240514051615.330979-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 disas/riscv.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 64 insertions(+), 1 deletion(-)

diff --git a/disas/riscv.c b/disas/riscv.c
index XXXXXXX..XXXXXXX 100644
--- a/disas/riscv.c
+++ b/disas/riscv.c
@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
     case 0x0383: return "mibound";
     case 0x0384: return "mdbase";
     case 0x0385: return "mdbound";
-    case 0x03a0: return "pmpcfg3";
+    case 0x03a0: return "pmpcfg0";
+    case 0x03a1: return "pmpcfg1";
+    case 0x03a2: return "pmpcfg2";
+    case 0x03a3: return "pmpcfg3";
+    case 0x03a4: return "pmpcfg4";
+    case 0x03a5: return "pmpcfg5";
+    case 0x03a6: return "pmpcfg6";
+    case 0x03a7: return "pmpcfg7";
+    case 0x03a8: return "pmpcfg8";
+    case 0x03a9: return "pmpcfg9";
+    case 0x03aa: return "pmpcfg10";
+    case 0x03ab: return "pmpcfg11";
+    case 0x03ac: return "pmpcfg12";
+    case 0x03ad: return "pmpcfg13";
+    case 0x03ae: return "pmpcfg14";
+    case 0x03af: return "pmpcfg15";
     case 0x03b0: return "pmpaddr0";
     case 0x03b1: return "pmpaddr1";
     case 0x03b2: return "pmpaddr2";
@@ -XXX,XX +XXX,XX @@ static const char *csr_name(int csrno)
     case 0x03bd: return "pmpaddr13";
     case 0x03be: return "pmpaddr14";
     case 0x03bf: return "pmpaddr15";
+    case 0x03c0: return "pmpaddr16";
+    case 0x03c1: return "pmpaddr17";
+    case 0x03c2: return "pmpaddr18";
+    case 0x03c3: return "pmpaddr19";
+    case 0x03c4: return "pmpaddr20";
+    case 0x03c5: return "pmpaddr21";
+    case 0x03c6: return "pmpaddr22";
+    case 0x03c7: return "pmpaddr23";
+    case 0x03c8: return "pmpaddr24";
+    case 0x03c9: return "pmpaddr25";
+    case 0x03ca: return "pmpaddr26";
+    case 0x03cb: return "pmpaddr27";
+    case 0x03cc: return "pmpaddr28";
+    case 0x03cd: return "pmpaddr29";
+    case 0x03ce: return "pmpaddr30";
+    case 0x03cf: return "pmpaddr31";
+    case 0x03d0: return "pmpaddr32";
+    case 0x03d1: return "pmpaddr33";
+    case 0x03d2: return "pmpaddr34";
+    case 0x03d3: return "pmpaddr35";
+    case 0x03d4: return "pmpaddr36";
+    case 0x03d5: return "pmpaddr37";
+    case 0x03d6: return "pmpaddr38";
+    case 0x03d7: return "pmpaddr39";
+    case 0x03d8: return "pmpaddr40";
+    case 0x03d9: return "pmpaddr41";
+    case 0x03da: return "pmpaddr42";
+    case 0x03db: return "pmpaddr43";
+    case 0x03dc: return "pmpaddr44";
+    case 0x03dd: return "pmpaddr45";
+    case 0x03de: return "pmpaddr46";
+    case 0x03df: return "pmpaddr47";
+    case 0x03e0: return "pmpaddr48";
+    case 0x03e1: return "pmpaddr49";
+    case 0x03e2: return "pmpaddr50";
+    case 0x03e3: return "pmpaddr51";
+    case 0x03e4: return "pmpaddr52";
+    case 0x03e5: return "pmpaddr53";
+    case 0x03e6: return "pmpaddr54";
+    case 0x03e7: return "pmpaddr55";
+    case 0x03e8: return "pmpaddr56";
+    case 0x03e9: return "pmpaddr57";
+    case 0x03ea: return "pmpaddr58";
+    case 0x03eb: return "pmpaddr59";
+    case 0x03ec: return "pmpaddr60";
+    case 0x03ed: return "pmpaddr61";
+    case 0x03ee: return "pmpaddr62";
+    case 0x03ef: return "pmpaddr63";
     case 0x0780: return "mtohost";
     case 0x0781: return "mfromhost";
     case 0x0782: return "mreset";
-- 
2.45.1

From: Yu-Ming Chang <yumin686@andestech.com>

Both CSRRS and CSRRC always read the addressed CSR and cause any read side
effects regardless of rs1 and rd fields. Note that if rs1 specifies a register
holding a zero value other than x0, the instruction will still attempt to write
the unmodified value back to the CSR and will cause any attendant side effects.

So if CSRRS or CSRRC tries to write a read-only CSR with rs1 which specifies
a register holding a zero value, an illegal instruction exception should be
raised.

Signed-off-by: Yu-Ming Chang <yumin686@andestech.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240403070823.80897-1-yumin686@andestech.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h       |  4 ++++
 target/riscv/csr.c       | 51 ++++++++++++++++++++++++++++++++++++----
 target/riscv/op_helper.c |  6 ++---
 3 files changed, 53 insertions(+), 8 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc,
 void riscv_cpu_update_mask(CPURISCVState *env);
 bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 
+RISCVException riscv_csrr(CPURISCVState *env, int csrno,
+                          target_ulong *ret_value);
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                            target_ulong *ret_value,
                            target_ulong new_value, target_ulong write_mask);
@@ -XXX,XX +XXX,XX @@ typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
                                           target_ulong new_value,
                                           target_ulong write_mask);
 
+RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
+                               Int128 *ret_value);
 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
                                 Int128 *ret_value,
                                 Int128 new_value, Int128 write_mask);
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException rmw_seed(CPURISCVState *env, int csrno,
 
 static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
                                                int csrno,
-                                               bool write_mask)
+                                               bool write)
 {
     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
     bool read_only = get_field(csrno, 0xC00) == 3;
@@ -XXX,XX +XXX,XX @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
     }
 
     /* read / write check */
-    if (write_mask && read_only) {
+    if (write && read_only) {
         return RISCV_EXCP_ILLEGAL_INST;
     }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+RISCVException riscv_csrr(CPURISCVState *env, int csrno,
+                           target_ulong *ret_value)
+{
+    RISCVException ret = riscv_csrrw_check(env, csrno, false);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
+    return riscv_csrrw_do64(env, csrno, ret_value, 0, 0);
+}
+
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
                            target_ulong *ret_value,
                            target_ulong new_value, target_ulong write_mask)
 {
-    RISCVException ret = riscv_csrrw_check(env, csrno, write_mask);
+    RISCVException ret = riscv_csrrw_check(env, csrno, true);
     if (ret != RISCV_EXCP_NONE) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
+                               Int128 *ret_value)
+{
+    RISCVException ret;
+
+    ret = riscv_csrrw_check(env, csrno, false);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
+    if (csr_ops[csrno].read128) {
+        return riscv_csrrw_do128(env, csrno, ret_value,
+                                 int128_zero(), int128_zero());
+    }
+
+    /*
+     * Fall back to 64-bit version for now, if the 128-bit alternative isn't
+     * at all defined.
+     * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
+     * significant), for those, this fallback is correctly handling the
+     * accesses
+     */
+    target_ulong old_value;
+    ret = riscv_csrrw_do64(env, csrno, &old_value,
+                           (target_ulong)0,
+                           (target_ulong)0);
+    if (ret == RISCV_EXCP_NONE && ret_value) {
+        *ret_value = int128_make64(old_value);
+    }
+    return ret;
+}
+
 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
                                 Int128 *ret_value,
                                 Int128 new_value, Int128 write_mask)
 {
     RISCVException ret;
 
-    ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask));
+    ret = riscv_csrrw_check(env, csrno, true);
     if (ret != RISCV_EXCP_NONE) {
         return ret;
     }
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
     }
 
     target_ulong val = 0;
-    RISCVException ret = riscv_csrrw(env, csr, &val, 0, 0);
+    RISCVException ret = riscv_csrr(env, csr, &val);
 
     if (ret != RISCV_EXCP_NONE) {
         riscv_raise_exception(env, ret, GETPC());
@@ -XXX,XX +XXX,XX @@ target_ulong helper_csrrw(CPURISCVState *env, int csr,
 target_ulong helper_csrr_i128(CPURISCVState *env, int csr)
 {
     Int128 rv = int128_zero();
-    RISCVException ret = riscv_csrrw_i128(env, csr, &rv,
-                                          int128_zero(),
-                                          int128_zero());
+    RISCVException ret = riscv_csrr_i128(env, csr, &rv);
 
     if (ret != RISCV_EXCP_NONE) {
         riscv_raise_exception(env, ret, GETPC());
-- 
2.45.1