Series comparison

 [PULL v2 00/45] riscv-to-apply queue
-From: Alistair Francis <alistair.francis@wdc.com>
+The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:
-The following changes since commit 222059a0fccf4af3be776fe35a5ea2d6a68f9a0b:
+  Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)
   Merge tag 'pull-ppc-20221221' of https://gitlab.com/danielhb/qemu into staging (2022-12-21 18:08:09 +0000)
 are available in the Git repository at:
-  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20221222-1
+  https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230911
-for you to fetch changes up to 71a9bc59728a054036f3db7dd82dab8f8bd2baf9:
+for you to fetch changes up to e7a03409f29e2da59297d55afbaec98c96e43e3a:
-  hw/intc: sifive_plic: Fix the pending register range check (2022-12-22 08:36:30 +1000)
+  target/riscv: don't read CSR in riscv_csrrw_do64 (2023-09-11 11:45:55 +1000)
 ----------------------------------------------------------------
-First RISC-V PR for QEMU 8.0
+First RISC-V PR for 8.2
-* Fix PMP propagation for tlb
+ * Remove 'host' CPU from TCG
-* Collection of bug fixes
+ * riscv_htif Fixup printing on big endian hosts
-* Add the `FIELDx_1CLEAR()` macro
+ * Add zmmul isa string
-* Bump the OpenTitan supported version
+ * Add smepmp isa string
-* Add smstateen support
+ * Fix page_check_range use in fault-only-first
-* Support native debug icount trigger
+ * Use existing lookup tables for MixColumns
-* Remove the redundant ipi-id property in the virt machine
+ * Add RISC-V vector cryptographic instruction set support
-* Support cache-related PMU events in virtual mode
+ * Implement WARL behaviour for mcountinhibit/mcounteren
-* Add some missing PolarFire SoC io regions
+ * Add Zihintntl extension ISA string to DTS
-* Fix mret exception cause when no pmp rule is configured
+ * Fix zfa fleq.d and fltq.d
-* Fix bug where disabling compressed instructions would crash QEMU
+ * Fix upper/lower mtime write calculation
-* Add Zawrs ISA extension support
+ * Make rtc variable names consistent
-* A range of code refactoring and cleanups
+ * Use abi type for linux-user target_ucontext
  * Add RISC-V KVM AIA Support
  * Fix riscv,pmu DT node path in the virt machine
  * Update CSR bits name for svadu extension
  * Mark zicond non-experimental
  * Fix satp_mode_finalize() when satp_mode.supported = 0
  * Fix non-KVM --enable-debug build
  * Add new extensions to hwprobe
  * Use accelerated helper for AES64KS1I
  * Allocate itrigger timers only once
  * Respect mseccfg.RLB for pmpaddrX changes
  * Align the AIA model to v1.0 ratified spec
  * Don't read the CSR in riscv_csrrw_do64
 ----------------------------------------------------------------
-Anup Patel (1):
+Akihiko Odaki (1):
-      target/riscv: Typo fix in sstc() predicate
+      target/riscv: Allocate itrigger timers only once
-Atish Patra (1):
+Ard Biesheuvel (2):
-      hw/riscv: virt: Remove the redundant ipi-id property
+      target/riscv: Use existing lookup tables for MixColumns
       target/riscv: Use accelerated helper for AES64KS1I
-Bin Meng (20):
+Conor Dooley (1):
-      target/riscv: Add some comments for sstatus CSR in riscv_cpu_dump_state()
+      hw/riscv: virt: Fix riscv,pmu DT node path
       target/riscv: Fix mret exception cause when no pmp rule is configured
       target/riscv: Simplify helper_sret() a little bit
       target/riscv: Clear mstatus.MPRV when leaving M-mode for priv spec 1.12+
       hw/riscv: Select MSI_NONBROKEN in SIFIVE_PLIC
       hw/intc: Select MSI_NONBROKEN in RISC-V AIA interrupt controllers
       hw/riscv: Fix opentitan dependency to SIFIVE_PLIC
       hw/riscv: Sort machines Kconfig options in alphabetical order
       hw/riscv: spike: Remove misleading comments
       hw/intc: sifive_plic: Drop PLICMode_H
       hw/intc: sifive_plic: Improve robustness of the PLIC config parser
       hw/intc: sifive_plic: Use error_setg() to propagate the error up via errp in sifive_plic_realize()
       hw/intc: sifive_plic: Update "num-sources" property default value
       hw/riscv: microchip_pfsoc: Fix the number of interrupt sources of PLIC
       hw/riscv: sifive_e: Fix the number of interrupt sources of PLIC
       hw/riscv: sifive_u: Avoid using magic number for "riscv, ndev"
       hw/riscv: virt: Fix the value of "riscv, ndev" in the dtb
       hw/intc: sifive_plic: Change "priority-base" to start from interrupt source 0
       hw/riscv: opentitan: Drop "hartid-base" and "priority-base" initialization
       hw/intc: sifive_plic: Fix the pending register range check
-Christoph Muellner (1):
+Daniel Henrique Barboza (6):
-      RISC-V: Add Zawrs ISA extension support
+      target/riscv/cpu.c: do not run 'host' CPU with TCG
       target/riscv/cpu.c: add zmmul isa string
       target/riscv/cpu.c: add smepmp isa string
       target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
       hw/riscv/virt.c: fix non-KVM --enable-debug build
       hw/intc/riscv_aplic.c fix non-KVM --enable-debug build
-Conor Dooley (3):
+Dickon Hood (2):
-      hw/misc: pfsoc: add fabric clocks to ioscb
+      target/riscv: Refactor translation of vector-widening instruction
-      hw/riscv: pfsoc: add missing FICs as unimplemented
+      target/riscv: Add Zvbb ISA extension support
       hw/{misc, riscv}: pfsoc: add system controller as unimplemented
-Frédéric Pétrot (1):
+Jason Chien (3):
-      hw/intc: sifive_plic: Renumber the S irqs for numa support
+      target/riscv: Add Zihintntl extension ISA string to DTS
       hw/intc: Fix upper/lower mtime write calculation
       hw/intc: Make rtc variable names consistent
-Jim Shu (2):
+Kiran Ostrolenk (4):
-      target/riscv: support cache-related PMU events in virtual mode
+      target/riscv: Refactor some of the generic vector functionality
-      hw/intc: sifive_plic: fix out-of-bound access of source_priority array
+      target/riscv: Refactor vector-vector translation macro
       target/riscv: Refactor some of the generic vector functionality
       target/riscv: Add Zvknh ISA extension support
-LIU Zhiwei (5):
+LIU Zhiwei (3):
-      target/riscv: Fix PMP propagation for tlb
+      target/riscv: Fix page_check_range use in fault-only-first
-      target/riscv: Add itrigger support when icount is not enabled
+      target/riscv: Fix zfa fleq.d and fltq.d
-      target/riscv: Add itrigger support when icount is enabled
+      linux-user/riscv: Use abi type for target_ucontext
       target/riscv: Enable native debug itrigger
       target/riscv: Add itrigger_enabled field to CPURISCVState
-Mayuresh Chitale (3):
+Lawrence Hunter (2):
-      target/riscv: Add smstateen support
+      target/riscv: Add Zvbc ISA extension support
-      target/riscv: smstateen check for h/s/envcfg
+      target/riscv: Add Zvksh ISA extension support
       target/riscv: generate virtual instruction exception
-Richard Henderson (4):
+Leon Schuermann (1):
-      tcg/riscv: Fix range matched by TCG_CT_CONST_M12
+      target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes
       tcg/riscv: Fix reg overlap case in tcg_out_addsub2
       tcg/riscv: Fix base register for user-only qemu_ld/st
       target/riscv: Set pc_succ_insn for !rvc illegal insn
-Wilfred Mallawa (4):
+Max Chou (3):
-      hw/registerfields: add `FIELDx_1CLEAR()` macro
+      crypto: Create sm4_subword
-      hw/ssi/ibex_spi: implement `FIELD32_1CLEAR` macro
+      crypto: Add SM4 constant parameter CK
-      hw/riscv/opentitan: bump opentitan
+      target/riscv: Add Zvksed ISA extension support
       hw/riscv/opentitan: add aon_timer base unimpl
- include/hw/intc/sifive_plic.h                  |   1 -
+Nazar Kazakov (4):
- include/hw/misc/mchp_pfsoc_ioscb.h             |   4 +
+      target/riscv: Remove redundant "cpu_vl == 0" checks
- include/hw/misc/mchp_pfsoc_sysreg.h            |   1 +
+      target/riscv: Move vector translation checks
- include/hw/registerfields.h                    |  22 ++
+      target/riscv: Add Zvkned ISA extension support
- include/hw/riscv/microchip_pfsoc.h             |   7 +-
+      target/riscv: Add Zvkg ISA extension support
- include/hw/riscv/opentitan.h                   |  10 +-
- include/hw/riscv/shakti_c.h                    |   2 +-
+Nikita Shubin (1):
- include/hw/riscv/sifive_e.h                    |   9 +-
+      target/riscv: don't read CSR in riscv_csrrw_do64
- include/hw/riscv/sifive_u.h                    |   2 +-
- include/hw/riscv/virt.h                        |   8 +-
+Rob Bradford (1):
- target/riscv/cpu.h                             |  10 +
+      target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren
- target/riscv/cpu_bits.h                        |  37 +++
- target/riscv/debug.h                           |  13 +
+Robbin Ehn (1):
- target/riscv/helper.h                          |   2 +
+      linux-user/riscv: Add new extensions to hwprobe
- target/riscv/pmp.h                             |   6 +-
- target/riscv/insn32.decode                     |   4 +
+Thomas Huth (2):
- hw/intc/sifive_plic.c                          |  66 +++--
+      hw/char/riscv_htif: Fix printing of console characters on big endian hosts
- hw/misc/mchp_pfsoc_ioscb.c                     |  78 ++++-
+      hw/char/riscv_htif: Fix the console syscall on big endian hosts
- hw/misc/mchp_pfsoc_sysreg.c                    |  18 +-
- hw/riscv/microchip_pfsoc.c                     | 121 ++++----
+Tommy Wu (1):
- hw/riscv/opentitan.c                           |  26 +-
+      target/riscv: Align the AIA model to v1.0 ratified spec
- hw/riscv/sifive_u.c                            |   3 +-
- hw/riscv/spike.c                               |   1 -
+Vineet Gupta (1):
- hw/riscv/virt.c                                |   7 +-
+      riscv: zicond: make non-experimental
- hw/ssi/ibex_spi_host.c                         |  21 +-
- target/riscv/cpu.c                             |  11 +
+Weiwei Li (1):
- target/riscv/cpu_helper.c                      |  26 +-
+      target/riscv: Update CSR bits name for svadu extension
- target/riscv/csr.c                             | 393 ++++++++++++++++++++++++-
- target/riscv/debug.c                           | 205 +++++++++++++
+Yong-Xuan Wang (5):
- target/riscv/machine.c                         |  36 +++
+      target/riscv: support the AIA device emulation with KVM enabled
- target/riscv/op_helper.c                       |  28 +-
+      target/riscv: check the in-kernel irqchip support
- target/riscv/pmp.c                             |  90 ++----
+      target/riscv: Create an KVM AIA irqchip
- target/riscv/translate.c                       |  54 +++-
+      target/riscv: update APLIC and IMSIC to support KVM AIA
- target/riscv/insn_trans/trans_privileged.c.inc |   4 +-
+      target/riscv: select KVM AIA in riscv virt machine
- target/riscv/insn_trans/trans_rvi.c.inc        |   8 +-
- target/riscv/insn_trans/trans_rvv.c.inc        |   4 +-
+ include/crypto/aes.h                      |   7 +
- target/riscv/insn_trans/trans_rvzawrs.c.inc    |  51 ++++
+ include/crypto/sm4.h                      |   9 +
- tcg/riscv/tcg-target.c.inc                     |  68 +++--
+ target/riscv/cpu_bits.h                   |   8 +-
- hw/intc/Kconfig                                |   3 +
+ target/riscv/cpu_cfg.h                    |   9 +
- hw/riscv/Kconfig                               |  22 +-
+ target/riscv/debug.h                      |   3 +-
- tests/tcg/Makefile.target                      |   2 +
+ target/riscv/helper.h                     |  98 +++
- tests/tcg/riscv64/Makefile.target              |   6 +
+ target/riscv/kvm_riscv.h                  |   5 +
- tests/tcg/riscv64/test-noc.S                   |  32 ++
+ target/riscv/vector_internals.h           | 228 +++++++
-files changed, 1256 insertions(+), 266 deletions(-)
+ target/riscv/insn32.decode                |  58 ++
- create mode 100644 target/riscv/insn_trans/trans_rvzawrs.c.inc
+ crypto/aes.c                              |   4 +-
- create mode 100644 tests/tcg/riscv64/test-noc.S
+ crypto/sm4.c                              |  10 +
  hw/char/riscv_htif.c                      |  12 +-
  hw/intc/riscv_aclint.c                    |  11 +-
  hw/intc/riscv_aplic.c                     |  52 +-
  hw/intc/riscv_imsic.c                     |  25 +-
  hw/riscv/virt.c                           | 374 ++++++------
  linux-user/riscv/signal.c                 |   4 +-
  linux-user/syscall.c                      |  14 +-
  target/arm/tcg/crypto_helper.c            |  10 +-
  target/riscv/cpu.c                        |  83 ++-
  target/riscv/cpu_helper.c                 |   6 +-
  target/riscv/crypto_helper.c              |  51 +-
  target/riscv/csr.c                        |  54 +-
  target/riscv/debug.c                      |  15 +-
  target/riscv/kvm.c                        | 201 ++++++-
  target/riscv/pmp.c                        |   4 +
  target/riscv/translate.c                  |   1 +
  target/riscv/vcrypto_helper.c             | 970 ++++++++++++++++++++++++++++++
  target/riscv/vector_helper.c              | 245 +-------
  target/riscv/vector_internals.c           |  81 +++
  target/riscv/insn_trans/trans_rvv.c.inc   | 171 +++---
  target/riscv/insn_trans/trans_rvvk.c.inc  | 606 +++++++++++++++++++
  target/riscv/insn_trans/trans_rvzfa.c.inc |   4 +-
  target/riscv/meson.build                  |   4 +-
 files changed, 2785 insertions(+), 652 deletions(-)
  create mode 100644 target/riscv/vector_internals.h
  create mode 100644 target/riscv/vcrypto_helper.c
  create mode 100644 target/riscv/vector_internals.c
  create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc

-[PULL v2 33/45] hw/riscv: Sort machines Kconfig options in alphabetical order
+[PULL v2 01/45] target/riscv/cpu.c: do not run 'host' CPU with TCG
-From: Bin Meng <bmeng@tinylab.org>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-SHAKTI_C machine Kconfig option was inserted in disorder. Fix it.
+The 'host' CPU is available in a CONFIG_KVM build and it's currently
 available for all accels, but is a KVM only CPU. This means that in a
 RISC-V KVM capable host we can do things like this:
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
 qemu-system-riscv64: H extension requires priv spec 1.12.0
 This CPU does not have a priv spec because we don't filter its extensions
 via priv spec. We shouldn't be reaching riscv_cpu_realize_tcg() at all
 with the 'host' CPU.
 We don't have a way to filter the 'host' CPU out of the available CPU
 options (-cpu help) if the build includes both KVM and TCG. What we can
 do is to error out during riscv_cpu_realize_tcg() if the user chooses
 the 'host' CPU with accel=tcg:
 $ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
 qemu-system-riscv64: 'host' CPU is not compatible with TCG acceleration
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Message-Id: <20230721133411.474105-1-dbarboza@ventanamicro.com>
 Message-Id: <20221211030829.802437-4-bmeng@tinylab.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/Kconfig | 16 +++++++++-------
+ target/riscv/cpu.c | 5 +++++
-file changed, 9 insertions(+), 7 deletions(-)
+file changed, 5 insertions(+)
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/Kconfig
+--- a/target/riscv/cpu.c
-+++ b/hw/riscv/Kconfig
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ config RISCV_NUMA
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
- config IBEX
+     CPURISCVState *env = &cpu->env;
-     bool
+     Error *local_err = NULL;
-+# RISC-V machines in alphabetical order
++    if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_CPU_HOST)) {
 +        error_setg(errp, "'host' CPU is not compatible with TCG acceleration");
 +        return;
 +    }
 +
- config MICROCHIP_PFSOC
+     riscv_cpu_validate_misa_mxl(cpu, &local_err);
-     bool
+     if (local_err != NULL) {
-     select CADENCE_SDHCI
+         error_propagate(errp, local_err);
@@ -XXX,XX +XXX,XX @@ config OPENTITAN
      select SIFIVE_PLIC
      select UNIMP
 -config SHAKTI_C
 -    bool
 -    select UNIMP
 -    select SHAKTI_UART
 -    select RISCV_ACLINT
 -    select SIFIVE_PLIC
 -
  config RISCV_VIRT
      bool
      imply PCI_DEVICES
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
      select FW_CFG_DMA
      select PLATFORM_BUS
 +config SHAKTI_C
 +    bool
 +    select RISCV_ACLINT
 +    select SHAKTI_UART
 +    select SIFIVE_PLIC
 +    select UNIMP
 +
  config SIFIVE_E
      bool
      select RISCV_ACLINT
 --
-.38.1
+.41.0

-[PULL v2 41/45] hw/riscv: sifive_u: Avoid using magic number for "riscv, ndev"
+[PULL v2 02/45] hw/char/riscv_htif: Fix printing of console characters on big endian hosts
-From: Bin Meng <bmeng@tinylab.org>
+From: Thomas Huth <thuth@redhat.com>
-At present magic number is used to create "riscv,ndev" property
+The character that should be printed is stored in the 64 bit "payload"
-in the dtb. Let's use the macro SIFIVE_U_PLIC_NUM_SOURCES that
+variable. The code currently tries to print it by taking the address
-is used to instantiate the PLIC model instead.
+of the variable and passing this pointer to qemu_chr_fe_write(). However,
 this only works on little endian hosts where the least significant bits
 are stored on the lowest address. To do this in a portable way, we have
 to store the value in an uint8_t variable instead.
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+Fixes: 5033606780 ("RISC-V HTIF Console")
-Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221211030829.802437-12-bmeng@tinylab.org>
+Reviewed-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-Id: <20230721094720.902454-2-thuth@redhat.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/sifive_u.c | 3 ++-
+ hw/char/riscv_htif.c | 3 ++-
 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/sifive_u.c
+--- a/hw/char/riscv_htif.c
-+++ b/hw/riscv/sifive_u.c
++++ b/hw/char/riscv_htif.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
+@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
-     qemu_fdt_setprop_cells(fdt, nodename, "reg",
+             s->tohost = 0; /* clear to indicate we read */
-x0, memmap[SIFIVE_U_DEV_PLIC].base,
+             return;
-x0, memmap[SIFIVE_U_DEV_PLIC].size);
+         } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
--    qemu_fdt_setprop_cell(fdt, nodename, "riscv,ndev", 0x35);
+-            qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1);
-+    qemu_fdt_setprop_cell(fdt, nodename, "riscv,ndev",
++            uint8_t ch = (uint8_t)payload;
-+                          SIFIVE_U_PLIC_NUM_SOURCES - 1);
++            qemu_chr_fe_write(&s->chr, &ch, 1);
-     qemu_fdt_setprop_cell(fdt, nodename, "phandle", plic_phandle);
+             resp = 0x100 | (uint8_t)payload;
-     plic_phandle = qemu_fdt_get_phandle(fdt, nodename);
+         } else {
-     g_free(cells);
+             qemu_log("HTIF device %d: unknown command\n", device);
 --
-.38.1
+.41.0

-[PULL v2 44/45] hw/riscv: opentitan: Drop "hartid-base" and "priority-base" initialization
+[PULL v2 03/45] hw/char/riscv_htif: Fix the console syscall on big endian hosts
-From: Bin Meng <bmeng@tinylab.org>
+From: Thomas Huth <thuth@redhat.com>
-"hartid-base" and "priority-base" are zero by default. There is no
+Values that have been read via cpu_physical_memory_read() from the
-need to initialize them to zero again.
+guest's memory have to be swapped in case the host endianess differs
 from the guest.
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+Fixes: a6e13e31d5 ("riscv_htif: Support console output via proxy syscall")
-Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221211030829.802437-15-bmeng@tinylab.org>
+Reviewed-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Message-Id: <20230721094720.902454-3-thuth@redhat.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/opentitan.c | 2 --
+ hw/char/riscv_htif.c | 9 +++++----
-file changed, 2 deletions(-)
+file changed, 5 insertions(+), 4 deletions(-)
-diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
+diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/opentitan.c
+--- a/hw/char/riscv_htif.c
-+++ b/hw/riscv/opentitan.c
++++ b/hw/char/riscv_htif.c
-@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/timer.h"
-     /* PLIC */
+ #include "qemu/error-report.h"
-     qdev_prop_set_string(DEVICE(&s->plic), "hart-config", "M");
+ #include "exec/address-spaces.h"
--    qdev_prop_set_uint32(DEVICE(&s->plic), "hartid-base", 0);
++#include "exec/tswap.h"
-     qdev_prop_set_uint32(DEVICE(&s->plic), "num-sources", 180);
+ #include "sysemu/dma.h"
-     qdev_prop_set_uint32(DEVICE(&s->plic), "num-priorities", 3);
--    qdev_prop_set_uint32(DEVICE(&s->plic), "priority-base", 0x00);
+ #define RISCV_DEBUG_HTIF 0
-     qdev_prop_set_uint32(DEVICE(&s->plic), "pending-base", 0x1000);
+@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
-     qdev_prop_set_uint32(DEVICE(&s->plic), "enable-base", 0x2000);
+             } else {
-     qdev_prop_set_uint32(DEVICE(&s->plic), "enable-stride", 32);
+                 uint64_t syscall[8];
                  cpu_physical_memory_read(payload, syscall, sizeof(syscall));
 -                if (syscall[0] == PK_SYS_WRITE &&
 -                    syscall[1] == HTIF_DEV_CONSOLE &&
 -                    syscall[3] == HTIF_CONSOLE_CMD_PUTC) {
 +                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
 +                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
 +                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
                      uint8_t ch;
 -                    cpu_physical_memory_read(syscall[2], &ch, 1);
 +                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
                      qemu_chr_fe_write(&s->chr, &ch, 1);
                      resp = 0x100 | (uint8_t)payload;
                  } else {
 --
-.38.1
+.41.0

-[PULL v2 32/45] hw/riscv: Fix opentitan dependency to SIFIVE_PLIC
+[PULL v2 04/45] target/riscv/cpu.c: add zmmul isa string
-From: Bin Meng <bmeng@tinylab.org>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Since commit ef6310064820 ("hw/riscv: opentitan: Update to the latest build")
+zmmul was promoted from experimental to ratified in commit 6d00ffad4e95.
-the IBEX PLIC model was replaced with the SiFive PLIC model in the
+Add a riscv,isa string for it.
 'opentitan' machine but we forgot the add the dependency there.
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+Fixes: 6d00ffad4e95 ("target/riscv: move zmmul out of the experimental properties")
-Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221211030829.802437-3-bmeng@tinylab.org>
+Message-Id: <20230720132424.371132-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/Kconfig | 1 +
+ target/riscv/cpu.c | 1 +
 file changed, 1 insertion(+)
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/Kconfig
+--- a/target/riscv/cpu.c
-+++ b/hw/riscv/Kconfig
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
- config OPENTITAN
+     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
-     bool
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
-     select IBEX
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
-+    select SIFIVE_PLIC
++    ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
-     select UNIMP
+     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
+     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
- config SHAKTI_C
+     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
 --
-.38.1
+.41.0

-[PULL v2 20/45] target/riscv: Add some comments for sstatus CSR in riscv_cpu_dump_state()
+[PULL v2 05/45] target/riscv/cpu.c: add smepmp isa string
-From: Bin Meng <bmeng@tinylab.org>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-sstatus register dump is currently missing in riscv_cpu_dump_state().
+The cpu->cfg.epmp extension is still experimental, but it already has a
-As sstatus is a copy of mstatus, which is described in the priv spec,
+'smepmp' riscv,isa string. Add it.
 it seems redundant to print the same information twice.
-Add some comments for this to let people know this is intentional.
+Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
 Signed-off-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221125050354.3166023-1-bmeng@tinylab.org>
+Message-Id: <20230720132424.371132-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.c | 4 ++++
+ target/riscv/cpu.c | 1 +
-file changed, 4 insertions(+)
+file changed, 1 insertion(+)
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-             CSR_MHARTID,
+     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
-             CSR_MSTATUS,
+     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
-             CSR_MSTATUSH,
+     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
-+            /*
++    ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, epmp),
-+             * CSR_SSTATUS is intentionally omitted here as its value
+     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
-+             * can be figured out by looking at CSR_MSTATUS
+     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
-+             */
+     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
              CSR_HSTATUS,
              CSR_VSSTATUS,
              CSR_MIP,
 --
-.38.1
+.41.0

-[PULL v2 15/45] target/riscv: Add itrigger_enabled field to CPURISCVState
+[PULL v2 06/45] target/riscv: Fix page_check_range use in fault-only-first
 From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Avoid calling riscv_itrigger_enabled() when calculate the tbflags.
+Commit bef6f008b98(accel/tcg: Return bool from page_check_range) converts
-As the itrigger enable status can only be changed when write
+integer return value to bool type. However, it wrongly converted the use
-tdata1, migration load or itrigger fire, update env->itrigger_enabled
+of the API in riscv fault-only-first, where page_check_range < = 0, should
-at these places.
+be converted to !page_check_range.
 Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20221013062946.7530-5-zhiwei_liu@linux.alibaba.com>
+Message-ID: <20230729031618.821-1-zhiwei_liu@linux.alibaba.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        |  1 +
+ target/riscv/vector_helper.c | 2 +-
- target/riscv/cpu_helper.c |  3 +--
+file changed, 1 insertion(+), 1 deletion(-)
  target/riscv/debug.c      |  3 +++
  target/riscv/machine.c    | 15 +++++++++++++++
 files changed, 20 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/vector_helper.c
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
+@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
-     struct CPUWatchpoint *cpu_watchpoint[RV_MAX_TRIGGERS];
+                                          cpu_mmu_index(env, false));
-     QEMUTimer *itrigger_timer[RV_MAX_TRIGGERS];
+                 if (host) {
-     int64_t last_icount;
+ #ifdef CONFIG_USER_ONLY
-+    bool itrigger_enabled;
+-                    if (page_check_range(addr, offset, PAGE_READ)) {
++                    if (!page_check_range(addr, offset, PAGE_READ)) {
-     /* machine specific rdtime callback */
+                         vl = i;
-     uint64_t (*rdtime_fn)(void *);
+                         goto ProbeSuccess;
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+                     }
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
                             get_field(env->mstatus_hs, MSTATUS_VS));
      }
      if (riscv_feature(env, RISCV_FEATURE_DEBUG) && !icount_enabled()) {
 -        flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER,
 -                           riscv_itrigger_enabled(env));
 +        flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER, env->itrigger_enabled);
      }
  #endif
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ void helper_itrigger_match(CPURISCVState *env)
          }
          itrigger_set_count(env, i, count--);
          if (!count) {
 +            env->itrigger_enabled = riscv_itrigger_enabled(env);
              do_trigger_action(env, i);
          }
      }
@@ -XXX,XX +XXX,XX @@ static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
                  /* set the count to timer */
                  timer_mod(env->itrigger_timer[index],
                            env->last_icount + itrigger_get_count(env, index));
 +            } else {
 +                env->itrigger_enabled = riscv_itrigger_enabled(env);
              }
          }
          break;
 diff --git a/target/riscv/machine.c b/target/riscv/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/machine.c
 +++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/error-report.h"
  #include "sysemu/kvm.h"
  #include "migration/cpu.h"
 +#include "sysemu/cpu-timers.h"
 +#include "debug.h"
  static bool pmp_needed(void *opaque)
  {
@@ -XXX,XX +XXX,XX @@ static bool debug_needed(void *opaque)
      return riscv_feature(env, RISCV_FEATURE_DEBUG);
  }
 +static int debug_post_load(void *opaque, int version_id)
 +{
 +    RISCVCPU *cpu = opaque;
 +    CPURISCVState *env = &cpu->env;
 +
 +    if (icount_enabled()) {
 +        env->itrigger_enabled = riscv_itrigger_enabled(env);
 +    }
 +
 +    return 0;
 +}
 +
  static const VMStateDescription vmstate_debug = {
      .name = "cpu/debug",
      .version_id = 2,
      .minimum_version_id = 2,
      .needed = debug_needed,
 +    .post_load = debug_post_load,
      .fields = (VMStateField[]) {
          VMSTATE_UINTTL(env.trigger_cur, RISCVCPU),
          VMSTATE_UINTTL_ARRAY(env.tdata1, RISCVCPU, RV_MAX_TRIGGERS),
 --
-.38.1
+.41.0

-[PULL v2 43/45] hw/intc: sifive_plic: Change "priority-base" to start from interrupt source 0
+[PULL v2 07/45] target/riscv: Use existing lookup tables for MixColumns
-From: Bin Meng <bmeng@tinylab.org>
+From: Ard Biesheuvel <ardb@kernel.org>
-At present the SiFive PLIC model "priority-base" expects interrupt
+The AES MixColumns and InvMixColumns operations are relatively
-priority register base starting from source 1 instead source 0,
+expensive 4x4 matrix multiplications in GF(2^8), which is why C
-that's why on most platforms "priority-base" is set to 0x04 except
+implementations usually rely on precomputed lookup tables rather than
-'opentitan' machine. 'opentitan' should have set "priority-base"
+performing the calculations on demand.
 to 0x04 too.
-Note the irq number calculation in sifive_plic_{read,write} is
+Given that we already carry those tables in QEMU, we can just grab the
-correct as the codes make up for the irq number by adding 1.
+right value in the implementation of the RISC-V AES32 instructions. Note
 that the tables in question are permuted according to the respective
 Sbox, so we can omit the Sbox lookup as well in this case.
-Let's simply update "priority-base" to start from interrupt source
+Cc: Richard Henderson <richard.henderson@linaro.org>
-and add a comment to make it crystal clear.
+Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
+Cc: Zewen Ye <lustrew@foxmail.com>
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+Cc: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Cc: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
-Message-Id: <20221211030829.802437-14-bmeng@tinylab.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230731084043.1791984-1-ardb@kernel.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/microchip_pfsoc.h | 2 +-
+ include/crypto/aes.h         |  7 +++++++
- include/hw/riscv/shakti_c.h        | 2 +-
+ crypto/aes.c                 |  4 ++--
- include/hw/riscv/sifive_e.h        | 2 +-
+ target/riscv/crypto_helper.c | 34 ++++------------------------------
- include/hw/riscv/sifive_u.h        | 2 +-
+files changed, 13 insertions(+), 32 deletions(-)
  include/hw/riscv/virt.h            | 2 +-
  hw/intc/sifive_plic.c              | 5 +++--
 files changed, 8 insertions(+), 7 deletions(-)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+diff --git a/include/crypto/aes.h b/include/crypto/aes.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
+--- a/include/crypto/aes.h
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/include/crypto/aes.h
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
+ extern const uint8_t AES_sbox[256];
- #define MICROCHIP_PFSOC_PLIC_NUM_SOURCES        187
+ extern const uint8_t AES_isbox[256];
- #define MICROCHIP_PFSOC_PLIC_NUM_PRIORITIES     7
--#define MICROCHIP_PFSOC_PLIC_PRIORITY_BASE      0x04
++/*
-+#define MICROCHIP_PFSOC_PLIC_PRIORITY_BASE      0x00
++AES_Te0[x] = S [x].[02, 01, 01, 03];
- #define MICROCHIP_PFSOC_PLIC_PENDING_BASE       0x1000
++AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
- #define MICROCHIP_PFSOC_PLIC_ENABLE_BASE        0x2000
++*/
- #define MICROCHIP_PFSOC_PLIC_ENABLE_STRIDE      0x80
++
-diff --git a/include/hw/riscv/shakti_c.h b/include/hw/riscv/shakti_c.h
++extern const uint32_t AES_Te0[256], AES_Td0[256];
 +
  #endif
 diff --git a/crypto/aes.c b/crypto/aes.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/shakti_c.h
+--- a/crypto/aes.c
-+++ b/include/hw/riscv/shakti_c.h
++++ b/crypto/aes.c
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
- #define SHAKTI_C_PLIC_NUM_SOURCES 28
+ AES_Td4[x] = Si[x].[01, 01, 01, 01];
- /* Excluding Priority 0 */
+ */
- #define SHAKTI_C_PLIC_NUM_PRIORITIES 2
--#define SHAKTI_C_PLIC_PRIORITY_BASE 0x04
+-static const uint32_t AES_Te0[256] = {
-+#define SHAKTI_C_PLIC_PRIORITY_BASE 0x00
++const uint32_t AES_Te0[256] = {
- #define SHAKTI_C_PLIC_PENDING_BASE 0x1000
+xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
- #define SHAKTI_C_PLIC_ENABLE_BASE 0x2000
+xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
- #define SHAKTI_C_PLIC_ENABLE_STRIDE 0x80
+x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
-diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
+@@ -XXX,XX +XXX,XX @@ static const uint32_t AES_Te4[256] = {
 xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
  };
 -static const uint32_t AES_Td0[256] = {
 +const uint32_t AES_Td0[256] = {
 x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
 x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
 x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
 diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/sifive_e.h
+--- a/target/riscv/crypto_helper.c
-+++ b/include/hw/riscv/sifive_e.h
++++ b/target/riscv/crypto_helper.c
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@
-  */
+ #include "crypto/aes-round.h"
- #define SIFIVE_E_PLIC_NUM_SOURCES 53
+ #include "crypto/sm4.h"
- #define SIFIVE_E_PLIC_NUM_PRIORITIES 7
--#define SIFIVE_E_PLIC_PRIORITY_BASE 0x04
+-#define AES_XTIME(a) \
-+#define SIFIVE_E_PLIC_PRIORITY_BASE 0x00
+-    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
- #define SIFIVE_E_PLIC_PENDING_BASE 0x1000
+-
- #define SIFIVE_E_PLIC_ENABLE_BASE 0x2000
+-#define AES_GFMUL(a, b) (( \
- #define SIFIVE_E_PLIC_ENABLE_STRIDE 0x80
+-    (((b) & 0x1) ? (a) : 0) ^ \
-diff --git a/include/hw/riscv/sifive_u.h b/include/hw/riscv/sifive_u.h
+-    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
-index XXXXXXX..XXXXXXX 100644
+-    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
---- a/include/hw/riscv/sifive_u.h
+-    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
-+++ b/include/hw/riscv/sifive_u.h
+-
-@@ -XXX,XX +XXX,XX @@ enum {
+-static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
+-{
- #define SIFIVE_U_PLIC_NUM_SOURCES 54
+-    uint32_t u;
- #define SIFIVE_U_PLIC_NUM_PRIORITIES 7
+-
--#define SIFIVE_U_PLIC_PRIORITY_BASE 0x04
+-    if (fwd) {
-+#define SIFIVE_U_PLIC_PRIORITY_BASE 0x00
+-        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
- #define SIFIVE_U_PLIC_PENDING_BASE 0x1000
+-            (AES_GFMUL(x, 2) << 0);
- #define SIFIVE_U_PLIC_ENABLE_BASE 0x2000
+-    } else {
- #define SIFIVE_U_PLIC_ENABLE_STRIDE 0x80
+-        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
+-            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
-index XXXXXXX..XXXXXXX 100644
+-    }
---- a/include/hw/riscv/virt.h
+-    return u;
-+++ b/include/hw/riscv/virt.h
+-}
-@@ -XXX,XX +XXX,XX @@ enum {
+-
- #define VIRT_IRQCHIP_MAX_GUESTS_BITS 3
+ #define sext32_xlen(x) (target_ulong)(int32_t)(x)
- #define VIRT_IRQCHIP_MAX_GUESTS ((1U << VIRT_IRQCHIP_MAX_GUESTS_BITS) - 1U)
+ static inline target_ulong aes32_operation(target_ulong shamt,
--#define VIRT_PLIC_PRIORITY_BASE 0x04
+@@ -XXX,XX +XXX,XX @@ static inline target_ulong aes32_operation(target_ulong shamt,
-+#define VIRT_PLIC_PRIORITY_BASE 0x00
+                                            bool enc, bool mix)
- #define VIRT_PLIC_PENDING_BASE 0x1000
+ {
- #define VIRT_PLIC_ENABLE_BASE 0x2000
+     uint8_t si = rs2 >> shamt;
- #define VIRT_PLIC_ENABLE_STRIDE 0x80
+-    uint8_t so;
-diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
+     uint32_t mixed;
-index XXXXXXX..XXXXXXX 100644
+     target_ulong res;
---- a/hw/intc/sifive_plic.c
-+++ b/hw/intc/sifive_plic.c
+     if (enc) {
-@@ -XXX,XX +XXX,XX @@ static uint64_t sifive_plic_read(void *opaque, hwaddr addr, unsigned size)
+-        so = AES_sbox[si];
-     SiFivePLICState *plic = opaque;
+         if (mix) {
+-            mixed = aes_mixcolumn_byte(so, true);
-     if (addr_between(addr, plic->priority_base, plic->num_sources << 2)) {
++            mixed = be32_to_cpu(AES_Te0[si]);
--        uint32_t irq = ((addr - plic->priority_base) >> 2) + 1;
+         } else {
-+        uint32_t irq = (addr - plic->priority_base) >> 2;
+-            mixed = so;
++            mixed = AES_sbox[si];
-         return plic->source_priority[irq];
+         }
-     } else if (addr_between(addr, plic->pending_base, plic->num_sources >> 3)) {
+     } else {
-@@ -XXX,XX +XXX,XX @@ static void sifive_plic_write(void *opaque, hwaddr addr, uint64_t value,
+-        so = AES_isbox[si];
-     SiFivePLICState *plic = opaque;
+         if (mix) {
+-            mixed = aes_mixcolumn_byte(so, false);
-     if (addr_between(addr, plic->priority_base, plic->num_sources << 2)) {
++            mixed = be32_to_cpu(AES_Td0[si]);
--        uint32_t irq = ((addr - plic->priority_base) >> 2) + 1;
+         } else {
-+        uint32_t irq = (addr - plic->priority_base) >> 2;
+-            mixed = so;
++            mixed = AES_isbox[si];
-         if (((plic->num_priorities + 1) & plic->num_priorities) == 0) {
+         }
-             /*
+     }
-@@ -XXX,XX +XXX,XX @@ static Property sifive_plic_properties[] = {
+     mixed = rol32(mixed, shamt);
      /* number of interrupt sources including interrupt source 0 */
      DEFINE_PROP_UINT32("num-sources", SiFivePLICState, num_sources, 1),
      DEFINE_PROP_UINT32("num-priorities", SiFivePLICState, num_priorities, 0),
 +    /* interrupt priority register base starting from source 0 */
      DEFINE_PROP_UINT32("priority-base", SiFivePLICState, priority_base, 0),
      DEFINE_PROP_UINT32("pending-base", SiFivePLICState, pending_base, 0),
      DEFINE_PROP_UINT32("enable-base", SiFivePLICState, enable_base, 0),
 --
-.38.1
+.41.0

-[PULL v2 26/45] target/riscv: Set pc_succ_insn for !rvc illegal insn
+[PULL v2 08/45] target/riscv: Refactor some of the generic vector functionality
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Failure to set pc_succ_insn may result in a TB covering zero bytes,
+Take some functions/macros out of `vector_helper` and put them in a new
-which triggers an assert within the code generator.
+module called `vector_internals`. This ensures they can be used by both
 vector and vector-crypto helpers (latter implemented in proceeding
 commits).
-Cc: qemu-stable@nongnu.org
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1224
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-ID: <20230711165917.2629866-2-max.chou@sifive.com>
 Message-Id: <20221203175744.151365-1-richard.henderson@linaro.org>
 [ Changes by AF:
  - Add missing run-plugin-test-noc-% line
 ]
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/translate.c          | 12 ++++--------
+ target/riscv/vector_internals.h | 182 +++++++++++++++++++++++++++++
- tests/tcg/Makefile.target         |  2 ++
+ target/riscv/vector_helper.c    | 201 +-------------------------------
- tests/tcg/riscv64/Makefile.target |  6 ++++++
+ target/riscv/vector_internals.c |  81 +++++++++++++
- tests/tcg/riscv64/test-noc.S      | 32 +++++++++++++++++++++++++++++++
+ target/riscv/meson.build        |   1 +
-files changed, 44 insertions(+), 8 deletions(-)
+files changed, 265 insertions(+), 200 deletions(-)
- create mode 100644 tests/tcg/riscv64/test-noc.S
+ create mode 100644 target/riscv/vector_internals.h
  create mode 100644 target/riscv/vector_internals.c
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
      ctx->virt_inst_excp = false;
      /* Check for compressed insn */
      if (insn_len(opcode) == 2) {
 -        if (!has_ext(ctx, RVC)) {
 -            gen_exception_illegal(ctx);
 -        } else {
 -            ctx->opcode = opcode;
 -            ctx->pc_succ_insn = ctx->base.pc_next + 2;
 -            if (decode_insn16(ctx, opcode)) {
 -                return;
 -            }
 +        ctx->opcode = opcode;
 +        ctx->pc_succ_insn = ctx->base.pc_next + 2;
 +        if (has_ext(ctx, RVC) && decode_insn16(ctx, opcode)) {
 +            return;
          }
      } else {
          uint32_t opcode32 = opcode;
 diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/Makefile.target
 +++ b/tests/tcg/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
  %: %.c
      $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $< -o $@ $(LDFLAGS)
 +%: %.S
 +    $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $< -o $@ $(LDFLAGS)
  else
  # For softmmu targets we include a different Makefile fragement as the
  # build options for bare programs are usually pretty different. They
 diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/riscv64/Makefile.target
 +++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@
  VPATH += $(SRC_PATH)/tests/tcg/riscv64
  TESTS += test-div
  TESTS += noexec
 +
 +# Disable compressed instructions for test-noc
 +TESTS += test-noc
 +test-noc: LDFLAGS = -nostdlib -static
 +run-test-noc: QEMU_OPTS += -cpu rv64,c=false
 +run-plugin-test-noc-%: QEMU_OPTS += -cpu rv64,c=false
 diff --git a/tests/tcg/riscv64/test-noc.S b/tests/tcg/riscv64/test-noc.S
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/tests/tcg/riscv64/test-noc.S
++++ b/target/riscv/vector_internals.h
 @@ -XXX,XX +XXX,XX @@
-+#include <asm/unistd.h>
++/*
-+
++ * RISC-V Vector Extension Internals
-+    .text
++ *
-+    .globl _start
++ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
-+_start:
++ *
-+    .option    norvc
++ * This program is free software; you can redistribute it and/or modify it
-+    li    a0, 4        /* SIGILL */
++ * under the terms and conditions of the GNU General Public License,
-+    la    a1, sa
++ * version 2 or later, as published by the Free Software Foundation.
-+    li    a2, 0
++ *
-+    li    a3, 8
++ * This program is distributed in the hope it will be useful, but WITHOUT
-+    li    a7, __NR_rt_sigaction
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+    scall
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-+
++ * more details.
-+    .option    rvc
++ *
-+    li    a0, 1
++ * You should have received a copy of the GNU General Public License along with
-+    j    exit
++ * this program.  If not, see <http://www.gnu.org/licenses/>.
-+    .option    norvc
++ */
 +
-+pass:
++#ifndef TARGET_RISCV_VECTOR_INTERNALS_H
-+    li    a0, 0
++#define TARGET_RISCV_VECTOR_INTERNALS_H
-+exit:
++
-+    li    a7, __NR_exit
++#include "qemu/osdep.h"
-+    scall
++#include "qemu/bitops.h"
-+
++#include "cpu.h"
-+    .data
++#include "tcg/tcg-gvec-desc.h"
-+    /* struct kernel_sigaction sa = { .sa_handler = pass }; */
++#include "internals.h"
-+    .type    sa, @object
++
-+    .size    sa, 32
++static inline uint32_t vext_nf(uint32_t desc)
-+sa:
++{
-+    .dword    pass
++    return FIELD_EX32(simd_data(desc), VDATA, NF);
-+    .zero    24
++}
 +
 +/*
 + * Note that vector data is stored in host-endian 64-bit chunks,
 + * so addressing units smaller than that needs a host-endian fixup.
 + */
 +#if HOST_BIG_ENDIAN
 +#define H1(x)   ((x) ^ 7)
 +#define H1_2(x) ((x) ^ 6)
 +#define H1_4(x) ((x) ^ 4)
 +#define H2(x)   ((x) ^ 3)
 +#define H4(x)   ((x) ^ 1)
 +#define H8(x)   ((x))
 +#else
 +#define H1(x)   (x)
 +#define H1_2(x) (x)
 +#define H1_4(x) (x)
 +#define H2(x)   (x)
 +#define H4(x)   (x)
 +#define H8(x)   (x)
 +#endif
 +
 +/*
 + * Encode LMUL to lmul as following:
 + *     LMUL    vlmul    lmul
 + *      1       000       0
 + *      2       001       1
 + *      4       010       2
 + *      8       011       3
 + *      -       100       -
 + *     1/8      101      -3
 + *     1/4      110      -2
 + *     1/2      111      -1
 + */
 +static inline int32_t vext_lmul(uint32_t desc)
 +{
 +    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
 +}
 +
 +static inline uint32_t vext_vm(uint32_t desc)
 +{
 +    return FIELD_EX32(simd_data(desc), VDATA, VM);
 +}
 +
 +static inline uint32_t vext_vma(uint32_t desc)
 +{
 +    return FIELD_EX32(simd_data(desc), VDATA, VMA);
 +}
 +
 +static inline uint32_t vext_vta(uint32_t desc)
 +{
 +    return FIELD_EX32(simd_data(desc), VDATA, VTA);
 +}
 +
 +static inline uint32_t vext_vta_all_1s(uint32_t desc)
 +{
 +    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
 +}
 +
 +/*
 + * Earlier designs (pre-0.9) had a varying number of bits
 + * per mask value (MLEN). In the 0.9 design, MLEN=1.
 + * (Section 4.5)
 + */
 +static inline int vext_elem_mask(void *v0, int index)
 +{
 +    int idx = index / 64;
 +    int pos = index  % 64;
 +    return (((uint64_t *)v0)[idx] >> pos) & 1;
 +}
 +
 +/*
 + * Get number of total elements, including prestart, body and tail elements.
 + * Note that when LMUL < 1, the tail includes the elements past VLMAX that
 + * are held in the same vector register.
 + */
 +static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
 +                                            uint32_t esz)
 +{
 +    uint32_t vlenb = simd_maxsz(desc);
 +    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
 +    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
 +                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
 +    return (vlenb << emul) / esz;
 +}
 +
 +/* set agnostic elements to 1s */
 +void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 +                       uint32_t tot);
 +
 +/* expand macro args before macro */
 +#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
 +
 +/* (TD, T1, T2, TX1, TX2) */
 +#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
 +#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
 +#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
 +#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 +
 +/* operation of two vector elements */
 +typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
 +
 +#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
 +static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
 +{                                                               \
 +    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
 +    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
 +    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
 +}
 +
 +void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
 +                CPURISCVState *env, uint32_t desc,
 +                opivv2_fn *fn, uint32_t esz);
 +
 +/* generate the helpers for OPIVV */
 +#define GEN_VEXT_VV(NAME, ESZ)                            \
 +void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
 +                  void *vs2, CPURISCVState *env,          \
 +                  uint32_t desc)                          \
 +{                                                         \
 +    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
 +               do_##NAME, ESZ);                           \
 +}
 +
 +typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
 +
 +/*
 + * (T1)s1 gives the real operator type.
 + * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
 + */
 +#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
 +static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
 +{                                                                   \
 +    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
 +    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
 +}
 +
 +void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
 +                CPURISCVState *env, uint32_t desc,
 +                opivx2_fn fn, uint32_t esz);
 +
 +/* generate the helpers for OPIVX */
 +#define GEN_VEXT_VX(NAME, ESZ)                            \
 +void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
 +                  void *vs2, CPURISCVState *env,          \
 +                  uint32_t desc)                          \
 +{                                                         \
 +    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
 +               do_##NAME, ESZ);                           \
 +}
 +
 +#endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vector_helper.c
 +++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "fpu/softfloat.h"
  #include "tcg/tcg-gvec-desc.h"
  #include "internals.h"
 +#include "vector_internals.h"
  #include <math.h>
  target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
      return vl;
  }
 -/*
 - * Note that vector data is stored in host-endian 64-bit chunks,
 - * so addressing units smaller than that needs a host-endian fixup.
 - */
 -#if HOST_BIG_ENDIAN
 -#define H1(x)   ((x) ^ 7)
 -#define H1_2(x) ((x) ^ 6)
 -#define H1_4(x) ((x) ^ 4)
 -#define H2(x)   ((x) ^ 3)
 -#define H4(x)   ((x) ^ 1)
 -#define H8(x)   ((x))
 -#else
 -#define H1(x)   (x)
 -#define H1_2(x) (x)
 -#define H1_4(x) (x)
 -#define H2(x)   (x)
 -#define H4(x)   (x)
 -#define H8(x)   (x)
 -#endif
 -
 -static inline uint32_t vext_nf(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, NF);
 -}
 -
 -static inline uint32_t vext_vm(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VM);
 -}
 -
 -/*
 - * Encode LMUL to lmul as following:
 - *     LMUL    vlmul    lmul
 - *      1       000       0
 - *      2       001       1
 - *      4       010       2
 - *      8       011       3
 - *      -       100       -
 - *     1/8      101      -3
 - *     1/4      110      -2
 - *     1/2      111      -1
 - */
 -static inline int32_t vext_lmul(uint32_t desc)
 -{
 -    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
 -}
 -
 -static inline uint32_t vext_vta(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VTA);
 -}
 -
 -static inline uint32_t vext_vma(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VMA);
 -}
 -
 -static inline uint32_t vext_vta_all_1s(uint32_t desc)
 -{
 -    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
 -}
 -
  /*
   * Get the maximum number of elements can be operated.
   *
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
      return scale < 0 ? vlenb >> -scale : vlenb << scale;
  }
 -/*
 - * Get number of total elements, including prestart, body and tail elements.
 - * Note that when LMUL < 1, the tail includes the elements past VLMAX that
 - * are held in the same vector register.
 - */
 -static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
 -                                            uint32_t esz)
 -{
 -    uint32_t vlenb = simd_maxsz(desc);
 -    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
 -    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
 -                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
 -    return (vlenb << emul) / esz;
 -}
 -
  static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
  {
      return (addr & ~env->cur_pmmask) | env->cur_pmbase;
@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
      }
  }
 -/* set agnostic elements to 1s */
 -static void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 -                              uint32_t tot)
 -{
 -    if (is_agnostic == 0) {
 -        /* policy undisturbed */
 -        return;
 -    }
 -    if (tot - cnt == 0) {
 -        return;
 -    }
 -    memset(base + cnt, -1, tot - cnt);
 -}
 -
  static inline void vext_set_elem_mask(void *v0, int index,
                                        uint8_t value)
  {
@@ -XXX,XX +XXX,XX @@ static inline void vext_set_elem_mask(void *v0, int index,
      ((uint64_t *)v0)[idx] = deposit64(old, pos, 1, value);
  }
 -/*
 - * Earlier designs (pre-0.9) had a varying number of bits
 - * per mask value (MLEN). In the 0.9 design, MLEN=1.
 - * (Section 4.5)
 - */
 -static inline int vext_elem_mask(void *v0, int index)
 -{
 -    int idx = index / 64;
 -    int pos = index  % 64;
 -    return (((uint64_t *)v0)[idx] >> pos) & 1;
 -}
 -
  /* elements operations for load and store */
  typedef void vext_ldst_elem_fn(CPURISCVState *env, abi_ptr addr,
                                 uint32_t idx, void *vd, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
   * Vector Integer Arithmetic Instructions
   */
 -/* expand macro args before macro */
 -#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
 -
  /* (TD, T1, T2, TX1, TX2) */
  #define OP_SSS_B int8_t, int8_t, int8_t, int8_t, int8_t
  #define OP_SSS_H int16_t, int16_t, int16_t, int16_t, int16_t
  #define OP_SSS_W int32_t, int32_t, int32_t, int32_t, int32_t
  #define OP_SSS_D int64_t, int64_t, int64_t, int64_t, int64_t
 -#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
 -#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
 -#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
 -#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
  #define OP_SUS_B int8_t, uint8_t, int8_t, uint8_t, int8_t
  #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
  #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
  #define NOP_UUU_H uint16_t, uint16_t, uint32_t, uint16_t, uint32_t
  #define NOP_UUU_W uint32_t, uint32_t, uint64_t, uint32_t, uint64_t
 -/* operation of two vector elements */
 -typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
 -
 -#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
 -static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
 -{                                                               \
 -    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
 -    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
 -    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
 -}
  #define DO_SUB(N, M) (N - M)
  #define DO_RSUB(N, M) (M - N)
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vsub_vv_h, OP_SSS_H, H2, H2, H2, DO_SUB)
  RVVCALL(OPIVV2, vsub_vv_w, OP_SSS_W, H4, H4, H4, DO_SUB)
  RVVCALL(OPIVV2, vsub_vv_d, OP_SSS_D, H8, H8, H8, DO_SUB)
 -static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
 -                       CPURISCVState *env, uint32_t desc,
 -                       opivv2_fn *fn, uint32_t esz)
 -{
 -    uint32_t vm = vext_vm(desc);
 -    uint32_t vl = env->vl;
 -    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 -    uint32_t vta = vext_vta(desc);
 -    uint32_t vma = vext_vma(desc);
 -    uint32_t i;
 -
 -    for (i = env->vstart; i < vl; i++) {
 -        if (!vm && !vext_elem_mask(v0, i)) {
 -            /* set masked-off elements to 1s */
 -            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
 -            continue;
 -        }
 -        fn(vd, vs1, vs2, i);
 -    }
 -    env->vstart = 0;
 -    /* set tail elements to 1s */
 -    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
 -}
 -
 -/* generate the helpers for OPIVV */
 -#define GEN_VEXT_VV(NAME, ESZ)                            \
 -void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
 -                  void *vs2, CPURISCVState *env,          \
 -                  uint32_t desc)                          \
 -{                                                         \
 -    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
 -               do_##NAME, ESZ);                           \
 -}
 -
  GEN_VEXT_VV(vadd_vv_b, 1)
  GEN_VEXT_VV(vadd_vv_h, 2)
  GEN_VEXT_VV(vadd_vv_w, 4)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV(vsub_vv_h, 2)
  GEN_VEXT_VV(vsub_vv_w, 4)
  GEN_VEXT_VV(vsub_vv_d, 8)
 -typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
 -
 -/*
 - * (T1)s1 gives the real operator type.
 - * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
 - */
 -#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
 -static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
 -{                                                                   \
 -    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
 -    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
 -}
  RVVCALL(OPIVX2, vadd_vx_b, OP_SSS_B, H1, H1, DO_ADD)
  RVVCALL(OPIVX2, vadd_vx_h, OP_SSS_H, H2, H2, DO_ADD)
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vrsub_vx_h, OP_SSS_H, H2, H2, DO_RSUB)
  RVVCALL(OPIVX2, vrsub_vx_w, OP_SSS_W, H4, H4, DO_RSUB)
  RVVCALL(OPIVX2, vrsub_vx_d, OP_SSS_D, H8, H8, DO_RSUB)
 -static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
 -                       CPURISCVState *env, uint32_t desc,
 -                       opivx2_fn fn, uint32_t esz)
 -{
 -    uint32_t vm = vext_vm(desc);
 -    uint32_t vl = env->vl;
 -    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 -    uint32_t vta = vext_vta(desc);
 -    uint32_t vma = vext_vma(desc);
 -    uint32_t i;
 -
 -    for (i = env->vstart; i < vl; i++) {
 -        if (!vm && !vext_elem_mask(v0, i)) {
 -            /* set masked-off elements to 1s */
 -            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
 -            continue;
 -        }
 -        fn(vd, s1, vs2, i);
 -    }
 -    env->vstart = 0;
 -    /* set tail elements to 1s */
 -    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
 -}
 -
 -/* generate the helpers for OPIVX */
 -#define GEN_VEXT_VX(NAME, ESZ)                            \
 -void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
 -                  void *vs2, CPURISCVState *env,          \
 -                  uint32_t desc)                          \
 -{                                                         \
 -    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
 -               do_##NAME, ESZ);                           \
 -}
 -
  GEN_VEXT_VX(vadd_vx_b, 1)
  GEN_VEXT_VX(vadd_vx_h, 2)
  GEN_VEXT_VX(vadd_vx_w, 4)
 diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * RISC-V Vector Extension Internals
 + *
 + * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "vector_internals.h"
 +
 +/* set agnostic elements to 1s */
 +void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 +                       uint32_t tot)
 +{
 +    if (is_agnostic == 0) {
 +        /* policy undisturbed */
 +        return;
 +    }
 +    if (tot - cnt == 0) {
 +        return ;
 +    }
 +    memset(base + cnt, -1, tot - cnt);
 +}
 +
 +void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
 +                CPURISCVState *env, uint32_t desc,
 +                opivv2_fn *fn, uint32_t esz)
 +{
 +    uint32_t vm = vext_vm(desc);
 +    uint32_t vl = env->vl;
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t vma = vext_vma(desc);
 +    uint32_t i;
 +
 +    for (i = env->vstart; i < vl; i++) {
 +        if (!vm && !vext_elem_mask(v0, i)) {
 +            /* set masked-off elements to 1s */
 +            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
 +            continue;
 +        }
 +        fn(vd, vs1, vs2, i);
 +    }
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
 +}
 +
 +void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
 +                CPURISCVState *env, uint32_t desc,
 +                opivx2_fn fn, uint32_t esz)
 +{
 +    uint32_t vm = vext_vm(desc);
 +    uint32_t vl = env->vl;
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t vma = vext_vma(desc);
 +    uint32_t i;
 +
 +    for (i = env->vstart; i < vl; i++) {
 +        if (!vm && !vext_elem_mask(v0, i)) {
 +            /* set masked-off elements to 1s */
 +            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
 +            continue;
 +        }
 +        fn(vd, s1, vs2, i);
 +    }
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
 +}
 diff --git a/target/riscv/meson.build b/target/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/meson.build
 +++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
    'gdbstub.c',
    'op_helper.c',
    'vector_helper.c',
 +  'vector_internals.c',
    'bitmanip_helper.c',
    'translate.c',
    'm128_helper.c',
 --
-.38.1
+.41.0

-[PULL v2 21/45] hw/misc: pfsoc: add fabric clocks to ioscb
+[PULL v2 09/45] target/riscv: Refactor vector-vector translation macro
-From: Conor Dooley <conor.dooley@microchip.com>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-On PolarFire SoC, some peripherals (eg the PCI root port) are clocked by
+Refactor the non SEW-specific stuff out of `GEN_OPIVV_TRANS` into
-"Clock Conditioning Circuitry" in the FPGA. The specific clock depends
+function `opivv_trans` (similar to `opivi_trans`). `opivv_trans` will be
-on the FPGA bitstream & can be locked to one particular {D,P}LL - in the
+used in proceeding vector-crypto commits.
 Icicle Kit Reference Design v2022.09 or later this is/will be the case.
-Linux v6.1+ will have a driver for this peripheral and devicetrees that
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-previously relied on "fixed-frequency" clock nodes have been switched
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-over to clock-controller nodes. The IOSCB region is represented in QEMU,
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-but the specific region of it that the CCCs occupy has not so v6.1-rcN
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-kernels fail to boot in QEMU.
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-3-max.chou@sifive.com>
 Add the regions as unimplemented so that the status-quo in terms of boot
 is maintained.
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
 Message-Id: <20221117225518.4102575-2-conor@kernel.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/misc/mchp_pfsoc_ioscb.h | 1 +
+ target/riscv/insn_trans/trans_rvv.c.inc | 62 +++++++++++++------------
- hw/misc/mchp_pfsoc_ioscb.c         | 6 ++++++
+file changed, 32 insertions(+), 30 deletions(-)
 files changed, 7 insertions(+)
-diff --git a/include/hw/misc/mchp_pfsoc_ioscb.h b/include/hw/misc/mchp_pfsoc_ioscb.h
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/mchp_pfsoc_ioscb.h
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/include/hw/misc/mchp_pfsoc_ioscb.h
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ typedef struct MchpPfSoCIoscbState {
+@@ -XXX,XX +XXX,XX @@ GEN_OPIWX_WIDEN_TRANS(vwadd_wx)
-     MemoryRegion lane23;
+ GEN_OPIWX_WIDEN_TRANS(vwsubu_wx)
-     MemoryRegion ctrl;
+ GEN_OPIWX_WIDEN_TRANS(vwsub_wx)
-     MemoryRegion cfg;
-+    MemoryRegion ccc;
++static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
-     MemoryRegion pll_mss;
++                        gen_helper_gvec_4_ptr *fn, DisasContext *s)
-     MemoryRegion cfm_mss;
++{
-     MemoryRegion pll_ddr;
++    uint32_t data = 0;
-diff --git a/hw/misc/mchp_pfsoc_ioscb.c b/hw/misc/mchp_pfsoc_ioscb.c
++    TCGLabel *over = gen_new_label();
-index XXXXXXX..XXXXXXX 100644
++    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
---- a/hw/misc/mchp_pfsoc_ioscb.c
++    tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-+++ b/hw/misc/mchp_pfsoc_ioscb.c
++
-@@ -XXX,XX +XXX,XX @@
++    data = FIELD_DP32(data, VDATA, VM, vm);
-  */
++    data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
- #define IOSCB_WHOLE_REG_SIZE        0x10000000
++    data = FIELD_DP32(data, VDATA, VTA, s->vta);
- #define IOSCB_SUBMOD_REG_SIZE       0x1000
++    data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
-+#define IOSCB_CCC_REG_SIZE          0x2000000
++    data = FIELD_DP32(data, VDATA, VMA, s->vma);
 +    tcg_gen_gvec_4_ptr(vreg_ofs(s, vd), vreg_ofs(s, 0), vreg_ofs(s, vs1),
 +                       vreg_ofs(s, vs2), cpu_env, s->cfg_ptr->vlen / 8,
 +                       s->cfg_ptr->vlen / 8, data, fn);
 +    mark_vs_dirty(s);
 +    gen_set_label(over);
 +    return true;
 +}
 +
  /* Vector Integer Add-with-Carry / Subtract-with-Borrow Instructions */
  /* OPIVV without GVEC IR */
 -#define GEN_OPIVV_TRANS(NAME, CHECK)                               \
 -static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
 -{                                                                  \
 -    if (CHECK(s, a)) {                                             \
 -        uint32_t data = 0;                                         \
 -        static gen_helper_gvec_4_ptr * const fns[4] = {            \
 -            gen_helper_##NAME##_b, gen_helper_##NAME##_h,          \
 -            gen_helper_##NAME##_w, gen_helper_##NAME##_d,          \
 -        };                                                         \
 -        TCGLabel *over = gen_new_label();                          \
 -        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
 -        tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
 -                                                                   \
 -        data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
 -        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
 -        data = FIELD_DP32(data, VDATA, VTA, s->vta);               \
 -        data =                                                     \
 -            FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);\
 -        data = FIELD_DP32(data, VDATA, VMA, s->vma);               \
 -        tcg_gen_gvec_4_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),     \
 -                           vreg_ofs(s, a->rs1),                    \
 -                           vreg_ofs(s, a->rs2), cpu_env,           \
 -                           s->cfg_ptr->vlen / 8,                   \
 -                           s->cfg_ptr->vlen / 8, data,             \
 -                           fns[s->sew]);                           \
 -        mark_vs_dirty(s);                                          \
 -        gen_set_label(over);                                       \
 -        return true;                                               \
 -    }                                                              \
 -    return false;                                                  \
 +#define GEN_OPIVV_TRANS(NAME, CHECK)                                     \
 +static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
 +{                                                                        \
 +    if (CHECK(s, a)) {                                                   \
 +        static gen_helper_gvec_4_ptr * const fns[4] = {                  \
 +            gen_helper_##NAME##_b, gen_helper_##NAME##_h,                \
 +            gen_helper_##NAME##_w, gen_helper_##NAME##_d,                \
 +        };                                                               \
 +        return opivv_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s);\
 +    }                                                                    \
 +    return false;                                                        \
  }
  /*
-  * There are many sub-modules in the IOSCB module.
-@@ -XXX,XX +XXX,XX @@
- #define IOSCB_LANE23_BASE           0x06510000
- #define IOSCB_CTRL_BASE             0x07020000
- #define IOSCB_CFG_BASE              0x07080000
-+#define IOSCB_CCC_BASE              0x08000000
- #define IOSCB_PLL_MSS_BASE          0x0E001000
- #define IOSCB_CFM_MSS_BASE          0x0E002000
- #define IOSCB_PLL_DDR_BASE          0x0E010000
-@@ -XXX,XX +XXX,XX @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
-                           "mchp.pfsoc.ioscb.cfg", IOSCB_SUBMOD_REG_SIZE);
-     memory_region_add_subregion(&s->container, IOSCB_CFG_BASE, &s->cfg);
-+    memory_region_init_io(&s->ccc, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
-+                          "mchp.pfsoc.ioscb.ccc", IOSCB_CCC_REG_SIZE);
-+    memory_region_add_subregion(&s->container, IOSCB_CCC_BASE, &s->ccc);
-+
-     memory_region_init_io(&s->pll_mss, OBJECT(s), &mchp_pfsoc_pll_ops, s,
-                           "mchp.pfsoc.ioscb.pll_mss", IOSCB_SUBMOD_REG_SIZE);
-     memory_region_add_subregion(&s->container, IOSCB_PLL_MSS_BASE, &s->pll_mss);
 --
-.38.1
+.41.0

-[PULL v2 37/45] hw/intc: sifive_plic: Use error_setg() to propagate the error up via errp in sifive_plic_realize()
+[PULL v2 10/45] target/riscv: Remove redundant "cpu_vl == 0" checks
-From: Bin Meng <bmeng@tinylab.org>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-The realize() callback has an errp for us to propagate the error up.
+Remove the redundant "vl == 0" check which is already included within the  vstart >= vl check, when vl == 0.
 While we are here, correct the wrong multi-line comment format.
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Message-Id: <20221211030829.802437-8-bmeng@tinylab.org>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <20230711165917.2629866-4-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/intc/sifive_plic.c | 7 ++++---
+ target/riscv/insn_trans/trans_rvv.c.inc | 31 +------------------------
-file changed, 4 insertions(+), 3 deletions(-)
+file changed, 1 insertion(+), 30 deletions(-)
-diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/sifive_plic.c
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/hw/intc/sifive_plic.c
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static void sifive_plic_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
-     s->m_external_irqs = g_malloc(sizeof(qemu_irq) * s->num_harts);
+     TCGv_i32 desc;
-     qdev_init_gpio_out(dev, s->m_external_irqs, s->num_harts);
+     TCGLabel *over = gen_new_label();
--    /* We can't allow the supervisor to control SEIP as this would allow the
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-+    /*
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-+     * We can't allow the supervisor to control SEIP as this would allow the
-      * supervisor to clear a pending external interrupt which will result in
+     dest = tcg_temp_new_ptr();
-      * lost a interrupt in the case a PLIC is attached. The SEIP bit must be
+@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
-      * hardware controlled when a PLIC is attached.
+     TCGv_i32 desc;
-@@ -XXX,XX +XXX,XX @@ static void sifive_plic_realize(DeviceState *dev, Error **errp)
-     for (i = 0; i < s->num_harts; i++) {
+     TCGLabel *over = gen_new_label();
-         RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(s->hartid_base + i));
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
-         if (riscv_cpu_claim_interrupts(cpu, MIP_SEIP) < 0) {
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
--            error_report("SEIP already claimed");
--            exit(1);
+     dest = tcg_temp_new_ptr();
-+            error_setg(errp, "SEIP already claimed");
+@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
-+            return;
+     TCGv_i32 desc;
-         }
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
      TCGv_i32 desc;
      TCGLabel *over = gen_new_label();
 -    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
      tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
      dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
          return false;
      }
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
+@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
+     uint32_t data = 0;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     dest = tcg_temp_new_ptr();
+@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
+     uint32_t data = 0;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     dest = tcg_temp_new_ptr();
+@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
+     if (checkfn(s, a)) {
+         uint32_t data = 0;
+         TCGLabel *over = gen_new_label();
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         data = FIELD_DP32(data, VDATA, VM, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
+     if (opiwv_widen_check(s, a)) {
+         uint32_t data = 0;
+         TCGLabel *over = gen_new_label();
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         data = FIELD_DP32(data, VDATA, VM, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
+ {
+     uint32_t data = 0;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     data = FIELD_DP32(data, VDATA, VM, vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+             gen_helper_##NAME##_w,                                 \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
+                 gen_helper_vmv_v_v_w, gen_helper_vmv_v_v_d,
+             };
+             TCGLabel *over = gen_new_label();
+-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+             tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
+         vext_check_ss(s, a->rd, 0, 1)) {
+         TCGv s1;
+         TCGLabel *over = gen_new_label();
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         s1 = get_gpr(s, a->rs1, EXT_SIGN);
+@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
+                 gen_helper_vmv_v_x_w, gen_helper_vmv_v_x_d,
+             };
+             TCGLabel *over = gen_new_label();
+-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+             s1 = tcg_constant_i64(simm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm(s, RISCV_FRM_DYN);                              \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
+     TCGv_i64 t1;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     dest = tcg_temp_new_ptr();
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
+         };                                                       \
+         TCGLabel *over = gen_new_label();                        \
+         gen_set_rm(s, RISCV_FRM_DYN);                            \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);        \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);\
+                                                                  \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm(s, RISCV_FRM_DYN);                              \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
+         uint32_t data = 0;
+         TCGLabel *over = gen_new_label();
+         gen_set_rm_chkfrm(s, rm);
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         data = FIELD_DP32(data, VDATA, VM, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
+                 gen_helper_vmv_v_x_d,
+             };
+             TCGLabel *over = gen_new_label();
+-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+             t1 = tcg_temp_new_i64();
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm_chkfrm(s, FRM);                                 \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm(s, RISCV_FRM_DYN);                              \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm_chkfrm(s, FRM);                                 \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
+         };                                                         \
+         TCGLabel *over = gen_new_label();                          \
+         gen_set_rm_chkfrm(s, FRM);                                 \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
+         uint32_t data = 0;                                         \
+         gen_helper_gvec_4_ptr *fn = gen_helper_##NAME;             \
+         TCGLabel *over = gen_new_label();                          \
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
+                                                                    \
+         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
+@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
+         require_vm(a->vm, a->rd)) {
+         uint32_t data = 0;
+         TCGLabel *over = gen_new_label();
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         data = FIELD_DP32(data, VDATA, VM, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_s_x(DisasContext *s, arg_vmv_s_x *a)
+         TCGv s1;
+         TCGLabel *over = gen_new_label();
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         t1 = tcg_temp_new_i64();
+@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
+         TCGv_i64 t1;
+         TCGLabel *over = gen_new_label();
+-        /* if vl == 0 or vstart >= vl, skip vector register write back */
+-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
++        /* if vstart >= vl, skip vector register write back */
+         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+         /* NaN-box f[rs1] */
+@@ -XXX,XX +XXX,XX @@ static bool int_ext_op(DisasContext *s, arg_rmr *a, uint8_t seq)
+     uint32_t data = 0;
+     gen_helper_gvec_3_ptr *fn;
+     TCGLabel *over = gen_new_label();
+-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+     static gen_helper_gvec_3_ptr * const fns[6][4] = {
 --
-.38.1
+.41.0

-[PULL v2 29/45] RISC-V: Add Zawrs ISA extension support
+[PULL v2 11/45] target/riscv: Add Zvbc ISA extension support
-From: Christoph Muellner <christoph.muellner@vrull.eu>
+From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-This patch adds support for the Zawrs ISA extension.
+This commit adds support for the Zvbc vector-crypto extension, which
-Given the current (incomplete) implementation of reservation sets
+consists of the following instructions:
-there seems to be no way to provide a full emulation of the WRS
-instruction (wake on reservation set invalidation or timeout or
+* vclmulh.[vx,vv]
-interrupt). Therefore, we just exit the TB and return to the main loop.
+* vclmul.[vx,vv]
-The specification can be found here:
+Translation functions are defined in
-  https://github.com/riscv/riscv-zawrs/blob/main/zawrs.adoc
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
+`target/riscv/vcrypto_helper.c`.
-Note, that the Zawrs extension is frozen, but not ratified yet.
+Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Changes since v3:
+Co-authored-by: Max Chou <max.chou@sifive.com>
-* Remove "RFC" since the extension is frozen
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-* Rebase on master and fix integration issues
+Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-* Fix entry ordering in extension list
+Signed-off-by: Max Chou <max.chou@sifive.com>
+[max.chou@sifive.com: Exposed x-zvbc property]
-Changes since v2:
+Message-ID: <20230711165917.2629866-5-max.chou@sifive.com>
 * Rebase on master and resolve conflicts
 * Adjustments according to a specification change
 * Inline REQUIRE_ZAWRS() since it has only one user
 Changes since v1:
 * Adding zawrs to the ISA string that is passed to the kernel
 Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20221005144948.3421504-1-christoph.muellner@vrull.eu>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h                          |  1 +
+ target/riscv/cpu_cfg.h                   |  1 +
- target/riscv/insn32.decode                  |  4 ++
+ target/riscv/helper.h                    |  6 +++
- target/riscv/cpu.c                          |  7 +++
+ target/riscv/insn32.decode               |  6 +++
- target/riscv/translate.c                    |  1 +
+ target/riscv/cpu.c                       |  9 ++++
- target/riscv/insn_trans/trans_rvzawrs.c.inc | 51 +++++++++++++++++++++
+ target/riscv/translate.c                 |  1 +
-files changed, 64 insertions(+)
+ target/riscv/vcrypto_helper.c            | 59 ++++++++++++++++++++++
- create mode 100644 target/riscv/insn_trans/trans_rvzawrs.c.inc
+ target/riscv/insn_trans/trans_rvvk.c.inc | 62 ++++++++++++++++++++++++
+ target/riscv/meson.build                 |  3 +-
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+files changed, 146 insertions(+), 1 deletion(-)
-index XXXXXXX..XXXXXXX 100644
+ create mode 100644 target/riscv/vcrypto_helper.c
---- a/target/riscv/cpu.h
+ create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc
-+++ b/target/riscv/cpu.h
 diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_cfg.h
 +++ b/target/riscv/cpu_cfg.h
 @@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_svnapot;
+     bool ext_zve32f;
-     bool ext_svpbmt;
+     bool ext_zve64f;
-     bool ext_zdinx;
+     bool ext_zve64d;
-+    bool ext_zawrs;
++    bool ext_zvbc;
-     bool ext_zfh;
+     bool ext_zmmul;
-     bool ext_zfhmin;
+     bool ext_zvfbfmin;
-     bool ext_zfinx;
+     bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vfwcvtbf16_f_f_v, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vfwmaccbf16_vv, void, ptr, ptr, ptr, ptr, env, i32)
  DEF_HELPER_6(vfwmaccbf16_vf, void, ptr, ptr, i64, ptr, env, i32)
 +
 +/* Vector crypto functions */
 +DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
-@@ -XXX,XX +XXX,XX @@ vsetvli         0 ........... ..... 111 ..... 1010111  @r2_zimm11
+@@ -XXX,XX +XXX,XX @@ vfwcvtbf16_f_f_v  010010 . ..... 01101 001 ..... 1010111 @r2_vm
- vsetivli        11 .......... ..... 111 ..... 1010111  @r2_zimm10
+ # *** Zvfbfwma Standard Extension ***
- vsetvl          1000000 ..... ..... 111 ..... 1010111  @r
+ vfwmaccbf16_vv    111011 . ..... ..... 001 ..... 1010111 @r_vm
+ vfwmaccbf16_vf    111011 . ..... ..... 101 ..... 1010111 @r_vm
-+# *** Zawrs Standard Extension ***
++
-+wrs_nto    000000001101 00000 000 00000 1110011
++# *** Zvbc vector crypto extension ***
-+wrs_sto    000000011101 00000 000 00000 1110011
++vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
-+
++vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
- # *** RV32 Zba Standard Extension ***
++vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
- sh1add     0010000 .......... 010 ..... 0110011 @r
++vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
  sh2add     0010000 .......... 100 ..... 0110011 @r
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
 @@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
-     ISA_EXT_DATA_ENTRY(zicsr, true, PRIV_VERSION_1_10_0, ext_icsr),
+     ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
-     ISA_EXT_DATA_ENTRY(zifencei, true, PRIV_VERSION_1_10_0, ext_ifencei),
+     ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
-     ISA_EXT_DATA_ENTRY(zihintpause, true, PRIV_VERSION_1_10_0, ext_zihintpause),
+     ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
-+    ISA_EXT_DATA_ENTRY(zawrs, true, PRIV_VERSION_1_12_0, ext_zawrs),
++    ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
-     ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_12_0, ext_zfh),
+     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
-     ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_12_0, ext_zfhmin),
+     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
-     ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
+     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
-@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
-             return;
+         return;
-         }
+     }
-+        if ((cpu->cfg.ext_zawrs) && !cpu->cfg.ext_a) {
++    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
-+            error_setg(errp, "Zawrs extension requires A extension");
++        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
-+            return;
++        return;
-+        }
++    }
 +
-         if ((cpu->cfg.ext_zfh || cpu->cfg.ext_zfhmin) && !cpu->cfg.ext_f) {
+     if (cpu->cfg.ext_zk) {
-             error_setg(errp, "Zfh/Zfhmin extensions require F extension");
+         cpu->cfg.ext_zkn = true;
-             return;
+         cpu->cfg.ext_zkr = true;
 @@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
+     DEFINE_PROP_BOOL("x-zvfbfmin", RISCVCPU, cfg.ext_zvfbfmin, false),
-     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
+     DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
-     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
-+    DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
++    /* Vector cryptography extensions */
-     DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
++    DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
-     DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
++
-     DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
+     DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
 @@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
- #include "insn_trans/trans_rvh.c.inc"
+ #include "insn_trans/trans_rvzfa.c.inc"
  #include "insn_trans/trans_rvv.c.inc"
  #include "insn_trans/trans_rvb.c.inc"
 +#include "insn_trans/trans_rvzawrs.c.inc"
  #include "insn_trans/trans_rvzfh.c.inc"
  #include "insn_trans/trans_rvk.c.inc"
++#include "insn_trans/trans_rvvk.c.inc"
  #include "insn_trans/trans_privileged.c.inc"
-diff --git a/target/riscv/insn_trans/trans_rvzawrs.c.inc b/target/riscv/insn_trans/trans_rvzawrs.c.inc
+ #include "insn_trans/trans_svinval.c.inc"
  #include "insn_trans/trans_rvbf16.c.inc"
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/target/riscv/insn_trans/trans_rvzawrs.c.inc
++++ b/target/riscv/vcrypto_helper.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * RISC-V translation routines for the RISC-V Zawrs Extension.
++ * RISC-V Vector Crypto Extension Helpers for QEMU.
 + *
-+ * Copyright (c) 2022 Christoph Muellner, christoph.muellner@vrull.io
++ * Copyright (C) 2023 SiFive, Inc.
 + * Written by Codethink Ltd and SiFive.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 ...
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+static bool trans_wrs(DisasContext *ctx)
++#include "qemu/osdep.h"
-+{
++#include "qemu/host-utils.h"
-+    if (!ctx->cfg_ptr->ext_zawrs) {
++#include "qemu/bitops.h"
-+        return false;
++#include "cpu.h"
-+    }
++#include "exec/memop.h"
-+
++#include "exec/exec-all.h"
-+    /*
++#include "exec/helper-proto.h"
-+     * The specification says:
++#include "internals.h"
-+     * While stalled, an implementation is permitted to occasionally
++#include "vector_internals.h"
-+     * terminate the stall and complete execution for any reason.
++
-+     *
++static uint64_t clmul64(uint64_t y, uint64_t x)
-+     * So let's just exit TB and return to the main loop.
++{
-+     */
++    uint64_t result = 0;
-+
++    for (int j = 63; j >= 0; j--) {
-+    /* Clear the load reservation  (if any).  */
++        if ((y >> j) & 1) {
-+    tcg_gen_movi_tl(load_res, -1);
++            result ^= (x << j);
-+
++        }
-+    gen_set_pc_imm(ctx, ctx->pc_succ_insn);
++    }
-+    tcg_gen_exit_tb(NULL, 0);
++    return result;
-+    ctx->base.is_jmp = DISAS_NORETURN;
++}
 +
-+    return true;
++static uint64_t clmulh64(uint64_t y, uint64_t x)
-+}
++{
-+
++    uint64_t result = 0;
-+#define GEN_TRANS_WRS(insn)                                     \
++    for (int j = 63; j >= 1; j--) {
-+static bool trans_ ## insn(DisasContext *ctx, arg_ ## insn *a)  \
++        if ((y >> j) & 1) {
-+{                                                               \
++            result ^= (x >> (64 - j));
-+    (void)a;                                                    \
++        }
-+    return trans_wrs(ctx);                                      \
++    }
-+}
++    return result;
-+
++}
-+GEN_TRANS_WRS(wrs_nto)
++
-+GEN_TRANS_WRS(wrs_sto)
++RVVCALL(OPIVV2, vclmul_vv, OP_UUU_D, H8, H8, H8, clmul64)
 +GEN_VEXT_VV(vclmul_vv, 8)
 +RVVCALL(OPIVX2, vclmul_vx, OP_UUU_D, H8, H8, clmul64)
 +GEN_VEXT_VX(vclmul_vx, 8)
 +RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
 +GEN_VEXT_VV(vclmulh_vv, 8)
 +RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
 +GEN_VEXT_VX(vclmulh_vx, 8)
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@
 +/*
 + * RISC-V translation routines for the vector crypto extension.
 + *
 + * Copyright (C) 2023 SiFive, Inc.
 + * Written by Codethink Ltd and SiFive.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +/*
 + * Zvbc
 + */
 +
 +#define GEN_VV_MASKED_TRANS(NAME, CHECK)                     \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)   \
 +    {                                                        \
 +        if (CHECK(s, a)) {                                   \
 +            return opivv_trans(a->rd, a->rs1, a->rs2, a->vm, \
 +                               gen_helper_##NAME, s);        \
 +        }                                                    \
 +        return false;                                        \
 +    }
 +
 +static bool vclmul_vv_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return opivv_check(s, a) &&
 +           s->cfg_ptr->ext_zvbc == true &&
 +           s->sew == MO_64;
 +}
 +
 +GEN_VV_MASKED_TRANS(vclmul_vv, vclmul_vv_check)
 +GEN_VV_MASKED_TRANS(vclmulh_vv, vclmul_vv_check)
 +
 +#define GEN_VX_MASKED_TRANS(NAME, CHECK)                     \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)   \
 +    {                                                        \
 +        if (CHECK(s, a)) {                                   \
 +            return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, \
 +                               gen_helper_##NAME, s);        \
 +        }                                                    \
 +        return false;                                        \
 +    }
 +
 +static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return opivx_check(s, a) &&
 +           s->cfg_ptr->ext_zvbc == true &&
 +           s->sew == MO_64;
 +}
 +
 +GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
 +GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
 diff --git a/target/riscv/meson.build b/target/riscv/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/meson.build
 +++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
    'translate.c',
    'm128_helper.c',
    'crypto_helper.c',
 -  'zce_helper.c'
 +  'zce_helper.c',
 +  'vcrypto_helper.c'
  ))
  riscv_ss.add(when: 'CONFIG_KVM', if_true: files('kvm.c'), if_false: files('kvm-stub.c'))
 --
-.38.1
+.41.0

-[PULL v2 01/45] target/riscv: Fix PMP propagation for tlb
+[PULL v2 12/45] target/riscv: Move vector translation checks
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Only the pmp index that be checked by pmp_hart_has_privs can be used
+Move the checks out of `do_opiv{v,x,i}_gvec{,_shift}` functions
-by pmp_get_tlb_size to avoid an error pmp index.
+and into the corresponding macros. This enables the functions to be
 reused in proceeding commits without check duplication.
-Before modification, we may use an error pmp index. For example,
+Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-we check address 0x4fc, and the size 0x4 in pmp_hart_has_privs. If there
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-is an pmp rule, valid range is [0x4fc, 0x500), then pmp_hart_has_privs
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-will return true;
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Message-ID: <20230711165917.2629866-6-max.chou@sifive.com>
 However, this checked pmp index is discarded as pmp_hart_has_privs
 return bool value. In pmp_is_range_in_tlb, it will traverse all pmp
 rules. The tlb_sa will be 0x0, and tlb_ea will be 0xfff. If there is
 a pmp rule [0x10, 0x14), it will be misused as it is legal in
 pmp_get_tlb_size.
 As we have already known the correct pmp index, just remove the
 remove the pmp_is_range_in_tlb and get tlb size directly from
 pmp_get_tlb_size.
 Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20221012060016.30856-1-zhiwei_liu@linux.alibaba.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/pmp.h        |  6 +--
+ target/riscv/insn_trans/trans_rvv.c.inc | 28 +++++++++++--------------
- target/riscv/cpu_helper.c | 16 ++++---
+file changed, 12 insertions(+), 16 deletions(-)
  target/riscv/pmp.c        | 90 +++++++++++++--------------------------
 files changed, 42 insertions(+), 70 deletions(-)
-diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/pmp.h
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/target/riscv/pmp.h
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env);
+@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
- void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
+               gen_helper_gvec_4_ptr *fn)
      target_ulong val);
  target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
 -bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
 +int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
      target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
      target_ulong mode);
 -bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
 -                         target_ulong *tlb_size);
 +target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
 +                              target_ulong tlb_sa, target_ulong tlb_ea);
  void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
  void pmp_update_rule_nums(CPURISCVState *env);
  uint32_t pmp_get_num_rules(CPURISCVState *env);
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu_helper.c
 +++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address_pmp(CPURISCVState *env, int *prot,
                                      int mode)
  {
-     pmp_priv_t pmp_priv;
+     TCGLabel *over = gen_new_label();
--    target_ulong tlb_size_pmp = 0;
+-    if (!opivv_check(s, a)) {
-+    int pmp_index = -1;
+-        return false;
+-    }
-     if (!riscv_feature(env, RISCV_FEATURE_PMP)) {
-         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
-         return TRANSLATE_SUCCESS;
-     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
+         gen_helper_##NAME##_b, gen_helper_##NAME##_h,              \
--    if (!pmp_hart_has_privs(env, addr, size, 1 << access_type, &pmp_priv,
+         gen_helper_##NAME##_w, gen_helper_##NAME##_d,              \
--                            mode)) {
+     };                                                             \
-+    pmp_index = pmp_hart_has_privs(env, addr, size, 1 << access_type,
++    if (!opivv_check(s, a)) {                                      \
-+                                   &pmp_priv, mode);
++        return false;                                              \
-+    if (pmp_index < 0) {
++    }                                                              \
-         *prot = 0;
+     return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);   \
-         return TRANSLATE_PMP_FAIL;
+ }
-     }
+@@ -XXX,XX +XXX,XX @@ static inline bool
-     *prot = pmp_priv_to_page_prot(pmp_priv);
+ do_opivx_gvec(DisasContext *s, arg_rmrr *a, GVecGen2sFn *gvec_fn,
--    if (tlb_size != NULL) {
+               gen_helper_opivx *fn)
 -        if (pmp_is_range_in_tlb(env, addr & ~(*tlb_size - 1), &tlb_size_pmp)) {
 -            *tlb_size = tlb_size_pmp;
 -        }
 +    if ((tlb_size != NULL) && pmp_index != MAX_RISCV_PMPS) {
 +        target_ulong tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
 +        target_ulong tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
 +
 +        *tlb_size = pmp_get_tlb_size(env, pmp_index, tlb_sa, tlb_ea);
      }
      return TRANSLATE_SUCCESS;
 diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/pmp.c
 +++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
  /*
   * Check if the address has required RWX privs to complete desired operation
 + * Return PMP rule index if a pmp rule match
 + * Return MAX_RISCV_PMPS if default match
 + * Return negtive value if no match
   */
 -bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
 +int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
      target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
      target_ulong mode)
  {
-@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+-    if (!opivx_check(s, a)) {
+-        return false;
      /* Short cut if no rules */
      if (0 == pmp_get_num_rules(env)) {
 -        return pmp_hart_has_privs_default(env, addr, size, privs,
 -                                          allowed_privs, mode);
 +        if (pmp_hart_has_privs_default(env, addr, size, privs,
 +                                       allowed_privs, mode)) {
 +            ret = MAX_RISCV_PMPS;
 +        }
      }
      if (size == 0) {
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
          if ((s + e) == 1) {
              qemu_log_mask(LOG_GUEST_ERROR,
                            "pmp violation - access is partially inside\n");
 -            ret = 0;
 +            ret = -1;
              break;
          }
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
                  }
              }
 -            ret = ((privs & *allowed_privs) == privs);
 +            if ((privs & *allowed_privs) == privs) {
 +                ret = i;
 +            }
              break;
          }
      }
      /* No rule matched */
      if (ret == -1) {
 -        return pmp_hart_has_privs_default(env, addr, size, privs,
 -                                          allowed_privs, mode);
 +        if (pmp_hart_has_privs_default(env, addr, size, privs,
 +                                       allowed_privs, mode)) {
 +            ret = MAX_RISCV_PMPS;
 +        }
      }
 -    return ret == 1 ? true : false;
 +    return ret;
  }
  /*
@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env)
   * Calculate the TLB size if the start address or the end address of
   * PMP entry is presented in the TLB page.
   */
 -static target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
 -                                     target_ulong tlb_sa, target_ulong tlb_ea)
 +target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
 +                              target_ulong tlb_sa, target_ulong tlb_ea)
  {
      target_ulong pmp_sa = env->pmp_state.addr[pmp_index].sa;
      target_ulong pmp_ea = env->pmp_state.addr[pmp_index].ea;
 -    if (pmp_sa >= tlb_sa && pmp_ea <= tlb_ea) {
 -        return pmp_ea - pmp_sa + 1;
 -    }
 -
--    if (pmp_sa >= tlb_sa && pmp_sa <= tlb_ea && pmp_ea >= tlb_ea) {
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
--        return tlb_ea - pmp_sa + 1;
+         TCGv_i64 src1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          gen_helper_##NAME##_b, gen_helper_##NAME##_h,              \
          gen_helper_##NAME##_w, gen_helper_##NAME##_d,              \
      };                                                             \
 +    if (!opivx_check(s, a)) {                                      \
 +        return false;                                              \
 +    }                                                              \
      return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);   \
  }
@@ -XXX,XX +XXX,XX @@ static inline bool
  do_opivi_gvec(DisasContext *s, arg_rmrr *a, GVecGen2iFn *gvec_fn,
                gen_helper_opivx *fn, imm_mode_t imm_mode)
  {
 -    if (!opivx_check(s, a)) {
 -        return false;
 -    }
 -
--    if (pmp_ea <= tlb_ea && pmp_ea >= tlb_sa && pmp_sa <= tlb_sa) {
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
--        return pmp_ea - tlb_sa + 1;
+         gvec_fn(s->sew, vreg_ofs(s, a->rd), vreg_ofs(s, a->rs2),
                  extract_imm(s, a->rs1, imm_mode), MAXSZ(s), MAXSZ(s));
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
          gen_helper_##OPIVX##_b, gen_helper_##OPIVX##_h,            \
          gen_helper_##OPIVX##_w, gen_helper_##OPIVX##_d,            \
      };                                                             \
 +    if (!opivx_check(s, a)) {                                      \
 +        return false;                                              \
 +    }                                                              \
      return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF,                 \
                           fns[s->sew], IMM_MODE);                   \
  }
@@ -XXX,XX +XXX,XX @@ static inline bool
  do_opivx_gvec_shift(DisasContext *s, arg_rmrr *a, GVecGen2sFn32 *gvec_fn,
                      gen_helper_opivx *fn)
  {
 -    if (!opivx_check(s, a)) {
 -        return false;
 -    }
 -
--    return 0;
+     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
--}
+         TCGv_i32 src1 = tcg_temp_new_i32();
--
--/*
+@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
-- * Check is there a PMP entry which range covers this page. If so,
+         gen_helper_##NAME##_b, gen_helper_##NAME##_h,                     \
-- * try to find the minimum granularity for the TLB size.
+         gen_helper_##NAME##_w, gen_helper_##NAME##_d,                     \
-- */
+     };                                                                    \
--bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
+-                                                                          \
--                         target_ulong *tlb_size)
++    if (!opivx_check(s, a)) {                                             \
--{
++        return false;                                                     \
--    int i;
++    }                                                                     \
--    target_ulong val;
+     return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, fns[s->sew]);    \
 -    target_ulong tlb_ea = (tlb_sa + TARGET_PAGE_SIZE - 1);
 -
 -    for (i = 0; i < MAX_RISCV_PMPS; i++) {
 -        val = pmp_get_tlb_size(env, i, tlb_sa, tlb_ea);
 -        if (val) {
 -            if (*tlb_size == 0 || *tlb_size > val) {
 -                *tlb_size = val;
 -            }
 -        }
 -    }
 -
 -    if (*tlb_size != 0) {
 +    if (pmp_sa <= tlb_sa && pmp_ea >= tlb_ea) {
 +        return TARGET_PAGE_SIZE;
 +    } else {
          /*
 -         * At this point we have a tlb_size that is the smallest possible size
 -         * That fits within a TARGET_PAGE_SIZE and the PMP region.
 -         *
 -         * If the size is less then TARGET_PAGE_SIZE we drop the size to 1.
 -         * This means the result isn't cached in the TLB and is only used for
 -         * a single translation.
 -         */
 -        if (*tlb_size < TARGET_PAGE_SIZE) {
 -            *tlb_size = 1;
 -        }
 -
 -        return true;
 +        * At this point we have a tlb_size that is the smallest possible size
 +        * That fits within a TARGET_PAGE_SIZE and the PMP region.
 +        *
 +        * If the size is less then TARGET_PAGE_SIZE we drop the size to 1.
 +        * This means the result isn't cached in the TLB and is only used for
 +        * a single translation.
 +        */
 +        return 1;
      }
 -
 -    return false;
  }
- /*
 --
-.38.1
+.41.0

-[PULL v2 06/45] tcg/riscv: Fix base register for user-only qemu_ld/st
+[PULL v2 13/45] target/riscv: Refactor translation of vector-widening instruction
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Dickon Hood <dickon.hood@codethink.co.uk>
-When guest_base != 0, we were not coordinating the usage of
+Zvbb (implemented in later commit) has a widening instruction, which
-TCG_REG_TMP0 as base properly, leading to a previous zero-extend
+requires an extra check on the enabled extensions.  Refactor
-of the input address being discarded.
+GEN_OPIVX_WIDEN_TRANS() to take a check function to avoid reimplementing
 it.
-Shuffle the alignment check to the front, because that does not
+Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
-depend on the zero-extend, and it keeps the register usage clear.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Set base after each step of the address arithmetic instead of before.
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Return the base register used from tcg_out_tlb_load, so as to
+Message-ID: <20230711165917.2629866-7-max.chou@sifive.com>
 keep that register choice localized to that function.
 Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20221023233337.2846860-1-richard.henderson@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- tcg/riscv/tcg-target.c.inc | 39 +++++++++++++++++++++-----------------
+ target/riscv/insn_trans/trans_rvv.c.inc | 52 +++++++++++--------------
-file changed, 22 insertions(+), 17 deletions(-)
+file changed, 23 insertions(+), 29 deletions(-)
-diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
+diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/riscv/tcg-target.c.inc
+--- a/target/riscv/insn_trans/trans_rvv.c.inc
-+++ b/tcg/riscv/tcg-target.c.inc
++++ b/target/riscv/insn_trans/trans_rvv.c.inc
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_goto(TCGContext *s, const tcg_insn_unit *target)
+@@ -XXX,XX +XXX,XX @@ static bool opivx_widen_check(DisasContext *s, arg_rmrr *a)
-     tcg_debug_assert(ok);
+            vext_check_ds(s, a->rd, a->rs2, a->vm);
  }
--static void tcg_out_tlb_load(TCGContext *s, TCGReg addrl,
+-static bool do_opivx_widen(DisasContext *s, arg_rmrr *a,
--                             TCGReg addrh, MemOpIdx oi,
+-                           gen_helper_opivx *fn)
--                             tcg_insn_unit **label_ptr, bool is_load)
+-{
-+static TCGReg tcg_out_tlb_load(TCGContext *s, TCGReg addrl,
+-    if (opivx_widen_check(s, a)) {
-+                               TCGReg addrh, MemOpIdx oi,
+-        return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, fn, s);
-+                               tcg_insn_unit **label_ptr, bool is_load)
+-    }
- {
+-    return false;
-     MemOp opc = get_memop(oi);
+-}
-     unsigned s_bits = opc & MO_SIZE;
+-
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg addrl,
+-#define GEN_OPIVX_WIDEN_TRANS(NAME) \
-         addrl = TCG_REG_TMP0;
+-static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
-     }
+-{                                                            \
-     tcg_out_opc_reg(s, OPC_ADD, TCG_REG_TMP0, TCG_REG_TMP2, addrl);
+-    static gen_helper_opivx * const fns[3] = {               \
-+    return TCG_REG_TMP0;
+-        gen_helper_##NAME##_b,                               \
 -        gen_helper_##NAME##_h,                               \
 -        gen_helper_##NAME##_w                                \
 -    };                                                       \
 -    return do_opivx_widen(s, a, fns[s->sew]);                \
 +#define GEN_OPIVX_WIDEN_TRANS(NAME, CHECK) \
 +static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
 +{                                                                         \
 +    if (CHECK(s, a)) {                                                    \
 +        static gen_helper_opivx * const fns[3] = {                        \
 +            gen_helper_##NAME##_b,                                        \
 +            gen_helper_##NAME##_h,                                        \
 +            gen_helper_##NAME##_w                                         \
 +        };                                                                \
 +        return opivx_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s); \
 +    }                                                                     \
 +    return false;                                                         \
  }
- static void add_qemu_ldst_label(TCGContext *s, int is_ld, MemOpIdx oi,
+-GEN_OPIVX_WIDEN_TRANS(vwaddu_vx)
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
+-GEN_OPIVX_WIDEN_TRANS(vwadd_vx)
- #else
+-GEN_OPIVX_WIDEN_TRANS(vwsubu_vx)
-     unsigned a_bits;
+-GEN_OPIVX_WIDEN_TRANS(vwsub_vx)
- #endif
++GEN_OPIVX_WIDEN_TRANS(vwaddu_vx, opivx_widen_check)
--    TCGReg base = TCG_REG_TMP0;
++GEN_OPIVX_WIDEN_TRANS(vwadd_vx, opivx_widen_check)
-+    TCGReg base;
++GEN_OPIVX_WIDEN_TRANS(vwsubu_vx, opivx_widen_check)
++GEN_OPIVX_WIDEN_TRANS(vwsub_vx, opivx_widen_check)
-     data_regl = *args++;
-     data_regh = (TCG_TARGET_REG_BITS == 32 && is_64 ? *args++ : 0);
+ /* WIDEN OPIVV with WIDEN */
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
+ static bool opiwv_widen_check(DisasContext *s, arg_rmrr *a)
-     opc = get_memop(oi);
+@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vrem_vx, opivx_check)
+ GEN_OPIVV_WIDEN_TRANS(vwmul_vv, opivv_widen_check)
- #if defined(CONFIG_SOFTMMU)
+ GEN_OPIVV_WIDEN_TRANS(vwmulu_vv, opivv_widen_check)
--    tcg_out_tlb_load(s, addr_regl, addr_regh, oi, label_ptr, 1);
+ GEN_OPIVV_WIDEN_TRANS(vwmulsu_vv, opivv_widen_check)
-+    base = tcg_out_tlb_load(s, addr_regl, addr_regh, oi, label_ptr, 1);
+-GEN_OPIVX_WIDEN_TRANS(vwmul_vx)
-     tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
+-GEN_OPIVX_WIDEN_TRANS(vwmulu_vx)
-     add_qemu_ldst_label(s, 1, oi,
+-GEN_OPIVX_WIDEN_TRANS(vwmulsu_vx)
-                         (is_64 ? TCG_TYPE_I64 : TCG_TYPE_I32),
++GEN_OPIVX_WIDEN_TRANS(vwmul_vx, opivx_widen_check)
-                         data_regl, data_regh, addr_regl, addr_regh,
++GEN_OPIVX_WIDEN_TRANS(vwmulu_vx, opivx_widen_check)
-                         s->code_ptr, label_ptr);
++GEN_OPIVX_WIDEN_TRANS(vwmulsu_vx, opivx_widen_check)
- #else
--    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+ /* Vector Single-Width Integer Multiply-Add Instructions */
--        tcg_out_ext32u(s, base, addr_regl);
+ GEN_OPIVV_TRANS(vmacc_vv, opivv_check)
--        addr_regl = base;
+@@ -XXX,XX +XXX,XX @@ GEN_OPIVX_TRANS(vnmsub_vx, opivx_check)
--    }
+ GEN_OPIVV_WIDEN_TRANS(vwmaccu_vv, opivv_widen_check)
-     a_bits = get_alignment_bits(opc);
+ GEN_OPIVV_WIDEN_TRANS(vwmacc_vv, opivv_widen_check)
-     if (a_bits) {
+ GEN_OPIVV_WIDEN_TRANS(vwmaccsu_vv, opivv_widen_check)
-         tcg_out_test_alignment(s, true, addr_regl, a_bits);
+-GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx)
-     }
+-GEN_OPIVX_WIDEN_TRANS(vwmacc_vx)
-+    base = addr_regl;
+-GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx)
-+    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+-GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx)
-+        tcg_out_ext32u(s, TCG_REG_TMP0, base);
++GEN_OPIVX_WIDEN_TRANS(vwmaccu_vx, opivx_widen_check)
-+        base = TCG_REG_TMP0;
++GEN_OPIVX_WIDEN_TRANS(vwmacc_vx, opivx_widen_check)
-+    }
++GEN_OPIVX_WIDEN_TRANS(vwmaccsu_vx, opivx_widen_check)
-     if (guest_base != 0) {
++GEN_OPIVX_WIDEN_TRANS(vwmaccus_vx, opivx_widen_check)
--        tcg_out_opc_reg(s, OPC_ADD, base, TCG_GUEST_BASE_REG, addr_regl);
-+        tcg_out_opc_reg(s, OPC_ADD, TCG_REG_TMP0, TCG_GUEST_BASE_REG, base);
+ /* Vector Integer Merge and Move Instructions */
-+        base = TCG_REG_TMP0;
+ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
      }
      tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
  #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
  #else
      unsigned a_bits;
  #endif
 -    TCGReg base = TCG_REG_TMP0;
 +    TCGReg base;
      data_regl = *args++;
      data_regh = (TCG_TARGET_REG_BITS == 32 && is_64 ? *args++ : 0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
      opc = get_memop(oi);
  #if defined(CONFIG_SOFTMMU)
 -    tcg_out_tlb_load(s, addr_regl, addr_regh, oi, label_ptr, 0);
 +    base = tcg_out_tlb_load(s, addr_regl, addr_regh, oi, label_ptr, 0);
      tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
      add_qemu_ldst_label(s, 0, oi,
                          (is_64 ? TCG_TYPE_I64 : TCG_TYPE_I32),
                          data_regl, data_regh, addr_regl, addr_regh,
                          s->code_ptr, label_ptr);
  #else
 -    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
 -        tcg_out_ext32u(s, base, addr_regl);
 -        addr_regl = base;
 -    }
      a_bits = get_alignment_bits(opc);
      if (a_bits) {
          tcg_out_test_alignment(s, false, addr_regl, a_bits);
      }
 +    base = addr_regl;
 +    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
 +        tcg_out_ext32u(s, TCG_REG_TMP0, base);
 +        base = TCG_REG_TMP0;
 +    }
      if (guest_base != 0) {
 -        tcg_out_opc_reg(s, OPC_ADD, base, TCG_GUEST_BASE_REG, addr_regl);
 +        tcg_out_opc_reg(s, OPC_ADD, TCG_REG_TMP0, TCG_GUEST_BASE_REG, base);
 +        base = TCG_REG_TMP0;
      }
      tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
  #endif
 --
-.38.1
+.41.0

-[PULL v2 35/45] hw/intc: sifive_plic: Drop PLICMode_H
+[PULL v2 14/45] target/riscv: Refactor some of the generic vector functionality
-From: Bin Meng <bmeng@tinylab.org>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-H-mode has been removed since priv spec 1.10. Drop it.
+Move some macros out of `vector_helper` and into `vector_internals`.
 This ensures they can be used by both vector and vector-crypto helpers
 (latter implemented in proceeding commits).
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Message-Id: <20221211030829.802437-6-bmeng@tinylab.org>
+Message-ID: <20230711165917.2629866-8-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/intc/sifive_plic.h | 1 -
+ target/riscv/vector_internals.h | 46 +++++++++++++++++++++++++++++++++
- hw/intc/sifive_plic.c         | 1 -
+ target/riscv/vector_helper.c    | 42 ------------------------------
-files changed, 2 deletions(-)
+files changed, 46 insertions(+), 42 deletions(-)
-diff --git a/include/hw/intc/sifive_plic.h b/include/hw/intc/sifive_plic.h
+diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/sifive_plic.h
+--- a/target/riscv/vector_internals.h
-+++ b/include/hw/intc/sifive_plic.h
++++ b/target/riscv/vector_internals.h
-@@ -XXX,XX +XXX,XX @@ DECLARE_INSTANCE_CHECKER(SiFivePLICState, SIFIVE_PLIC,
+@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
- typedef enum PLICMode {
+ /* expand macro args before macro */
-     PLICMode_U,
+ #define RVVCALL(macro, ...)  macro(__VA_ARGS__)
-     PLICMode_S,
--    PLICMode_H,
++/* (TD, T2, TX2) */
-     PLICMode_M
++#define OP_UU_B uint8_t, uint8_t, uint8_t
- } PLICMode;
++#define OP_UU_H uint16_t, uint16_t, uint16_t
++#define OP_UU_W uint32_t, uint32_t, uint32_t
-diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
++#define OP_UU_D uint64_t, uint64_t, uint64_t
 +
  /* (TD, T1, T2, TX1, TX2) */
  #define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
  #define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
  #define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
  #define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 +#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 +static void do_##NAME(void *vd, void *vs2, int i)      \
 +{                                                      \
 +    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
 +    *((TD *)vd + HD(i)) = OP(s2);                      \
 +}
 +
 +#define GEN_VEXT_V(NAME, ESZ)                          \
 +void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
 +                  CPURISCVState *env, uint32_t desc)   \
 +{                                                      \
 +    uint32_t vm = vext_vm(desc);                       \
 +    uint32_t vl = env->vl;                             \
 +    uint32_t total_elems =                             \
 +        vext_get_total_elems(env, desc, ESZ);          \
 +    uint32_t vta = vext_vta(desc);                     \
 +    uint32_t vma = vext_vma(desc);                     \
 +    uint32_t i;                                        \
 +                                                       \
 +    for (i = env->vstart; i < vl; i++) {               \
 +        if (!vm && !vext_elem_mask(v0, i)) {           \
 +            /* set masked-off elements to 1s */        \
 +            vext_set_elems_1s(vd, vma, i * ESZ,        \
 +                              (i + 1) * ESZ);          \
 +            continue;                                  \
 +        }                                              \
 +        do_##NAME(vd, vs2, i);                         \
 +    }                                                  \
 +    env->vstart = 0;                                   \
 +    /* set tail elements to 1s */                      \
 +    vext_set_elems_1s(vd, vta, vl * ESZ,               \
 +                      total_elems * ESZ);              \
 +}
 +
  /* operation of two vector elements */
  typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
                 do_##NAME, ESZ);                           \
  }
 +/* Three of the widening shortening macros: */
 +/* (TD, T1, T2, TX1, TX2) */
 +#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
 +#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
 +#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
 +
  #endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
 diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/sifive_plic.c
+--- a/target/riscv/vector_helper.c
-+++ b/hw/intc/sifive_plic.c
++++ b/target/riscv/vector_helper.c
-@@ -XXX,XX +XXX,XX @@ static PLICMode char_to_mode(char c)
+@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
-     switch (c) {
+ #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
-     case 'U': return PLICMode_U;
+ #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
-     case 'S': return PLICMode_S;
+ #define OP_SUS_D int64_t, uint64_t, int64_t, uint64_t, int64_t
--    case 'H': return PLICMode_H;
+-#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
-     case 'M': return PLICMode_M;
+-#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
-     default:
+-#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
-         error_report("plic: invalid mode '%c'", c);
+ #define WOP_SSS_B int16_t, int8_t, int8_t, int16_t, int16_t
  #define WOP_SSS_H int32_t, int16_t, int16_t, int32_t, int32_t
  #define WOP_SSS_W int64_t, int32_t, int32_t, int64_t, int64_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_h, 4)
  GEN_VEXT_VF(vfwnmsac_vf_w, 8)
  /* Vector Floating-Point Square-Root Instruction */
 -/* (TD, T2, TX2) */
 -#define OP_UU_H uint16_t, uint16_t, uint16_t
 -#define OP_UU_W uint32_t, uint32_t, uint32_t
 -#define OP_UU_D uint64_t, uint64_t, uint64_t
 -
  #define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
  static void do_##NAME(void *vd, void *vs2, int i,      \
                        CPURISCVState *env)              \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
  GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
  /* Vector Floating-Point Classify Instruction */
 -#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 -static void do_##NAME(void *vd, void *vs2, int i)      \
 -{                                                      \
 -    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
 -    *((TD *)vd + HD(i)) = OP(s2);                      \
 -}
 -
 -#define GEN_VEXT_V(NAME, ESZ)                          \
 -void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
 -                  CPURISCVState *env, uint32_t desc)   \
 -{                                                      \
 -    uint32_t vm = vext_vm(desc);                       \
 -    uint32_t vl = env->vl;                             \
 -    uint32_t total_elems =                             \
 -        vext_get_total_elems(env, desc, ESZ);          \
 -    uint32_t vta = vext_vta(desc);                     \
 -    uint32_t vma = vext_vma(desc);                     \
 -    uint32_t i;                                        \
 -                                                       \
 -    for (i = env->vstart; i < vl; i++) {               \
 -        if (!vm && !vext_elem_mask(v0, i)) {           \
 -            /* set masked-off elements to 1s */        \
 -            vext_set_elems_1s(vd, vma, i * ESZ,        \
 -                              (i + 1) * ESZ);          \
 -            continue;                                  \
 -        }                                              \
 -        do_##NAME(vd, vs2, i);                         \
 -    }                                                  \
 -    env->vstart = 0;                                   \
 -    /* set tail elements to 1s */                      \
 -    vext_set_elems_1s(vd, vta, vl * ESZ,               \
 -                      total_elems * ESZ);              \
 -}
 -
  target_ulong fclass_h(uint64_t frs1)
  {
      float16 f = frs1;
 --
-.38.1
+.41.0

-[PULL v2 12/45] target/riscv: Add itrigger support when icount is not enabled
+[PULL v2 15/45] target/riscv: Add Zvbb ISA extension support
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+From: Dickon Hood <dickon.hood@codethink.co.uk>
-When icount is not enabled, there is no API in QEMU that can get the
+This commit adds support for the Zvbb vector-crypto extension, which
-guest instruction number.
+consists of the following instructions:
-Translate the guest code in a way that each TB only has one instruction.
+* vrol.[vv,vx]
-After executing the instruction, decrease the count by 1 until it reaches 0
+* vror.[vv,vx,vi]
-where the itrigger fires.
+* vbrev8.v
 * vrev8.v
 * vandn.[vv,vx]
 * vbrev.v
 * vclz.v
 * vctz.v
 * vcpop.v
 * vwsll.[vv,vx,vi]
-Note that only when priviledge matches the itrigger configuration,
+Translation functions are defined in
-the count will decrease.
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
-Message-Id: <20221013062946.7530-2-zhiwei_liu@linux.alibaba.com>
+Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 [max.chou@sifive.com: Fix imm mode of vror.vi]
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvbb property]
 Message-ID: <20230711165917.2629866-9-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h                            |  2 +
+ target/riscv/cpu_cfg.h                   |   1 +
- target/riscv/debug.h                          | 12 ++++
+ target/riscv/helper.h                    |  62 +++++++++
- target/riscv/helper.h                         |  2 +
+ target/riscv/insn32.decode               |  20 +++
- target/riscv/cpu_helper.c                     |  6 ++
+ target/riscv/cpu.c                       |  12 ++
- target/riscv/debug.c                          | 71 +++++++++++++++++++
+ target/riscv/vcrypto_helper.c            | 138 +++++++++++++++++++
- target/riscv/translate.c                      | 33 ++++++++-
+ target/riscv/insn_trans/trans_rvvk.c.inc | 164 +++++++++++++++++++++++
- .../riscv/insn_trans/trans_privileged.c.inc   |  4 +-
+files changed, 397 insertions(+)
  target/riscv/insn_trans/trans_rvi.c.inc       |  8 +--
  target/riscv/insn_trans/trans_rvv.c.inc       |  4 +-
 files changed, 131 insertions(+), 11 deletions(-)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
+--- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/cpu.h
++++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, PM_MASK_ENABLED, 22, 1)
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
- FIELD(TB_FLAGS, PM_BASE_ENABLED, 23, 1)
+     bool ext_zve32f;
- FIELD(TB_FLAGS, VTA, 24, 1)
+     bool ext_zve64f;
- FIELD(TB_FLAGS, VMA, 25, 1)
+     bool ext_zve64d;
-+/* Native debug itrigger */
++    bool ext_zvbb;
-+FIELD(TB_FLAGS, ITRIGGER, 26, 1)
+     bool ext_zvbc;
+     bool ext_zmmul;
- #ifdef TARGET_RISCV32
+     bool ext_zvfbfmin;
  #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
 diff --git a/target/riscv/debug.h b/target/riscv/debug.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.h
 +++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ enum {
      SIZE_NUM = 16
  };
 +/* itrigger filed masks */
 +#define ITRIGGER_ACTION       0x3f
 +#define ITRIGGER_U            BIT(6)
 +#define ITRIGGER_S            BIT(7)
 +#define ITRIGGER_PENDING      BIT(8)
 +#define ITRIGGER_M            BIT(9)
 +#define ITRIGGER_COUNT        (0x3fff << 10)
 +#define ITRIGGER_HIT          BIT(24)
 +#define ITRIGGER_VU           BIT(25)
 +#define ITRIGGER_VS           BIT(26)
 +
  bool tdata_available(CPURISCVState *env, int tdata_index);
  target_ulong tselect_csr_read(CPURISCVState *env);
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
  void riscv_trigger_init(CPURISCVState *env);
 +bool riscv_itrigger_enabled(CPURISCVState *env);
  #endif /* RISCV_DEBUG_H */
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(sret, tl, env)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
- DEF_HELPER_1(mret, tl, env)
+ DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
- DEF_HELPER_1(wfi, void, env)
+ DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
- DEF_HELPER_1(tlb_flush, void, env)
+ DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
-+/* Native Debug */
++
-+DEF_HELPER_1(itrigger_match, void, env)
++DEF_HELPER_6(vror_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
- #endif
++DEF_HELPER_6(vror_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
++DEF_HELPER_6(vror_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
- /* Hypervisor functions */
++DEF_HELPER_6(vror_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
++
 +DEF_HELPER_6(vror_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vror_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vrol_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vrol_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vrol_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vrol_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_5(vrev8_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vrev8_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev8_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vbrev_v_d, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vclz_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vclz_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vctz_v_d, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_b, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_h, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_w, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vcpop_v_d, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_6(vwsll_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vwsll_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_6(vandn_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 +DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/insn32.decode
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/insn32.decode
 @@ -XXX,XX +XXX,XX @@
- #include "tcg/tcg-op.h"
+ %imm_u    12:s20                 !function=ex_shift_12
- #include "trace.h"
+ %imm_bs   30:2                   !function=ex_shift_3
- #include "semihosting/common-semi.h"
+ %imm_rnum 20:4
-+#include "sysemu/cpu-timers.h"
++%imm_z6   26:1 15:5
- #include "cpu_bits.h"
-+#include "debug.h"
+ # Argument sets:
+ &empty
- int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
+@@ -XXX,XX +XXX,XX @@
- {
+ @r_vm    ...... vm:1 ..... ..... ... ..... ....... &rmrr %rs2 %rs1 %rd
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
+ @r_vm_1  ...... . ..... ..... ... ..... .......    &rmrr vm=1 %rs2 %rs1 %rd
-         flags = FIELD_DP32(flags, TB_FLAGS, MSTATUS_HS_VS,
+ @r_vm_0  ...... . ..... ..... ... ..... .......    &rmrr vm=0 %rs2 %rs1 %rd
-                            get_field(env->mstatus_hs, MSTATUS_VS));
++@r2_zimm6  ..... . vm:1 ..... ..... ... ..... .......  &rmrr %rs2 rs1=%imm_z6 %rd
  @r2_zimm11 . zimm:11  ..... ... ..... ....... %rs1 %rd
  @r2_zimm10 .. zimm:10  ..... ... ..... ....... %rs1 %rd
  @r2_s    .......   ..... ..... ... ..... ....... %rs2 %rs1
@@ -XXX,XX +XXX,XX @@ vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
  vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
  vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
  vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
 +
 +# *** Zvbb vector crypto extension ***
 +vrol_vv     010101 . ..... ..... 000 ..... 1010111 @r_vm
 +vrol_vx     010101 . ..... ..... 100 ..... 1010111 @r_vm
 +vror_vv     010100 . ..... ..... 000 ..... 1010111 @r_vm
 +vror_vx     010100 . ..... ..... 100 ..... 1010111 @r_vm
 +vror_vi     01010. . ..... ..... 011 ..... 1010111 @r2_zimm6
 +vbrev8_v    010010 . ..... 01000 010 ..... 1010111 @r2_vm
 +vrev8_v     010010 . ..... 01001 010 ..... 1010111 @r2_vm
 +vandn_vv    000001 . ..... ..... 000 ..... 1010111 @r_vm
 +vandn_vx    000001 . ..... ..... 100 ..... 1010111 @r_vm
 +vbrev_v     010010 . ..... 01010 010 ..... 1010111 @r2_vm
 +vclz_v      010010 . ..... 01100 010 ..... 1010111 @r2_vm
 +vctz_v      010010 . ..... 01101 010 ..... 1010111 @r2_vm
 +vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
 +vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
 +vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
 +vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
      ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
      ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
 +    ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
      ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
      ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
      ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
          return;
      }
-+    if (riscv_feature(env, RISCV_FEATURE_DEBUG) && !icount_enabled()) {
-+        flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER,
++    /*
-+                           riscv_itrigger_enabled(env));
++     * In principle Zve*x would also suffice here, were they supported
-+    }
++     * in qemu
- #endif
++     */
++    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
-     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
++        error_setg(errp,
-diff --git a/target/riscv/debug.c b/target/riscv/debug.c
++                   "Vector crypto extensions require V or Zve* extensions");
 +        return;
 +    }
 +
      if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
          error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
      /* Vector cryptography extensions */
 +    DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
      DEFINE_PROP_END_OF_LIST(),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/debug.c
+--- a/target/riscv/vcrypto_helper.c
-+++ b/target/riscv/debug.c
++++ b/target/riscv/vcrypto_helper.c
 @@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qemu/host-utils.h"
+ #include "qemu/bitops.h"
++#include "qemu/bswap.h"
  #include "cpu.h"
- #include "trace.h"
+ #include "exec/memop.h"
  #include "exec/exec-all.h"
-+#include "exec/helper-proto.h"
+@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
+ GEN_VEXT_VV(vclmulh_vv, 8)
- /*
+ RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
-  * The following M-mode trigger CSRs are implemented:
+ GEN_VEXT_VX(vclmulh_vx, 8)
-@@ -XXX,XX +XXX,XX @@ static void type6_reg_write(CPURISCVState *env, target_ulong index,
++
-     return;
++RVVCALL(OPIVV2, vror_vv_b, OP_UUU_B, H1, H1, H1, ror8)
- }
++RVVCALL(OPIVV2, vror_vv_h, OP_UUU_H, H2, H2, H2, ror16)
++RVVCALL(OPIVV2, vror_vv_w, OP_UUU_W, H4, H4, H4, ror32)
-+/* icount trigger type */
++RVVCALL(OPIVV2, vror_vv_d, OP_UUU_D, H8, H8, H8, ror64)
-+static inline int
++GEN_VEXT_VV(vror_vv_b, 1)
-+itrigger_get_count(CPURISCVState *env, int index)
++GEN_VEXT_VV(vror_vv_h, 2)
 +GEN_VEXT_VV(vror_vv_w, 4)
 +GEN_VEXT_VV(vror_vv_d, 8)
 +
 +RVVCALL(OPIVX2, vror_vx_b, OP_UUU_B, H1, H1, ror8)
 +RVVCALL(OPIVX2, vror_vx_h, OP_UUU_H, H2, H2, ror16)
 +RVVCALL(OPIVX2, vror_vx_w, OP_UUU_W, H4, H4, ror32)
 +RVVCALL(OPIVX2, vror_vx_d, OP_UUU_D, H8, H8, ror64)
 +GEN_VEXT_VX(vror_vx_b, 1)
 +GEN_VEXT_VX(vror_vx_h, 2)
 +GEN_VEXT_VX(vror_vx_w, 4)
 +GEN_VEXT_VX(vror_vx_d, 8)
 +
 +RVVCALL(OPIVV2, vrol_vv_b, OP_UUU_B, H1, H1, H1, rol8)
 +RVVCALL(OPIVV2, vrol_vv_h, OP_UUU_H, H2, H2, H2, rol16)
 +RVVCALL(OPIVV2, vrol_vv_w, OP_UUU_W, H4, H4, H4, rol32)
 +RVVCALL(OPIVV2, vrol_vv_d, OP_UUU_D, H8, H8, H8, rol64)
 +GEN_VEXT_VV(vrol_vv_b, 1)
 +GEN_VEXT_VV(vrol_vv_h, 2)
 +GEN_VEXT_VV(vrol_vv_w, 4)
 +GEN_VEXT_VV(vrol_vv_d, 8)
 +
 +RVVCALL(OPIVX2, vrol_vx_b, OP_UUU_B, H1, H1, rol8)
 +RVVCALL(OPIVX2, vrol_vx_h, OP_UUU_H, H2, H2, rol16)
 +RVVCALL(OPIVX2, vrol_vx_w, OP_UUU_W, H4, H4, rol32)
 +RVVCALL(OPIVX2, vrol_vx_d, OP_UUU_D, H8, H8, rol64)
 +GEN_VEXT_VX(vrol_vx_b, 1)
 +GEN_VEXT_VX(vrol_vx_h, 2)
 +GEN_VEXT_VX(vrol_vx_w, 4)
 +GEN_VEXT_VX(vrol_vx_d, 8)
 +
 +static uint64_t brev8(uint64_t val)
 +{
-+    return get_field(env->tdata1[index], ITRIGGER_COUNT);
++    val = ((val & 0x5555555555555555ull) << 1) |
 +          ((val & 0xAAAAAAAAAAAAAAAAull) >> 1);
 +    val = ((val & 0x3333333333333333ull) << 2) |
 +          ((val & 0xCCCCCCCCCCCCCCCCull) >> 2);
 +    val = ((val & 0x0F0F0F0F0F0F0F0Full) << 4) |
 +          ((val & 0xF0F0F0F0F0F0F0F0ull) >> 4);
 +
 +    return val;
 +}
 +
-+static inline void
++RVVCALL(OPIVV1, vbrev8_v_b, OP_UU_B, H1, H1, brev8)
-+itrigger_set_count(CPURISCVState *env, int index, int value)
++RVVCALL(OPIVV1, vbrev8_v_h, OP_UU_H, H2, H2, brev8)
 +RVVCALL(OPIVV1, vbrev8_v_w, OP_UU_W, H4, H4, brev8)
 +RVVCALL(OPIVV1, vbrev8_v_d, OP_UU_D, H8, H8, brev8)
 +GEN_VEXT_V(vbrev8_v_b, 1)
 +GEN_VEXT_V(vbrev8_v_h, 2)
 +GEN_VEXT_V(vbrev8_v_w, 4)
 +GEN_VEXT_V(vbrev8_v_d, 8)
 +
 +#define DO_IDENTITY(a) (a)
 +RVVCALL(OPIVV1, vrev8_v_b, OP_UU_B, H1, H1, DO_IDENTITY)
 +RVVCALL(OPIVV1, vrev8_v_h, OP_UU_H, H2, H2, bswap16)
 +RVVCALL(OPIVV1, vrev8_v_w, OP_UU_W, H4, H4, bswap32)
 +RVVCALL(OPIVV1, vrev8_v_d, OP_UU_D, H8, H8, bswap64)
 +GEN_VEXT_V(vrev8_v_b, 1)
 +GEN_VEXT_V(vrev8_v_h, 2)
 +GEN_VEXT_V(vrev8_v_w, 4)
 +GEN_VEXT_V(vrev8_v_d, 8)
 +
 +#define DO_ANDN(a, b) ((a) & ~(b))
 +RVVCALL(OPIVV2, vandn_vv_b, OP_UUU_B, H1, H1, H1, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_h, OP_UUU_H, H2, H2, H2, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_w, OP_UUU_W, H4, H4, H4, DO_ANDN)
 +RVVCALL(OPIVV2, vandn_vv_d, OP_UUU_D, H8, H8, H8, DO_ANDN)
 +GEN_VEXT_VV(vandn_vv_b, 1)
 +GEN_VEXT_VV(vandn_vv_h, 2)
 +GEN_VEXT_VV(vandn_vv_w, 4)
 +GEN_VEXT_VV(vandn_vv_d, 8)
 +
 +RVVCALL(OPIVX2, vandn_vx_b, OP_UUU_B, H1, H1, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_h, OP_UUU_H, H2, H2, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_w, OP_UUU_W, H4, H4, DO_ANDN)
 +RVVCALL(OPIVX2, vandn_vx_d, OP_UUU_D, H8, H8, DO_ANDN)
 +GEN_VEXT_VX(vandn_vx_b, 1)
 +GEN_VEXT_VX(vandn_vx_h, 2)
 +GEN_VEXT_VX(vandn_vx_w, 4)
 +GEN_VEXT_VX(vandn_vx_d, 8)
 +
 +RVVCALL(OPIVV1, vbrev_v_b, OP_UU_B, H1, H1, revbit8)
 +RVVCALL(OPIVV1, vbrev_v_h, OP_UU_H, H2, H2, revbit16)
 +RVVCALL(OPIVV1, vbrev_v_w, OP_UU_W, H4, H4, revbit32)
 +RVVCALL(OPIVV1, vbrev_v_d, OP_UU_D, H8, H8, revbit64)
 +GEN_VEXT_V(vbrev_v_b, 1)
 +GEN_VEXT_V(vbrev_v_h, 2)
 +GEN_VEXT_V(vbrev_v_w, 4)
 +GEN_VEXT_V(vbrev_v_d, 8)
 +
 +RVVCALL(OPIVV1, vclz_v_b, OP_UU_B, H1, H1, clz8)
 +RVVCALL(OPIVV1, vclz_v_h, OP_UU_H, H2, H2, clz16)
 +RVVCALL(OPIVV1, vclz_v_w, OP_UU_W, H4, H4, clz32)
 +RVVCALL(OPIVV1, vclz_v_d, OP_UU_D, H8, H8, clz64)
 +GEN_VEXT_V(vclz_v_b, 1)
 +GEN_VEXT_V(vclz_v_h, 2)
 +GEN_VEXT_V(vclz_v_w, 4)
 +GEN_VEXT_V(vclz_v_d, 8)
 +
 +RVVCALL(OPIVV1, vctz_v_b, OP_UU_B, H1, H1, ctz8)
 +RVVCALL(OPIVV1, vctz_v_h, OP_UU_H, H2, H2, ctz16)
 +RVVCALL(OPIVV1, vctz_v_w, OP_UU_W, H4, H4, ctz32)
 +RVVCALL(OPIVV1, vctz_v_d, OP_UU_D, H8, H8, ctz64)
 +GEN_VEXT_V(vctz_v_b, 1)
 +GEN_VEXT_V(vctz_v_h, 2)
 +GEN_VEXT_V(vctz_v_w, 4)
 +GEN_VEXT_V(vctz_v_d, 8)
 +
 +RVVCALL(OPIVV1, vcpop_v_b, OP_UU_B, H1, H1, ctpop8)
 +RVVCALL(OPIVV1, vcpop_v_h, OP_UU_H, H2, H2, ctpop16)
 +RVVCALL(OPIVV1, vcpop_v_w, OP_UU_W, H4, H4, ctpop32)
 +RVVCALL(OPIVV1, vcpop_v_d, OP_UU_D, H8, H8, ctpop64)
 +GEN_VEXT_V(vcpop_v_b, 1)
 +GEN_VEXT_V(vcpop_v_h, 2)
 +GEN_VEXT_V(vcpop_v_w, 4)
 +GEN_VEXT_V(vcpop_v_d, 8)
 +
 +#define DO_SLL(N, M) (N << (M & (sizeof(N) * 8 - 1)))
 +RVVCALL(OPIVV2, vwsll_vv_b, WOP_UUU_B, H2, H1, H1, DO_SLL)
 +RVVCALL(OPIVV2, vwsll_vv_h, WOP_UUU_H, H4, H2, H2, DO_SLL)
 +RVVCALL(OPIVV2, vwsll_vv_w, WOP_UUU_W, H8, H4, H4, DO_SLL)
 +GEN_VEXT_VV(vwsll_vv_b, 2)
 +GEN_VEXT_VV(vwsll_vv_h, 4)
 +GEN_VEXT_VV(vwsll_vv_w, 8)
 +
 +RVVCALL(OPIVX2, vwsll_vx_b, WOP_UUU_B, H2, H1, DO_SLL)
 +RVVCALL(OPIVX2, vwsll_vx_h, WOP_UUU_H, H4, H2, DO_SLL)
 +RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
 +GEN_VEXT_VX(vwsll_vx_b, 2)
 +GEN_VEXT_VX(vwsll_vx_h, 4)
 +GEN_VEXT_VX(vwsll_vx_w, 8)
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
  GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
  GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
 +
 +/*
 + * Zvbb
 + */
 +
 +#define GEN_OPIVI_GVEC_TRANS_CHECK(NAME, IMM_MODE, OPIVX, SUF, CHECK)   \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)              \
 +    {                                                                   \
 +        if (CHECK(s, a)) {                                              \
 +            static gen_helper_opivx *const fns[4] = {                   \
 +                gen_helper_##OPIVX##_b,                                 \
 +                gen_helper_##OPIVX##_h,                                 \
 +                gen_helper_##OPIVX##_w,                                 \
 +                gen_helper_##OPIVX##_d,                                 \
 +            };                                                          \
 +            return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew], \
 +                                 IMM_MODE);                             \
 +        }                                                               \
 +        return false;                                                   \
 +    }
 +
 +#define GEN_OPIVV_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
 +    {                                                                    \
 +        if (CHECK(s, a)) {                                               \
 +            static gen_helper_gvec_4_ptr *const fns[4] = {               \
 +                gen_helper_##NAME##_b,                                   \
 +                gen_helper_##NAME##_h,                                   \
 +                gen_helper_##NAME##_w,                                   \
 +                gen_helper_##NAME##_d,                                   \
 +            };                                                           \
 +            return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
 +        }                                                                \
 +        return false;                                                    \
 +    }
 +
 +#define GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(NAME, SUF, CHECK)       \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
 +    {                                                            \
 +        if (CHECK(s, a)) {                                       \
 +            static gen_helper_opivx *const fns[4] = {            \
 +                gen_helper_##NAME##_b,                           \
 +                gen_helper_##NAME##_h,                           \
 +                gen_helper_##NAME##_w,                           \
 +                gen_helper_##NAME##_d,                           \
 +            };                                                   \
 +            return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, \
 +                                       fns[s->sew]);             \
 +        }                                                        \
 +        return false;                                            \
 +    }
 +
 +static bool zvbb_vv_check(DisasContext *s, arg_rmrr *a)
 +{
-+    env->tdata1[index] = set_field(env->tdata1[index],
++    return opivv_check(s, a) && s->cfg_ptr->ext_zvbb == true;
 +                                   ITRIGGER_COUNT, value);
 +}
 +
-+static bool check_itrigger_priv(CPURISCVState *env, int index)
++static bool zvbb_vx_check(DisasContext *s, arg_rmrr *a)
 +{
-+    target_ulong tdata1 = env->tdata1[index];
++    return opivx_check(s, a) && s->cfg_ptr->ext_zvbb == true;
 +    if (riscv_cpu_virt_enabled(env)) {
 +        /* check VU/VS bit against current privilege level */
 +        return (get_field(tdata1, ITRIGGER_VS) == env->priv) ||
 +               (get_field(tdata1, ITRIGGER_VU) == env->priv);
 +    } else {
 +        /* check U/S/M bit against current privilege level */
 +        return (get_field(tdata1, ITRIGGER_M) == env->priv) ||
 +               (get_field(tdata1, ITRIGGER_S) == env->priv) ||
 +               (get_field(tdata1, ITRIGGER_U) == env->priv);
 +    }
 +}
 +
-+bool riscv_itrigger_enabled(CPURISCVState *env)
++/* vrol.v[vx] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vrol_vv, rotlv, zvbb_vv_check)
 +GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vrol_vx, rotls, zvbb_vx_check)
 +
 +/* vror.v[vxi] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vror_vv, rotrv, zvbb_vv_check)
 +GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vror_vx, rotrs, zvbb_vx_check)
 +GEN_OPIVI_GVEC_TRANS_CHECK(vror_vi, IMM_TRUNC_SEW, vror_vx, rotri, zvbb_vx_check)
 +
 +#define GEN_OPIVX_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
 +    {                                                                    \
 +        if (CHECK(s, a)) {                                               \
 +            static gen_helper_opivx *const fns[4] = {                    \
 +                gen_helper_##NAME##_b,                                   \
 +                gen_helper_##NAME##_h,                                   \
 +                gen_helper_##NAME##_w,                                   \
 +                gen_helper_##NAME##_d,                                   \
 +            };                                                           \
 +            return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
 +        }                                                                \
 +        return false;                                                    \
 +    }
 +
 +/* vandn.v[vx] */
 +GEN_OPIVV_GVEC_TRANS_CHECK(vandn_vv, andc, zvbb_vv_check)
 +GEN_OPIVX_GVEC_TRANS_CHECK(vandn_vx, andcs, zvbb_vx_check)
 +
 +#define GEN_OPIV_TRANS(NAME, CHECK)                                        \
 +    static bool trans_##NAME(DisasContext *s, arg_rmr *a)                  \
 +    {                                                                      \
 +        if (CHECK(s, a)) {                                                 \
 +            uint32_t data = 0;                                             \
 +            static gen_helper_gvec_3_ptr *const fns[4] = {                 \
 +                gen_helper_##NAME##_b,                                     \
 +                gen_helper_##NAME##_h,                                     \
 +                gen_helper_##NAME##_w,                                     \
 +                gen_helper_##NAME##_d,                                     \
 +            };                                                             \
 +            TCGLabel *over = gen_new_label();                              \
 +            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);     \
 +                                                                           \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                     \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                 \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                   \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s); \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                   \
 +            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),         \
 +                               vreg_ofs(s, a->rs2), cpu_env,               \
 +                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, \
 +                               data, fns[s->sew]);                         \
 +            mark_vs_dirty(s);                                              \
 +            gen_set_label(over);                                           \
 +            return true;                                                   \
 +        }                                                                  \
 +        return false;                                                      \
 +    }
 +
 +static bool zvbb_opiv_check(DisasContext *s, arg_rmr *a)
 +{
-+    int count;
++    return s->cfg_ptr->ext_zvbb == true &&
-+    for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
++           require_rvv(s) &&
-+        if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
++           vext_check_isa_ill(s) &&
-+            continue;
++           vext_check_ss(s, a->rd, a->rs2, a->vm);
 +        }
 +        if (check_itrigger_priv(env, i)) {
 +            continue;
 +        }
 +        count = itrigger_get_count(env, i);
 +        if (!count) {
 +            continue;
 +        }
 +        return true;
 +    }
 +
 +    return false;
 +}
 +
-+void helper_itrigger_match(CPURISCVState *env)
++GEN_OPIV_TRANS(vbrev8_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vrev8_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vbrev_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vclz_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vctz_v, zvbb_opiv_check)
 +GEN_OPIV_TRANS(vcpop_v, zvbb_opiv_check)
 +
 +static bool vwsll_vv_check(DisasContext *s, arg_rmrr *a)
 +{
-+    int count;
++    return s->cfg_ptr->ext_zvbb && opivv_widen_check(s, a);
 +    for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
 +        if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
 +            continue;
 +        }
 +        if (check_itrigger_priv(env, i)) {
 +            continue;
 +        }
 +        count = itrigger_get_count(env, i);
 +        if (!count) {
 +            continue;
 +        }
 +        itrigger_set_count(env, i, count--);
 +        if (!count) {
 +            do_trigger_action(env, i);
 +        }
 +    }
 +}
 +
- target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
++static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
  {
      switch (tdata_index) {
 diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/translate.c
 +++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      /* PointerMasking extension */
      bool pm_mask_enabled;
      bool pm_base_enabled;
 +    /* Use icount trigger for native debug */
 +    bool itrigger;
      /* TCG of the current insn_start */
      TCGOp *insn_start;
  } DisasContext;
@@ -XXX,XX +XXX,XX @@ static void gen_exception_inst_addr_mis(DisasContext *ctx)
      generate_exception(ctx, RISCV_EXCP_INST_ADDR_MIS);
  }
 +static void lookup_and_goto_ptr(DisasContext *ctx)
 +{
-+#ifndef CONFIG_USER_ONLY
++    return s->cfg_ptr->ext_zvbb && opivx_widen_check(s, a);
 +    if (ctx->itrigger) {
 +        gen_helper_itrigger_match(cpu_env);
 +    }
 +#endif
 +    tcg_gen_lookup_and_goto_ptr();
 +}
 +
-+static void exit_tb(DisasContext *ctx)
++/* OPIVI without GVEC IR */
-+{
++#define GEN_OPIVI_WIDEN_TRANS(NAME, IMM_MODE, OPIVX, CHECK)                  \
-+#ifndef CONFIG_USER_ONLY
++    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
-+    if (ctx->itrigger) {
++    {                                                                        \
-+        gen_helper_itrigger_match(cpu_env);
++        if (CHECK(s, a)) {                                                   \
-+    }
++            static gen_helper_opivx *const fns[3] = {                        \
-+#endif
++                gen_helper_##OPIVX##_b,                                      \
-+    tcg_gen_exit_tb(NULL, 0);
++                gen_helper_##OPIVX##_h,                                      \
-+}
++                gen_helper_##OPIVX##_w,                                      \
-+
++            };                                                               \
- static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
++            return opivi_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s, \
- {
++                               IMM_MODE);                                    \
--    if (translator_use_goto_tb(&ctx->base, dest)) {
++        }                                                                    \
-+     /*
++        return false;                                                        \
-+      * Under itrigger, instruction executes one by one like singlestep,
++    }
-+      * direct block chain benefits will be small.
++
-+      */
++GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
-+    if (translator_use_goto_tb(&ctx->base, dest) && !ctx->itrigger) {
++GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
-         tcg_gen_goto_tb(n);
++GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
          gen_set_pc_imm(ctx, dest);
          tcg_gen_exit_tb(ctx->base.tb, n);
      } else {
          gen_set_pc_imm(ctx, dest);
 -        tcg_gen_lookup_and_goto_ptr();
 +        lookup_and_goto_ptr(ctx);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
      memset(ctx->ftemp, 0, sizeof(ctx->ftemp));
      ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
      ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
 +    ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
      ctx->zero = tcg_constant_tl(0);
  }
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
      /* Only the first insn within a TB is allowed to cross a page boundary. */
      if (ctx->base.is_jmp == DISAS_NEXT) {
 -        if (!is_same_page(&ctx->base, ctx->base.pc_next)) {
 +        if (ctx->itrigger || !is_same_page(&ctx->base, ctx->base.pc_next)) {
              ctx->base.is_jmp = DISAS_TOO_MANY;
          } else {
              unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;
 diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_privileged.c.inc
 +++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
      if (has_ext(ctx, RVS)) {
          decode_save_opc(ctx);
          gen_helper_sret(cpu_pc, cpu_env);
 -        tcg_gen_exit_tb(NULL, 0); /* no chaining */
 +        exit_tb(ctx); /* no chaining */
          ctx->base.is_jmp = DISAS_NORETURN;
      } else {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
  #ifndef CONFIG_USER_ONLY
      decode_save_opc(ctx);
      gen_helper_mret(cpu_pc, cpu_env);
 -    tcg_gen_exit_tb(NULL, 0); /* no chaining */
 +    exit_tb(ctx); /* no chaining */
      ctx->base.is_jmp = DISAS_NORETURN;
      return true;
  #else
 diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvi.c.inc
 +++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
      }
      gen_set_gpri(ctx, a->rd, ctx->pc_succ_insn);
 -    tcg_gen_lookup_and_goto_ptr();
 +    lookup_and_goto_ptr(ctx);
      if (misaligned) {
          gen_set_label(misaligned);
@@ -XXX,XX +XXX,XX @@ static bool trans_pause(DisasContext *ctx, arg_pause *a)
       * end the TB and return to main loop
       */
      gen_set_pc_imm(ctx, ctx->pc_succ_insn);
 -    tcg_gen_exit_tb(NULL, 0);
 +    exit_tb(ctx);
      ctx->base.is_jmp = DISAS_NORETURN;
      return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fence_i(DisasContext *ctx, arg_fence_i *a)
       * however we need to end the translation block
       */
      gen_set_pc_imm(ctx, ctx->pc_succ_insn);
 -    tcg_gen_exit_tb(NULL, 0);
 +    exit_tb(ctx);
      ctx->base.is_jmp = DISAS_NORETURN;
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool do_csr_post(DisasContext *ctx)
      decode_save_opc(ctx);
      /* We may have changed important cpu state -- exit to main loop. */
      gen_set_pc_imm(ctx, ctx->pc_succ_insn);
 -    tcg_gen_exit_tb(NULL, 0);
 +    exit_tb(ctx);
      ctx->base.is_jmp = DISAS_NORETURN;
      return true;
  }
 diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvv.c.inc
 +++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
      mark_vs_dirty(s);
      gen_set_pc_imm(s, s->pc_succ_insn);
 -    tcg_gen_lookup_and_goto_ptr();
 +    lookup_and_goto_ptr(s);
      s->base.is_jmp = DISAS_NORETURN;
      if (rd == 0 && rs1 == 0) {
@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
      gen_set_gpr(s, rd, dst);
      mark_vs_dirty(s);
      gen_set_pc_imm(s, s->pc_succ_insn);
 -    tcg_gen_lookup_and_goto_ptr();
 +    lookup_and_goto_ptr(s);
      s->base.is_jmp = DISAS_NORETURN;
      return true;
 --
-.38.1
+.41.0

-[PULL v2 34/45] hw/riscv: spike: Remove misleading comments
+[PULL v2 16/45] target/riscv: Add Zvkned ISA extension support
-From: Bin Meng <bmeng@tinylab.org>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-PLIC is not included in the 'spike' machine.
+This commit adds support for the Zvkned vector-crypto extension, which
 consists of the following instructions:
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+* vaesef.[vv,vs]
-Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+* vaesdf.[vv,vs]
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+* vaesdm.[vv,vs]
-Message-Id: <20221211030829.802437-5-bmeng@tinylab.org>
+* vaesz.vs
 * vaesem.[vv,vs]
 * vaeskf1.vi
 * vaeskf2.vi
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Imported aes-round.h and exposed x-zvkned
 property]
 [max.chou@sifive.com: Fixed endian issues and replaced the vstart & vl
 egs checking by helper function]
 [max.chou@sifive.com: Replaced bswap32 calls in aes key expanding]
 Message-ID: <20230711165917.2629866-10-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/riscv/spike.c | 1 -
+ target/riscv/cpu_cfg.h                   |   1 +
-file changed, 1 deletion(-)
+ target/riscv/helper.h                    |  14 ++
  target/riscv/insn32.decode               |  14 ++
  target/riscv/cpu.c                       |   4 +-
  target/riscv/vcrypto_helper.c            | 202 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 147 +++++++++++++++++
 files changed, 381 insertions(+), 1 deletion(-)
-diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/spike.c
+--- a/target/riscv/cpu_cfg.h
-+++ b/hw/riscv/spike.c
++++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
      bool ext_zve64d;
      bool ext_zvbb;
      bool ext_zvbc;
 +    bool ext_zvkned;
      bool ext_zmmul;
      bool ext_zvfbfmin;
      bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
  DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
  DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
  DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
 +
 +DEF_HELPER_2(egs_check, void, i32, env)
 +
 +DEF_HELPER_4(vaesef_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesef_vs, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesdf_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesdf_vs, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesem_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesem_vs, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesdm_vv, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
 +DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
 +DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
 +DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
 @@ -XXX,XX +XXX,XX @@
-  *
+ @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
-  * 0) HTIF Console and Poweroff
+ @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
-  * 1) CLINT (Timer and IPI)
+ @r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
-- * 2) PLIC (Platform Level Interrupt Controller)
++@r2_vm_1 ...... . ..... ..... ... ..... ....... &rmr vm=1 %rs2 %rd
-  *
+ @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
-  * This program is free software; you can redistribute it and/or modify it
+ @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
-  * under the terms and conditions of the GNU General Public License,
+ @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
@@ -XXX,XX +XXX,XX @@ vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
  vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
  vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
  vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
 +
 +# *** Zvkned vector crypto extension ***
 +vaesef_vv   101000 1 ..... 00011 010 ..... 1110111 @r2_vm_1
 +vaesef_vs   101001 1 ..... 00011 010 ..... 1110111 @r2_vm_1
 +vaesdf_vv   101000 1 ..... 00001 010 ..... 1110111 @r2_vm_1
 +vaesdf_vs   101001 1 ..... 00001 010 ..... 1110111 @r2_vm_1
 +vaesem_vv   101000 1 ..... 00010 010 ..... 1110111 @r2_vm_1
 +vaesem_vs   101001 1 ..... 00010 010 ..... 1110111 @r2_vm_1
 +vaesdm_vv   101000 1 ..... 00000 010 ..... 1110111 @r2_vm_1
 +vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
 +vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
 +vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
      ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
      ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
 +    ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
      ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
      ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
      ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * In principle Zve*x would also suffice here, were they supported
       * in qemu
       */
 -    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
 +    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      /* Vector cryptography extensions */
      DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 +    DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/bitops.h"
  #include "qemu/bswap.h"
  #include "cpu.h"
 +#include "crypto/aes.h"
 +#include "crypto/aes-round.h"
  #include "exec/memop.h"
  #include "exec/exec-all.h"
  #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
  GEN_VEXT_VX(vwsll_vx_b, 2)
  GEN_VEXT_VX(vwsll_vx_h, 4)
  GEN_VEXT_VX(vwsll_vx_w, 8)
 +
 +void HELPER(egs_check)(uint32_t egs, CPURISCVState *env)
 +{
 +    uint32_t vl = env->vl;
 +    uint32_t vstart = env->vstart;
 +
 +    if (vl % egs != 0 || vstart % egs != 0) {
 +        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
 +    }
 +}
 +
 +static inline void xor_round_key(AESState *round_state, AESState *round_key)
 +{
 +    round_state->v = round_state->v ^ round_key->v;
 +}
 +
 +#define GEN_ZVKNED_HELPER_VV(NAME, ...)                                   \
 +    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
 +                      uint32_t desc)                                      \
 +    {                                                                     \
 +        uint32_t vl = env->vl;                                            \
 +        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
 +        uint32_t vta = vext_vta(desc);                                    \
 +                                                                          \
 +        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
 +            AESState round_key;                                           \
 +            round_key.d[0] = *((uint64_t *)vs2 + H8(i * 2 + 0));          \
 +            round_key.d[1] = *((uint64_t *)vs2 + H8(i * 2 + 1));          \
 +            AESState round_state;                                         \
 +            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
 +            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
 +            __VA_ARGS__;                                                  \
 +            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
 +            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
 +        }                                                                 \
 +        env->vstart = 0;                                                  \
 +        /* set tail elements to 1s */                                     \
 +        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
 +    }
 +
 +#define GEN_ZVKNED_HELPER_VS(NAME, ...)                                   \
 +    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
 +                      uint32_t desc)                                      \
 +    {                                                                     \
 +        uint32_t vl = env->vl;                                            \
 +        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
 +        uint32_t vta = vext_vta(desc);                                    \
 +                                                                          \
 +        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
 +            AESState round_key;                                           \
 +            round_key.d[0] = *((uint64_t *)vs2 + H8(0));                  \
 +            round_key.d[1] = *((uint64_t *)vs2 + H8(1));                  \
 +            AESState round_state;                                         \
 +            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
 +            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
 +            __VA_ARGS__;                                                  \
 +            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
 +            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
 +        }                                                                 \
 +        env->vstart = 0;                                                  \
 +        /* set tail elements to 1s */                                     \
 +        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
 +    }
 +
 +GEN_ZVKNED_HELPER_VV(vaesef_vv, aesenc_SB_SR_AK(&round_state,
 +                                                &round_state,
 +                                                &round_key,
 +                                                false);)
 +GEN_ZVKNED_HELPER_VS(vaesef_vs, aesenc_SB_SR_AK(&round_state,
 +                                                &round_state,
 +                                                &round_key,
 +                                                false);)
 +GEN_ZVKNED_HELPER_VV(vaesdf_vv, aesdec_ISB_ISR_AK(&round_state,
 +                                                  &round_state,
 +                                                  &round_key,
 +                                                  false);)
 +GEN_ZVKNED_HELPER_VS(vaesdf_vs, aesdec_ISB_ISR_AK(&round_state,
 +                                                  &round_state,
 +                                                  &round_key,
 +                                                  false);)
 +GEN_ZVKNED_HELPER_VV(vaesem_vv, aesenc_SB_SR_MC_AK(&round_state,
 +                                                   &round_state,
 +                                                   &round_key,
 +                                                   false);)
 +GEN_ZVKNED_HELPER_VS(vaesem_vs, aesenc_SB_SR_MC_AK(&round_state,
 +                                                   &round_state,
 +                                                   &round_key,
 +                                                   false);)
 +GEN_ZVKNED_HELPER_VV(vaesdm_vv, aesdec_ISB_ISR_AK_IMC(&round_state,
 +                                                      &round_state,
 +                                                      &round_key,
 +                                                      false);)
 +GEN_ZVKNED_HELPER_VS(vaesdm_vs, aesdec_ISB_ISR_AK_IMC(&round_state,
 +                                                      &round_state,
 +                                                      &round_key,
 +                                                      false);)
 +GEN_ZVKNED_HELPER_VS(vaesz_vs, xor_round_key(&round_state, &round_key);)
 +
 +void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
 +                        CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +    uint32_t vl = env->vl;
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +    uint32_t vta = vext_vta(desc);
 +
 +    uimm &= 0b1111;
 +    if (uimm > 10 || uimm == 0) {
 +        uimm ^= 0b1000;
 +    }
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint32_t rk[8], tmp;
 +        static const uint32_t rcon[] = {
 +            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
 +            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
 +        };
 +
 +        rk[0] = vs2[i * 4 + H4(0)];
 +        rk[1] = vs2[i * 4 + H4(1)];
 +        rk[2] = vs2[i * 4 + H4(2)];
 +        rk[3] = vs2[i * 4 + H4(3)];
 +        tmp = ror32(rk[3], 8);
 +
 +        rk[4] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
 +                         ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
 +                         ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
 +                         ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
 +                      ^ rcon[uimm - 1];
 +        rk[5] = rk[1] ^ rk[4];
 +        rk[6] = rk[2] ^ rk[5];
 +        rk[7] = rk[3] ^ rk[6];
 +
 +        vd[i * 4 + H4(0)] = rk[4];
 +        vd[i * 4 + H4(1)] = rk[5];
 +        vd[i * 4 + H4(2)] = rk[6];
 +        vd[i * 4 + H4(3)] = rk[7];
 +    }
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 +}
 +
 +void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
 +                        CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +    uint32_t vl = env->vl;
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +    uint32_t vta = vext_vta(desc);
 +
 +    uimm &= 0b1111;
 +    if (uimm > 14 || uimm < 2) {
 +        uimm ^= 0b1000;
 +    }
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint32_t rk[12], tmp;
 +        static const uint32_t rcon[] = {
 +            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
 +            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
 +        };
 +
 +        rk[0] = vd[i * 4 + H4(0)];
 +        rk[1] = vd[i * 4 + H4(1)];
 +        rk[2] = vd[i * 4 + H4(2)];
 +        rk[3] = vd[i * 4 + H4(3)];
 +        rk[4] = vs2[i * 4 + H4(0)];
 +        rk[5] = vs2[i * 4 + H4(1)];
 +        rk[6] = vs2[i * 4 + H4(2)];
 +        rk[7] = vs2[i * 4 + H4(3)];
 +
 +        if (uimm % 2 == 0) {
 +            tmp = ror32(rk[7], 8);
 +            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
 +                             ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
 +                             ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
 +                             ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
 +                          ^ rcon[(uimm - 1) / 2];
 +        } else {
 +            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(rk[7] >> 24) & 0xff] << 24) |
 +                             ((uint32_t)AES_sbox[(rk[7] >> 16) & 0xff] << 16) |
 +                             ((uint32_t)AES_sbox[(rk[7] >> 8) & 0xff] << 8) |
 +                             ((uint32_t)AES_sbox[(rk[7] >> 0) & 0xff] << 0));
 +        }
 +        rk[9] = rk[1] ^ rk[8];
 +        rk[10] = rk[2] ^ rk[9];
 +        rk[11] = rk[3] ^ rk[10];
 +
 +        vd[i * 4 + H4(0)] = rk[8];
 +        vd[i * 4 + H4(1)] = rk[9];
 +        vd[i * 4 + H4(2)] = rk[10];
 +        vd[i * 4 + H4(3)] = rk[11];
 +    }
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
  GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
  GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
  GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
 +
 +/*
 + * Zvkned
 + */
 +
 +#define ZVKNED_EGS 4
 +
 +#define GEN_V_UNMASKED_TRANS(NAME, CHECK, EGS)                                \
 +    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
 +    {                                                                         \
 +        if (CHECK(s, a)) {                                                    \
 +            TCGv_ptr rd_v, rs2_v;                                             \
 +            TCGv_i32 desc, egs;                                               \
 +            uint32_t data = 0;                                                \
 +            TCGLabel *over = gen_new_label();                                 \
 +                                                                              \
 +            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
 +                /* save opcode for unwinding in case we throw an exception */ \
 +                decode_save_opc(s);                                           \
 +                egs = tcg_constant_i32(EGS);                                  \
 +                gen_helper_egs_check(egs, cpu_env);                           \
 +                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
 +            }                                                                 \
 +                                                                              \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
 +            rd_v = tcg_temp_new_ptr();                                        \
 +            rs2_v = tcg_temp_new_ptr();                                       \
 +            desc = tcg_constant_i32(                                          \
 +                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
 +            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
 +            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
 +            gen_helper_##NAME(rd_v, rs2_v, cpu_env, desc);                    \
 +            mark_vs_dirty(s);                                                 \
 +            gen_set_label(over);                                              \
 +            return true;                                                      \
 +        }                                                                     \
 +        return false;                                                         \
 +    }
 +
 +static bool vaes_check_vv(DisasContext *s, arg_rmr *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul) &&
 +           s->sew == MO_32;
 +}
 +
 +static bool vaes_check_overlap(DisasContext *s, int vd, int vs2)
 +{
 +    int8_t op_size = s->lmul <= 0 ? 1 : 1 << s->lmul;
 +    return !is_overlapped(vd, op_size, vs2, 1);
 +}
 +
 +static bool vaes_check_vs(DisasContext *s, arg_rmr *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return vaes_check_overlap(s, a->rd, a->rs2) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           require_align(a->rd, s->lmul) &&
 +           s->sew == MO_32;
 +}
 +
 +GEN_V_UNMASKED_TRANS(vaesef_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesef_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdf_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdf_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdm_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesdm_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesz_vs, vaes_check_vs, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesem_vv, vaes_check_vv, ZVKNED_EGS)
 +GEN_V_UNMASKED_TRANS(vaesem_vs, vaes_check_vs, ZVKNED_EGS)
 +
 +#define GEN_VI_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
 +    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
 +    {                                                                         \
 +        if (CHECK(s, a)) {                                                    \
 +            TCGv_ptr rd_v, rs2_v;                                             \
 +            TCGv_i32 uimm_v, desc, egs;                                       \
 +            uint32_t data = 0;                                                \
 +            TCGLabel *over = gen_new_label();                                 \
 +                                                                              \
 +            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
 +                /* save opcode for unwinding in case we throw an exception */ \
 +                decode_save_opc(s);                                           \
 +                egs = tcg_constant_i32(EGS);                                  \
 +                gen_helper_egs_check(egs, cpu_env);                           \
 +                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
 +            }                                                                 \
 +                                                                              \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
 +                                                                              \
 +            rd_v = tcg_temp_new_ptr();                                        \
 +            rs2_v = tcg_temp_new_ptr();                                       \
 +            uimm_v = tcg_constant_i32(a->rs1);                                \
 +            desc = tcg_constant_i32(                                          \
 +                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
 +            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
 +            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
 +            gen_helper_##NAME(rd_v, rs2_v, uimm_v, cpu_env, desc);            \
 +            mark_vs_dirty(s);                                                 \
 +            gen_set_label(over);                                              \
 +            return true;                                                      \
 +        }                                                                     \
 +        return false;                                                         \
 +    }
 +
 +static bool vaeskf1_check(DisasContext *s, arg_vaeskf1_vi *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32 &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
 +{
 +    int egw_bytes = ZVKNED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkned == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32 &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
 +GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
 --
-.38.1
+.41.0

-[PULL v2 19/45] target/riscv: support cache-related PMU events in virtual mode
+[PULL v2 17/45] target/riscv: Add Zvknh ISA extension support
-From: Jim Shu <jim.shu@sifive.com>
+From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
-let tlb_fill() function also increments PMU counter when it is from
+This commit adds support for the Zvknh vector-crypto extension, which
-two-stage translation, so QEMU could also monitor these PMU events when
+consists of the following instructions:
 CPU runs in VS/VU mode (like running guest OS).
-Signed-off-by: Jim Shu <jim.shu@sifive.com>
+* vsha2ms.vv
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+* vsha2c[hl].vv
-Message-Id: <20221123090635.6574-1-jim.shu@sifive.com>
 Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvknha & x-zvknhb properties]
 [max.chou@sifive.com: Replaced SEW selection to happened during
 translation]
 Message-ID: <20230711165917.2629866-11-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu_helper.c | 2 +-
+ target/riscv/cpu_cfg.h                   |   2 +
-file changed, 1 insertion(+), 1 deletion(-)
+ target/riscv/helper.h                    |   6 +
  target/riscv/insn32.decode               |   5 +
  target/riscv/cpu.c                       |  13 +-
  target/riscv/vcrypto_helper.c            | 238 +++++++++++++++++++++++
  target/riscv/insn_trans/trans_rvvk.c.inc | 129 ++++++++++++
 files changed, 390 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/cpu_cfg.h
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-         }
+     bool ext_zvbb;
      bool ext_zvbc;
      bool ext_zvkned;
 +    bool ext_zvknha;
 +    bool ext_zvknhb;
      bool ext_zmmul;
      bool ext_zvfbfmin;
      bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
  DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
  DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
  DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
 +
 +DEF_HELPER_5(vsha2ms_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
  vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
  vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
 +# *** Zvknh vector crypto extension ***
 +vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
      ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
      ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
 +    ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
 +    ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
      ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
      ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
      ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * In principle Zve*x would also suffice here, were they supported
       * in qemu
       */
 -    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
 +    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
 +        !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
      }
-+    pmu_tlb_fill_incr_ctr(cpu, access_type);
+-    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
-     if (riscv_cpu_virt_enabled(env) ||
+-        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
-         ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
++    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
-          access_type != MMU_INST_FETCH)) {
++        error_setg(
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
++            errp,
-             }
++            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
-         }
+         return;
-     } else {
+     }
--        pmu_tlb_fill_incr_ctr(cpu, access_type);
-         /* Single stage lookup */
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
-         ret = get_physical_address(env, &pa, &prot, address, NULL,
+     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
-                                    access_type, mmu_idx, true, false, false);
+     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
 +    DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
 +    DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
      /* set tail elements to 1s */
      vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
  }
 +
 +static inline uint32_t sig0_sha256(uint32_t x)
 +{
 +    return ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3);
 +}
 +
 +static inline uint32_t sig1_sha256(uint32_t x)
 +{
 +    return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
 +}
 +
 +static inline uint64_t sig0_sha512(uint64_t x)
 +{
 +    return ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7);
 +}
 +
 +static inline uint64_t sig1_sha512(uint64_t x)
 +{
 +    return ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6);
 +}
 +
 +static inline void vsha2ms_e32(uint32_t *vd, uint32_t *vs1, uint32_t *vs2)
 +{
 +    uint32_t res[4];
 +    res[0] = sig1_sha256(vs1[H4(2)]) + vs2[H4(1)] + sig0_sha256(vd[H4(1)]) +
 +             vd[H4(0)];
 +    res[1] = sig1_sha256(vs1[H4(3)]) + vs2[H4(2)] + sig0_sha256(vd[H4(2)]) +
 +             vd[H4(1)];
 +    res[2] =
 +        sig1_sha256(res[0]) + vs2[H4(3)] + sig0_sha256(vd[H4(3)]) + vd[H4(2)];
 +    res[3] =
 +        sig1_sha256(res[1]) + vs1[H4(0)] + sig0_sha256(vs2[H4(0)]) + vd[H4(3)];
 +    vd[H4(3)] = res[3];
 +    vd[H4(2)] = res[2];
 +    vd[H4(1)] = res[1];
 +    vd[H4(0)] = res[0];
 +}
 +
 +static inline void vsha2ms_e64(uint64_t *vd, uint64_t *vs1, uint64_t *vs2)
 +{
 +    uint64_t res[4];
 +    res[0] = sig1_sha512(vs1[2]) + vs2[1] + sig0_sha512(vd[1]) + vd[0];
 +    res[1] = sig1_sha512(vs1[3]) + vs2[2] + sig0_sha512(vd[2]) + vd[1];
 +    res[2] = sig1_sha512(res[0]) + vs2[3] + sig0_sha512(vd[3]) + vd[2];
 +    res[3] = sig1_sha512(res[1]) + vs1[0] + sig0_sha512(vs2[0]) + vd[3];
 +    vd[3] = res[3];
 +    vd[2] = res[2];
 +    vd[1] = res[1];
 +    vd[0] = res[0];
 +}
 +
 +void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                        uint32_t desc)
 +{
 +    uint32_t sew = FIELD_EX64(env->vtype, VTYPE, VSEW);
 +    uint32_t esz = sew == MO_32 ? 4 : 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        if (sew == MO_32) {
 +            vsha2ms_e32(((uint32_t *)vd) + i * 4, ((uint32_t *)vs1) + i * 4,
 +                        ((uint32_t *)vs2) + i * 4);
 +        } else {
 +            /* If not 32 then SEW should be 64 */
 +            vsha2ms_e64(((uint64_t *)vd) + i * 4, ((uint64_t *)vs1) + i * 4,
 +                        ((uint64_t *)vs2) + i * 4);
 +        }
 +    }
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +static inline uint64_t sum0_64(uint64_t x)
 +{
 +    return ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39);
 +}
 +
 +static inline uint32_t sum0_32(uint32_t x)
 +{
 +    return ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22);
 +}
 +
 +static inline uint64_t sum1_64(uint64_t x)
 +{
 +    return ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41);
 +}
 +
 +static inline uint32_t sum1_32(uint32_t x)
 +{
 +    return ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25);
 +}
 +
 +#define ch(x, y, z) ((x & y) ^ ((~x) & z))
 +
 +#define maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
 +
 +static void vsha2c_64(uint64_t *vs2, uint64_t *vd, uint64_t *vs1)
 +{
 +    uint64_t a = vs2[3], b = vs2[2], e = vs2[1], f = vs2[0];
 +    uint64_t c = vd[3], d = vd[2], g = vd[1], h = vd[0];
 +    uint64_t W0 = vs1[0], W1 = vs1[1];
 +    uint64_t T1 = h + sum1_64(e) + ch(e, f, g) + W0;
 +    uint64_t T2 = sum0_64(a) + maj(a, b, c);
 +
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    T1 = h + sum1_64(e) + ch(e, f, g) + W1;
 +    T2 = sum0_64(a) + maj(a, b, c);
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    vd[0] = f;
 +    vd[1] = e;
 +    vd[2] = b;
 +    vd[3] = a;
 +}
 +
 +static void vsha2c_32(uint32_t *vs2, uint32_t *vd, uint32_t *vs1)
 +{
 +    uint32_t a = vs2[H4(3)], b = vs2[H4(2)], e = vs2[H4(1)], f = vs2[H4(0)];
 +    uint32_t c = vd[H4(3)], d = vd[H4(2)], g = vd[H4(1)], h = vd[H4(0)];
 +    uint32_t W0 = vs1[H4(0)], W1 = vs1[H4(1)];
 +    uint32_t T1 = h + sum1_32(e) + ch(e, f, g) + W0;
 +    uint32_t T2 = sum0_32(a) + maj(a, b, c);
 +
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    T1 = h + sum1_32(e) + ch(e, f, g) + W1;
 +    T2 = sum0_32(a) + maj(a, b, c);
 +    h = g;
 +    g = f;
 +    f = e;
 +    e = d + T1;
 +    d = c;
 +    c = b;
 +    b = a;
 +    a = T1 + T2;
 +
 +    vd[H4(0)] = f;
 +    vd[H4(1)] = e;
 +    vd[H4(2)] = b;
 +    vd[H4(3)] = a;
 +}
 +
 +void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 4;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
 +                  ((uint32_t *)vs1) + 4 * i + 2);
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
 +                  ((uint64_t *)vs1) + 4 * i + 2);
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    const uint32_t esz = 4;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
 +                  (((uint32_t *)vs1) + 4 * i));
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
 +                          uint32_t desc)
 +{
 +    uint32_t esz = 8;
 +    uint32_t total_elems;
 +    uint32_t vta = vext_vta(desc);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
 +                  (((uint64_t *)vs1) + 4 * i));
 +    }
 +
 +    /* set tail elements to 1s */
 +    total_elems = vext_get_total_elems(env, desc, esz);
 +    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
  GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
  GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
 +
 +/*
 + * Zvknh
 + */
 +
 +#define ZVKNH_EGS 4
 +
 +#define GEN_VV_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
 +    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
 +    {                                                                         \
 +        if (CHECK(s, a)) {                                                    \
 +            uint32_t data = 0;                                                \
 +            TCGLabel *over = gen_new_label();                                 \
 +            TCGv_i32 egs;                                                     \
 +                                                                              \
 +            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
 +                /* save opcode for unwinding in case we throw an exception */ \
 +                decode_save_opc(s);                                           \
 +                egs = tcg_constant_i32(EGS);                                  \
 +                gen_helper_egs_check(egs, cpu_env);                           \
 +                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
 +            }                                                                 \
 +                                                                              \
 +            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
 +            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
 +            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
 +            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
 +            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
 +                                                                              \
 +            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),       \
 +                               vreg_ofs(s, a->rs2), cpu_env,                  \
 +                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8,    \
 +                               data, gen_helper_##NAME);                      \
 +                                                                              \
 +            mark_vs_dirty(s);                                                 \
 +            gen_set_label(over);                                              \
 +            return true;                                                      \
 +        }                                                                     \
 +        return false;                                                         \
 +    }
 +
 +static bool vsha_check_sew(DisasContext *s)
 +{
 +    return (s->cfg_ptr->ext_zvknha == true && s->sew == MO_32) ||
 +           (s->cfg_ptr->ext_zvknhb == true &&
 +            (s->sew == MO_32 || s->sew == MO_64));
 +}
 +
 +static bool vsha_check(DisasContext *s, arg_rmrr *a)
 +{
 +    int egw_bytes = ZVKNH_EGS << s->sew;
 +    int mult = 1 << MAX(s->lmul, 0);
 +    return opivv_check(s, a) &&
 +           vsha_check_sew(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           !is_overlapped(a->rd, mult, a->rs1, mult) &&
 +           !is_overlapped(a->rd, mult, a->rs2, mult) &&
 +           s->lmul >= 0;
 +}
 +
 +GEN_VV_UNMASKED_TRANS(vsha2ms_vv, vsha_check, ZVKNH_EGS)
 +
 +static bool trans_vsha2cl_vv(DisasContext *s, arg_rmrr *a)
 +{
 +    if (vsha_check(s, a)) {
 +        uint32_t data = 0;
 +        TCGLabel *over = gen_new_label();
 +        TCGv_i32 egs;
 +
 +        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
 +            /* save opcode for unwinding in case we throw an exception */
 +            decode_save_opc(s);
 +            egs = tcg_constant_i32(ZVKNH_EGS);
 +            gen_helper_egs_check(egs, cpu_env);
 +            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 +        }
 +
 +        data = FIELD_DP32(data, VDATA, VM, a->vm);
 +        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
 +        data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);
 +
 +        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
 +            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
 +            s->cfg_ptr->vlen / 8, data,
 +            s->sew == MO_32 ?
 +                gen_helper_vsha2cl32_vv : gen_helper_vsha2cl64_vv);
 +
 +        mark_vs_dirty(s);
 +        gen_set_label(over);
 +        return true;
 +    }
 +    return false;
 +}
 +
 +static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
 +{
 +    if (vsha_check(s, a)) {
 +        uint32_t data = 0;
 +        TCGLabel *over = gen_new_label();
 +        TCGv_i32 egs;
 +
 +        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
 +            /* save opcode for unwinding in case we throw an exception */
 +            decode_save_opc(s);
 +            egs = tcg_constant_i32(ZVKNH_EGS);
 +            gen_helper_egs_check(egs, cpu_env);
 +            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 +        }
 +
 +        data = FIELD_DP32(data, VDATA, VM, a->vm);
 +        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
 +        data = FIELD_DP32(data, VDATA, VTA, s->vta);
 +        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
 +        data = FIELD_DP32(data, VDATA, VMA, s->vma);
 +
 +        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
 +            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
 +            s->cfg_ptr->vlen / 8, data,
 +            s->sew == MO_32 ?
 +                gen_helper_vsha2ch32_vv : gen_helper_vsha2ch64_vv);
 +
 +        mark_vs_dirty(s);
 +        gen_set_label(over);
 +        return true;
 +    }
 +    return false;
 +}
 --
-.38.1
+.41.0

-[PULL v2 31/45] hw/intc: Select MSI_NONBROKEN in RISC-V AIA interrupt controllers
+[PULL v2 18/45] target/riscv: Add Zvksh ISA extension support
-From: Bin Meng <bmeng@tinylab.org>
+From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-hw/pci/Kconfig says MSI_NONBROKEN should be selected by interrupt
+This commit adds support for the Zvksh vector-crypto extension, which
-controllers regardless of how MSI is implemented. msi_nonbroken is
+consists of the following instructions:
-initialized to true in both riscv_aplic_realize() and
-riscv_imsic_realize().
+* vsm3me.vv
+* vsm3c.vi
-Select MSI_NONBROKEN in RISCV_APLIC and RISCV_IMSIC.
+Translation functions are defined in
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+`target/riscv/vcrypto_helper.c`.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-Id: <20221211030829.802437-2-bmeng@tinylab.org>
+Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 [max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvksh property]
 Message-ID: <20230711165917.2629866-12-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/intc/Kconfig | 2 ++
+ target/riscv/cpu_cfg.h                   |   1 +
-file changed, 2 insertions(+)
+ target/riscv/helper.h                    |   3 +
+ target/riscv/insn32.decode               |   4 +
-diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
+ target/riscv/cpu.c                       |   6 +-
-index XXXXXXX..XXXXXXX 100644
+ target/riscv/vcrypto_helper.c            | 134 +++++++++++++++++++++++
---- a/hw/intc/Kconfig
+ target/riscv/insn_trans/trans_rvvk.c.inc |  31 ++++++
-+++ b/hw/intc/Kconfig
+files changed, 177 insertions(+), 2 deletions(-)
-@@ -XXX,XX +XXX,XX @@ config RISCV_ACLINT
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
- config RISCV_APLIC
+index XXXXXXX..XXXXXXX 100644
-     bool
+--- a/target/riscv/cpu_cfg.h
-+    select MSI_NONBROKEN
++++ b/target/riscv/cpu_cfg.h
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
- config RISCV_IMSIC
+     bool ext_zvkned;
-     bool
+     bool ext_zvknha;
-+    select MSI_NONBROKEN
+     bool ext_zvknhb;
++    bool ext_zvksh;
- config SIFIVE_PLIC
+     bool ext_zmmul;
-     bool
+     bool ext_zvfbfmin;
      bool ext_zvfbfwma;
 diff --git a/target/riscv/helper.h b/target/riscv/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/helper.h
 +++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
  DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
 +
 +DEF_HELPER_5(vsm3me_vv, void, ptr, ptr, ptr, env, i32)
 +DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
 diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn32.decode
 +++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +
 +# *** Zvksh vector crypto extension ***
 +vsm3me_vv   100000 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
      ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
      ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
 +    ISA_EXT_DATA_ENTRY(zvksh, PRIV_VERSION_1_12_0, ext_zvksh),
      ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
      ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
      ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * In principle Zve*x would also suffice here, were they supported
       * in qemu
       */
 -    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
 -        !cpu->cfg.ext_zve32f) {
 +    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha ||
 +         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
      DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 +    DEFINE_PROP_BOOL("x-zvksh", RISCVCPU, cfg.ext_zvksh, false),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
      vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
      env->vstart = 0;
  }
 +
 +static inline uint32_t p1(uint32_t x)
 +{
 +    return x ^ rol32(x, 15) ^ rol32(x, 23);
 +}
 +
 +static inline uint32_t zvksh_w(uint32_t m16, uint32_t m9, uint32_t m3,
 +                               uint32_t m13, uint32_t m6)
 +{
 +    return p1(m16 ^ m9 ^ rol32(m3, 15)) ^ rol32(m13, 7) ^ m6;
 +}
 +
 +void HELPER(vsm3me_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
 +                       CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t esz = memop_size(FIELD_EX64(env->vtype, VTYPE, VSEW));
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs1 = vs1_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +
 +    for (int i = env->vstart / 8; i < env->vl / 8; i++) {
 +        uint32_t w[24];
 +        for (int j = 0; j < 8; j++) {
 +            w[j] = bswap32(vs1[H4((i * 8) + j)]);
 +            w[j + 8] = bswap32(vs2[H4((i * 8) + j)]);
 +        }
 +        for (int j = 0; j < 8; j++) {
 +            w[j + 16] =
 +                zvksh_w(w[j], w[j + 7], w[j + 13], w[j + 3], w[j + 10]);
 +        }
 +        for (int j = 0; j < 8; j++) {
 +            vd[(i * 8) + j] = bswap32(w[H4(j + 16)]);
 +        }
 +    }
 +    vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 +
 +static inline uint32_t ff1(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return x ^ y ^ z;
 +}
 +
 +static inline uint32_t ff2(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return (x & y) | (x & z) | (y & z);
 +}
 +
 +static inline uint32_t ff_j(uint32_t x, uint32_t y, uint32_t z, uint32_t j)
 +{
 +    return (j <= 15) ? ff1(x, y, z) : ff2(x, y, z);
 +}
 +
 +static inline uint32_t gg1(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return x ^ y ^ z;
 +}
 +
 +static inline uint32_t gg2(uint32_t x, uint32_t y, uint32_t z)
 +{
 +    return (x & y) | (~x & z);
 +}
 +
 +static inline uint32_t gg_j(uint32_t x, uint32_t y, uint32_t z, uint32_t j)
 +{
 +    return (j <= 15) ? gg1(x, y, z) : gg2(x, y, z);
 +}
 +
 +static inline uint32_t t_j(uint32_t j)
 +{
 +    return (j <= 15) ? 0x79cc4519 : 0x7a879d8a;
 +}
 +
 +static inline uint32_t p_0(uint32_t x)
 +{
 +    return x ^ rol32(x, 9) ^ rol32(x, 17);
 +}
 +
 +static void sm3c(uint32_t *vd, uint32_t *vs1, uint32_t *vs2, uint32_t uimm)
 +{
 +    uint32_t x0, x1;
 +    uint32_t j;
 +    uint32_t ss1, ss2, tt1, tt2;
 +    x0 = vs2[0] ^ vs2[4];
 +    x1 = vs2[1] ^ vs2[5];
 +    j = 2 * uimm;
 +    ss1 = rol32(rol32(vs1[0], 12) + vs1[4] + rol32(t_j(j), j % 32), 7);
 +    ss2 = ss1 ^ rol32(vs1[0], 12);
 +    tt1 = ff_j(vs1[0], vs1[1], vs1[2], j) + vs1[3] + ss2 + x0;
 +    tt2 = gg_j(vs1[4], vs1[5], vs1[6], j) + vs1[7] + ss1 + vs2[0];
 +    vs1[3] = vs1[2];
 +    vd[3] = rol32(vs1[1], 9);
 +    vs1[1] = vs1[0];
 +    vd[1] = tt1;
 +    vs1[7] = vs1[6];
 +    vd[7] = rol32(vs1[5], 19);
 +    vs1[5] = vs1[4];
 +    vd[5] = p_0(tt2);
 +    j = 2 * uimm + 1;
 +    ss1 = rol32(rol32(vd[1], 12) + vd[5] + rol32(t_j(j), j % 32), 7);
 +    ss2 = ss1 ^ rol32(vd[1], 12);
 +    tt1 = ff_j(vd[1], vs1[1], vd[3], j) + vs1[3] + ss2 + x1;
 +    tt2 = gg_j(vd[5], vs1[5], vd[7], j) + vs1[7] + ss1 + vs2[1];
 +    vd[2] = rol32(vs1[1], 9);
 +    vd[0] = tt1;
 +    vd[6] = rol32(vs1[5], 19);
 +    vd[4] = p_0(tt2);
 +}
 +
 +void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
 +                      CPURISCVState *env, uint32_t desc)
 +{
 +    uint32_t esz = memop_size(FIELD_EX64(env->vtype, VTYPE, VSEW));
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t *vd = vd_vptr;
 +    uint32_t *vs2 = vs2_vptr;
 +    uint32_t v1[8], v2[8], v3[8];
 +
 +    for (int i = env->vstart / 8; i < env->vl / 8; i++) {
 +        for (int k = 0; k < 8; k++) {
 +            v2[k] = bswap32(vd[H4(i * 8 + k)]);
 +            v3[k] = bswap32(vs2[H4(i * 8 + k)]);
 +        }
 +        sm3c(v1, v2, v3, uimm);
 +        for (int k = 0; k < 8; k++) {
 +            vd[i * 8 + k] = bswap32(v1[H4(k)]);
 +        }
 +    }
 +    vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
      }
      return false;
  }
 +
 +/*
 + * Zvksh
 + */
 +
 +#define ZVKSH_EGS 8
 +
 +static inline bool vsm3_check(DisasContext *s, arg_rmrr *a)
 +{
 +    int egw_bytes = ZVKSH_EGS << s->sew;
 +    int mult = 1 << MAX(s->lmul, 0);
 +    return s->cfg_ptr->ext_zvksh == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           !is_overlapped(a->rd, mult, a->rs2, mult) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32;
 +}
 +
 +static inline bool vsm3me_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return vsm3_check(s, a) && vext_check_sss(s, a->rd, a->rs1, a->rs2, a->vm);
 +}
 +
 +static inline bool vsm3c_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return vsm3_check(s, a) && vext_check_ss(s, a->rd, a->rs2, a->vm);
 +}
 +
 +GEN_VV_UNMASKED_TRANS(vsm3me_vv, vsm3me_check, ZVKSH_EGS)
 +GEN_VI_UNMASKED_TRANS(vsm3c_vi, vsm3c_check, ZVKSH_EGS)
 --
-.38.1
+.41.0

-[PULL v2 30/45] hw/riscv: Select MSI_NONBROKEN in SIFIVE_PLIC
+[PULL v2 19/45] target/riscv: Add Zvkg ISA extension support
-From: Bin Meng <bmeng@tinylab.org>
+From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
-hw/pci/Kconfig says MSI_NONBROKEN should be selected by interrupt
+This commit adds support for the Zvkg vector-crypto extension, which
-controllers regardless of how MSI is implemented. msi_nonbroken is
+consists of the following instructions:
-initialized to true in sifive_plic_realize().
+* vgmul.vv
-Let SIFIVE_PLIC select MSI_NONBROKEN and drop the selection from
+* vghsh.vv
-RISC-V machines.
+Translation functions are defined in
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+`target/riscv/vcrypto_helper.c`.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
-Message-Id: <20221211030829.802437-1-bmeng@tinylab.org>
+[max.chou@sifive.com: Replaced vstart checking by TCG op]
 Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
 Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 [max.chou@sifive.com: Exposed x-zvkg property]
 [max.chou@sifive.com: Replaced uint by int for cross win32 build]
 Message-ID: <20230711165917.2629866-13-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/intc/Kconfig  | 1 +
+ target/riscv/cpu_cfg.h                   |  1 +
- hw/riscv/Kconfig | 5 -----
+ target/riscv/helper.h                    |  3 +
-files changed, 1 insertion(+), 5 deletions(-)
+ target/riscv/insn32.decode               |  4 ++
+ target/riscv/cpu.c                       |  6 +-
-diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
+ target/riscv/vcrypto_helper.c            | 72 ++++++++++++++++++++++++
-index XXXXXXX..XXXXXXX 100644
+ target/riscv/insn_trans/trans_rvvk.c.inc | 30 ++++++++++
---- a/hw/intc/Kconfig
+files changed, 114 insertions(+), 2 deletions(-)
-+++ b/hw/intc/Kconfig
-@@ -XXX,XX +XXX,XX @@ config RISCV_IMSIC
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
+index XXXXXXX..XXXXXXX 100644
- config SIFIVE_PLIC
+--- a/target/riscv/cpu_cfg.h
-     bool
++++ b/target/riscv/cpu_cfg.h
-+    select MSI_NONBROKEN
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
+     bool ext_zve64d;
- config GOLDFISH_PIC
+     bool ext_zvbb;
-     bool
+     bool ext_zvbc;
-diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
++    bool ext_zvkg;
-index XXXXXXX..XXXXXXX 100644
+     bool ext_zvkned;
---- a/hw/riscv/Kconfig
+     bool ext_zvknha;
-+++ b/hw/riscv/Kconfig
+     bool ext_zvknhb;
-@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
-     select MCHP_PFSOC_IOSCB
+index XXXXXXX..XXXXXXX 100644
-     select MCHP_PFSOC_MMUART
+--- a/target/riscv/helper.h
-     select MCHP_PFSOC_SYSREG
++++ b/target/riscv/helper.h
--    select MSI_NONBROKEN
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
-     select RISCV_ACLINT
-     select SIFIVE_PDMA
+ DEF_HELPER_5(vsm3me_vv, void, ptr, ptr, ptr, env, i32)
-     select SIFIVE_PLIC
+ DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
-@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
++
-     imply TPM_TIS_SYSBUS
++DEF_HELPER_5(vghsh_vv, void, ptr, ptr, ptr, env, i32)
-     select RISCV_NUMA
++DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
-     select GOLDFISH_RTC
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
--    select MSI_NONBROKEN
+index XXXXXXX..XXXXXXX 100644
-     select PCI
+--- a/target/riscv/insn32.decode
-     select PCI_EXPRESS_GENERIC_BRIDGE
++++ b/target/riscv/insn32.decode
-     select PFLASH_CFI01
+@@ -XXX,XX +XXX,XX @@ vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
-@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
+ # *** Zvksh vector crypto extension ***
+ vsm3me_vv   100000 1 ..... ..... 010 ..... 1110111 @r_vm_1
- config SIFIVE_E
+ vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
-     bool
++
--    select MSI_NONBROKEN
++# *** Zvkg vector crypto extension ***
-     select RISCV_ACLINT
++vghsh_vv    101100 1 ..... ..... 010 ..... 1110111 @r_vm_1
-     select SIFIVE_GPIO
++vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
-     select SIFIVE_PLIC
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
+index XXXXXXX..XXXXXXX 100644
- config SIFIVE_U
+--- a/target/riscv/cpu.c
-     bool
++++ b/target/riscv/cpu.c
-     select CADENCE
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
--    select MSI_NONBROKEN
+     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
-     select RISCV_ACLINT
+     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
-     select SIFIVE_GPIO
+     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
-     select SIFIVE_PDMA
++    ISA_EXT_DATA_ENTRY(zvkg, PRIV_VERSION_1_12_0, ext_zvkg),
-@@ -XXX,XX +XXX,XX @@ config SPIKE
+     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
-     bool
+     ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
-     select RISCV_NUMA
+     ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
-     select HTIF
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
--    select MSI_NONBROKEN
+      * In principle Zve*x would also suffice here, were they supported
-     select RISCV_ACLINT
+      * in qemu
-     select SIFIVE_PLIC
+      */
 -    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha ||
 -         cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
 +    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkg || cpu->cfg.ext_zvkned ||
 +         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      /* Vector cryptography extensions */
      DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
      DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 +    DEFINE_PROP_BOOL("x-zvkg", RISCVCPU, cfg.ext_zvkg, false),
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
      DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vsm3c_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
      vext_set_elems_1s(vd_vptr, vta, env->vl * esz, total_elems * esz);
      env->vstart = 0;
  }
 +
 +void HELPER(vghsh_vv)(void *vd_vptr, void *vs1_vptr, void *vs2_vptr,
 +                      CPURISCVState *env, uint32_t desc)
 +{
 +    uint64_t *vd = vd_vptr;
 +    uint64_t *vs1 = vs1_vptr;
 +    uint64_t *vs2 = vs2_vptr;
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint64_t Y[2] = {vd[i * 2 + 0], vd[i * 2 + 1]};
 +        uint64_t H[2] = {brev8(vs2[i * 2 + 0]), brev8(vs2[i * 2 + 1])};
 +        uint64_t X[2] = {vs1[i * 2 + 0], vs1[i * 2 + 1]};
 +        uint64_t Z[2] = {0, 0};
 +
 +        uint64_t S[2] = {brev8(Y[0] ^ X[0]), brev8(Y[1] ^ X[1])};
 +
 +        for (int j = 0; j < 128; j++) {
 +            if ((S[j / 64] >> (j % 64)) & 1) {
 +                Z[0] ^= H[0];
 +                Z[1] ^= H[1];
 +            }
 +            bool reduce = ((H[1] >> 63) & 1);
 +            H[1] = H[1] << 1 | H[0] >> 63;
 +            H[0] = H[0] << 1;
 +            if (reduce) {
 +                H[0] ^= 0x87;
 +            }
 +        }
 +
 +        vd[i * 2 + 0] = brev8(Z[0]);
 +        vd[i * 2 + 1] = brev8(Z[1]);
 +    }
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
 +    env->vstart = 0;
 +}
 +
 +void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
 +                      uint32_t desc)
 +{
 +    uint64_t *vd = vd_vptr;
 +    uint64_t *vs2 = vs2_vptr;
 +    uint32_t vta = vext_vta(desc);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
 +
 +    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
 +        uint64_t Y[2] = {brev8(vd[i * 2 + 0]), brev8(vd[i * 2 + 1])};
 +        uint64_t H[2] = {brev8(vs2[i * 2 + 0]), brev8(vs2[i * 2 + 1])};
 +        uint64_t Z[2] = {0, 0};
 +
 +        for (int j = 0; j < 128; j++) {
 +            if ((Y[j / 64] >> (j % 64)) & 1) {
 +                Z[0] ^= H[0];
 +                Z[1] ^= H[1];
 +            }
 +            bool reduce = ((H[1] >> 63) & 1);
 +            H[1] = H[1] << 1 | H[0] >> 63;
 +            H[0] = H[0] << 1;
 +            if (reduce) {
 +                H[0] ^= 0x87;
 +            }
 +        }
 +
 +        vd[i * 2 + 0] = brev8(Z[0]);
 +        vd[i * 2 + 1] = brev8(Z[1]);
 +    }
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
 +    env->vstart = 0;
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static inline bool vsm3c_check(DisasContext *s, arg_rmrr *a)
  GEN_VV_UNMASKED_TRANS(vsm3me_vv, vsm3me_check, ZVKSH_EGS)
  GEN_VI_UNMASKED_TRANS(vsm3c_vi, vsm3c_check, ZVKSH_EGS)
 +
 +/*
 + * Zvkg
 + */
 +
 +#define ZVKG_EGS 4
 +
 +static bool vgmul_check(DisasContext *s, arg_rmr *a)
 +{
 +    int egw_bytes = ZVKG_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkg == true &&
 +           vext_check_isa_ill(s) &&
 +           require_rvv(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           vext_check_ss(s, a->rd, a->rs2, a->vm) &&
 +           s->sew == MO_32;
 +}
 +
 +GEN_V_UNMASKED_TRANS(vgmul_vv, vgmul_check, ZVKG_EGS)
 +
 +static bool vghsh_check(DisasContext *s, arg_rmrr *a)
 +{
 +    int egw_bytes = ZVKG_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvkg == true &&
 +           opivv_check(s, a) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32;
 +}
 +
 +GEN_VV_UNMASKED_TRANS(vghsh_vv, vghsh_check, ZVKG_EGS)
 --
-.38.1
+.41.0

-[PULL v2 36/45] hw/intc: sifive_plic: Improve robustness of the PLIC config parser
+[PULL v2 20/45] crypto: Create sm4_subword
-From: Bin Meng <bmeng@tinylab.org>
+From: Max Chou <max.chou@sifive.com>
-At present the PLIC config parser can only handle legal config string
+Allows sharing of sm4_subword between different targets.
 like "MS,MS". However if a config string like ",MS,MS,,MS,MS,," is
 given the parser won't get the correct configuration.
-This commit improves the config parser to make it more robust.
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Max Chou <max.chou@sifive.com>
-Message-Id: <20221211030829.802437-7-bmeng@tinylab.org>
+Message-ID: <20230711165917.2629866-14-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/intc/sifive_plic.c | 24 ++++++++++++++++--------
+ include/crypto/sm4.h           |  8 ++++++++
-file changed, 16 insertions(+), 8 deletions(-)
+ target/arm/tcg/crypto_helper.c | 10 ++--------
 files changed, 10 insertions(+), 8 deletions(-)
-diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
+diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/sifive_plic.c
+--- a/include/crypto/sm4.h
-+++ b/hw/intc/sifive_plic.c
++++ b/include/crypto/sm4.h
-@@ -XXX,XX +XXX,XX @@ static void sifive_plic_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@
-  */
- static void parse_hart_config(SiFivePLICState *plic)
+ extern const uint8_t sm4_sbox[256];
- {
--    int addrid, hartid, modes;
++static inline uint32_t sm4_subword(uint32_t word)
-+    int addrid, hartid, modes, m;
++{
-     const char *p;
++    return sm4_sbox[word & 0xff] |
-     char c;
++           sm4_sbox[(word >> 8) & 0xff] << 8 |
++           sm4_sbox[(word >> 16) & 0xff] << 16 |
-@@ -XXX,XX +XXX,XX @@ static void parse_hart_config(SiFivePLICState *plic)
++           sm4_sbox[(word >> 24) & 0xff] << 24;
-     p = plic->hart_config;
++}
-     while ((c = *p++)) {
++
-         if (c == ',') {
+ #endif
--            addrid += ctpop8(modes);
+diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
--            modes = 0;
+index XXXXXXX..XXXXXXX 100644
--            hartid++;
+--- a/target/arm/tcg/crypto_helper.c
-+            if (modes) {
++++ b/target/arm/tcg/crypto_helper.c
-+                addrid += ctpop8(modes);
+@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
-+                hartid++;
+             CR_ST_WORD(d, (i + 3) % 4) ^
-+                modes = 0;
+             CR_ST_WORD(n, i);
-+            }
-         } else {
+-        t = sm4_sbox[t & 0xff] |
--            int m = 1 << char_to_mode(c);
+-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-+            m = 1 << char_to_mode(c);
+-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-             if (modes == (modes | m)) {
+-            sm4_sbox[(t >> 24) & 0xff] << 24;
-                 error_report("plic: duplicate mode '%c' in config: %s",
++        t = sm4_subword(t);
-                              c, plic->hart_config);
-@@ -XXX,XX +XXX,XX @@ static void parse_hart_config(SiFivePLICState *plic)
+         CR_ST_WORD(d, i) ^= t ^ rol32(t, 2) ^ rol32(t, 10) ^ rol32(t, 18) ^
-     }
+                             rol32(t, 24);
-     if (modes) {
+@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4ekey(uint64_t *rd, uint64_t *rn, uint64_t *rm)
-         addrid += ctpop8(modes);
+             CR_ST_WORD(d, (i + 3) % 4) ^
-+        hartid++;
+             CR_ST_WORD(m, i);
-+        modes = 0;
-     }
+-        t = sm4_sbox[t & 0xff] |
--    hartid++;
+-            sm4_sbox[(t >> 8) & 0xff] << 8 |
+-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-     plic->num_addrs = addrid;
+-            sm4_sbox[(t >> 24) & 0xff] << 24;
-     plic->num_harts = hartid;
++        t = sm4_subword(t);
-@@ -XXX,XX +XXX,XX @@ static void parse_hart_config(SiFivePLICState *plic)
-     p = plic->hart_config;
+         CR_ST_WORD(d, i) ^= t ^ rol32(t, 13) ^ rol32(t, 23);
      while ((c = *p++)) {
          if (c == ',') {
 -            hartid++;
 +            if (modes) {
 +                hartid++;
 +                modes = 0;
 +            }
          } else {
 +            m = char_to_mode(c);
              plic->addr_config[addrid].addrid = addrid;
              plic->addr_config[addrid].hartid = hartid;
 -            plic->addr_config[addrid].mode = char_to_mode(c);
 +            plic->addr_config[addrid].mode = m;
 +            modes |= (1 << m);
              addrid++;
          }
      }
 --
-.38.1
+.41.0

-[PULL v2 40/45] hw/riscv: sifive_e: Fix the number of interrupt sources of PLIC
+[PULL v2 21/45] crypto: Add SM4 constant parameter CK
-From: Bin Meng <bmeng@tinylab.org>
+From: Max Chou <max.chou@sifive.com>
-Per chapter 10 in Freedom E310 manuals [1][2][3], E310 G002 and G003
+Adds sm4_ck constant for use in sm4 cryptography across different targets.
 supports 52 interrupt sources while G000 supports 51 interrupt sources.
-We use the value of G002 and G003, so it is 53 (including source 0).
+Signed-off-by: Max Chou <max.chou@sifive.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-[1] G000 manual:
+Signed-off-by: Max Chou <max.chou@sifive.com>
-https://sifive.cdn.prismic.io/sifive/4faf3e34-4a42-4c2f-be9e-c77baa4928c7_fe310-g000-manual-v3p2.pdf
+Message-ID: <20230711165917.2629866-15-max.chou@sifive.com>
 [2] G002 manual:
 https://sifive.cdn.prismic.io/sifive/034760b5-ac6a-4b1c-911c-f4148bb2c4a5_fe310-g002-v1p5.pdf
 [3] G003 manual:
 https://sifive.cdn.prismic.io/sifive/3af39c59-6498-471e-9dab-5355a0d539eb_fe310-g003-manual.pdf
 Fixes: eb637edb1241 ("SiFive Freedom E Series RISC-V Machine")
 Signed-off-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20221211030829.802437-11-bmeng@tinylab.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/sifive_e.h | 7 ++++++-
+ include/crypto/sm4.h |  1 +
-file changed, 6 insertions(+), 1 deletion(-)
+ crypto/sm4.c         | 10 ++++++++++
 files changed, 11 insertions(+)
-diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
+diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/sifive_e.h
+--- a/include/crypto/sm4.h
-+++ b/include/hw/riscv/sifive_e.h
++++ b/include/crypto/sm4.h
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@
  #define QEMU_SM4_H
  extern const uint8_t sm4_sbox[256];
 +extern const uint32_t sm4_ck[32];
  static inline uint32_t sm4_subword(uint32_t word)
  {
 diff --git a/crypto/sm4.c b/crypto/sm4.c
 index XXXXXXX..XXXXXXX 100644
 --- a/crypto/sm4.c
 +++ b/crypto/sm4.c
@@ -XXX,XX +XXX,XX @@ uint8_t const sm4_sbox[] = {
 x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
  };
- #define SIFIVE_E_PLIC_HART_CONFIG "M"
++uint32_t const sm4_ck[] = {
--#define SIFIVE_E_PLIC_NUM_SOURCES 127
++    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
-+/*
++    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
-+ * Freedom E310 G002 and G003 supports 52 interrupt sources while
++    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
-+ * Freedom E310 G000 supports 51 interrupt sources. We use the value
++    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
-+ * of G002 and G003, so it is 53 (including interrupt source 0).
++    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
-+ */
++    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
-+#define SIFIVE_E_PLIC_NUM_SOURCES 53
++    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
- #define SIFIVE_E_PLIC_NUM_PRIORITIES 7
++    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
- #define SIFIVE_E_PLIC_PRIORITY_BASE 0x04
++};
  #define SIFIVE_E_PLIC_PENDING_BASE 0x1000
 --
-.38.1
+.41.0

-[PULL v2 08/45] hw/riscv/opentitan: add aon_timer base unimpl
+[PULL v2 22/45] target/riscv: Add Zvksed ISA extension support
-From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+From: Max Chou <max.chou@sifive.com>
-Adds the updated `aon_timer` base as an unimplemented device. This is
+This commit adds support for the Zvksed vector-crypto extension, which
-used by TockOS, patch ensures the guest doesn't hit load faults.
+consists of the following instructions:
-Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+* vsm4k.vi
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+* vsm4r.[vv,vs]
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221025043335.339815-3-wilfred.mallawa@opensource.wdc.com>
+Translation functions are defined in
 `target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
 `target/riscv/vcrypto_helper.c`.
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 [lawrence.hunter@codethink.co.uk: Moved SM4 functions from
 crypto_helper.c to vcrypto_helper.c]
 [nazar.kazakov@codethink.co.uk: Added alignment checks, refactored code to
 use macros, and minor style changes]
 Signed-off-by: Max Chou <max.chou@sifive.com>
 Message-ID: <20230711165917.2629866-16-max.chou@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/opentitan.h | 1 +
+ target/riscv/cpu_cfg.h                   |   1 +
- hw/riscv/opentitan.c         | 3 +++
+ target/riscv/helper.h                    |   4 +
-files changed, 4 insertions(+)
+ target/riscv/insn32.decode               |   5 +
+ target/riscv/cpu.c                       |   5 +-
-diff --git a/include/hw/riscv/opentitan.h b/include/hw/riscv/opentitan.h
+ target/riscv/vcrypto_helper.c            | 127 +++++++++++++++++++++++
-index XXXXXXX..XXXXXXX 100644
+ target/riscv/insn_trans/trans_rvvk.c.inc |  43 ++++++++
---- a/include/hw/riscv/opentitan.h
+files changed, 184 insertions(+), 1 deletion(-)
-+++ b/include/hw/riscv/opentitan.h
-@@ -XXX,XX +XXX,XX @@ enum {
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
-     IBEX_DEV_RSTMGR,
+index XXXXXXX..XXXXXXX 100644
-     IBEX_DEV_CLKMGR,
+--- a/target/riscv/cpu_cfg.h
-     IBEX_DEV_PINMUX,
++++ b/target/riscv/cpu_cfg.h
-+    IBEX_DEV_AON_TIMER,
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     IBEX_DEV_USBDEV,
+     bool ext_zvkned;
-     IBEX_DEV_FLASH_CTRL,
+     bool ext_zvknha;
-     IBEX_DEV_PLIC,
+     bool ext_zvknhb;
-diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
++    bool ext_zvksed;
-index XXXXXXX..XXXXXXX 100644
+     bool ext_zvksh;
---- a/hw/riscv/opentitan.c
+     bool ext_zmmul;
-+++ b/hw/riscv/opentitan.c
+     bool ext_zvfbfmin;
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry ibex_memmap[] = {
+diff --git a/target/riscv/helper.h b/target/riscv/helper.h
-     [IBEX_DEV_RSTMGR] =         {  0x40410000,  0x1000  },
+index XXXXXXX..XXXXXXX 100644
-     [IBEX_DEV_CLKMGR] =         {  0x40420000,  0x1000  },
+--- a/target/riscv/helper.h
-     [IBEX_DEV_PINMUX] =         {  0x40460000,  0x1000  },
++++ b/target/riscv/helper.h
-+    [IBEX_DEV_AON_TIMER] =      {  0x40470000,  0x1000  },
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_5(vsm3c_vi, void, ptr, ptr, i32, env, i32)
-     [IBEX_DEV_SENSOR_CTRL] =    {  0x40490000,  0x1000  },
-     [IBEX_DEV_FLASH_CTRL] =     {  0x41000000,  0x1000  },
+ DEF_HELPER_5(vghsh_vv, void, ptr, ptr, ptr, env, i32)
-     [IBEX_DEV_AES] =            {  0x41100000,  0x1000  },
+ DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
-@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
++
-         memmap[IBEX_DEV_CLKMGR].base, memmap[IBEX_DEV_CLKMGR].size);
++DEF_HELPER_5(vsm4k_vi, void, ptr, ptr, i32, env, i32)
-     create_unimplemented_device("riscv.lowrisc.ibex.pinmux",
++DEF_HELPER_4(vsm4r_vv, void, ptr, ptr, env, i32)
-         memmap[IBEX_DEV_PINMUX].base, memmap[IBEX_DEV_PINMUX].size);
++DEF_HELPER_4(vsm4r_vs, void, ptr, ptr, env, i32)
-+    create_unimplemented_device("riscv.lowrisc.ibex.aon_timer",
+diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
-+        memmap[IBEX_DEV_AON_TIMER].base, memmap[IBEX_DEV_AON_TIMER].size);
+index XXXXXXX..XXXXXXX 100644
-     create_unimplemented_device("riscv.lowrisc.ibex.usbdev",
+--- a/target/riscv/insn32.decode
-         memmap[IBEX_DEV_USBDEV].base, memmap[IBEX_DEV_USBDEV].size);
++++ b/target/riscv/insn32.decode
-     create_unimplemented_device("riscv.lowrisc.ibex.flash_ctrl",
+@@ -XXX,XX +XXX,XX @@ vsm3c_vi    101011 1 ..... ..... 010 ..... 1110111 @r_vm_1
  # *** Zvkg vector crypto extension ***
  vghsh_vv    101100 1 ..... ..... 010 ..... 1110111 @r_vm_1
  vgmul_vv    101000 1 ..... 10001 010 ..... 1110111 @r2_vm_1
 +
 +# *** Zvksed vector crypto extension ***
 +vsm4k_vi    100001 1 ..... ..... 010 ..... 1110111 @r_vm_1
 +vsm4r_vv    101000 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 +vsm4r_vs    101001 1 ..... 10000 010 ..... 1110111 @r2_vm_1
 diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/cpu.c
 +++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
      ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
      ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
      ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
 +    ISA_EXT_DATA_ENTRY(zvksed, PRIV_VERSION_1_12_0, ext_zvksed),
      ISA_EXT_DATA_ENTRY(zvksh, PRIV_VERSION_1_12_0, ext_zvksh),
      ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
      ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
       * in qemu
       */
      if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkg || cpu->cfg.ext_zvkned ||
 -         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksh) && !cpu->cfg.ext_zve32f) {
 +         cpu->cfg.ext_zvknha || cpu->cfg.ext_zvksed || cpu->cfg.ext_zvksh) &&
 +        !cpu->cfg.ext_zve32f) {
          error_setg(errp,
                     "Vector crypto extensions require V or Zve* extensions");
          return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
      DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
      DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 +    DEFINE_PROP_BOOL("x-zvksed", RISCVCPU, cfg.ext_zvksed, false),
      DEFINE_PROP_BOOL("x-zvksh", RISCVCPU, cfg.ext_zvksh, false),
      DEFINE_PROP_END_OF_LIST(),
 diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/vcrypto_helper.c
 +++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "crypto/aes.h"
  #include "crypto/aes-round.h"
 +#include "crypto/sm4.h"
  #include "exec/memop.h"
  #include "exec/exec-all.h"
  #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ void HELPER(vgmul_vv)(void *vd_vptr, void *vs2_vptr, CPURISCVState *env,
      vext_set_elems_1s(vd, vta, env->vl * 4, total_elems * 4);
      env->vstart = 0;
  }
 +
 +void HELPER(vsm4k_vi)(void *vd, void *vs2, uint32_t uimm5, CPURISCVState *env,
 +                      uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t rnd = uimm5 & 0x7;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            rk[j - vstart] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            tmp[j] = rk[j];
 +        }
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            uint32_t b, s;
 +            b = tmp[j + 1] ^ tmp[j + 2] ^ tmp[j + 3] ^ sm4_ck[rnd * 4 + j];
 +
 +            s = sm4_subword(b);
 +
 +            tmp[j + 4] = tmp[j] ^ (s ^ rol32(s, 13) ^ rol32(s, 23));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 +
 +static void do_sm4_round(uint32_t *rk, uint32_t *buf)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t s, b;
 +
 +    for (uint32_t j = egs; j < egs * 2; ++j) {
 +        b = buf[j - 3] ^ buf[j - 2] ^ buf[j - 1] ^ rk[j - 4];
 +
 +        s = sm4_subword(b);
 +
 +        buf[j] = buf[j - 4] ^ (s ^ rol32(s, 2) ^ rol32(s, 10) ^ rol32(s, 18) ^
 +                               rol32(s, 24));
 +    }
 +}
 +
 +void HELPER(vsm4r_vv)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            rk[j - vstart] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            tmp[j - vstart] = *((uint32_t *)vd + H4(j));
 +        }
 +
 +        do_sm4_round(rk, tmp);
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 +
 +void HELPER(vsm4r_vs)(void *vd, void *vs2, CPURISCVState *env, uint32_t desc)
 +{
 +    const uint32_t egs = 4;
 +    uint32_t group_start = env->vstart / egs;
 +    uint32_t group_end = env->vl / egs;
 +    uint32_t esz = sizeof(uint32_t);
 +    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
 +
 +    for (uint32_t i = group_start; i < group_end; ++i) {
 +        uint32_t vstart = i * egs;
 +        uint32_t vend = (i + 1) * egs;
 +        uint32_t rk[4] = {0};
 +        uint32_t tmp[8] = {0};
 +
 +        for (uint32_t j = 0; j < egs; ++j) {
 +            rk[j] = *((uint32_t *)vs2 + H4(j));
 +        }
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            tmp[j - vstart] = *((uint32_t *)vd + H4(j));
 +        }
 +
 +        do_sm4_round(rk, tmp);
 +
 +        for (uint32_t j = vstart; j < vend; ++j) {
 +            *((uint32_t *)vd + H4(j)) = tmp[egs + (j - vstart)];
 +        }
 +    }
 +
 +    env->vstart = 0;
 +    /* set tail elements to 1s */
 +    vext_set_elems_1s(vd, vext_vta(desc), env->vl * esz, total_elems * esz);
 +}
 diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/insn_trans/trans_rvvk.c.inc
 +++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vghsh_check(DisasContext *s, arg_rmrr *a)
  }
  GEN_VV_UNMASKED_TRANS(vghsh_vv, vghsh_check, ZVKG_EGS)
 +
 +/*
 + * Zvksed
 + */
 +
 +#define ZVKSED_EGS 4
 +
 +static bool zvksed_check(DisasContext *s)
 +{
 +    int egw_bytes = ZVKSED_EGS << s->sew;
 +    return s->cfg_ptr->ext_zvksed == true &&
 +           require_rvv(s) &&
 +           vext_check_isa_ill(s) &&
 +           MAXSZ(s) >= egw_bytes &&
 +           s->sew == MO_32;
 +}
 +
 +static bool vsm4k_vi_check(DisasContext *s, arg_rmrr *a)
 +{
 +    return zvksed_check(s) &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +GEN_VI_UNMASKED_TRANS(vsm4k_vi, vsm4k_vi_check, ZVKSED_EGS)
 +
 +static bool vsm4r_vv_check(DisasContext *s, arg_rmr *a)
 +{
 +    return zvksed_check(s) &&
 +           require_align(a->rd, s->lmul) &&
 +           require_align(a->rs2, s->lmul);
 +}
 +
 +GEN_V_UNMASKED_TRANS(vsm4r_vv, vsm4r_vv_check, ZVKSED_EGS)
 +
 +static bool vsm4r_vs_check(DisasContext *s, arg_rmr *a)
 +{
 +    return zvksed_check(s) &&
 +           !is_overlapped(a->rd, 1 << MAX(s->lmul, 0), a->rs2, 1) &&
 +           require_align(a->rd, s->lmul);
 +}
 +
 +GEN_V_UNMASKED_TRANS(vsm4r_vs, vsm4r_vs_check, ZVKSED_EGS)
 --
-.38.1
+.41.0

-[PULL v2 09/45] target/riscv: Add smstateen support
+[PULL v2 23/45] target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren
-From: Mayuresh Chitale <mchitale@ventanamicro.com>
+From: Rob Bradford <rbradford@rivosinc.com>
-Smstateen extension specifies a mechanism to close
+These are WARL fields - zero out the bits for unavailable counters and
-the potential covert channels that could cause security issues.
+special case the TM bit in mcountinhibit which is hardwired to zero.
 This patch achieves this by modifying the value written so that any use
 of the field will see the correctly masked bits.
-This patch adds the CSRs defined in the specification and
+Tested by modifying OpenSBI to write max value to these CSRs and upon
-the corresponding predicates and read/write functions.
+subsequent read the appropriate number of bits for number of PMUs is
 enabled and the TM bit is zero in mcountinhibit.
-Signed-off-by: Mayuresh Chitale <mchitale@ventanamicro.com>
+Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Atish Patra <atishp@rivosinc.com>
-Message-Id: <20221016124726.102129-2-mchitale@ventanamicro.com>
+Message-ID: <20230802124906.24197-1-rbradford@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h      |   4 +
+ target/riscv/csr.c | 11 +++++++++--
- target/riscv/cpu_bits.h |  37 +++++
+file changed, 9 insertions(+), 2 deletions(-)
  target/riscv/csr.c      | 316 ++++++++++++++++++++++++++++++++++++++++
  target/riscv/machine.c  |  21 +++
 files changed, 378 insertions(+)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
-     /* CSRs for execution enviornment configuration */
-     uint64_t menvcfg;
-+    uint64_t mstateen[SMSTATEEN_MAX_COUNT];
-+    uint64_t hstateen[SMSTATEEN_MAX_COUNT];
-+    uint64_t sstateen[SMSTATEEN_MAX_COUNT];
-     target_ulong senvcfg;
-     uint64_t henvcfg;
- #endif
-@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-     bool ext_ifencei;
-     bool ext_icsr;
-     bool ext_zihintpause;
-+    bool ext_smstateen;
-     bool ext_sstc;
-     bool ext_svinval;
-     bool ext_svnapot;
-diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_bits.h
-+++ b/target/riscv/cpu_bits.h
-@@ -XXX,XX +XXX,XX @@
- /* Supervisor Configuration CSRs */
- #define CSR_SENVCFG         0x10A
-+/* Supervisor state CSRs */
-+#define CSR_SSTATEEN0       0x10C
-+#define CSR_SSTATEEN1       0x10D
-+#define CSR_SSTATEEN2       0x10E
-+#define CSR_SSTATEEN3       0x10F
-+
- /* Supervisor Trap Handling */
- #define CSR_SSCRATCH        0x140
- #define CSR_SEPC            0x141
-@@ -XXX,XX +XXX,XX @@
- #define CSR_HENVCFG         0x60A
- #define CSR_HENVCFGH        0x61A
-+/* Hypervisor state CSRs */
-+#define CSR_HSTATEEN0       0x60C
-+#define CSR_HSTATEEN0H      0x61C
-+#define CSR_HSTATEEN1       0x60D
-+#define CSR_HSTATEEN1H      0x61D
-+#define CSR_HSTATEEN2       0x60E
-+#define CSR_HSTATEEN2H      0x61E
-+#define CSR_HSTATEEN3       0x60F
-+#define CSR_HSTATEEN3H      0x61F
-+
- /* Virtual CSRs */
- #define CSR_VSSTATUS        0x200
- #define CSR_VSIE            0x204
-@@ -XXX,XX +XXX,XX @@
- #define CSR_MENVCFG         0x30A
- #define CSR_MENVCFGH        0x31A
-+/* Machine state CSRs */
-+#define CSR_MSTATEEN0       0x30C
-+#define CSR_MSTATEEN0H      0x31C
-+#define CSR_MSTATEEN1       0x30D
-+#define CSR_MSTATEEN1H      0x31D
-+#define CSR_MSTATEEN2       0x30E
-+#define CSR_MSTATEEN2H      0x31E
-+#define CSR_MSTATEEN3       0x30F
-+#define CSR_MSTATEEN3H      0x31F
-+
-+/* Common defines for all smstateen */
-+#define SMSTATEEN_MAX_COUNT 4
-+#define SMSTATEEN0_CS       (1ULL << 0)
-+#define SMSTATEEN0_FCSR     (1ULL << 1)
-+#define SMSTATEEN0_HSCONTXT (1ULL << 57)
-+#define SMSTATEEN0_IMSIC    (1ULL << 58)
-+#define SMSTATEEN0_AIA      (1ULL << 59)
-+#define SMSTATEEN0_SVSLCT   (1ULL << 60)
-+#define SMSTATEEN0_HSENVCFG (1ULL << 62)
-+#define SMSTATEEN_STATEEN   (1ULL << 63)
-+
- /* Enhanced Physical Memory Protection (ePMP) */
- #define CSR_MSECCFG         0x747
- #define CSR_MSECCFGH        0x757
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException umode32(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
-     return umode(env, csrno);
+ {
- }
+     int cidx;
+     PMUCTRState *counter;
-+static RISCVException mstateen(CPURISCVState *env, int csrno)
++    RISCVCPU *cpu = env_archcpu(env);
-+{
-+    CPUState *cs = env_cpu(env);
+-    env->mcountinhibit = val;
-+    RISCVCPU *cpu = RISCV_CPU(cs);
++    /* WARL register - disable unavailable counters; TM bit is always 0 */
 +    env->mcountinhibit =
 +        val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR);
      /* Check if any other counter is also monitoring cycles/instructions */
      for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
  static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
                                         target_ulong val)
  {
 -    env->mcounteren = val;
 +    RISCVCPU *cpu = env_archcpu(env);
 +
-+    if (!cpu->cfg.ext_smstateen) {
++    /* WARL register - disable unavailable counters */
-+        return RISCV_EXCP_ILLEGAL_INST;
++    env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
-+    }
++                             COUNTEREN_IR);
 +
 +    return any(env, csrno);
 +}
 +
 +static RISCVException hstateen_pred(CPURISCVState *env, int csrno, int base)
 +{
 +    CPUState *cs = env_cpu(env);
 +    RISCVCPU *cpu = RISCV_CPU(cs);
 +
 +    if (!cpu->cfg.ext_smstateen) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    if (env->priv < PRV_M) {
 +        if (!(env->mstateen[csrno - base] & SMSTATEEN_STATEEN)) {
 +            return RISCV_EXCP_ILLEGAL_INST;
 +        }
 +    }
 +
 +    return hmode(env, csrno);
 +}
 +
 +static RISCVException hstateen(CPURISCVState *env, int csrno)
 +{
 +    return hstateen_pred(env, csrno, CSR_HSTATEEN0);
 +}
 +
 +static RISCVException hstateenh(CPURISCVState *env, int csrno)
 +{
 +    return hstateen_pred(env, csrno, CSR_HSTATEEN0H);
 +}
 +
 +static RISCVException sstateen(CPURISCVState *env, int csrno)
 +{
 +    bool virt = riscv_cpu_virt_enabled(env);
 +    int index = csrno - CSR_SSTATEEN0;
 +    CPUState *cs = env_cpu(env);
 +    RISCVCPU *cpu = RISCV_CPU(cs);
 +
 +    if (!cpu->cfg.ext_smstateen) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    if (env->priv < PRV_M) {
 +        if (!(env->mstateen[index] & SMSTATEEN_STATEEN)) {
 +            return RISCV_EXCP_ILLEGAL_INST;
 +        }
 +
 +        if (virt) {
 +            if (!(env->hstateen[index] & SMSTATEEN_STATEEN)) {
 +                return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 +            }
 +        }
 +    }
 +
 +    return smode(env, csrno);
 +}
 +
  /* Checks if PointerMasking registers could be accessed */
  static RISCVException pointer_masking(CPURISCVState *env, int csrno)
  {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
      return RISCV_EXCP_NONE;
  }
-+static RISCVException read_mstateen(CPURISCVState *env, int csrno,
-+                                    target_ulong *val)
-+{
-+    *val = env->mstateen[csrno - CSR_MSTATEEN0];
-+
-+    return RISCV_EXCP_NONE;
-+}
-+
-+static RISCVException write_mstateen(CPURISCVState *env, int csrno,
-+                                     uint64_t wr_mask, target_ulong new_val)
-+{
-+    uint64_t *reg;
-+
-+    reg = &env->mstateen[csrno - CSR_MSTATEEN0];
-+    *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
-+
-+    return RISCV_EXCP_NONE;
-+}
-+
-+static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
-+                                      target_ulong new_val)
-+{
-+    uint64_t wr_mask = SMSTATEEN_STATEEN;
-+
-+    return write_mstateen(env, csrno, wr_mask, new_val);
-+}
-+
-+static RISCVException write_mstateen_1_3(CPURISCVState *env, int csrno,
-+                                      target_ulong new_val)
-+{
-+    return write_mstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
-+}
-+
-+static RISCVException read_mstateenh(CPURISCVState *env, int csrno,
-+                                      target_ulong *val)
-+{
-+    *val = env->mstateen[csrno - CSR_MSTATEEN0H] >> 32;
-+
-+    return RISCV_EXCP_NONE;
-+}
-+
-+static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
-+                                      uint64_t wr_mask, target_ulong new_val)
-+{
-+    uint64_t *reg, val;
-+
-+    reg = &env->mstateen[csrno - CSR_MSTATEEN0H];
-+    val = (uint64_t)new_val << 32;
-+    val |= *reg & 0xFFFFFFFF;
-+    *reg = (*reg & ~wr_mask) | (val & wr_mask);
-+
-+    return RISCV_EXCP_NONE;
-+}
-+
-+static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
-+                                      target_ulong new_val)
-+{
-+    uint64_t wr_mask = SMSTATEEN_STATEEN;
-+
-+    return write_mstateenh(env, csrno, wr_mask, new_val);
-+}
-+
-+static RISCVException write_mstateenh_1_3(CPURISCVState *env, int csrno,
-+                                      target_ulong new_val)
-+{
-+    return write_mstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
-+}
-+
-+static RISCVException read_hstateen(CPURISCVState *env, int csrno,
-+                                    target_ulong *val)
-+{
-+    int index = csrno - CSR_HSTATEEN0;
-+
-+    *val = env->hstateen[index] & env->mstateen[index];
-+
-+    return RISCV_EXCP_NONE;
-+}
-+
-+static RISCVException write_hstateen(CPURISCVState *env, int csrno,
-+                                     uint64_t mask, target_ulong new_val)
-+{
-+    int index = csrno - CSR_HSTATEEN0;
-+    uint64_t *reg, wr_mask;
-+
-+    reg = &env->hstateen[index];
-+    wr_mask = env->mstateen[index] & mask;
-+    *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
-+
-+    return RISCV_EXCP_NONE;
-+}
-+
-+static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
-+                                      target_ulong new_val)
-+{
-+    uint64_t wr_mask = SMSTATEEN_STATEEN;
-+
-+    return write_hstateen(env, csrno, wr_mask, new_val);
-+}
-+
-+static RISCVException write_hstateen_1_3(CPURISCVState *env, int csrno,
-+                                      target_ulong new_val)
-+{
-+    return write_hstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
-+}
-+
-+static RISCVException read_hstateenh(CPURISCVState *env, int csrno,
-+                                     target_ulong *val)
-+{
-+    int index = csrno - CSR_HSTATEEN0H;
-+
-+    *val = (env->hstateen[index] >> 32) & (env->mstateen[index] >> 32);
-+
-+    return RISCV_EXCP_NONE;
-+}
-+
-+static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
-+                                      uint64_t mask, target_ulong new_val)
-+{
-+    int index = csrno - CSR_HSTATEEN0H;
-+    uint64_t *reg, wr_mask, val;
-+
-+    reg = &env->hstateen[index];
-+    val = (uint64_t)new_val << 32;
-+    val |= *reg & 0xFFFFFFFF;
-+    wr_mask = env->mstateen[index] & mask;
-+    *reg = (*reg & ~wr_mask) | (val & wr_mask);
-+
-+    return RISCV_EXCP_NONE;
-+}
-+
-+static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
-+                                       target_ulong new_val)
-+{
-+    uint64_t wr_mask = SMSTATEEN_STATEEN;
-+
-+    return write_hstateenh(env, csrno, wr_mask, new_val);
-+}
-+
-+static RISCVException write_hstateenh_1_3(CPURISCVState *env, int csrno,
-+                                       target_ulong new_val)
-+{
-+    return write_hstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
-+}
-+
-+static RISCVException read_sstateen(CPURISCVState *env, int csrno,
-+                                    target_ulong *val)
-+{
-+    bool virt = riscv_cpu_virt_enabled(env);
-+    int index = csrno - CSR_SSTATEEN0;
-+
-+    *val = env->sstateen[index] & env->mstateen[index];
-+    if (virt) {
-+        *val &= env->hstateen[index];
-+    }
-+
-+    return RISCV_EXCP_NONE;
-+}
-+
-+static RISCVException write_sstateen(CPURISCVState *env, int csrno,
-+                                     uint64_t mask, target_ulong new_val)
-+{
-+    bool virt = riscv_cpu_virt_enabled(env);
-+    int index = csrno - CSR_SSTATEEN0;
-+    uint64_t wr_mask;
-+    uint64_t *reg;
-+
-+    wr_mask = env->mstateen[index] & mask;
-+    if (virt) {
-+        wr_mask &= env->hstateen[index];
-+    }
-+
-+    reg = &env->sstateen[index];
-+    *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
-+
-+    return RISCV_EXCP_NONE;
-+}
-+
-+static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
-+                                      target_ulong new_val)
-+{
-+    uint64_t wr_mask = SMSTATEEN_STATEEN;
-+
-+    return write_sstateen(env, csrno, wr_mask, new_val);
-+}
-+
-+static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno,
-+                                      target_ulong new_val)
-+{
-+    return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
-+}
-+
- static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
-                                 uint64_t *ret_val,
-                                 uint64_t new_val, uint64_t wr_mask)
-@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
-     [CSR_HENVCFGH] = { "henvcfgh", hmode32, read_henvcfgh, write_henvcfgh,
-                        .min_priv_ver = PRIV_VERSION_1_12_0              },
-+    /* Smstateen extension CSRs */
-+    [CSR_MSTATEEN0] = { "mstateen0", mstateen, read_mstateen, write_mstateen0,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_MSTATEEN0H] = { "mstateen0h", mstateen, read_mstateenh,
-+                          write_mstateen0h,
-+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_MSTATEEN1] = { "mstateen1", mstateen, read_mstateen,
-+                        write_mstateen_1_3,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_MSTATEEN1H] = { "mstateen1h", mstateen, read_mstateenh,
-+                         write_mstateenh_1_3,
-+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_MSTATEEN2] = { "mstateen2", mstateen, read_mstateen,
-+                        write_mstateen_1_3,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_MSTATEEN2H] = { "mstateen2h", mstateen, read_mstateenh,
-+                         write_mstateenh_1_3,
-+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_MSTATEEN3] = { "mstateen3", mstateen, read_mstateen,
-+                        write_mstateen_1_3,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_MSTATEEN3H] = { "mstateen3h", mstateen, read_mstateenh,
-+                         write_mstateenh_1_3,
-+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_HSTATEEN0] = { "hstateen0", hstateen, read_hstateen, write_hstateen0,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_HSTATEEN0H] = { "hstateen0h", hstateenh, read_hstateenh,
-+                         write_hstateen0h,
-+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_HSTATEEN1] = { "hstateen1", hstateen, read_hstateen,
-+                        write_hstateen_1_3,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_HSTATEEN1H] = { "hstateen1h", hstateenh, read_hstateenh,
-+                         write_hstateenh_1_3,
-+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_HSTATEEN2] = { "hstateen2", hstateen, read_hstateen,
-+                        write_hstateen_1_3,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_HSTATEEN2H] = { "hstateen2h", hstateenh, read_hstateenh,
-+                         write_hstateenh_1_3,
-+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_HSTATEEN3] = { "hstateen3", hstateen, read_hstateen,
-+                        write_hstateen_1_3,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_HSTATEEN3H] = { "hstateen3h", hstateenh, read_hstateenh,
-+                         write_hstateenh_1_3,
-+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_SSTATEEN0] = { "sstateen0", sstateen, read_sstateen, write_sstateen0,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_SSTATEEN1] = { "sstateen1", sstateen, read_sstateen,
-+                        write_sstateen_1_3,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_SSTATEEN2] = { "sstateen2", sstateen, read_sstateen,
-+                        write_sstateen_1_3,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+    [CSR_SSTATEEN3] = { "sstateen3", sstateen, read_sstateen,
-+                        write_sstateen_1_3,
-+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
-+
-     /* Supervisor Trap Setup */
-     [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
-                          NULL,                read_sstatus_i128               },
-diff --git a/target/riscv/machine.c b/target/riscv/machine.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/machine.c
-+++ b/target/riscv/machine.c
-@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_post_load(void *opaque, int version_id)
-     return 0;
- }
-+static bool smstateen_needed(void *opaque)
-+{
-+    RISCVCPU *cpu = opaque;
-+
-+    return cpu->cfg.ext_smstateen;
-+}
-+
-+static const VMStateDescription vmstate_smstateen = {
-+    .name = "cpu/smtateen",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .needed = smstateen_needed,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT64_ARRAY(env.mstateen, RISCVCPU, 4),
-+        VMSTATE_UINT64_ARRAY(env.hstateen, RISCVCPU, 4),
-+        VMSTATE_UINT64_ARRAY(env.sstateen, RISCVCPU, 4),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
- static bool envcfg_needed(void *opaque)
- {
-     RISCVCPU *cpu = opaque;
-@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
-         &vmstate_kvmtimer,
-         &vmstate_envcfg,
-         &vmstate_debug,
-+        &vmstate_smstateen,
-         NULL
-     }
- };
 --
-.38.1
+.41.0

-[PULL v2 05/45] tcg/riscv: Fix reg overlap case in tcg_out_addsub2
+[PULL v2 24/45] target/riscv: Add Zihintntl extension ISA string to DTS
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Jason Chien <jason.chien@sifive.com>
-There was a typo using opc_addi instead of opc_add with the
+RVA23 Profiles states:
-two registers.  While we're at it, simplify the gating test
+The RVA23 profiles are intended to be used for 64-bit application
-to al == bl to improve dynamic scheduling even when the
+processors that will run rich OS stacks from standard binary OS
-output register does not overlap the inputs.
+distributions and with a substantial number of third-party binary user
 applications that will be supported over a considerable length of time
 in the field.
-Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+The chapter 4 of the unprivileged spec introduces the Zihintntl extension
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+and Zihintntl is a mandatory extension presented in RVA23 Profiles, whose
 purpose is to enable application and operating system portability across
 different implementations. Thus the DTS should contain the Zihintntl ISA
 string in order to pass to software.
 The unprivileged spec states:
 Like any HINTs, these instructions may be freely ignored. Hence, although
 they are described in terms of cache-based memory hierarchies, they do not
 mandate the provision of caches.
 These instructions are encoded with non-used opcode, e.g. ADD x0, x0, x2,
 which QEMU already supports, and QEMU does not emulate cache. Therefore
 these instructions can be considered as a no-op, and we only need to add
 a new property for the Zihintntl extension.
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221020233836.2341671-1-richard.henderson@linaro.org>
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
 Message-ID: <20230726074049.19505-2-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- tcg/riscv/tcg-target.c.inc | 10 ++++++++--
+ target/riscv/cpu_cfg.h | 1 +
-file changed, 8 insertions(+), 2 deletions(-)
+ target/riscv/cpu.c     | 2 ++
 files changed, 3 insertions(+)
-diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
+diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/riscv/tcg-target.c.inc
+--- a/target/riscv/cpu_cfg.h
-+++ b/tcg/riscv/tcg-target.c.inc
++++ b/target/riscv/cpu_cfg.h
-@@ -XXX,XX +XXX,XX @@ static void tcg_out_addsub2(TCGContext *s,
+@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
-         if (cbl) {
+     bool ext_icbom;
-             tcg_out_opc_imm(s, opc_addi, rl, al, bl);
+     bool ext_icboz;
-             tcg_out_opc_imm(s, OPC_SLTIU, TCG_REG_TMP0, rl, bl);
+     bool ext_zicond;
--        } else if (rl == al && rl == bl) {
++    bool ext_zihintntl;
-+        } else if (al == bl) {
+     bool ext_zihintpause;
-+            /*
+     bool ext_smstateen;
-+             * If the input regs overlap, this is a simple doubling
+     bool ext_sstc;
-+             * and carry-out is the input msb.  This special case is
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
-+             * required when the output reg overlaps the input,
+index XXXXXXX..XXXXXXX 100644
-+             * but we might as well use it always.
+--- a/target/riscv/cpu.c
-+             */
++++ b/target/riscv/cpu.c
-             tcg_out_opc_imm(s, OPC_SLTI, TCG_REG_TMP0, al, 0);
+@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
--            tcg_out_opc_reg(s, opc_addi, rl, al, bl);
+     ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
-+            tcg_out_opc_reg(s, opc_add, rl, al, al);
+     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
-         } else {
+     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
-             tcg_out_opc_reg(s, opc_add, rl, al, bl);
++    ISA_EXT_DATA_ENTRY(zihintntl, PRIV_VERSION_1_10_0, ext_zihintntl),
-             tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_TMP0,
+     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
      ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
      ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("sscofpmf", RISCVCPU, cfg.ext_sscofpmf, false),
      DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
      DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
 +    DEFINE_PROP_BOOL("Zihintntl", RISCVCPU, cfg.ext_zihintntl, true),
      DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
      DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
      DEFINE_PROP_BOOL("Zfa", RISCVCPU, cfg.ext_zfa, true),
 --
-.38.1
+.41.0

-[PULL v2 16/45] hw/intc: sifive_plic: Renumber the S irqs for numa support
+[PULL v2 25/45] target/riscv: Fix zfa fleq.d and fltq.d
-From: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr>
+From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Commit 40244040a7a changed the way the S irqs are numbered. This breaks when
+Commit a47842d ("riscv: Add support for the Zfa extension") implemented the zfa extension.
-using numa configuration, e.g.:
+However, it has some typos for fleq.d and fltq.d. Both of them misused the fltq.s
-./qemu-system-riscv64 -nographic -machine virt,dumpdtb=numa-tree.dtb \
+helper function.
                       -m 2G -smp cpus=16 \
               -object memory-backend-ram,id=mem0,size=512M \
               -object memory-backend-ram,id=mem1,size=512M \
               -object memory-backend-ram,id=mem2,size=512M \
               -object memory-backend-ram,id=mem3,size=512M \
               -numa node,cpus=0-3,memdev=mem0,nodeid=0 \
               -numa node,cpus=4-7,memdev=mem1,nodeid=1 \
               -numa node,cpus=8-11,memdev=mem2,nodeid=2 \
               -numa node,cpus=12-15,memdev=mem3,nodeid=3
 leads to:
 Unexpected error in object_property_find_err() at ../qom/object.c:1304:
 qemu-system-riscv64: Property 'riscv.sifive.plic.unnamed-gpio-out[8]' not
 found
-This patch makes the nubering of the S irqs identical to what it was before.
+Fixes: a47842d ("riscv: Add support for the Zfa extension")
+Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Signed-off-by: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr>
+Message-ID: <20230728003906.768-1-zhiwei_liu@linux.alibaba.com>
 Message-Id: <20221114135122.1668703-1-frederic.petrot@univ-grenoble-alpes.fr>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/intc/sifive_plic.c | 4 ++--
+ target/riscv/insn_trans/trans_rvzfa.c.inc | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
+diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/sifive_plic.c
+--- a/target/riscv/insn_trans/trans_rvzfa.c.inc
-+++ b/hw/intc/sifive_plic.c
++++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
-@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
+@@ -XXX,XX +XXX,XX @@ bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
-         CPUState *cpu = qemu_get_cpu(cpu_num);
+     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
+     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
-         if (plic->addr_config[i].mode == PLICMode_M) {
--            qdev_connect_gpio_out(dev, num_harts - plic->hartid_base + cpu_num,
+-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
-+            qdev_connect_gpio_out(dev, cpu_num - hartid_base + num_harts,
++    gen_helper_fleq_d(dest, cpu_env, src1, src2);
-                                   qdev_get_gpio_in(DEVICE(cpu), IRQ_M_EXT));
+     gen_set_gpr(ctx, a->rd, dest);
-         }
+     return true;
-         if (plic->addr_config[i].mode == PLICMode_S) {
+ }
--            qdev_connect_gpio_out(dev, cpu_num,
+@@ -XXX,XX +XXX,XX @@ bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
-+            qdev_connect_gpio_out(dev, cpu_num - hartid_base,
+     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
-                                   qdev_get_gpio_in(DEVICE(cpu), IRQ_S_EXT));
+     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
-         }
-     }
+-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
 +    gen_helper_fltq_d(dest, cpu_env, src1, src2);
      gen_set_gpr(ctx, a->rd, dest);
      return true;
  }
 --
-.38.1
+.41.0

-[PULL v2 45/45] hw/intc: sifive_plic: Fix the pending register range check
+[PULL v2 26/45] hw/intc: Fix upper/lower mtime write calculation
-From: Bin Meng <bmeng@tinylab.org>
+From: Jason Chien <jason.chien@sifive.com>
-The pending register upper limit is currently set to
+When writing the upper mtime, we should keep the original lower mtime
-plic->num_sources >> 3, which is wrong, e.g.: considering
+whose value is given by cpu_riscv_read_rtc() instead of
-plic->num_sources is 7, the upper limit becomes 0 which fails
+cpu_riscv_read_rtc_raw(). The same logic applies to writes to lower mtime.
 the range check if reading the pending register at pending_base.
-Fixes: 1e24429e40df ("SiFive RISC-V PLIC Block")
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
 Signed-off-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221211030829.802437-16-bmeng@tinylab.org>
+Message-ID: <20230728082502.26439-1-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/intc/sifive_plic.c | 5 +++--
+ hw/intc/riscv_aclint.c | 5 +++--
 file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
+diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/sifive_plic.c
+--- a/hw/intc/riscv_aclint.c
-+++ b/hw/intc/sifive_plic.c
++++ b/hw/intc/riscv_aclint.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t sifive_plic_read(void *opaque, hwaddr addr, unsigned size)
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
-         uint32_t irq = (addr - plic->priority_base) >> 2;
+         return;
+     } else if (addr == mtimer->time_base || addr == mtimer->time_base + 4) {
-         return plic->source_priority[irq];
+         uint64_t rtc_r = cpu_riscv_read_rtc_raw(mtimer->timebase_freq);
--    } else if (addr_between(addr, plic->pending_base, plic->num_sources >> 3)) {
++        uint64_t rtc = cpu_riscv_read_rtc(mtimer);
-+    } else if (addr_between(addr, plic->pending_base,
-+                            (plic->num_sources + 31) >> 3)) {
+         if (addr == mtimer->time_base) {
-         uint32_t word = (addr - plic->pending_base) >> 2;
+             if (size == 4) {
+                 /* time_lo for RV32/RV64 */
-         return plic->pending[word];
+-                mtimer->time_delta = ((rtc_r & ~0xFFFFFFFFULL) | value) - rtc_r;
-@@ -XXX,XX +XXX,XX @@ static void sifive_plic_write(void *opaque, hwaddr addr, uint64_t value,
++                mtimer->time_delta = ((rtc & ~0xFFFFFFFFULL) | value) - rtc_r;
-             sifive_plic_update(plic);
+             } else {
-         }
+                 /* time for RV64 */
-     } else if (addr_between(addr, plic->pending_base,
+                 mtimer->time_delta = value - rtc_r;
--                            plic->num_sources >> 3)) {
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
-+                            (plic->num_sources + 31) >> 3)) {
+         } else {
-         qemu_log_mask(LOG_GUEST_ERROR,
+             if (size == 4) {
-                       "%s: invalid pending write: 0x%" HWADDR_PRIx "",
+                 /* time_hi for RV32/RV64 */
-                       __func__, addr);
+-                mtimer->time_delta = (value << 32 | (rtc_r & 0xFFFFFFFF)) - rtc_r;
 +                mtimer->time_delta = (value << 32 | (rtc & 0xFFFFFFFF)) - rtc_r;
              } else {
                  qemu_log_mask(LOG_GUEST_ERROR,
                                "aclint-mtimer: invalid time_hi write: %08x",
 --
-.38.1
+.41.0

-[PULL v2 28/45] target/riscv: Clear mstatus.MPRV when leaving M-mode for priv spec 1.12+
+[PULL v2 27/45] hw/intc: Make rtc variable names consistent
-From: Bin Meng <bmeng@tinylab.org>
+From: Jason Chien <jason.chien@sifive.com>
-Since priv spec v1.12, MRET and SRET now clear mstatus.MPRV when
+The variables whose values are given by cpu_riscv_read_rtc() should be named
-leaving M-mode.
+"rtc". The variables whose value are given by cpu_riscv_read_rtc_raw()
 should be named "rtc_r".
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+Signed-off-by: Jason Chien <jason.chien@sifive.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221207090037.281452-2-bmeng@tinylab.org>
+Message-ID: <20230728082502.26439-2-jason.chien@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/op_helper.c | 6 ++++++
+ hw/intc/riscv_aclint.c | 6 +++---
-file changed, 6 insertions(+)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
+diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
+--- a/hw/intc/riscv_aclint.c
-+++ b/target/riscv/op_helper.c
++++ b/hw/intc/riscv_aclint.c
-@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
-                         get_field(mstatus, MSTATUS_SPIE));
+     uint64_t next;
-     mstatus = set_field(mstatus, MSTATUS_SPIE, 1);
+     uint64_t diff;
-     mstatus = set_field(mstatus, MSTATUS_SPP, PRV_U);
-+    if (env->priv_ver >= PRIV_VERSION_1_12_0) {
+-    uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
-+        mstatus = set_field(mstatus, MSTATUS_MPRV, 0);
++    uint64_t rtc = cpu_riscv_read_rtc(mtimer);
-+    }
-     env->mstatus = mstatus;
+     /* Compute the relative hartid w.r.t the socket */
+     hartid = hartid - mtimer->hartid_base;
-     if (riscv_has_ext(env, RVH) && !riscv_cpu_virt_enabled(env)) {
-@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
+     mtimer->timecmp[hartid] = value;
-     mstatus = set_field(mstatus, MSTATUS_MPIE, 1);
+-    if (mtimer->timecmp[hartid] <= rtc_r) {
-     mstatus = set_field(mstatus, MSTATUS_MPP, PRV_U);
++    if (mtimer->timecmp[hartid] <= rtc) {
-     mstatus = set_field(mstatus, MSTATUS_MPV, 0);
+         /*
-+    if ((env->priv_ver >= PRIV_VERSION_1_12_0) && (prev_priv != PRV_M)) {
+          * If we're setting an MTIMECMP value in the "past",
-+        mstatus = set_field(mstatus, MSTATUS_MPRV, 0);
+          * immediately raise the timer interrupt
-+    }
+@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
-     env->mstatus = mstatus;
-     riscv_cpu_set_mode(env, prev_priv);
+     /* otherwise, set up the future timer interrupt */
      qemu_irq_lower(mtimer->timer_irqs[hartid]);
 -    diff = mtimer->timecmp[hartid] - rtc_r;
 +    diff = mtimer->timecmp[hartid] - rtc;
      /* back to ns (note args switched in muldiv64) */
      uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
 --
-.38.1
+.41.0

-[PULL v2 14/45] target/riscv: Enable native debug itrigger
+[PULL v2 28/45] linux-user/riscv: Use abi type for target_ucontext
 From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-When QEMU is not in icount mode, execute instruction one by one. The
+We should not use types dependend on host arch for target_ucontext.
-tdata1 can be read directly.
+This bug is found when run rv32 applications.
 When QEMU is in icount mode, use a timer to simulate the itrigger. The
 tdata1 may be not right because of lazy update of count in tdata1. Thus,
 We should pack the adjusted count into tdata1 before read it back.
 Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-Id: <20221013062946.7530-4-zhiwei_liu@linux.alibaba.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-ID: <20230811055438.1945-1-zhiwei_liu@linux.alibaba.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/debug.c | 72 ++++++++++++++++++++++++++++++++++++++++++++
+ linux-user/riscv/signal.c | 4 ++--
-file changed, 72 insertions(+)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/debug.c b/target/riscv/debug.c
+diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/debug.c
+--- a/linux-user/riscv/signal.c
-+++ b/target/riscv/debug.c
++++ b/linux-user/riscv/signal.c
-@@ -XXX,XX +XXX,XX @@ void riscv_itrigger_update_priv(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@ struct target_sigcontext {
-     riscv_itrigger_update_count(env);
+ }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
- }
+ struct target_ucontext {
-+static target_ulong itrigger_validate(CPURISCVState *env,
+-    unsigned long uc_flags;
-+                                      target_ulong ctrl)
+-    struct target_ucontext *uc_link;
-+{
++    abi_ulong uc_flags;
-+    target_ulong val;
++    abi_ptr uc_link;
-+
+     target_stack_t uc_stack;
-+    /* validate the generic part first */
+     target_sigset_t uc_sigmask;
-+    val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT);
+     uint8_t   __unused[1024 / 8 - sizeof(target_sigset_t)];
 +
 +    /* validate unimplemented (always zero) bits */
 +    warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action");
 +    warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit");
 +    warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending");
 +
 +    /* keep the mode and attribute bits */
 +    val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S |
 +                   ITRIGGER_M | ITRIGGER_COUNT);
 +
 +    return val;
 +}
 +
 +static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
 +                               int tdata_index, target_ulong val)
 +{
 +    target_ulong new_val;
 +
 +    switch (tdata_index) {
 +    case TDATA1:
 +        /* set timer for icount */
 +        new_val = itrigger_validate(env, val);
 +        if (new_val != env->tdata1[index]) {
 +            env->tdata1[index] = new_val;
 +            if (icount_enabled()) {
 +                env->last_icount = icount_get_raw();
 +                /* set the count to timer */
 +                timer_mod(env->itrigger_timer[index],
 +                          env->last_icount + itrigger_get_count(env, index));
 +            }
 +        }
 +        break;
 +    case TDATA2:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "tdata2 is not supported for icount trigger\n");
 +        break;
 +    case TDATA3:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "tdata3 is not supported for icount trigger\n");
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    return;
 +}
 +
 +static int itrigger_get_adjust_count(CPURISCVState *env)
 +{
 +    int count = itrigger_get_count(env, env->trigger_cur), executed;
 +    if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) {
 +        executed = icount_get_raw() - env->last_icount;
 +        count += executed;
 +    }
 +    return count;
 +}
 +
  target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
  {
 +    int trigger_type;
      switch (tdata_index) {
      case TDATA1:
 +        trigger_type = extract_trigger_type(env, env->tdata1[env->trigger_cur]);
 +        if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) {
 +            return deposit64(env->tdata1[env->trigger_cur], 10, 14,
 +                             itrigger_get_adjust_count(env));
 +        }
          return env->tdata1[env->trigger_cur];
      case TDATA2:
          return env->tdata2[env->trigger_cur];
@@ -XXX,XX +XXX,XX @@ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
          type6_reg_write(env, env->trigger_cur, tdata_index, val);
          break;
      case TRIGGER_TYPE_INST_CNT:
 +        itrigger_reg_write(env, env->trigger_cur, tdata_index, val);
 +        break;
      case TRIGGER_TYPE_INT:
      case TRIGGER_TYPE_EXCP:
      case TRIGGER_TYPE_EXT_SRC:
 --
-.38.1
+.41.0

-[PULL v2 23/45] hw/{misc, riscv}: pfsoc: add system controller as unimplemented
+[PULL v2 29/45] target/riscv: support the AIA device emulation with KVM enabled
-From: Conor Dooley <conor.dooley@microchip.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-The system controller on PolarFire SoC is access via a mailbox. The
+In this patch, we create the APLIC and IMSIC FDT helper functions and
-control registers for this mailbox lie in the "IOSCB" region & the
+remove M mode AIA devices when using KVM acceleration.
 interrupt is cleared via write to the "SYSREG" region. It also has a
 QSPI controller, usually connected to a flash chip, that is used for
 storing FPGA bitstreams and used for In-Application Programming (IAP).
-Linux has an implementation of the system controller, through which the
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-hwrng is accessed, leading to load/store access faults.
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Add the QSPI as unimplemented and a very basic (effectively
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-unimplemented) version of the system controller's mailbox. Rather than
+Message-ID: <20230727102439.22554-2-yongxuan.wang@sifive.com>
 purely marking the regions as unimplemented, service the mailbox
 requests by reporting failures and raising the interrupt so a guest can
 better handle the lack of support.
 Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20221117225518.4102575-4-conor@kernel.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/misc/mchp_pfsoc_ioscb.h  |  3 ++
+ hw/riscv/virt.c | 290 +++++++++++++++++++++++-------------------------
- include/hw/misc/mchp_pfsoc_sysreg.h |  1 +
+file changed, 137 insertions(+), 153 deletions(-)
  include/hw/riscv/microchip_pfsoc.h  |  1 +
  hw/misc/mchp_pfsoc_ioscb.c          | 72 ++++++++++++++++++++++++++++-
  hw/misc/mchp_pfsoc_sysreg.c         | 18 ++++++--
  hw/riscv/microchip_pfsoc.c          |  6 +++
 files changed, 95 insertions(+), 6 deletions(-)
-diff --git a/include/hw/misc/mchp_pfsoc_ioscb.h b/include/hw/misc/mchp_pfsoc_ioscb.h
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/mchp_pfsoc_ioscb.h
+--- a/hw/riscv/virt.c
-+++ b/include/hw/misc/mchp_pfsoc_ioscb.h
++++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ typedef struct MchpPfSoCIoscbState {
+@@ -XXX,XX +XXX,XX @@ static uint32_t imsic_num_bits(uint32_t count)
-     MemoryRegion lane01;
+     return ret;
-     MemoryRegion lane23;
+ }
-     MemoryRegion ctrl;
-+    MemoryRegion qspixip;
+-static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
-+    MemoryRegion mailbox;
+-                             uint32_t *phandle, uint32_t *intc_phandles,
-     MemoryRegion cfg;
+-                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
-     MemoryRegion ccc;
++static void create_fdt_one_imsic(RISCVVirtState *s, hwaddr base_addr,
-     MemoryRegion pll_mss;
++                                 uint32_t *intc_phandles, uint32_t msi_phandle,
-@@ -XXX,XX +XXX,XX @@ typedef struct MchpPfSoCIoscbState {
++                                 bool m_mode, uint32_t imsic_guest_bits)
-     MemoryRegion cfm_sgmii;
+ {
-     MemoryRegion bc_sgmii;
+     int cpu, socket;
-     MemoryRegion io_calib_sgmii;
+     char *imsic_name;
-+    qemu_irq irq;
+     MachineState *ms = MACHINE(s);
- } MchpPfSoCIoscbState;
+     int socket_count = riscv_socket_count(ms);
+-    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
- #define TYPE_MCHP_PFSOC_IOSCB "mchp.pfsoc.ioscb"
++    uint32_t imsic_max_hart_per_socket;
-diff --git a/include/hw/misc/mchp_pfsoc_sysreg.h b/include/hw/misc/mchp_pfsoc_sysreg.h
+     uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/mchp_pfsoc_sysreg.h
+-    *msi_m_phandle = (*phandle)++;
-+++ b/include/hw/misc/mchp_pfsoc_sysreg.h
+-    *msi_s_phandle = (*phandle)++;
-@@ -XXX,XX +XXX,XX @@
+     imsic_cells = g_new0(uint32_t, ms->smp.cpus * 2);
- typedef struct MchpPfSoCSysregState {
+     imsic_regs = g_new0(uint32_t, socket_count * 4);
-     SysBusDevice parent;
-     MemoryRegion sysreg;
+-    /* M-level IMSIC node */
-+    qemu_irq irq;
+     for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
- } MchpPfSoCSysregState;
+         imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
- #define TYPE_MCHP_PFSOC_SYSREG "mchp.pfsoc.sysreg"
++        imsic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+     }
-index XXXXXXX..XXXXXXX 100644
+-    imsic_max_hart_per_socket = 0;
---- a/include/hw/riscv/microchip_pfsoc.h
+-    for (socket = 0; socket < socket_count; socket++) {
-+++ b/include/hw/riscv/microchip_pfsoc.h
+-        imsic_addr = memmap[VIRT_IMSIC_M].base +
-@@ -XXX,XX +XXX,XX @@ enum {
+-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-     MICROCHIP_PFSOC_MMUART2_IRQ = 92,
+-        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
-     MICROCHIP_PFSOC_MMUART3_IRQ = 93,
+-        imsic_regs[socket * 4 + 0] = 0;
-     MICROCHIP_PFSOC_MMUART4_IRQ = 94,
+-        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
-+    MICROCHIP_PFSOC_MAILBOX_IRQ = 96,
+-        imsic_regs[socket * 4 + 2] = 0;
- };
+-        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
+-        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
- #define MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT    1
+-            imsic_max_hart_per_socket = s->soc[socket].num_harts;
-diff --git a/hw/misc/mchp_pfsoc_ioscb.c b/hw/misc/mchp_pfsoc_ioscb.c
+-        }
-index XXXXXXX..XXXXXXX 100644
+-    }
---- a/hw/misc/mchp_pfsoc_ioscb.c
+-    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-+++ b/hw/misc/mchp_pfsoc_ioscb.c
+-        (unsigned long)memmap[VIRT_IMSIC_M].base);
-@@ -XXX,XX +XXX,XX @@
+-    qemu_fdt_add_subnode(ms->fdt, imsic_name);
- #include "qemu/bitops.h"
+-    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
- #include "qemu/log.h"
+-        "riscv,imsics");
- #include "qapi/error.h"
+-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
-+#include "hw/irq.h"
+-        FDT_IMSIC_INT_CELLS);
- #include "hw/sysbus.h"
+-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
- #include "hw/misc/mchp_pfsoc_ioscb.h"
+-        NULL, 0);
+-    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
-@@ -XXX,XX +XXX,XX @@
+-        NULL, 0);
- #define IOSCB_WHOLE_REG_SIZE        0x10000000
+-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
- #define IOSCB_SUBMOD_REG_SIZE       0x1000
+-        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
- #define IOSCB_CCC_REG_SIZE          0x2000000
+-    qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
-+#define IOSCB_CTRL_REG_SIZE         0x800
+-        socket_count * sizeof(uint32_t) * 4);
-+#define IOSCB_QSPIXIP_REG_SIZE      0x200
+-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
-+
+-        VIRT_IRQCHIP_NUM_MSIS);
+-    if (socket_count > 1) {
- /*
+-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
-  * There are many sub-modules in the IOSCB module.
+-            imsic_num_bits(imsic_max_hart_per_socket));
-@@ -XXX,XX +XXX,XX @@
+-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
- #define IOSCB_LANE01_BASE           0x06500000
+-            imsic_num_bits(socket_count));
- #define IOSCB_LANE23_BASE           0x06510000
+-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
- #define IOSCB_CTRL_BASE             0x07020000
+-            IMSIC_MMIO_GROUP_MIN_SHIFT);
-+#define IOSCB_QSPIXIP_BASE          0x07020100
+-    }
-+#define IOSCB_MAILBOX_BASE          0x07020800
+-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_m_phandle);
- #define IOSCB_CFG_BASE              0x07080000
+-
- #define IOSCB_CCC_BASE              0x08000000
+-    g_free(imsic_name);
- #define IOSCB_PLL_MSS_BASE          0x0E001000
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
+-    /* S-level IMSIC node */
-     .endianness = DEVICE_LITTLE_ENDIAN,
+-    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
- };
+-        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
+-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
-+#define SERVICES_CR             0x50
+-    }
-+#define SERVICES_SR             0x54
+-    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
-+#define SERVICES_STATUS_SHIFT   16
+     imsic_max_hart_per_socket = 0;
-+
+     for (socket = 0; socket < socket_count; socket++) {
-+static uint64_t mchp_pfsoc_ctrl_read(void *opaque, hwaddr offset,
+-        imsic_addr = memmap[VIRT_IMSIC_S].base +
-+                                     unsigned size)
+-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
 +        imsic_addr = base_addr + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
          imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
                       s->soc[socket].num_harts;
          imsic_regs[socket * 4 + 0] = 0;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
              imsic_max_hart_per_socket = s->soc[socket].num_harts;
          }
      }
 -    imsic_name = g_strdup_printf("/soc/imsics@%lx",
 -        (unsigned long)memmap[VIRT_IMSIC_S].base);
 +
 +    imsic_name = g_strdup_printf("/soc/imsics@%lx", (unsigned long)base_addr);
      qemu_fdt_add_subnode(ms->fdt, imsic_name);
 -    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
 -        "riscv,imsics");
 +    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible", "riscv,imsics");
      qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
 -        FDT_IMSIC_INT_CELLS);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
 -        NULL, 0);
 -    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
 -        NULL, 0);
 +                          FDT_IMSIC_INT_CELLS);
 +    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller", NULL, 0);
      qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
 -        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
 +                     imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
      qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
 -        socket_count * sizeof(uint32_t) * 4);
 +                     socket_count * sizeof(uint32_t) * 4);
      qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
 -        VIRT_IRQCHIP_NUM_MSIS);
 +                     VIRT_IRQCHIP_NUM_MSIS);
 +
      if (imsic_guest_bits) {
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,guest-index-bits",
 -            imsic_guest_bits);
 +                              imsic_guest_bits);
      }
 +
      if (socket_count > 1) {
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
 -            imsic_num_bits(imsic_max_hart_per_socket));
 +                              imsic_num_bits(imsic_max_hart_per_socket));
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
 -            imsic_num_bits(socket_count));
 +                              imsic_num_bits(socket_count));
          qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
 -            IMSIC_MMIO_GROUP_MIN_SHIFT);
 +                              IMSIC_MMIO_GROUP_MIN_SHIFT);
      }
 -    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_s_phandle);
 -    g_free(imsic_name);
 +    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", msi_phandle);
 +    g_free(imsic_name);
      g_free(imsic_regs);
      g_free(imsic_cells);
  }
 -static void create_fdt_socket_aplic(RISCVVirtState *s,
 -                                    const MemMapEntry *memmap, int socket,
 -                                    uint32_t msi_m_phandle,
 -                                    uint32_t msi_s_phandle,
 -                                    uint32_t *phandle,
 -                                    uint32_t *intc_phandles,
 -                                    uint32_t *aplic_phandles)
 +static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
 +                             uint32_t *phandle, uint32_t *intc_phandles,
 +                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
 +{
-+    uint32_t val = 0;
++    *msi_m_phandle = (*phandle)++;
-+
++    *msi_s_phandle = (*phandle)++;
-+    switch (offset) {
++
-+    case SERVICES_SR:
++    if (!kvm_enabled()) {
-+        /*
++        /* M-level IMSIC node */
-+         * Although some services have no error codes, most do. All services
++        create_fdt_one_imsic(s, memmap[VIRT_IMSIC_M].base, intc_phandles,
-+         * that do implement errors, begin their error codes at 1. Treat all
++                             *msi_m_phandle, true, 0);
 +         * service requests as failures & return 1.
 +         * See the "PolarFire® FPGA and PolarFire SoC FPGA System Services"
 +         * user guide for more information on service error codes.
 +         */
 +        val = 1u << SERVICES_STATUS_SHIFT;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_UNIMP, "%s: unimplemented device read "
 +                      "(size %d, offset 0x%" HWADDR_PRIx ")\n",
 +                      __func__, size, offset);
 +    }
 +
-+    return val;
++    /* S-level IMSIC node */
 +    create_fdt_one_imsic(s, memmap[VIRT_IMSIC_S].base, intc_phandles,
 +                         *msi_s_phandle, false,
 +                         imsic_num_bits(s->aia_guests + 1));
 +
 +}
 +
-+static void mchp_pfsoc_ctrl_write(void *opaque, hwaddr offset,
++static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
-+                                  uint64_t value, unsigned size)
++                                 unsigned long aplic_addr, uint32_t aplic_size,
 +                                 uint32_t msi_phandle,
 +                                 uint32_t *intc_phandles,
 +                                 uint32_t aplic_phandle,
 +                                 uint32_t aplic_child_phandle,
 +                                 bool m_mode)
  {
      int cpu;
      char *aplic_name;
      uint32_t *aplic_cells;
 -    unsigned long aplic_addr;
      MachineState *ms = MACHINE(s);
 -    uint32_t aplic_m_phandle, aplic_s_phandle;
 -    aplic_m_phandle = (*phandle)++;
 -    aplic_s_phandle = (*phandle)++;
      aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 -    /* M-level APLIC node */
      for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
          aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
 +        aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
      }
 -    aplic_addr = memmap[VIRT_APLIC_M].base +
 -                 (memmap[VIRT_APLIC_M].size * socket);
 +
      aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
      qemu_fdt_add_subnode(ms->fdt, aplic_name);
      qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
      qemu_fdt_setprop_cell(ms->fdt, aplic_name,
 -        "#interrupt-cells", FDT_APLIC_INT_CELLS);
 +                          "#interrupt-cells", FDT_APLIC_INT_CELLS);
      qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
 +
      if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
          qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
 -            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +                         aplic_cells,
 +                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
      } else {
 -        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
 -            msi_m_phandle);
 +        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
      }
 +
      qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
 -        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
 +                           0x0, aplic_addr, 0x0, aplic_size);
      qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
 -        VIRT_IRQCHIP_NUM_SOURCES);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
 -        aplic_s_phandle);
 -    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
 -        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
 +                          VIRT_IRQCHIP_NUM_SOURCES);
 +
 +    if (aplic_child_phandle) {
 +        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
 +                              aplic_child_phandle);
 +        qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
 +                               aplic_child_phandle, 0x1,
 +                               VIRT_IRQCHIP_NUM_SOURCES);
 +    }
 +
      riscv_socket_fdt_write_id(ms, aplic_name, socket);
 -    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_m_phandle);
 +    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_phandle);
 +
      g_free(aplic_name);
 +    g_free(aplic_cells);
 +}
 -    /* S-level APLIC node */
 -    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 -        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
 -        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
 +static void create_fdt_socket_aplic(RISCVVirtState *s,
 +                                    const MemMapEntry *memmap, int socket,
 +                                    uint32_t msi_m_phandle,
 +                                    uint32_t msi_s_phandle,
 +                                    uint32_t *phandle,
 +                                    uint32_t *intc_phandles,
 +                                    uint32_t *aplic_phandles)
 +{
-+    MchpPfSoCIoscbState *s = opaque;
++    char *aplic_name;
-+
++    unsigned long aplic_addr;
-+    switch (offset) {
++    MachineState *ms = MACHINE(s);
-+    case SERVICES_CR:
++    uint32_t aplic_m_phandle, aplic_s_phandle;
-+        qemu_irq_raise(s->irq);
++
-+        break;
++    aplic_m_phandle = (*phandle)++;
-+    default:
++    aplic_s_phandle = (*phandle)++;
-+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
++
-+                      "(size %d, value 0x%" PRIx64
++    if (!kvm_enabled()) {
-+                      ", offset 0x%" HWADDR_PRIx ")\n",
++        /* M-level APLIC node */
-+                      __func__, size, value, offset);
++        aplic_addr = memmap[VIRT_APLIC_M].base +
-+    }
++                     (memmap[VIRT_APLIC_M].size * socket);
-+}
++        create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
-+
++                             msi_m_phandle, intc_phandles,
-+static const MemoryRegionOps mchp_pfsoc_ctrl_ops = {
++                             aplic_m_phandle, aplic_s_phandle,
-+    .read = mchp_pfsoc_ctrl_read,
++                             true);
-+    .write = mchp_pfsoc_ctrl_write,
+     }
-+    .endianness = DEVICE_LITTLE_ENDIAN,
++
-+};
++    /* S-level APLIC node */
-+
+     aplic_addr = memmap[VIRT_APLIC_S].base +
- static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
+                  (memmap[VIRT_APLIC_S].size * socket);
- {
++    create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
-     MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
++                         msi_s_phandle, intc_phandles,
-@@ -XXX,XX +XXX,XX @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
++                         aplic_s_phandle, 0,
-                           "mchp.pfsoc.ioscb.lane23", IOSCB_SUBMOD_REG_SIZE);
++                         false);
-     memory_region_add_subregion(&s->container, IOSCB_LANE23_BASE, &s->lane23);
++
+     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
--    memory_region_init_io(&s->ctrl, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
+-    qemu_fdt_add_subnode(ms->fdt, aplic_name);
--                          "mchp.pfsoc.ioscb.ctrl", IOSCB_SUBMOD_REG_SIZE);
+-    qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
-+    memory_region_init_io(&s->ctrl, OBJECT(s), &mchp_pfsoc_ctrl_ops, s,
+-    qemu_fdt_setprop_cell(ms->fdt, aplic_name,
-+                          "mchp.pfsoc.ioscb.ctrl", IOSCB_CTRL_REG_SIZE);
+-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
-     memory_region_add_subregion(&s->container, IOSCB_CTRL_BASE, &s->ctrl);
+-    qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
+-    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
-+    memory_region_init_io(&s->qspixip, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
+-        qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-+                          "mchp.pfsoc.ioscb.qspixip", IOSCB_QSPIXIP_REG_SIZE);
+-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
-+    memory_region_add_subregion(&s->container, IOSCB_QSPIXIP_BASE, &s->qspixip);
+-    } else {
-+
+-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
-+    memory_region_init_io(&s->mailbox, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
+-            msi_s_phandle);
-+                          "mchp.pfsoc.ioscb.mailbox", IOSCB_SUBMOD_REG_SIZE);
+-    }
-+    memory_region_add_subregion(&s->container, IOSCB_MAILBOX_BASE, &s->mailbox);
+-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-+
+-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
-     memory_region_init_io(&s->cfg, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
+-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
-                           "mchp.pfsoc.ioscb.cfg", IOSCB_SUBMOD_REG_SIZE);
+-        VIRT_IRQCHIP_NUM_SOURCES);
-     memory_region_add_subregion(&s->container, IOSCB_CFG_BASE, &s->cfg);
+-    riscv_socket_fdt_write_id(ms, aplic_name, socket);
-@@ -XXX,XX +XXX,XX @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
+-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_s_phandle);
-                           IOSCB_SUBMOD_REG_SIZE);
-     memory_region_add_subregion(&s->container, IOSCB_IO_CALIB_SGMII_BASE,
+     if (!socket) {
-                                 &s->io_calib_sgmii);
+         platform_bus_add_all_fdt_nodes(ms->fdt, aplic_name,
-+
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
-+    sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
      g_free(aplic_name);
 -    g_free(aplic_cells);
      aplic_phandles[socket] = aplic_s_phandle;
  }
- static void mchp_pfsoc_ioscb_class_init(ObjectClass *klass, void *data)
+@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
-diff --git a/hw/misc/mchp_pfsoc_sysreg.c b/hw/misc/mchp_pfsoc_sysreg.c
+     int i;
-index XXXXXXX..XXXXXXX 100644
+     hwaddr addr;
---- a/hw/misc/mchp_pfsoc_sysreg.c
+     uint32_t guest_bits;
-+++ b/hw/misc/mchp_pfsoc_sysreg.c
+-    DeviceState *aplic_m;
-@@ -XXX,XX +XXX,XX @@
+-    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
- #include "qemu/bitops.h"
++    DeviceState *aplic_s = NULL;
- #include "qemu/log.h"
++    DeviceState *aplic_m = NULL;
- #include "qapi/error.h"
++    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
-+#include "hw/irq.h"
- #include "hw/sysbus.h"
+     if (msimode) {
- #include "hw/misc/mchp_pfsoc_sysreg.h"
+-        /* Per-socket M-level IMSICs */
+-        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
- #define ENVM_CR         0xb8
+-        for (i = 0; i < hart_count; i++) {
-+#define MESSAGE_INT     0x118c
+-            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
+-                               base_hartid + i, true, 1,
- static uint64_t mchp_pfsoc_sysreg_read(void *opaque, hwaddr offset,
+-                               VIRT_IRQCHIP_NUM_MSIS);
-                                        unsigned size)
++        if (!kvm_enabled()) {
-@@ -XXX,XX +XXX,XX @@ static uint64_t mchp_pfsoc_sysreg_read(void *opaque, hwaddr offset,
++            /* Per-socket M-level IMSICs */
- static void mchp_pfsoc_sysreg_write(void *opaque, hwaddr offset,
++            addr = memmap[VIRT_IMSIC_M].base +
-                                     uint64_t value, unsigned size)
++                   socket * VIRT_IMSIC_GROUP_MAX_SIZE;
- {
++            for (i = 0; i < hart_count; i++) {
--    qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
++                riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
--                  "(size %d, value 0x%" PRIx64
++                                   base_hartid + i, true, 1,
--                  ", offset 0x%" HWADDR_PRIx ")\n",
++                                   VIRT_IRQCHIP_NUM_MSIS);
--                  __func__, size, value, offset);
++            }
-+    MchpPfSoCSysregState *s = opaque;
+         }
-+    switch (offset) {
-+    case MESSAGE_INT:
+         /* Per-socket S-level IMSICs */
-+        qemu_irq_lower(s->irq);
+@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
-+        break;
+         }
-+    default:
+     }
-+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
-+                      "(size %d, value 0x%" PRIx64
+-    /* Per-socket M-level APLIC */
-+                      ", offset 0x%" HWADDR_PRIx ")\n",
+-    aplic_m = riscv_aplic_create(
-+                      __func__, size, value, offset);
+-        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
-+    }
+-        memmap[VIRT_APLIC_M].size,
 -        (msimode) ? 0 : base_hartid,
 -        (msimode) ? 0 : hart_count,
 -        VIRT_IRQCHIP_NUM_SOURCES,
 -        VIRT_IRQCHIP_NUM_PRIO_BITS,
 -        msimode, true, NULL);
 -
 -    if (aplic_m) {
 -        /* Per-socket S-level APLIC */
 -        riscv_aplic_create(
 -            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
 -            memmap[VIRT_APLIC_S].size,
 -            (msimode) ? 0 : base_hartid,
 -            (msimode) ? 0 : hart_count,
 -            VIRT_IRQCHIP_NUM_SOURCES,
 -            VIRT_IRQCHIP_NUM_PRIO_BITS,
 -            msimode, false, aplic_m);
 +    if (!kvm_enabled()) {
 +        /* Per-socket M-level APLIC */
 +        aplic_m = riscv_aplic_create(memmap[VIRT_APLIC_M].base +
 +                                     socket * memmap[VIRT_APLIC_M].size,
 +                                     memmap[VIRT_APLIC_M].size,
 +                                     (msimode) ? 0 : base_hartid,
 +                                     (msimode) ? 0 : hart_count,
 +                                     VIRT_IRQCHIP_NUM_SOURCES,
 +                                     VIRT_IRQCHIP_NUM_PRIO_BITS,
 +                                     msimode, true, NULL);
      }
 -    return aplic_m;
 +    /* Per-socket S-level APLIC */
 +    aplic_s = riscv_aplic_create(memmap[VIRT_APLIC_S].base +
 +                                 socket * memmap[VIRT_APLIC_S].size,
 +                                 memmap[VIRT_APLIC_S].size,
 +                                 (msimode) ? 0 : base_hartid,
 +                                 (msimode) ? 0 : hart_count,
 +                                 VIRT_IRQCHIP_NUM_SOURCES,
 +                                 VIRT_IRQCHIP_NUM_PRIO_BITS,
 +                                 msimode, false, aplic_m);
 +
 +    return kvm_enabled() ? aplic_s : aplic_m;
  }
- static const MemoryRegionOps mchp_pfsoc_sysreg_ops = {
+ static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
@@ -XXX,XX +XXX,XX @@ static void mchp_pfsoc_sysreg_realize(DeviceState *dev, Error **errp)
                            "mchp.pfsoc.sysreg",
                            MCHP_PFSOC_SYSREG_REG_SIZE);
      sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->sysreg);
 +    sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
  }
  static void mchp_pfsoc_sysreg_class_init(ObjectClass *klass, void *data)
 diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/microchip_pfsoc.c
 +++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
      sysbus_realize(SYS_BUS_DEVICE(&s->sysreg), errp);
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysreg), 0,
                      memmap[MICROCHIP_PFSOC_SYSREG].base);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sysreg), 0,
 +                       qdev_get_gpio_in(DEVICE(s->plic),
 +                       MICROCHIP_PFSOC_MAILBOX_IRQ));
      /* AXISW */
      create_unimplemented_device("microchip.pfsoc.axisw",
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
      sysbus_realize(SYS_BUS_DEVICE(&s->ioscb), errp);
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->ioscb), 0,
                      memmap[MICROCHIP_PFSOC_IOSCB].base);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->ioscb), 0,
 +                       qdev_get_gpio_in(DEVICE(s->plic),
 +                       MICROCHIP_PFSOC_MAILBOX_IRQ));
      /* FPGA Fabric */
      create_unimplemented_device("microchip.pfsoc.fabricfic3",
 --
-.38.1
+.41.0

-[PULL v2 11/45] target/riscv: generate virtual instruction exception
+[PULL v2 30/45] target/riscv: check the in-kernel irqchip support
-From: Mayuresh Chitale <mchitale@ventanamicro.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-This patch adds a mechanism to generate a virtual instruction
+We check the in-kernel irqchip support when using KVM acceleration.
 instruction exception instead of an illegal instruction exception
 during instruction decode when virt is enabled.
-Signed-off-by: Mayuresh Chitale <mchitale@ventanamicro.com>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20221016124726.102129-4-mchitale@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20230727102439.22554-3-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/translate.c | 8 +++++++-
+ target/riscv/kvm.c | 10 +++++++++-
-file changed, 7 insertions(+), 1 deletion(-)
+file changed, 9 insertions(+), 1 deletion(-)
-diff --git a/target/riscv/translate.c b/target/riscv/translate.c
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/translate.c
+--- a/target/riscv/kvm.c
-+++ b/target/riscv/translate.c
++++ b/target/riscv/kvm.c
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
-        to reset this known value.  */
-     int frm;
+ int kvm_arch_irqchip_create(KVMState *s)
      RISCVMXL ol;
 +    bool virt_inst_excp;
      bool virt_enabled;
      const RISCVCPUConfig *cfg_ptr;
      bool hlsx;
@@ -XXX,XX +XXX,XX @@ static void gen_exception_illegal(DisasContext *ctx)
  {
-     tcg_gen_st_i32(tcg_constant_i32(ctx->opcode), cpu_env,
+-    return 0;
-                    offsetof(CPURISCVState, bins));
++    if (kvm_kernel_irqchip_split()) {
--    generate_exception(ctx, RISCV_EXCP_ILLEGAL_INST);
++        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
-+    if (ctx->virt_inst_excp) {
++        exit(1);
 +        generate_exception(ctx, RISCV_EXCP_VIRT_INSTRUCTION_FAULT);
 +    } else {
 +        generate_exception(ctx, RISCV_EXCP_ILLEGAL_INST);
 +    }
++
++    /*
++     * We can create the VAIA using the newer device control API.
++     */
++    return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
  }
- static void gen_exception_inst_addr_mis(DisasContext *ctx)
+ int kvm_arch_process_async_events(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
          { has_XVentanaCondOps_p,  decode_XVentanaCodeOps },
      };
 +    ctx->virt_inst_excp = false;
      /* Check for compressed insn */
      if (insn_len(opcode) == 2) {
          if (!has_ext(ctx, RVC)) {
 --
-.38.1
+.41.0

-[PULL v2 24/45] hw/intc: sifive_plic: fix out-of-bound access of source_priority array
+[PULL v2 31/45] target/riscv: Create an KVM AIA irqchip
-From: Jim Shu <jim.shu@sifive.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-If the number of interrupt is not multiple of 32, PLIC will have
+We create a vAIA chip by using the KVM_DEV_TYPE_RISCV_AIA and then set up
-out-of-bound access to source_priority array. Compute the number of
+the chip with the KVM_DEV_RISCV_AIA_GRP_* APIs.
-interrupt in the last word to avoid this out-of-bound access of array.
+We also extend KVM accelerator to specify the KVM AIA mode. The "riscv-aia"
 parameter is passed along with --accel in QEMU command-line.
 ) "riscv-aia=emul": IMSIC is emulated by hypervisor
 ) "riscv-aia=hwaccel": use hardware guest IMSIC
 ) "riscv-aia=auto": use the hardware guest IMSICs whenever available
                      otherwise we fallback to software emulation.
-Signed-off-by: Jim Shu <jim.shu@sifive.com>
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Reviewed-by: Bin Meng <bmeng@tinylab.org>
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-Message-Id: <20221127165753.30533-1-jim.shu@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20230727102439.22554-4-yongxuan.wang@sifive.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/intc/sifive_plic.c | 12 +++++++++++-
+ target/riscv/kvm_riscv.h |   4 +
-file changed, 11 insertions(+), 1 deletion(-)
+ target/riscv/kvm.c       | 186 +++++++++++++++++++++++++++++++++++++++
 files changed, 190 insertions(+)
-diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
+diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/sifive_plic.c
+--- a/target/riscv/kvm_riscv.h
-+++ b/hw/intc/sifive_plic.c
++++ b/target/riscv/kvm_riscv.h
-@@ -XXX,XX +XXX,XX @@ static uint32_t sifive_plic_claimed(SiFivePLICState *plic, uint32_t addrid)
+@@ -XXX,XX +XXX,XX @@
-     uint32_t max_irq = 0;
+ void kvm_riscv_init_user_properties(Object *cpu_obj);
-     uint32_t max_prio = plic->target_priority[addrid];
+ void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
-     int i, j;
+ void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
-+    int num_irq_in_word = 32;
++void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
++                          uint64_t aia_irq_num, uint64_t aia_msi_num,
-     for (i = 0; i < plic->bitfield_words; i++) {
++                          uint64_t aplic_base, uint64_t imsic_base,
-         uint32_t pending_enabled_not_claimed =
++                          uint64_t guest_num);
-@@ -XXX,XX +XXX,XX @@ static uint32_t sifive_plic_claimed(SiFivePLICState *plic, uint32_t addrid)
-             continue;
+ #endif
-         }
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
+index XXXXXXX..XXXXXXX 100644
--        for (j = 0; j < 32; j++) {
+--- a/target/riscv/kvm.c
-+        if (i == (plic->bitfield_words - 1)) {
++++ b/target/riscv/kvm.c
-+            /*
+@@ -XXX,XX +XXX,XX @@
-+             * If plic->num_sources is not multiple of 32, num-of-irq in last
+ #include "exec/address-spaces.h"
-+             * word is not 32. Compute the num-of-irq of last word to avoid
+ #include "hw/boards.h"
-+             * out-of-bound access of source_priority array.
+ #include "hw/irq.h"
-+             */
++#include "hw/intc/riscv_imsic.h"
-+            num_irq_in_word = plic->num_sources - ((plic->bitfield_words - 1) << 5);
+ #include "qemu/log.h"
  #include "hw/loader.h"
  #include "kvm_riscv.h"
@@ -XXX,XX +XXX,XX @@
  #include "chardev/char-fe.h"
  #include "migration/migration.h"
  #include "sysemu/runstate.h"
 +#include "hw/riscv/numa.h"
  static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                   uint64_t idx)
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_cpu_check_are_resettable(void)
      return true;
  }
 +static int aia_mode;
 +
 +static const char *kvm_aia_mode_str(uint64_t mode)
 +{
 +    switch (mode) {
 +    case KVM_DEV_RISCV_AIA_MODE_EMUL:
 +        return "emul";
 +    case KVM_DEV_RISCV_AIA_MODE_HWACCEL:
 +        return "hwaccel";
 +    case KVM_DEV_RISCV_AIA_MODE_AUTO:
 +    default:
 +        return "auto";
 +    };
 +}
 +
 +static char *riscv_get_kvm_aia(Object *obj, Error **errp)
 +{
 +    return g_strdup(kvm_aia_mode_str(aia_mode));
 +}
 +
 +static void riscv_set_kvm_aia(Object *obj, const char *val, Error **errp)
 +{
 +    if (!strcmp(val, "emul")) {
 +        aia_mode = KVM_DEV_RISCV_AIA_MODE_EMUL;
 +    } else if (!strcmp(val, "hwaccel")) {
 +        aia_mode = KVM_DEV_RISCV_AIA_MODE_HWACCEL;
 +    } else if (!strcmp(val, "auto")) {
 +        aia_mode = KVM_DEV_RISCV_AIA_MODE_AUTO;
 +    } else {
 +        error_setg(errp, "Invalid KVM AIA mode");
 +        error_append_hint(errp, "Valid values are emul, hwaccel, and auto.\n");
 +    }
 +}
 +
  void kvm_arch_accel_class_init(ObjectClass *oc)
  {
 +    object_class_property_add_str(oc, "riscv-aia", riscv_get_kvm_aia,
 +                                  riscv_set_kvm_aia);
 +    object_class_property_set_description(oc, "riscv-aia",
 +                                          "Set KVM AIA mode. Valid values are "
 +                                          "emul, hwaccel, and auto. Default "
 +                                          "is auto.");
 +    object_property_set_default_str(object_class_property_find(oc, "riscv-aia"),
 +                                    "auto");
 +}
 +
 +void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
 +                          uint64_t aia_irq_num, uint64_t aia_msi_num,
 +                          uint64_t aplic_base, uint64_t imsic_base,
 +                          uint64_t guest_num)
 +{
 +    int ret, i;
 +    int aia_fd = -1;
 +    uint64_t default_aia_mode;
 +    uint64_t socket_count = riscv_socket_count(machine);
 +    uint64_t max_hart_per_socket = 0;
 +    uint64_t socket, base_hart, hart_count, socket_imsic_base, imsic_addr;
 +    uint64_t socket_bits, hart_bits, guest_bits;
 +
 +    aia_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_RISCV_AIA, false);
 +
 +    if (aia_fd < 0) {
 +        error_report("Unable to create in-kernel irqchip");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_MODE,
 +                            &default_aia_mode, false, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to get current KVM AIA mode");
 +        exit(1);
 +    }
 +    qemu_log("KVM AIA: default mode is %s\n",
 +             kvm_aia_mode_str(default_aia_mode));
 +
 +    if (default_aia_mode != aia_mode) {
 +        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                                KVM_DEV_RISCV_AIA_CONFIG_MODE,
 +                                &aia_mode, true, NULL);
 +        if (ret < 0)
 +            warn_report("KVM AIA: failed to set KVM AIA mode");
 +        else
 +            qemu_log("KVM AIA: set current mode to %s\n",
 +                     kvm_aia_mode_str(aia_mode));
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
 +                            &aia_irq_num, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set number of input irq lines");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_IDS,
 +                            &aia_msi_num, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set number of msi");
 +        exit(1);
 +    }
 +
 +    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
 +                            &socket_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set group_bits");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
 +                            &group_shift, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set group_shift");
 +        exit(1);
 +    }
 +
 +    guest_bits = guest_num == 0 ? 0 :
 +                 find_last_bit(&guest_num, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_GUEST_BITS,
 +                            &guest_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set guest_bits");
 +        exit(1);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
 +                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
 +                            &aplic_base, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set the base address of APLIC");
 +        exit(1);
 +    }
 +
 +    for (socket = 0; socket < socket_count; socket++) {
 +        socket_imsic_base = imsic_base + socket * (1U << group_shift);
 +        hart_count = riscv_socket_hart_count(machine, socket);
 +        base_hart = riscv_socket_first_hartid(machine, socket);
 +
 +        if (max_hart_per_socket < hart_count) {
 +            max_hart_per_socket = hart_count;
 +        }
 +
-+        for (j = 0; j < num_irq_in_word; j++) {
++        for (i = 0; i < hart_count; i++) {
-             int irq = (i << 5) + j;
++            imsic_addr = socket_imsic_base + i * IMSIC_HART_SIZE(guest_bits);
-             uint32_t prio = plic->source_priority[irq];
++            ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
-             int enabled = pending_enabled_not_claimed & (1 << j);
++                                    KVM_DEV_RISCV_AIA_ADDR_IMSIC(i + base_hart),
 +                                    &imsic_addr, true, NULL);
 +            if (ret < 0) {
 +                error_report("KVM AIA: failed to set the IMSIC address for hart %d", i);
 +                exit(1);
 +            }
 +        }
 +    }
 +
 +    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
 +                            KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
 +                            &hart_bits, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: failed to set hart_bits");
 +        exit(1);
 +    }
 +
 +    if (kvm_has_gsi_routing()) {
 +        for (uint64_t idx = 0; idx < aia_irq_num + 1; ++idx) {
 +            /* KVM AIA only has one APLIC instance */
 +            kvm_irqchip_add_irq_route(kvm_state, idx, 0, idx);
 +        }
 +        kvm_gsi_routing_allowed = true;
 +        kvm_irqchip_commit_routes(kvm_state);
 +    }
 +
 +    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CTRL,
 +                            KVM_DEV_RISCV_AIA_CTRL_INIT,
 +                            NULL, true, NULL);
 +    if (ret < 0) {
 +        error_report("KVM AIA: initialized fail");
 +        exit(1);
 +    }
 +
 +    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
  }
 --
-.38.1
+.41.0

-[PULL v2 02/45] hw/registerfields: add `FIELDx_1CLEAR()` macro
+[PULL v2 32/45] target/riscv: update APLIC and IMSIC to support KVM AIA
-From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Adds a helper macro that implements the register `w1c`
+KVM AIA can't emulate APLIC only. When "aia=aplic" parameter is passed,
-functionality.
+APLIC devices is emulated by QEMU. For "aia=aplic-imsic", remove the
 mmio operations of APLIC when using KVM AIA and send wired interrupt
 signal via KVM_IRQ_LINE API.
 After KVM AIA enabled, MSI messages are delivered by KVM_SIGNAL_MSI API
 when the IMSICs receive mmio write requests.
-Ex:
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-  uint32_t data = FIELD32_1CLEAR(val, REG, FIELD);
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-If ANY bits of the specified `FIELD` is set
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-then the respective field is cleared and returned to `data`.
+Message-ID: <20230727102439.22554-5-yongxuan.wang@sifive.com>
 If the field is cleared (0), then no change and
 val is returned.
 Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20221017054950.317584-2-wilfred.mallawa@opensource.wdc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/registerfields.h | 22 ++++++++++++++++++++++
+ hw/intc/riscv_aplic.c | 56 ++++++++++++++++++++++++++++++-------------
-file changed, 22 insertions(+)
+ hw/intc/riscv_imsic.c | 25 +++++++++++++++----
 files changed, 61 insertions(+), 20 deletions(-)
-diff --git a/include/hw/registerfields.h b/include/hw/registerfields.h
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/registerfields.h
+--- a/hw/intc/riscv_aplic.c
-+++ b/include/hw/registerfields.h
++++ b/hw/intc/riscv_aplic.c
 @@ -XXX,XX +XXX,XX @@
-                   R_ ## reg ## _ ## field ## _LENGTH, _v.v);              \
+ #include "hw/irq.h"
-     _d; })
+ #include "target/riscv/cpu.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/kvm.h"
  #include "migration/vmstate.h"
  #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@
  #define APLIC_IDC_CLAIMI               0x1c
 +/*
-+ * Clear the specified field in storage if
++ * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
-+ * any field bits are set, else no changes made. Implements
++ * APLIC Wired.
 + * single/multi-bit `w1c`
 + *
 + */
-+#define FIELD8_1CLEAR(storage, reg, field)                                \
++static bool is_kvm_aia(bool msimode)
-+    (FIELD_EX8(storage, reg, field) ?                                     \
++{
-+    FIELD_DP8(storage, reg, field, 0x00) : storage)
++    return kvm_irqchip_in_kernel() && msimode;
 +}
 +
-+#define FIELD16_1CLEAR(storage, reg, field)                               \
+ static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
-+    (FIELD_EX16(storage, reg, field) ?                                    \
+                                             uint32_t word)
-+    FIELD_DP16(storage, reg, field, 0x00) : storage)
+ {
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
      return topi;
  }
 +static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
 +{
 +    kvm_set_irq(kvm_state, irq, !!level);
 +}
 +
-+#define FIELD32_1CLEAR(storage, reg, field)                               \
+ static void riscv_aplic_request(void *opaque, int irq, int level)
-+    (FIELD_EX32(storage, reg, field) ?                                    \
+ {
-+    FIELD_DP32(storage, reg, field, 0x00) : storage)
+     bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
      uint32_t i;
      RISCVAPLICState *aplic = RISCV_APLIC(dev);
 -    aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
 -    aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
 -    aplic->state = g_new0(uint32_t, aplic->num_irqs);
 -    aplic->target = g_new0(uint32_t, aplic->num_irqs);
 -    if (!aplic->msimode) {
 -        for (i = 0; i < aplic->num_irqs; i++) {
 -            aplic->target[i] = 1;
 +    if (!is_kvm_aia(aplic->msimode)) {
 +        aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
 +        aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
 +        aplic->state = g_new0(uint32_t, aplic->num_irqs);
 +        aplic->target = g_new0(uint32_t, aplic->num_irqs);
 +        if (!aplic->msimode) {
 +            for (i = 0; i < aplic->num_irqs; i++) {
 +                aplic->target[i] = 1;
 +            }
          }
 -    }
 -    aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
 -    aplic->iforce = g_new0(uint32_t, aplic->num_harts);
 -    aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 +        aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
 +        aplic->iforce = g_new0(uint32_t, aplic->num_harts);
 +        aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 -    memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops, aplic,
 -                          TYPE_RISCV_APLIC, aplic->aperture_size);
 -    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
 +        memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
 +                              aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
 +        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
 +    }
      /*
       * Only root APLICs have hardware IRQ lines. All non-root APLICs
       * have IRQ lines delegated by their parent APLIC.
       */
      if (!aplic->parent) {
 -        qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 +        if (is_kvm_aia(aplic->msimode)) {
 +            qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
 +        } else {
 +            qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
 +        }
      }
      /* Create output IRQ lines for non-MSI mode */
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
      qdev_prop_set_bit(dev, "mmode", mmode);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
 +
-+#define FIELD64_1CLEAR(storage, reg, field)                               \
++    if (!is_kvm_aia(msimode)) {
-+    (FIELD_EX64(storage, reg, field) ?                                    \
++        sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
-+    FIELD_DP64(storage, reg, field, 0x00) : storage)
++    }
      if (parent) {
          riscv_aplic_add_child(parent, dev);
 diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/riscv_imsic.c
 +++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@
  #include "target/riscv/cpu.h"
  #include "target/riscv/cpu_bits.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/kvm.h"
  #include "migration/vmstate.h"
  #define IMSIC_MMIO_PAGE_LE             0x00
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
          goto err;
      }
 +#if defined(CONFIG_KVM)
 +    if (kvm_irqchip_in_kernel()) {
 +        struct kvm_msi msi;
 +
- #define FIELD_SDP8(storage, reg, field, val) ({                           \
++        msi.address_lo = extract64(imsic->mmio.addr + addr, 0, 32);
-     struct {                                                              \
++        msi.address_hi = extract64(imsic->mmio.addr + addr, 32, 32);
-         signed int v:R_ ## reg ## _ ## field ## _LENGTH;                  \
++        msi.data = le32_to_cpu(value);
 +
 +        kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
 +
 +        return;
 +    }
 +#endif
 +
      /* Writes only supported for MSI little-endian registers */
      page = addr >> IMSIC_MMIO_PAGE_SHIFT;
      if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
      CPUState *cpu = cpu_by_arch_id(imsic->hartid);
      CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 -    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
 -    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
 -    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
 -    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
 +    if (!kvm_irqchip_in_kernel()) {
 +        imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
 +        imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
 +        imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
 +        imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
 +    }
      memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
                            imsic, TYPE_RISCV_IMSIC,
 --
-.38.1
+.41.0

-[PULL v2 42/45] hw/riscv: virt: Fix the value of "riscv, ndev" in the dtb
+[PULL v2 33/45] target/riscv: select KVM AIA in riscv virt machine
-From: Bin Meng <bmeng@tinylab.org>
+From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-Commit 28d8c281200f ("hw/riscv: virt: Add optional AIA IMSIC support to virt machine")
+Select KVM AIA when the host kernel has in-kernel AIA chip support.
-changed the value of VIRT_IRQCHIP_NUM_SOURCES from 127 to 53, which
+Since KVM AIA only has one APLIC instance, we map the QEMU APLIC
-is VIRTIO_NDEV and also used as the value of "riscv,ndev" property
+devices to KVM APLIC.
 in the dtb. Unfortunately this is wrong as VIRT_IRQCHIP_NUM_SOURCES
 should include interrupt source 0 but "riscv,ndev" does not.
-While we are here, we also fix the comments of platform bus irq range
+Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
-which is now "64 to 96", but should be "64 to 95", introduced since
+Reviewed-by: Jim Shu <jim.shu@sifive.com>
-commit 1832b7cb3f64 ("hw/riscv: virt: Create a platform bus").
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
-Fixes: 28d8c281200f ("hw/riscv: virt: Add optional AIA IMSIC support to virt machine")
+Message-ID: <20230727102439.22554-6-yongxuan.wang@sifive.com>
 Signed-off-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20221211030829.802437-13-bmeng@tinylab.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h | 5 ++---
+ hw/riscv/virt.c | 94 +++++++++++++++++++++++++++++++++----------------
- hw/riscv/virt.c         | 3 ++-
+file changed, 63 insertions(+), 31 deletions(-)
 files changed, 4 insertions(+), 4 deletions(-)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
-+++ b/include/hw/riscv/virt.h
-@@ -XXX,XX +XXX,XX @@ enum {
-     VIRTIO_IRQ = 1, /* 1 to 8 */
-     VIRTIO_COUNT = 8,
-     PCIE_IRQ = 0x20, /* 32 to 35 */
--    VIRT_PLATFORM_BUS_IRQ = 64, /* 64 to 96 */
--    VIRTIO_NDEV = 96 /* Arbitrary maximum number of interrupts */
-+    VIRT_PLATFORM_BUS_IRQ = 64, /* 64 to 95 */
- };
- #define VIRT_PLATFORM_BUS_NUM_IRQS 32
- #define VIRT_IRQCHIP_NUM_MSIS 255
--#define VIRT_IRQCHIP_NUM_SOURCES VIRTIO_NDEV
-+#define VIRT_IRQCHIP_NUM_SOURCES 96
- #define VIRT_IRQCHIP_NUM_PRIO_BITS 3
- #define VIRT_IRQCHIP_MAX_GUESTS_BITS 3
- #define VIRT_IRQCHIP_MAX_GUESTS ((1U << VIRT_IRQCHIP_MAX_GUESTS_BITS) - 1U)
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
+@@ -XXX,XX +XXX,XX @@
-         plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
+ #include "hw/riscv/virt.h"
-     qemu_fdt_setprop_cells(mc->fdt, plic_name, "reg",
+ #include "hw/riscv/boot.h"
-x0, plic_addr, 0x0, memmap[VIRT_PLIC].size);
+ #include "hw/riscv/numa.h"
--    qemu_fdt_setprop_cell(mc->fdt, plic_name, "riscv,ndev", VIRTIO_NDEV);
++#include "kvm_riscv.h"
-+    qemu_fdt_setprop_cell(mc->fdt, plic_name, "riscv,ndev",
+ #include "hw/intc/riscv_aclint.h"
-+                          VIRT_IRQCHIP_NUM_SOURCES - 1);
+ #include "hw/intc/riscv_aplic.h"
-     riscv_socket_fdt_write_id(mc, mc->fdt, plic_name, socket);
+ #include "hw/intc/riscv_imsic.h"
-     qemu_fdt_setprop_cell(mc->fdt, plic_name, "phandle",
+@@ -XXX,XX +XXX,XX @@
-         plic_phandles[socket]);
+ #error "Can't accommodate all IMSIC groups in address space"
  #endif
 +/* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
 +static bool virt_use_kvm_aia(RISCVVirtState *s)
 +{
 +    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 +}
 +
  static const MemMapEntry virt_memmap[] = {
      [VIRT_DEBUG] =        {        0x0,         0x100 },
      [VIRT_MROM] =         {     0x1000,        0xf000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
                                   uint32_t *intc_phandles,
                                   uint32_t aplic_phandle,
                                   uint32_t aplic_child_phandle,
 -                                 bool m_mode)
 +                                 bool m_mode, int num_harts)
  {
      int cpu;
      char *aplic_name;
      uint32_t *aplic_cells;
      MachineState *ms = MACHINE(s);
 -    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 +    aplic_cells = g_new0(uint32_t, num_harts * 2);
 -    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
 +    for (cpu = 0; cpu < num_harts; cpu++) {
          aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
          aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
      }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
      if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
          qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
 -                         aplic_cells,
 -                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
 +                         aplic_cells, num_harts * sizeof(uint32_t) * 2);
      } else {
          qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
      }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
                                      uint32_t msi_s_phandle,
                                      uint32_t *phandle,
                                      uint32_t *intc_phandles,
 -                                    uint32_t *aplic_phandles)
 +                                    uint32_t *aplic_phandles,
 +                                    int num_harts)
  {
      char *aplic_name;
      unsigned long aplic_addr;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
          create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
                               msi_m_phandle, intc_phandles,
                               aplic_m_phandle, aplic_s_phandle,
 -                             true);
 +                             true, num_harts);
      }
      /* S-level APLIC node */
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
      create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
                           msi_s_phandle, intc_phandles,
                           aplic_s_phandle, 0,
 -                         false);
 +                         false, num_harts);
      aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
          *msi_pcie_phandle = msi_s_phandle;
      }
 -    phandle_pos = ms->smp.cpus;
 -    for (socket = (socket_count - 1); socket >= 0; socket--) {
 -        phandle_pos -= s->soc[socket].num_harts;
 -
 -        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
 -            create_fdt_socket_plic(s, memmap, socket, phandle,
 -                &intc_phandles[phandle_pos], xplic_phandles);
 -        } else {
 -            create_fdt_socket_aplic(s, memmap, socket,
 -                msi_m_phandle, msi_s_phandle, phandle,
 -                &intc_phandles[phandle_pos], xplic_phandles);
 +    /* KVM AIA only has one APLIC instance */
 +    if (virt_use_kvm_aia(s)) {
 +        create_fdt_socket_aplic(s, memmap, 0,
 +                                msi_m_phandle, msi_s_phandle, phandle,
 +                                &intc_phandles[0], xplic_phandles,
 +                                ms->smp.cpus);
 +    } else {
 +        phandle_pos = ms->smp.cpus;
 +        for (socket = (socket_count - 1); socket >= 0; socket--) {
 +            phandle_pos -= s->soc[socket].num_harts;
 +
 +            if (s->aia_type == VIRT_AIA_TYPE_NONE) {
 +                create_fdt_socket_plic(s, memmap, socket, phandle,
 +                                       &intc_phandles[phandle_pos],
 +                                       xplic_phandles);
 +            } else {
 +                create_fdt_socket_aplic(s, memmap, socket,
 +                                        msi_m_phandle, msi_s_phandle, phandle,
 +                                        &intc_phandles[phandle_pos],
 +                                        xplic_phandles,
 +                                        s->soc[socket].num_harts);
 +            }
          }
      }
      g_free(intc_phandles);
 -    for (socket = 0; socket < socket_count; socket++) {
 -        if (socket == 0) {
 -            *irq_mmio_phandle = xplic_phandles[socket];
 -            *irq_virtio_phandle = xplic_phandles[socket];
 -            *irq_pcie_phandle = xplic_phandles[socket];
 -        }
 -        if (socket == 1) {
 -            *irq_virtio_phandle = xplic_phandles[socket];
 -            *irq_pcie_phandle = xplic_phandles[socket];
 -        }
 -        if (socket == 2) {
 -            *irq_pcie_phandle = xplic_phandles[socket];
 +    if (virt_use_kvm_aia(s)) {
 +        *irq_mmio_phandle = xplic_phandles[0];
 +        *irq_virtio_phandle = xplic_phandles[0];
 +        *irq_pcie_phandle = xplic_phandles[0];
 +    } else {
 +        for (socket = 0; socket < socket_count; socket++) {
 +            if (socket == 0) {
 +                *irq_mmio_phandle = xplic_phandles[socket];
 +                *irq_virtio_phandle = xplic_phandles[socket];
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
 +            if (socket == 1) {
 +                *irq_virtio_phandle = xplic_phandles[socket];
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
 +            if (socket == 2) {
 +                *irq_pcie_phandle = xplic_phandles[socket];
 +            }
          }
      }
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
          }
      }
 +    if (virt_use_kvm_aia(s)) {
 +        kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
 +                             VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
 +                             memmap[VIRT_APLIC_S].base,
 +                             memmap[VIRT_IMSIC_S].base,
 +                             s->aia_guests);
 +    }
 +
      if (riscv_is_32bit(&s->soc[0])) {
  #if HOST_LONG_BITS == 64
          /* limit RAM size in a 32-bit system */
 --
-.38.1
+.41.0

-[PULL v2 22/45] hw/riscv: pfsoc: add missing FICs as unimplemented
+[PULL v2 34/45] hw/riscv: virt: Fix riscv,pmu DT node path
 From: Conor Dooley <conor.dooley@microchip.com>
-The Fabric Interconnect Controllers provide interfaces between the FPGA
+On a dtb dumped from the virt machine, dt-validate complains:
-fabric and the core complex. There are 5 FICs on PolarFire SoC, numbered
+soc: pmu: {'riscv,event-to-mhpmcounters': [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280], [65563, 65563, 524280], [65569, 65569, 524280]], 'compatible': ['riscv,pmu']} should not be valid under {'type': 'object'}
-through 4. FIC2 is an AXI4 slave interface from the FPGA fabric and
+        from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
-does not show up on the MSS memory map. FIC4 is dedicated to the User
+That's pretty cryptic, but running the dtb back through dtc produces
-Crypto Processor and does not show up on the MSS memory map either.
+something a lot more reasonable:
 Warning (simple_bus_reg): /soc/pmu: missing or empty reg/ranges property
-FIC 0, 1 & 3 do show up in the MSS memory map and neither FICs 0 or 1
+Moving the riscv,pmu node out of the soc bus solves the problem.
 are represented in QEMU, leading to load access violations while booting
 Linux for Icicle if PCIe is enabled as the root port is connected via
 either FIC 0 or 1.
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20221117225518.4102575-3-conor@kernel.org>
+Message-ID: <20230727-groom-decline-2c57ce42841c@spud>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/microchip_pfsoc.h |   2 +
+ hw/riscv/virt.c | 2 +-
- hw/riscv/microchip_pfsoc.c         | 115 ++++++++++++++++-------------
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 65 insertions(+), 52 deletions(-)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
+--- a/hw/riscv/virt.c
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_pmu(RISCVVirtState *s)
-     MICROCHIP_PFSOC_USB,
+     MachineState *ms = MACHINE(s);
-     MICROCHIP_PFSOC_QSPI_XIP,
+     RISCVCPU hart = s->soc[0].harts[0];
-     MICROCHIP_PFSOC_IOSCB,
-+    MICROCHIP_PFSOC_FABRIC_FIC0,
+-    pmu_name = g_strdup_printf("/soc/pmu");
-+    MICROCHIP_PFSOC_FABRIC_FIC1,
++    pmu_name = g_strdup_printf("/pmu");
-     MICROCHIP_PFSOC_FABRIC_FIC3,
+     qemu_fdt_add_subnode(ms->fdt, pmu_name);
-     MICROCHIP_PFSOC_DRAM_LO,
+     qemu_fdt_setprop_string(ms->fdt, pmu_name, "compatible", "riscv,pmu");
-     MICROCHIP_PFSOC_DRAM_LO_ALIAS,
+     riscv_pmu_generate_fdt_node(ms->fdt, hart.cfg.pmu_num, pmu_name);
 diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/microchip_pfsoc.c
 +++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
   *     describes the complete IOSCB modules memory maps
   */
  static const MemMapEntry microchip_pfsoc_memmap[] = {
 -    [MICROCHIP_PFSOC_RSVD0] =           {        0x0,      0x100 },
 -    [MICROCHIP_PFSOC_DEBUG] =           {      0x100,      0xf00 },
 -    [MICROCHIP_PFSOC_E51_DTIM] =        {  0x1000000,     0x2000 },
 -    [MICROCHIP_PFSOC_BUSERR_UNIT0] =    {  0x1700000,     0x1000 },
 -    [MICROCHIP_PFSOC_BUSERR_UNIT1] =    {  0x1701000,     0x1000 },
 -    [MICROCHIP_PFSOC_BUSERR_UNIT2] =    {  0x1702000,     0x1000 },
 -    [MICROCHIP_PFSOC_BUSERR_UNIT3] =    {  0x1703000,     0x1000 },
 -    [MICROCHIP_PFSOC_BUSERR_UNIT4] =    {  0x1704000,     0x1000 },
 -    [MICROCHIP_PFSOC_CLINT] =           {  0x2000000,    0x10000 },
 -    [MICROCHIP_PFSOC_L2CC] =            {  0x2010000,     0x1000 },
 -    [MICROCHIP_PFSOC_DMA] =             {  0x3000000,   0x100000 },
 -    [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,  0x2000000 },
 -    [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,  0x4000000 },
 -    [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,     0x1000 },
 -    [MICROCHIP_PFSOC_WDOG0] =           { 0x20001000,     0x1000 },
 -    [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,     0x2000 },
 -    [MICROCHIP_PFSOC_AXISW] =           { 0x20004000,     0x1000 },
 -    [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,     0x1000 },
 -    [MICROCHIP_PFSOC_FMETER] =          { 0x20006000,     0x1000 },
 -    [MICROCHIP_PFSOC_DDR_SGMII_PHY] =   { 0x20007000,     0x1000 },
 -    [MICROCHIP_PFSOC_EMMC_SD] =         { 0x20008000,     0x1000 },
 -    [MICROCHIP_PFSOC_DDR_CFG] =         { 0x20080000,    0x40000 },
 -    [MICROCHIP_PFSOC_MMUART1] =         { 0x20100000,     0x1000 },
 -    [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,     0x1000 },
 -    [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,     0x1000 },
 -    [MICROCHIP_PFSOC_MMUART4] =         { 0x20106000,     0x1000 },
 -    [MICROCHIP_PFSOC_WDOG1] =           { 0x20101000,     0x1000 },
 -    [MICROCHIP_PFSOC_WDOG2] =           { 0x20103000,     0x1000 },
 -    [MICROCHIP_PFSOC_WDOG3] =           { 0x20105000,     0x1000 },
 -    [MICROCHIP_PFSOC_WDOG4] =           { 0x20106000,     0x1000 },
 -    [MICROCHIP_PFSOC_SPI0] =            { 0x20108000,     0x1000 },
 -    [MICROCHIP_PFSOC_SPI1] =            { 0x20109000,     0x1000 },
 -    [MICROCHIP_PFSOC_I2C0] =            { 0x2010a000,     0x1000 },
 -    [MICROCHIP_PFSOC_I2C1] =            { 0x2010b000,     0x1000 },
 -    [MICROCHIP_PFSOC_CAN0] =            { 0x2010c000,     0x1000 },
 -    [MICROCHIP_PFSOC_CAN1] =            { 0x2010d000,     0x1000 },
 -    [MICROCHIP_PFSOC_GEM0] =            { 0x20110000,     0x2000 },
 -    [MICROCHIP_PFSOC_GEM1] =            { 0x20112000,     0x2000 },
 -    [MICROCHIP_PFSOC_GPIO0] =           { 0x20120000,     0x1000 },
 -    [MICROCHIP_PFSOC_GPIO1] =           { 0x20121000,     0x1000 },
 -    [MICROCHIP_PFSOC_GPIO2] =           { 0x20122000,     0x1000 },
 -    [MICROCHIP_PFSOC_RTC] =             { 0x20124000,     0x1000 },
 -    [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,     0x1000 },
 -    [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
 -    [MICROCHIP_PFSOC_USB] =             { 0x20201000,     0x1000 },
 -    [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,  0x1000000 },
 -    [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000, 0x10000000 },
 -    [MICROCHIP_PFSOC_FABRIC_FIC3] =     { 0x40000000, 0x20000000 },
 -    [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000, 0x40000000 },
 -    [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000, 0x40000000 },
 -    [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,        0x0 },
 -    [MICROCHIP_PFSOC_DRAM_HI_ALIAS] = { 0x1400000000,        0x0 },
 +    [MICROCHIP_PFSOC_RSVD0] =           {        0x0,        0x100 },
 +    [MICROCHIP_PFSOC_DEBUG] =           {      0x100,        0xf00 },
 +    [MICROCHIP_PFSOC_E51_DTIM] =        {  0x1000000,       0x2000 },
 +    [MICROCHIP_PFSOC_BUSERR_UNIT0] =    {  0x1700000,       0x1000 },
 +    [MICROCHIP_PFSOC_BUSERR_UNIT1] =    {  0x1701000,       0x1000 },
 +    [MICROCHIP_PFSOC_BUSERR_UNIT2] =    {  0x1702000,       0x1000 },
 +    [MICROCHIP_PFSOC_BUSERR_UNIT3] =    {  0x1703000,       0x1000 },
 +    [MICROCHIP_PFSOC_BUSERR_UNIT4] =    {  0x1704000,       0x1000 },
 +    [MICROCHIP_PFSOC_CLINT] =           {  0x2000000,      0x10000 },
 +    [MICROCHIP_PFSOC_L2CC] =            {  0x2010000,       0x1000 },
 +    [MICROCHIP_PFSOC_DMA] =             {  0x3000000,     0x100000 },
 +    [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,    0x2000000 },
 +    [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,    0x4000000 },
 +    [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,       0x1000 },
 +    [MICROCHIP_PFSOC_WDOG0] =           { 0x20001000,       0x1000 },
 +    [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,       0x2000 },
 +    [MICROCHIP_PFSOC_AXISW] =           { 0x20004000,       0x1000 },
 +    [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,       0x1000 },
 +    [MICROCHIP_PFSOC_FMETER] =          { 0x20006000,       0x1000 },
 +    [MICROCHIP_PFSOC_DDR_SGMII_PHY] =   { 0x20007000,       0x1000 },
 +    [MICROCHIP_PFSOC_EMMC_SD] =         { 0x20008000,       0x1000 },
 +    [MICROCHIP_PFSOC_DDR_CFG] =         { 0x20080000,      0x40000 },
 +    [MICROCHIP_PFSOC_MMUART1] =         { 0x20100000,       0x1000 },
 +    [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,       0x1000 },
 +    [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,       0x1000 },
 +    [MICROCHIP_PFSOC_MMUART4] =         { 0x20106000,       0x1000 },
 +    [MICROCHIP_PFSOC_WDOG1] =           { 0x20101000,       0x1000 },
 +    [MICROCHIP_PFSOC_WDOG2] =           { 0x20103000,       0x1000 },
 +    [MICROCHIP_PFSOC_WDOG3] =           { 0x20105000,       0x1000 },
 +    [MICROCHIP_PFSOC_WDOG4] =           { 0x20106000,       0x1000 },
 +    [MICROCHIP_PFSOC_SPI0] =            { 0x20108000,       0x1000 },
 +    [MICROCHIP_PFSOC_SPI1] =            { 0x20109000,       0x1000 },
 +    [MICROCHIP_PFSOC_I2C0] =            { 0x2010a000,       0x1000 },
 +    [MICROCHIP_PFSOC_I2C1] =            { 0x2010b000,       0x1000 },
 +    [MICROCHIP_PFSOC_CAN0] =            { 0x2010c000,       0x1000 },
 +    [MICROCHIP_PFSOC_CAN1] =            { 0x2010d000,       0x1000 },
 +    [MICROCHIP_PFSOC_GEM0] =            { 0x20110000,       0x2000 },
 +    [MICROCHIP_PFSOC_GEM1] =            { 0x20112000,       0x2000 },
 +    [MICROCHIP_PFSOC_GPIO0] =           { 0x20120000,       0x1000 },
 +    [MICROCHIP_PFSOC_GPIO1] =           { 0x20121000,       0x1000 },
 +    [MICROCHIP_PFSOC_GPIO2] =           { 0x20122000,       0x1000 },
 +    [MICROCHIP_PFSOC_RTC] =             { 0x20124000,       0x1000 },
 +    [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,       0x1000 },
 +    [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,      0x20000 },
 +    [MICROCHIP_PFSOC_USB] =             { 0x20201000,       0x1000 },
 +    [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,    0x1000000 },
 +    [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000,   0x10000000 },
 +    [MICROCHIP_PFSOC_FABRIC_FIC0] =   { 0x2000000000, 0x1000000000 },
 +    [MICROCHIP_PFSOC_FABRIC_FIC1] =   { 0x3000000000, 0x1000000000 },
 +    [MICROCHIP_PFSOC_FABRIC_FIC3] =     { 0x40000000,   0x20000000 },
 +    [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000,   0x40000000 },
 +    [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000,   0x40000000 },
 +    [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,          0x0 },
 +    [MICROCHIP_PFSOC_DRAM_HI_ALIAS] = { 0x1400000000,          0x0 },
 +
  };
  static void microchip_pfsoc_soc_instance_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
      create_unimplemented_device("microchip.pfsoc.fabricfic3",
          memmap[MICROCHIP_PFSOC_FABRIC_FIC3].base,
          memmap[MICROCHIP_PFSOC_FABRIC_FIC3].size);
 +    /* FPGA Fabric */
 +    create_unimplemented_device("microchip.pfsoc.fabricfic0",
 +        memmap[MICROCHIP_PFSOC_FABRIC_FIC0].base,
 +        memmap[MICROCHIP_PFSOC_FABRIC_FIC0].size);
 +    /* FPGA Fabric */
 +    create_unimplemented_device("microchip.pfsoc.fabricfic1",
 +        memmap[MICROCHIP_PFSOC_FABRIC_FIC1].base,
 +        memmap[MICROCHIP_PFSOC_FABRIC_FIC1].size);
      /* QSPI Flash */
      memory_region_init_rom(qspi_xip_mem, OBJECT(dev),
 --
-.38.1
+.41.0

-[PULL v2 10/45] target/riscv: smstateen check for h/s/envcfg
+[PULL v2 35/45] target/riscv: Update CSR bits name for svadu extension
-From: Mayuresh Chitale <mchitale@ventanamicro.com>
+From: Weiwei Li <liweiwei@iscas.ac.cn>
-Accesses to henvcfg, henvcfgh and senvcfg are allowed only if the corresponding
+The Svadu specification updated the name of the *envcfg bit from
-bit in mstateen0/hstateen0 is enabled. Otherwise an illegal instruction trap is
+HADE to ADUE.
 generated.
-Signed-off-by: Mayuresh Chitale <mchitale@ventanamicro.com>
+Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
-Reviewed-by: Weiwei Li<liweiwei@iscas.ac.cn>
+Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Message-Id: <20221016124726.102129-3-mchitale@ventanamicro.com>
+Message-ID: <20230816141916.66898-1-liweiwei@iscas.ac.cn>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 87 ++++++++++++++++++++++++++++++++++++++++++----
+ target/riscv/cpu_bits.h   |  8 ++++----
-file changed, 80 insertions(+), 7 deletions(-)
+ target/riscv/cpu.c        |  4 ++--
  target/riscv/cpu_helper.c |  6 +++---
  target/riscv/csr.c        | 12 ++++++------
 files changed, 15 insertions(+), 15 deletions(-)
+diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_bits.h
++++ b/target/riscv/cpu_bits.h
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+ #define MENVCFG_CBIE                       (3UL << 4)
+ #define MENVCFG_CBCFE                      BIT(6)
+ #define MENVCFG_CBZE                       BIT(7)
+-#define MENVCFG_HADE                       (1ULL << 61)
++#define MENVCFG_ADUE                       (1ULL << 61)
+ #define MENVCFG_PBMTE                      (1ULL << 62)
+ #define MENVCFG_STCE                       (1ULL << 63)
+ /* For RV32 */
+-#define MENVCFGH_HADE                      BIT(29)
++#define MENVCFGH_ADUE                      BIT(29)
+ #define MENVCFGH_PBMTE                     BIT(30)
+ #define MENVCFGH_STCE                      BIT(31)
+@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
+ #define HENVCFG_CBIE                       MENVCFG_CBIE
+ #define HENVCFG_CBCFE                      MENVCFG_CBCFE
+ #define HENVCFG_CBZE                       MENVCFG_CBZE
+-#define HENVCFG_HADE                       MENVCFG_HADE
++#define HENVCFG_ADUE                       MENVCFG_ADUE
+ #define HENVCFG_PBMTE                      MENVCFG_PBMTE
+ #define HENVCFG_STCE                       MENVCFG_STCE
+ /* For RV32 */
+-#define HENVCFGH_HADE                       MENVCFGH_HADE
++#define HENVCFGH_ADUE                       MENVCFGH_ADUE
+ #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
+ #define HENVCFGH_STCE                       MENVCFGH_STCE
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
+     env->two_stage_lookup = false;
+     env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
+-                   (cpu->cfg.ext_svadu ? MENVCFG_HADE : 0);
++                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
+     env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
+-                   (cpu->cfg.ext_svadu ? HENVCFG_HADE : 0);
++                   (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
+     /* Initialized default priorities of local interrupts. */
+     for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
+diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu_helper.c
++++ b/target/riscv/cpu_helper.c
+@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
+     }
+     bool pbmte = env->menvcfg & MENVCFG_PBMTE;
+-    bool hade = env->menvcfg & MENVCFG_HADE;
++    bool adue = env->menvcfg & MENVCFG_ADUE;
+     if (first_stage && two_stage && env->virt_enabled) {
+         pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
+-        hade = hade && (env->henvcfg & HENVCFG_HADE);
++        adue = adue && (env->henvcfg & HENVCFG_ADUE);
+     }
+     int ptshift = (levels - 1) * ptidxbits;
+@@ -XXX,XX +XXX,XX @@ restart:
+     /* Page table updates need to be atomic with MTTCG enabled */
+     if (updated_pte != pte && !is_debug) {
+-        if (!hade) {
++        if (!adue) {
+             return TRANSLATE_FAIL;
+         }
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
+@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
- }
+     if (riscv_cpu_mxl(env) == MXL_RV64) {
+         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
- /* Predicates */
+                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-+#if !defined(CONFIG_USER_ONLY)
+-                (cfg->ext_svadu ? MENVCFG_HADE : 0);
-+static RISCVException smstateen_acc_ok(CPURISCVState *env, int index,
++                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
-+                                       uint64_t bit)
+     }
-+{
+     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
-+    bool virt = riscv_cpu_virt_enabled(env);
 +    CPUState *cs = env_cpu(env);
 +    RISCVCPU *cpu = RISCV_CPU(cs);
 +
 +    if (env->priv == PRV_M || !cpu->cfg.ext_smstateen) {
 +        return RISCV_EXCP_NONE;
 +    }
 +
 +    if (!(env->mstateen[index] & bit)) {
 +        return RISCV_EXCP_ILLEGAL_INST;
 +    }
 +
 +    if (virt) {
 +        if (!(env->hstateen[index] & bit)) {
 +            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 +        }
 +
 +        if (env->priv == PRV_U && !(env->sstateen[index] & bit)) {
 +            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
 +        }
 +    }
 +
 +    if (env->priv == PRV_U && riscv_has_ext(env, RVS)) {
 +        if (!(env->sstateen[index] & bit)) {
 +            return RISCV_EXCP_ILLEGAL_INST;
 +        }
 +    }
 +
 +    return RISCV_EXCP_NONE;
 +}
 +#endif
 +
  static RISCVException fs(CPURISCVState *env, int csrno)
  {
  #if !defined(CONFIG_USER_ONLY)
 @@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
- static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
+     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
-                                  target_ulong *val)
+     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
- {
+                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-+    RISCVException ret;
+-                    (cfg->ext_svadu ? MENVCFG_HADE : 0);
-+
++                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
-+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
+     uint64_t valh = (uint64_t)val << 32;
-+    if (ret != RISCV_EXCP_NONE) {
-+        return ret;
+     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
-+    }
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
-+
+      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
-     *val = env->senvcfg;
+      * henvcfg.hade is read_only 0 when menvcfg.hade = 0
-     return RISCV_EXCP_NONE;
+      */
- }
+-    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
++    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
-                                   target_ulong val)
+                            env->menvcfg);
  {
      uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
 +    RISCVException ret;
 -    env->senvcfg = (env->senvcfg & ~mask) | (val & mask);
 +    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +    env->senvcfg = (env->senvcfg & ~mask) | (val & mask);
      return RISCV_EXCP_NONE;
  }
  static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
                                   target_ulong *val)
  {
 +    RISCVException ret;
 +
 +    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +
      *val = env->henvcfg;
      return RISCV_EXCP_NONE;
  }
 @@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
-                                   target_ulong val)
+     }
  {
      uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
 +    RISCVException ret;
 +
 +    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
      if (riscv_cpu_mxl(env) == MXL_RV64) {
-         mask |= HENVCFG_PBMTE | HENVCFG_STCE;
+-        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE);
-@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
++        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
- static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
+     }
-                                  target_ulong *val)
- {
+     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
-+    RISCVException ret;
+@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
-+
+         return ret;
-+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
+     }
-+    if (ret != RISCV_EXCP_NONE) {
-+        return ret;
+-    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
-+    }
++    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
-+
+                             env->menvcfg)) >> 32;
      *val = env->henvcfg >> 32;
      return RISCV_EXCP_NONE;
  }
 @@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
+                                      target_ulong val)
  {
-     uint64_t mask = HENVCFG_PBMTE | HENVCFG_STCE;
+     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
 -                                    HENVCFG_HADE);
 +                                    HENVCFG_ADUE);
      uint64_t valh = (uint64_t)val << 32;
-+    RISCVException ret;
+     RISCVException ret;
 -    env->henvcfg = (env->henvcfg & ~mask) | (valh & mask);
 +    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
 +    if (ret != RISCV_EXCP_NONE) {
 +        return ret;
 +    }
 +    env->henvcfg = (env->henvcfg & ~mask) | (valh & mask);
      return RISCV_EXCP_NONE;
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateen(CPURISCVState *env, int csrno,
  static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
                                        target_ulong new_val)
  {
 -    uint64_t wr_mask = SMSTATEEN_STATEEN;
 +    uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
      return write_mstateen(env, csrno, wr_mask, new_val);
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
  static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
                                        target_ulong new_val)
  {
 -    uint64_t wr_mask = SMSTATEEN_STATEEN;
 +    uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
      return write_mstateenh(env, csrno, wr_mask, new_val);
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateen(CPURISCVState *env, int csrno,
  static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
                                        target_ulong new_val)
  {
 -    uint64_t wr_mask = SMSTATEEN_STATEEN;
 +    uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
      return write_hstateen(env, csrno, wr_mask, new_val);
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
  static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
                                         target_ulong new_val)
  {
 -    uint64_t wr_mask = SMSTATEEN_STATEEN;
 +    uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
      return write_hstateenh(env, csrno, wr_mask, new_val);
  }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_sstateen(CPURISCVState *env, int csrno,
  static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
                                        target_ulong new_val)
  {
 -    uint64_t wr_mask = SMSTATEEN_STATEEN;
 +    uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
      return write_sstateen(env, csrno, wr_mask, new_val);
  }
 --
-.38.1
+.41.0

-[PULL v2 38/45] hw/intc: sifive_plic: Update "num-sources" property default value
+[PULL v2 36/45] target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
-From: Bin Meng <bmeng@tinylab.org>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-At present the default value of "num-sources" property is zero,
+In the same emulated RISC-V host, the 'host' KVM CPU takes 4 times
-which does not make a lot of sense, as in sifive_plic_realize()
+longer to boot than the 'rv64' KVM CPU.
 we see s->bitfield_words is calculated by:
-  s->bitfield_words = (s->num_sources + 31) >> 5;
+The reason is an unintended behavior of riscv_cpu_satp_mode_finalize()
 when satp_mode.supported = 0, i.e. when cpu_init() does not set
 satp_mode_max_supported(). satp_mode_max_from_map(map) does:
-if the we don't configure "num-sources" property its default value
+- __builtin_clz(map)
 zero makes s->bitfield_words zero too, which isn't true because
 interrupt source 0 still occupies one word.
-Let's change the default value to 1 meaning that only interrupt
+This means that, if satp_mode.supported = 0, satp_mode_supported_max
-source 0 is supported by default and a sanity check in realize().
+wil be '31 - 32'. But this is C, so satp_mode_supported_max will gladly
 set it to UINT_MAX (4294967295). After that, if the user didn't set a
 satp_mode, set_satp_mode_default_map(cpu) will make
-While we are here, add a comment to describe the exact meaning of
+cfg.satp_mode.map = cfg.satp_mode.supported
 this property that the number should include interrupt source 0.
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+So satp_mode.map = 0. And then satp_mode_map_max will be set to
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+satp_mode_max_from_map(cpu->cfg.satp_mode.map), i.e. also UINT_MAX. The
-Message-Id: <20221211030829.802437-9-bmeng@tinylab.org>
+guard "satp_mode_map_max > satp_mode_supported_max" doesn't protect us
 here since both are UINT_MAX.
 And finally we have 2 loops:
         for (int i = satp_mode_map_max - 1; i >= 0; --i) {
 Which are, in fact, 2 loops from UINT_MAX -1 to -1. This is where the
 extra delay when booting the 'host' CPU is coming from.
 Commit 43d1de32f8 already set a precedence for satp_mode.supported = 0
 in a different manner. We're doing the same here. If supported == 0,
 interpret as 'the CPU wants the OS to handle satp mode alone' and skip
 satp_mode_finalize().
 We'll also put a guard in satp_mode_max_from_map() to assert out if map
 is 0 since the function is not ready to deal with it.
 Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
 Fixes: 6f23aaeb9b ("riscv: Allow user to set the satp mode")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Message-ID: <20230817152903.694926-1-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/intc/sifive_plic.c | 8 +++++++-
+ target/riscv/cpu.c | 23 ++++++++++++++++++++---
-file changed, 7 insertions(+), 1 deletion(-)
+file changed, 20 insertions(+), 3 deletions(-)
-diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/sifive_plic.c
+--- a/target/riscv/cpu.c
-+++ b/hw/intc/sifive_plic.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void sifive_plic_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static uint8_t satp_mode_from_str(const char *satp_mode_str)
-     parse_hart_config(s);
+ uint8_t satp_mode_max_from_map(uint32_t map)
+ {
-+    if (!s->num_sources) {
++    /*
-+        error_setg(errp, "plic: invalid number of interrupt sources");
++     * 'map = 0' will make us return (31 - 32), which C will
 +     * happily overflow to UINT_MAX. There's no good result to
 +     * return if 'map = 0' (e.g. returning 0 will be ambiguous
 +     * with the result for 'map = 1').
 +     *
 +     * Assert out if map = 0. Callers will have to deal with
 +     * it outside of this function.
 +     */
 +    g_assert(map > 0);
 +
      /* map here has at least one bit set, so no problem with clz */
      return 31 - __builtin_clz(map);
  }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
  static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
  {
      bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
 -    uint8_t satp_mode_map_max;
 -    uint8_t satp_mode_supported_max =
 -                        satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
 +    uint8_t satp_mode_map_max, satp_mode_supported_max;
 +
 +    /* The CPU wants the OS to decide which satp mode to use */
 +    if (cpu->cfg.satp_mode.supported == 0) {
 +        return;
 +    }
 +
-     s->bitfield_words = (s->num_sources + 31) >> 5;
++    satp_mode_supported_max =
-     s->num_enables = s->bitfield_words * s->num_addrs;
++                    satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
-     s->source_priority = g_new0(uint32_t, s->num_sources);
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sifive_plic = {
+     if (cpu->cfg.satp_mode.map == 0) {
- static Property sifive_plic_properties[] = {
+         if (cpu->cfg.satp_mode.init == 0) {
      DEFINE_PROP_STRING("hart-config", SiFivePLICState, hart_config),
      DEFINE_PROP_UINT32("hartid-base", SiFivePLICState, hartid_base, 0),
 -    DEFINE_PROP_UINT32("num-sources", SiFivePLICState, num_sources, 0),
 +    /* number of interrupt sources including interrupt source 0 */
 +    DEFINE_PROP_UINT32("num-sources", SiFivePLICState, num_sources, 1),
      DEFINE_PROP_UINT32("num-priorities", SiFivePLICState, num_priorities, 0),
      DEFINE_PROP_UINT32("priority-base", SiFivePLICState, priority_base, 0),
      DEFINE_PROP_UINT32("pending-base", SiFivePLICState, pending_base, 0),
 --
-.38.1
+.41.0

-[PULL v2 39/45] hw/riscv: microchip_pfsoc: Fix the number of interrupt sources of PLIC
+[PULL v2 37/45] riscv: zicond: make non-experimental
-From: Bin Meng <bmeng@tinylab.org>
+From: Vineet Gupta <vineetg@rivosinc.com>
-Per chapter 6.5.2 in [1], the number of interupt sources including
+zicond is now codegen supported in both llvm and gcc.
 interrupt source 0 should be 187.
-[1] PolarFire SoC MSS TRM:
+This change allows seamless enabling/testing of zicond in downstream
-https://ww1.microchip.com/downloads/aemDocuments/documents/FPGA/ProductDocuments/ReferenceManuals/PolarFire_SoC_FPGA_MSS_Technical_Reference_Manual_VC.pdf
+projects. e.g. currently riscv-gnu-toolchain parses elf attributes
 to create a cmdline for qemu but fails short of enabling it because of
 the "x-" prefix.
-Fixes: 56f6e31e7b7e ("hw/riscv: Initial support for Microchip PolarFire SoC Icicle Kit board")
+Signed-off-by: Vineet Gupta <vineetg@rivosinc.com>
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+Message-ID: <20230808181715.436395-1-vineetg@rivosinc.com>
 Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
-Message-Id: <20221211030829.802437-10-bmeng@tinylab.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/microchip_pfsoc.h | 2 +-
+ target/riscv/cpu.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/microchip_pfsoc.h
+--- a/target/riscv/cpu.c
-+++ b/include/hw/riscv/microchip_pfsoc.h
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
- #define MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT    1
+     DEFINE_PROP_BOOL("zcf", RISCVCPU, cfg.ext_zcf, false),
- #define MICROCHIP_PFSOC_COMPUTE_CPU_COUNT       4
+     DEFINE_PROP_BOOL("zcmp", RISCVCPU, cfg.ext_zcmp, false),
+     DEFINE_PROP_BOOL("zcmt", RISCVCPU, cfg.ext_zcmt, false),
--#define MICROCHIP_PFSOC_PLIC_NUM_SOURCES        185
++    DEFINE_PROP_BOOL("zicond", RISCVCPU, cfg.ext_zicond, false),
-+#define MICROCHIP_PFSOC_PLIC_NUM_SOURCES        187
- #define MICROCHIP_PFSOC_PLIC_NUM_PRIORITIES     7
+     /* Vendor-specific custom extensions */
- #define MICROCHIP_PFSOC_PLIC_PRIORITY_BASE      0x04
+     DEFINE_PROP_BOOL("xtheadba", RISCVCPU, cfg.ext_xtheadba, false),
- #define MICROCHIP_PFSOC_PLIC_PENDING_BASE       0x1000
+@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
      DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
      /* These are experimental so mark with 'x-' */
 -    DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
      /* ePMP 0.9.3 */
      DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
 --
-.38.1
+.41.0

-[PULL v2 18/45] hw/riscv: virt: Remove the redundant ipi-id property
+[PULL v2 38/45] hw/riscv/virt.c: fix non-KVM --enable-debug build
-From: Atish Patra <atishp@rivosinc.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-The imsic DT binding[1] has changed and no longer require an ipi-id.
+A build with --enable-debug and without KVM will fail as follows:
 The latest IMSIC driver dynamically allocates ipi id if slow-ipi
 is not defined.
-Get rid of the unused dt property which may lead to confusion.
+/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_riscv_virt.c.o: in function `virt_machine_init':
 ./qemu/build/../hw/riscv/virt.c:1465: undefined reference to `kvm_riscv_aia_create'
-[1] https://lore.kernel.org/lkml/20221111044207.1478350-5-apatel@ventanamicro.com/
+This happens because the code block with "if virt_use_kvm_aia(s)" isn't
 being ignored by the debug build, resulting in an undefined reference to
 a KVM only function.
-Signed-off-by: Atish Patra <atishp@rivosinc.com>
+Add a 'kvm_enabled()' conditional together with virt_use_kvm_aia() will
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+make the compiler crop the kvm_riscv_aia_create() call entirely from a
-Message-Id: <20221122080529.1692533-1-atishp@rivosinc.com>
+non-KVM build. Note that adding the 'kvm_enabled()' conditional inside
 virt_use_kvm_aia() won't fix the build because this function would need
 to be inlined multiple times to make the compiler zero out the entire
 block.
 While we're at it, use kvm_enabled() in all instances where
 virt_use_kvm_aia() is checked to allow the compiler to elide these other
 kvm-only instances as well.
 Suggested-by: Richard Henderson <richard.henderson@linaro.org>
 Fixes: dbdb99948e ("target/riscv: select KVM AIA in riscv virt machine")
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230830133503.711138-2-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/virt.h | 1 -
+ hw/riscv/virt.c | 6 +++---
- hw/riscv/virt.c         | 4 ----
+file changed, 3 insertions(+), 3 deletions(-)
 files changed, 5 deletions(-)
-diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/virt.h
-+++ b/include/hw/riscv/virt.h
-@@ -XXX,XX +XXX,XX @@ enum {
- #define VIRT_PLATFORM_BUS_NUM_IRQS 32
--#define VIRT_IRQCHIP_IPI_MSI 1
- #define VIRT_IRQCHIP_NUM_MSIS 255
- #define VIRT_IRQCHIP_NUM_SOURCES VIRTIO_NDEV
- #define VIRT_IRQCHIP_NUM_PRIO_BITS 3
 diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/riscv/virt.c
 +++ b/hw/riscv/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-         riscv_socket_count(mc) * sizeof(uint32_t) * 4);
+     }
-     qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,num-ids",
-         VIRT_IRQCHIP_NUM_MSIS);
+     /* KVM AIA only has one APLIC instance */
--    qemu_fdt_setprop_cells(mc->fdt, imsic_name, "riscv,ipi-id",
+-    if (virt_use_kvm_aia(s)) {
--        VIRT_IRQCHIP_IPI_MSI);
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-     if (riscv_socket_count(mc) > 1) {
+         create_fdt_socket_aplic(s, memmap, 0,
-         qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,hart-index-bits",
+                                 msi_m_phandle, msi_s_phandle, phandle,
-             imsic_num_bits(imsic_max_hart_per_socket));
+                                 &intc_phandles[0], xplic_phandles,
-@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
+@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
-         riscv_socket_count(mc) * sizeof(uint32_t) * 4);
-     qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,num-ids",
+     g_free(intc_phandles);
-         VIRT_IRQCHIP_NUM_MSIS);
--    qemu_fdt_setprop_cells(mc->fdt, imsic_name, "riscv,ipi-id",
+-    if (virt_use_kvm_aia(s)) {
--        VIRT_IRQCHIP_IPI_MSI);
++    if (kvm_enabled() && virt_use_kvm_aia(s)) {
-     if (imsic_guest_bits) {
+         *irq_mmio_phandle = xplic_phandles[0];
-         qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,guest-index-bits",
+         *irq_virtio_phandle = xplic_phandles[0];
-             imsic_guest_bits);
+         *irq_pcie_phandle = xplic_phandles[0];
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
          }
      }
 -    if (virt_use_kvm_aia(s)) {
 +    if (kvm_enabled() && virt_use_kvm_aia(s)) {
          kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
                               VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
                               memmap[VIRT_APLIC_S].base,
 --
-.38.1
+.41.0

-[PULL v2 07/45] hw/riscv/opentitan: bump opentitan
+[PULL v2 39/45] hw/intc/riscv_aplic.c fix non-KVM --enable-debug build
-From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-This patch updates the OpenTitan model to match
+Commit 6df0b37e2ab breaks a --enable-debug build in a non-KVM
-the specified register layout as per [1]. Which is also the latest
+environment with the following error:
 commit of OpenTitan supported by TockOS.
-Note: Pinmux and Padctrl has been merged into Pinmux [2][3], this patch removes
+/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_intc_riscv_aplic.c.o: in function `riscv_kvm_aplic_request':
-any references to Padctrl. Note: OpenTitan doc [2] has not yet specified
+./qemu/build/../hw/intc/riscv_aplic.c:486: undefined reference to `kvm_set_irq'
-much detail regarding this, except for a note that states `TODO: this
+collect2: error: ld returned 1 exit status
 section needs to be updated to reflect the pinmux/padctrl merger`
-[1] https://github.com/lowRISC/opentitan/blob/d072ac505f82152678d6e04be95c72b728a347b8/hw/top_earlgrey/sw/autogen/top_earlgrey_memory.h
+This happens because the debug build will poke into the
-[2] https://docs.opentitan.org/hw/top_earlgrey/doc/design/
+'if (is_kvm_aia(aplic->msimode))' block and fail to find a reference to
-[3] https://docs.opentitan.org/hw/ip/pinmux/doc/#overview
+the KVM only function riscv_kvm_aplic_request().
-Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+There are multiple solutions to fix this. We'll go with the same
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+solution from the previous patch, i.e. add a kvm_enabled() conditional
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+to filter out the block. But there's a catch: riscv_kvm_aplic_request()
-Message-Id: <20221025043335.339815-2-wilfred.mallawa@opensource.wdc.com>
+is a local function that would end up being used if the compiler crops
 the block, and this won't work. Quoting Richard Henderson's explanation
 in [1]:
 "(...) the compiler won't eliminate entire unused functions with -O0"
 We'll solve it by moving riscv_kvm_aplic_request() to kvm.c and add its
 declaration in kvm_riscv.h, where all other KVM specific public
 functions are already declared. Other archs handles KVM specific code in
 this manner and we expect to do the same from now on.
 [1] https://lore.kernel.org/qemu-riscv/d2f1ad02-eb03-138f-9d08-db676deeed05@linaro.org/
 Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
 Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-ID: <20230830133503.711138-3-dbarboza@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- include/hw/riscv/opentitan.h |  9 ++++-----
+ target/riscv/kvm_riscv.h | 1 +
- hw/riscv/opentitan.c         | 21 +++++++++++++--------
+ hw/intc/riscv_aplic.c    | 8 ++------
-files changed, 17 insertions(+), 13 deletions(-)
+ target/riscv/kvm.c       | 5 +++++
 files changed, 8 insertions(+), 6 deletions(-)
-diff --git a/include/hw/riscv/opentitan.h b/include/hw/riscv/opentitan.h
+diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/riscv/opentitan.h
+--- a/target/riscv/kvm_riscv.h
-+++ b/include/hw/riscv/opentitan.h
++++ b/target/riscv/kvm_riscv.h
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
-     IBEX_DEV_RSTMGR,
+                           uint64_t aia_irq_num, uint64_t aia_msi_num,
-     IBEX_DEV_CLKMGR,
+                           uint64_t aplic_base, uint64_t imsic_base,
-     IBEX_DEV_PINMUX,
+                           uint64_t guest_num);
--    IBEX_DEV_PADCTRL,
++void riscv_kvm_aplic_request(void *opaque, int irq, int level);
      IBEX_DEV_USBDEV,
      IBEX_DEV_FLASH_CTRL,
      IBEX_DEV_PLIC,
@@ -XXX,XX +XXX,XX @@ enum {
      IBEX_UART0_RX_TIMEOUT_IRQ     = 7,
      IBEX_UART0_RX_PARITY_ERR_IRQ  = 8,
      IBEX_TIMER_TIMEREXPIRED0_0    = 127,
 -    IBEX_SPI_HOST0_ERR_IRQ        = 151,
 -    IBEX_SPI_HOST0_SPI_EVENT_IRQ  = 152,
 -    IBEX_SPI_HOST1_ERR_IRQ        = 153,
 -    IBEX_SPI_HOST1_SPI_EVENT_IRQ  = 154,
 +    IBEX_SPI_HOST0_ERR_IRQ        = 134,
 +    IBEX_SPI_HOST0_SPI_EVENT_IRQ  = 135,
 +    IBEX_SPI_HOST1_ERR_IRQ        = 136,
 +    IBEX_SPI_HOST1_SPI_EVENT_IRQ  = 137,
  };
  #endif
-diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
+diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/opentitan.c
+--- a/hw/intc/riscv_aplic.c
-+++ b/hw/riscv/opentitan.c
++++ b/hw/intc/riscv_aplic.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/units.h"
+ #include "target/riscv/cpu.h"
  #include "sysemu/sysemu.h"
+ #include "sysemu/kvm.h"
-+/*
++#include "kvm_riscv.h"
-+ * This version of the OpenTitan machine currently supports
+ #include "migration/vmstate.h"
-+ * OpenTitan RTL version:
-+ * <lowRISC/opentitan@d072ac505f82152678d6e04be95c72b728a347b8>
+ #define APLIC_MAX_IDC                  (1UL << 14)
-+ *
+@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
-+ * MMIO mapping as per (specified commit):
+     return topi;
-+ * lowRISC/opentitan: hw/top_earlgrey/sw/autogen/top_earlgrey_memory.h
+ }
-+ */
- static const MemMapEntry ibex_memmap[] = {
+-static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
--    [IBEX_DEV_ROM] =            {  0x00008000,   0x8000 },
+-{
-+    [IBEX_DEV_ROM] =            {  0x00008000,  0x8000 },
+-    kvm_set_irq(kvm_state, irq, !!level);
-     [IBEX_DEV_RAM] =            {  0x10000000,  0x20000 },
+-}
-     [IBEX_DEV_FLASH] =          {  0x20000000,  0x100000 },
+-
-     [IBEX_DEV_UART] =           {  0x40000000,  0x1000  },
+ static void riscv_aplic_request(void *opaque, int irq, int level)
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry ibex_memmap[] = {
+ {
-     [IBEX_DEV_I2C] =            {  0x40080000,  0x1000  },
+     bool update = false;
-     [IBEX_DEV_PATTGEN] =        {  0x400e0000,  0x1000  },
+@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
-     [IBEX_DEV_TIMER] =          {  0x40100000,  0x1000  },
+      * have IRQ lines delegated by their parent APLIC.
--    [IBEX_DEV_SENSOR_CTRL] =    {  0x40110000,  0x1000  },
+      */
-     [IBEX_DEV_OTP_CTRL] =       {  0x40130000,  0x4000  },
+     if (!aplic->parent) {
-     [IBEX_DEV_LC_CTRL] =        {  0x40140000,  0x1000  },
+-        if (is_kvm_aia(aplic->msimode)) {
--    [IBEX_DEV_USBDEV] =         {  0x40150000,  0x1000  },
++        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
-+    [IBEX_DEV_ALERT_HANDLER] =  {  0x40150000,  0x1000  },
+             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
-     [IBEX_DEV_SPI_HOST0] =      {  0x40300000,  0x1000  },
+         } else {
-     [IBEX_DEV_SPI_HOST1] =      {  0x40310000,  0x1000  },
+             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
-+    [IBEX_DEV_USBDEV] =         {  0x40320000,  0x1000  },
+diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
-     [IBEX_DEV_PWRMGR] =         {  0x40400000,  0x1000  },
+index XXXXXXX..XXXXXXX 100644
-     [IBEX_DEV_RSTMGR] =         {  0x40410000,  0x1000  },
+--- a/target/riscv/kvm.c
-     [IBEX_DEV_CLKMGR] =         {  0x40420000,  0x1000  },
++++ b/target/riscv/kvm.c
-     [IBEX_DEV_PINMUX] =         {  0x40460000,  0x1000  },
+@@ -XXX,XX +XXX,XX @@
--    [IBEX_DEV_PADCTRL] =        {  0x40470000,  0x1000  },
+ #include "sysemu/runstate.h"
-+    [IBEX_DEV_SENSOR_CTRL] =    {  0x40490000,  0x1000  },
+ #include "hw/riscv/numa.h"
-     [IBEX_DEV_FLASH_CTRL] =     {  0x41000000,  0x1000  },
-     [IBEX_DEV_AES] =            {  0x41100000,  0x1000  },
++void riscv_kvm_aplic_request(void *opaque, int irq, int level)
-     [IBEX_DEV_HMAC] =           {  0x41110000,  0x1000  },
++{
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry ibex_memmap[] = {
++    kvm_set_irq(kvm_state, irq, !!level);
-     [IBEX_DEV_ENTROPY] =        {  0x41160000,  0x1000  },
++}
-     [IBEX_DEV_EDNO] =           {  0x41170000,  0x1000  },
++
-     [IBEX_DEV_EDN1] =           {  0x41180000,  0x1000  },
+ static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
--    [IBEX_DEV_ALERT_HANDLER] =  {  0x411b0000,  0x1000  },
+                                  uint64_t idx)
-     [IBEX_DEV_NMI_GEN] =        {  0x411c0000,  0x1000  },
+ {
      [IBEX_DEV_PERI] =           {  0x411f0000,  0x10000 },
 -    [IBEX_DEV_PLIC] =           {  0x48000000,  0x4005000  },
 +    [IBEX_DEV_PLIC] =           {  0x48000000,  0x4005000 },
      [IBEX_DEV_FLASH_VIRTUAL] =  {  0x80000000,  0x80000 },
  };
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
          memmap[IBEX_DEV_CLKMGR].base, memmap[IBEX_DEV_CLKMGR].size);
      create_unimplemented_device("riscv.lowrisc.ibex.pinmux",
          memmap[IBEX_DEV_PINMUX].base, memmap[IBEX_DEV_PINMUX].size);
 -    create_unimplemented_device("riscv.lowrisc.ibex.padctrl",
 -        memmap[IBEX_DEV_PADCTRL].base, memmap[IBEX_DEV_PADCTRL].size);
      create_unimplemented_device("riscv.lowrisc.ibex.usbdev",
          memmap[IBEX_DEV_USBDEV].base, memmap[IBEX_DEV_USBDEV].size);
      create_unimplemented_device("riscv.lowrisc.ibex.flash_ctrl",
 --
-.38.1
+.41.0

-[PULL v2 04/45] tcg/riscv: Fix range matched by TCG_CT_CONST_M12
+[PULL v2 40/45] linux-user/riscv: Add new extensions to hwprobe
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Robbin Ehn <rehn@rivosinc.com>
-We were matching a signed 13-bit range, not a 12-bit range.
+This patch adds the new extensions in
-Expand the commentary within the function and be explicit
+linux 6.5 to the hwprobe syscall.
 about all of the ranges.
-Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+And fixes RVC check to OR with correct value.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+The previous variable contains 0 therefore it
-Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+did work.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221022095821.2441874-1-richard.henderson@linaro.org>
+Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
 Acked-by: Richard Henderson <richard.henderson@linaro.org>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-ID: <bc82203b72d7efb30f1b4a8f9eb3d94699799dc8.camel@rivosinc.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- tcg/riscv/tcg-target.c.inc | 19 ++++++++++++++++---
+ linux-user/syscall.c | 14 +++++++++++++-
-file changed, 16 insertions(+), 3 deletions(-)
+file changed, 13 insertions(+), 1 deletion(-)
-diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
 index XXXXXXX..XXXXXXX 100644
---- a/tcg/riscv/tcg-target.c.inc
+--- a/linux-user/syscall.c
-+++ b/tcg/riscv/tcg-target.c.inc
++++ b/linux-user/syscall.c
-@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
+@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
-     if ((ct & TCG_CT_CONST_ZERO) && val == 0) {
+ #define RISCV_HWPROBE_KEY_IMA_EXT_0     4
-         return 1;
+ #define     RISCV_HWPROBE_IMA_FD       (1 << 0)
-     }
+ #define     RISCV_HWPROBE_IMA_C        (1 << 1)
--    if ((ct & TCG_CT_CONST_S12) && val == sextreg(val, 0, 12)) {
++#define     RISCV_HWPROBE_IMA_V        (1 << 2)
-+    /*
++#define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
-+     * Sign extended from 12 bits: [-0x800, 0x7ff].
++#define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
-+     * Used for most arithmetic, as this is the isa field.
++#define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
-+     */
-+    if ((ct & TCG_CT_CONST_S12) && val >= -0x800 && val <= 0x7ff) {
+ #define RISCV_HWPROBE_KEY_CPUPERF_0     5
-         return 1;
+ #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
-     }
+@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
--    if ((ct & TCG_CT_CONST_N12) && -val == sextreg(-val, 0, 12)) {
+                     riscv_has_ext(env, RVD) ?
-+    /*
+                     RISCV_HWPROBE_IMA_FD : 0;
-+     * Sign extended from 12 bits, negated: [-0x7ff, 0x800].
+             value |= riscv_has_ext(env, RVC) ?
-+     * Used for subtraction, where a constant must be handled by ADDI.
+-                     RISCV_HWPROBE_IMA_C : pair->value;
-+     */
++                     RISCV_HWPROBE_IMA_C : 0;
-+    if ((ct & TCG_CT_CONST_N12) && val >= -0x7ff && val <= 0x800) {
++            value |= riscv_has_ext(env, RVV) ?
-         return 1;
++                     RISCV_HWPROBE_IMA_V : 0;
-     }
++            value |= cfg->ext_zba ?
--    if ((ct & TCG_CT_CONST_M12) && val >= -0xfff && val <= 0xfff) {
++                     RISCV_HWPROBE_EXT_ZBA : 0;
-+    /*
++            value |= cfg->ext_zbb ?
-+     * Sign extended from 12 bits, +/- matching: [-0x7ff, 0x7ff].
++                     RISCV_HWPROBE_EXT_ZBB : 0;
-+     * Used by addsub2, which may need the negative operation,
++            value |= cfg->ext_zbs ?
-+     * and requires the modified constant to be representable.
++                     RISCV_HWPROBE_EXT_ZBS : 0;
-+     */
+             __put_user(value, &pair->value);
-+    if ((ct & TCG_CT_CONST_M12) && val >= -0x7ff && val <= 0x7ff) {
+             break;
-         return 1;
+         case RISCV_HWPROBE_KEY_CPUPERF_0:
      }
      return 0;
 --
-.38.1
+.41.0

-[PULL v2 25/45] target/riscv: Fix mret exception cause when no pmp rule is configured
+[PULL v2 41/45] target/riscv: Use accelerated helper for AES64KS1I
-From: Bin Meng <bmeng@tinylab.org>
+From: Ard Biesheuvel <ardb@kernel.org>
-The priv spec v1.12 says:
+Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
 implement the first half of the key schedule derivation. This does not
 actually involve shifting rows, so clone the same value into all four
 columns of the AES vector to counter that operation.
-  If no PMP entry matches an M-mode access, the access succeeds. If
+Cc: Richard Henderson <richard.henderson@linaro.org>
-  no PMP entry matches an S-mode or U-mode access, but at least one
+Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
-  PMP entry is implemented, the access fails. Failed accesses generate
+Cc: Palmer Dabbelt <palmer@dabbelt.com>
-  an instruction, load, or store access-fault exception.
+Cc: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
-At present the exception cause is set to 'illegal instruction' but
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-should have been 'instruction access fault'.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-ID: <20230831154118.138727-1-ardb@kernel.org>
 Fixes: d102f19a2085 ("target/riscv/pmp: Raise exception if no PMP entry is configured")
 Signed-off-by: Bin Meng <bmeng@tinylab.org>
 Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-Id: <20221205065303.204095-1-bmeng@tinylab.org>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/op_helper.c | 2 +-
+ target/riscv/crypto_helper.c | 17 +++++------------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 5 insertions(+), 12 deletions(-)
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
+diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
+--- a/target/riscv/crypto_helper.c
-+++ b/target/riscv/op_helper.c
++++ b/target/riscv/crypto_helper.c
-@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
-     if (riscv_feature(env, RISCV_FEATURE_PMP) &&
+     uint8_t enc_rnum = rnum;
-         !pmp_get_num_rules(env) && (prev_priv != PRV_M)) {
+     uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
--        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+-    uint8_t rcon_ = 0;
-+        riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
+-    target_ulong result;
 +    AESState t, rc = {};
      if (enc_rnum != 0xA) {
          temp = ror32(temp, 8); /* Rotate right by 8 */
 -        rcon_ = round_consts[enc_rnum];
 +        rc.w[0] = rc.w[1] = round_consts[enc_rnum];
      }
-     target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV);
+-    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
 -           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
 -           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
 -           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
 +    t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
 +    aesenc_SB_SR_AK(&t, &t, &rc, false);
 -    temp ^= rcon_;
 -
 -    result = ((uint64_t)temp << 32) | temp;
 -
 -    return result;
 +    return t.d[0];
  }
  target_ulong HELPER(aes64im)(target_ulong rs1)
 --
-.38.1
+.41.0

-[PULL v2 13/45] target/riscv: Add itrigger support when icount is enabled
+[PULL v2 42/45] target/riscv: Allocate itrigger timers only once
-From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
-The max count in itrigger can be 0x3FFF, which will cause a no trivial
+riscv_trigger_init() had been called on reset events that can happen
-translation and execution overload.
+several times for a CPU and it allocated timers for itrigger. If old
 timers were present, they were simply overwritten by the new timers,
 resulting in a memory leak.
-When icount is enabled, QEMU provides API that can fetch guest
+Divide riscv_trigger_init() into two functions, namely
-instruction number. Thus, we can set an timer for itrigger with
+riscv_trigger_realize() and riscv_trigger_reset() and call them in
-the count as deadline.
+appropriate timing. The timer allocation will happen only once for a
 CPU in riscv_trigger_realize().
-Only when timer expires or priviledge mode changes, do lazy update
+Fixes: 5a4ae64cac ("target/riscv: Add itrigger support when icount is enabled")
-to count.
+Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
+Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221013062946.7530-3-zhiwei_liu@linux.alibaba.com>
+Message-ID: <20230818034059.9146-1-akihiko.odaki@daynix.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/cpu.h        |  2 ++
+ target/riscv/debug.h |  3 ++-
- target/riscv/debug.h      |  1 +
+ target/riscv/cpu.c   |  8 +++++++-
- target/riscv/cpu_helper.c |  3 ++
+ target/riscv/debug.c | 15 ++++++++++++---
- target/riscv/debug.c      | 59 +++++++++++++++++++++++++++++++++++++++
+files changed, 21 insertions(+), 5 deletions(-)
 files changed, 65 insertions(+)
-diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu.h
-+++ b/target/riscv/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
-     target_ulong tdata3[RV_MAX_TRIGGERS];
-     struct CPUBreakpoint *cpu_breakpoint[RV_MAX_TRIGGERS];
-     struct CPUWatchpoint *cpu_watchpoint[RV_MAX_TRIGGERS];
-+    QEMUTimer *itrigger_timer[RV_MAX_TRIGGERS];
-+    int64_t last_icount;
-     /* machine specific rdtime callback */
-     uint64_t (*rdtime_fn)(void *);
 diff --git a/target/riscv/debug.h b/target/riscv/debug.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.h
 +++ b/target/riscv/debug.h
-@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
+@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs);
- void riscv_trigger_init(CPURISCVState *env);
+ bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
  bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
 -void riscv_trigger_init(CPURISCVState *env);
 +void riscv_trigger_realize(CPURISCVState *env);
 +void riscv_trigger_reset_hold(CPURISCVState *env);
  bool riscv_itrigger_enabled(CPURISCVState *env);
-+void riscv_itrigger_update_priv(CPURISCVState *env);
+ void riscv_itrigger_update_priv(CPURISCVState *env);
- #endif /* RISCV_DEBUG_H */
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
 diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/cpu_helper.c
+--- a/target/riscv/cpu.c
-+++ b/target/riscv/cpu_helper.c
++++ b/target/riscv/cpu.c
-@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
-     if (newpriv == PRV_H) {
-         newpriv = PRV_U;
+ #ifndef CONFIG_USER_ONLY
      if (cpu->cfg.debug) {
 -        riscv_trigger_init(env);
 +        riscv_trigger_reset_hold(env);
      }
-+    if (icount_enabled() && newpriv != env->priv) {
-+        riscv_itrigger_update_priv(env);
+     if (kvm_enabled()) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
      riscv_cpu_register_gdb_regs_for_features(cs);
 +#ifndef CONFIG_USER_ONLY
 +    if (cpu->cfg.debug) {
 +        riscv_trigger_realize(&cpu->env);
 +    }
-     /* tlb_flush is unnecessary as mode is contained in mmu_idx */
++#endif
-     env->priv = newpriv;
++
-     env->xl = cpu_recompute_xl(env);
+     qemu_init_vcpu(cs);
      cpu_reset(cs);
 diff --git a/target/riscv/debug.c b/target/riscv/debug.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/debug.c
 +++ b/target/riscv/debug.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
- #include "trace.h"
+     return false;
  #include "exec/exec-all.h"
  #include "exec/helper-proto.h"
 +#include "sysemu/cpu-timers.h"
  /*
   * The following M-mode trigger CSRs are implemented:
@@ -XXX,XX +XXX,XX @@ void helper_itrigger_match(CPURISCVState *env)
      }
  }
-+static void riscv_itrigger_update_count(CPURISCVState *env)
+-void riscv_trigger_init(CPURISCVState *env)
 +void riscv_trigger_realize(CPURISCVState *env)
 +{
-+    int count, executed;
++    int i;
 +    /*
 +     * Record last icount, so that we can evaluate the executed instructions
 +     * since last priviledge mode change or timer expire.
 +     */
 +    int64_t last_icount = env->last_icount, current_icount;
 +    current_icount = env->last_icount = icount_get_raw();
 +
-+    for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
++    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
-+        if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
++        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-+            continue;
++                                              riscv_itrigger_timer_cb, env);
 +        }
 +        count = itrigger_get_count(env, i);
 +        if (!count) {
 +            continue;
 +        }
 +        /*
 +         * Only when priviledge is changed or itrigger timer expires,
 +         * the count field in itrigger tdata1 register is updated.
 +         * And the count field in itrigger only contains remaining value.
 +         */
 +        if (check_itrigger_priv(env, i)) {
 +            /*
 +             * If itrigger enabled in this priviledge mode, the number of
 +             * executed instructions since last priviledge change
 +             * should be reduced from current itrigger count.
 +             */
 +            executed = current_icount - last_icount;
 +            itrigger_set_count(env, i, count - executed);
 +            if (count == executed) {
 +                do_trigger_action(env, i);
 +            }
 +        } else {
 +            /*
 +             * If itrigger is not enabled in this priviledge mode,
 +             * the number of executed instructions will be discard and
 +             * the count field in itrigger will not change.
 +             */
 +            timer_mod(env->itrigger_timer[i],
 +                      current_icount + count);
 +        }
 +    }
 +}
 +
-+static void riscv_itrigger_timer_cb(void *opaque)
++void riscv_trigger_reset_hold(CPURISCVState *env)
 +{
 +    riscv_itrigger_update_count((CPURISCVState *)opaque);
 +}
 +
 +void riscv_itrigger_update_priv(CPURISCVState *env)
 +{
 +    riscv_itrigger_update_count(env);
 +}
 +
  target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
  {
-     switch (tdata_index) {
+     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
      int i;
 @@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
          env->tdata3[i] = 0;
          env->cpu_breakpoint[i] = NULL;
          env->cpu_watchpoint[i] = NULL;
-+        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+-        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-+                                              riscv_itrigger_timer_cb, env);
+-                                              riscv_itrigger_timer_cb, env);
 +        timer_del(env->itrigger_timer[i]);
      }
  }
 --
-.38.1
+.41.0

-[PULL v2 03/45] hw/ssi/ibex_spi: implement `FIELD32_1CLEAR` macro
+[PULL v2 43/45] target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes
-From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
+From: Leon Schuermann <leons@opentitan.org>
-use the `FIELD32_1CLEAR` macro to implement register
+When the rule-lock bypass (RLB) bit is set in the mseccfg CSR, the PMP
-`rw1c` functionality to `ibex_spi`.
+configuration lock bits must not apply. While this behavior is
 implemented for the pmpcfgX CSRs, this bit is not respected for
 changes to the pmpaddrX CSRs. This patch ensures that pmpaddrX CSR
 writes work even on locked regions when the global rule-lock bypass is
 enabled.
-This change was tested by running the `SPI_HOST` from TockOS.
+Signed-off-by: Leon Schuermann <leons@opentitan.org>
+Reviewed-by: Mayuresh Chitale <mchitale@ventanamicro.com>
 Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221017054950.317584-3-wilfred.mallawa@opensource.wdc.com>
+Message-ID: <20230829215046.1430463-1-leon@is.currently.online>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- hw/ssi/ibex_spi_host.c | 21 +++++++++------------
+ target/riscv/pmp.c | 4 ++++
-file changed, 9 insertions(+), 12 deletions(-)
+file changed, 4 insertions(+)
-diff --git a/hw/ssi/ibex_spi_host.c b/hw/ssi/ibex_spi_host.c
+diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/ibex_spi_host.c
+--- a/target/riscv/pmp.c
-+++ b/hw/ssi/ibex_spi_host.c
++++ b/target/riscv/pmp.c
-@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_write(void *opaque, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ static inline uint8_t pmp_get_a_field(uint8_t cfg)
   */
  static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
  {
-     IbexSPIHostState *s = opaque;
++    /* mseccfg.RLB is set */
-     uint32_t val32 = val64;
++    if (MSECCFG_RLB_ISSET(env)) {
--    uint32_t shift_mask = 0xff, status = 0, data = 0;
++        return 0;
-+    uint32_t shift_mask = 0xff, status = 0;
++    }
-     uint8_t txqd_len;
+     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
-     trace_ibex_spi_host_write(addr, size, val64);
+         return 1;
@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_write(void *opaque, hwaddr addr,
      case IBEX_SPI_HOST_INTR_STATE:
          /* rw1c status register */
          if (FIELD_EX32(val32, INTR_STATE, ERROR)) {
 -            data = FIELD_DP32(data, INTR_STATE, ERROR, 0);
 +            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], INTR_STATE, ERROR);
          }
          if (FIELD_EX32(val32, INTR_STATE, SPI_EVENT)) {
 -            data = FIELD_DP32(data, INTR_STATE, SPI_EVENT, 0);
 +            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], INTR_STATE, SPI_EVENT);
          }
 -        s->regs[addr] = data;
          break;
      case IBEX_SPI_HOST_INTR_ENABLE:
          s->regs[addr] = val32;
@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_write(void *opaque, hwaddr addr,
       *  When an error occurs, the corresponding bit must be cleared
       *  here before issuing any further commands
       */
 -        status = s->regs[addr];
          /* rw1c status register */
          if (FIELD_EX32(val32, ERROR_STATUS, CMDBUSY)) {
 -            status = FIELD_DP32(status, ERROR_STATUS, CMDBUSY, 0);
 +            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, CMDBUSY);
          }
          if (FIELD_EX32(val32, ERROR_STATUS, OVERFLOW)) {
 -            status = FIELD_DP32(status, ERROR_STATUS, OVERFLOW, 0);
 +            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, OVERFLOW);
          }
          if (FIELD_EX32(val32, ERROR_STATUS, UNDERFLOW)) {
 -            status = FIELD_DP32(status, ERROR_STATUS, UNDERFLOW, 0);
 +            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, UNDERFLOW);
          }
          if (FIELD_EX32(val32, ERROR_STATUS, CMDINVAL)) {
 -            status = FIELD_DP32(status, ERROR_STATUS, CMDINVAL, 0);
 +            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, CMDINVAL);
          }
          if (FIELD_EX32(val32, ERROR_STATUS, CSIDINVAL)) {
 -            status = FIELD_DP32(status, ERROR_STATUS, CSIDINVAL, 0);
 +            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, CSIDINVAL);
          }
          if (FIELD_EX32(val32, ERROR_STATUS, ACCESSINVAL)) {
 -            status = FIELD_DP32(status, ERROR_STATUS, ACCESSINVAL, 0);
 +            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, ACCESSINVAL);
          }
 -        s->regs[addr] = status;
          break;
      case IBEX_SPI_HOST_EVENT_ENABLE:
      /* Controls which classes of SPI events raise an interrupt. */
 --
-.38.1
+.41.0

-[PULL v2 17/45] target/riscv: Typo fix in sstc() predicate
+[PULL v2 44/45] target/riscv: Align the AIA model to v1.0 ratified spec
-From: Anup Patel <apatel@ventanamicro.com>
+From: Tommy Wu <tommy.wu@sifive.com>
-We should use "&&" instead of "&" when checking hcounteren.TM and
+According to the new spec, when vsiselect has a reserved value, attempts
-henvcfg.STCE bits.
+from M-mode or HS-mode to access vsireg, or from VS-mode to access
 sireg, should preferably raise an illegal instruction exception.
-Fixes: 3ec0fe18a31f ("target/riscv: Add vstimecmp suppor")
+Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
-Signed-off-by: Anup Patel <apatel@ventanamicro.com>
+Reviewed-by: Frank Chang <frank.chang@sifive.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-ID: <20230816061647.600672-1-tommy.wu@sifive.com>
 Message-Id: <20221108125703.1463577-2-apatel@ventanamicro.com>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/csr.c | 2 +-
+ target/riscv/csr.c | 7 +++++--
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/riscv/csr.c
 +++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ static RISCVException sstc(CPURISCVState *env, int csrno)
+@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
  static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                       target_ulong new_val, target_ulong wr_mask)
  {
 -    bool virt;
 +    bool virt, isel_reserved;
      uint8_t *iprio;
      int ret = -EINVAL;
      target_ulong priv, isel, vgein;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
      /* Decode register details from CSR number */
      virt = false;
 +    isel_reserved = false;
      switch (csrno) {
      case CSR_MIREG:
          iprio = env->miprio;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                                                    riscv_cpu_mxl_bits(env)),
                                      val, new_val, wr_mask);
          }
 +    } else {
 +        isel_reserved = true;
      }
-     if (riscv_cpu_virt_enabled(env)) {
+ done:
--        if (!(get_field(env->hcounteren, COUNTEREN_TM) &
+     if (ret) {
-+        if (!(get_field(env->hcounteren, COUNTEREN_TM) &&
+-        return (env->virt_enabled && virt) ?
-               get_field(env->henvcfg, HENVCFG_STCE))) {
++        return (env->virt_enabled && virt && !isel_reserved) ?
-             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
-         }
+     }
      return RISCV_EXCP_NONE;
 --
-.38.1
+.41.0

-[PULL v2 27/45] target/riscv: Simplify helper_sret() a little bit
+[PULL v2 45/45] target/riscv: don't read CSR in riscv_csrrw_do64
-From: Bin Meng <bmeng@tinylab.org>
+From: Nikita Shubin <n.shubin@yadro.com>
-There are 2 paths in helper_sret() and the same mstatus update codes
+As per ISA:
 are replicated. Extract the common parts to simplify it a little bit.
-Signed-off-by: Bin Meng <bmeng@tinylab.org>
+"For CSRRWI, if rd=x0, then the instruction shall not read the CSR and
 shall not cause any of the side effects that might occur on a CSR read."
 trans_csrrwi() and trans_csrrw() call do_csrw() if rd=x0, do_csrw() calls
 riscv_csrrw_do64(), via helper_csrw() passing NULL as *ret_value.
 Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-Id: <20221207090037.281452-1-bmeng@tinylab.org>
+Message-ID: <20230808090914.17634-1-nikita.shubin@maquefel.me>
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 ---
- target/riscv/op_helper.c | 20 ++++++--------------
+ target/riscv/csr.c | 24 +++++++++++++++---------
-file changed, 6 insertions(+), 14 deletions(-)
+file changed, 15 insertions(+), 9 deletions(-)
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
+diff --git a/target/riscv/csr.c b/target/riscv/csr.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
+--- a/target/riscv/csr.c
-+++ b/target/riscv/op_helper.c
++++ b/target/riscv/csr.c
-@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
+@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
                                         target_ulong write_mask)
  {
      RISCVException ret;
 -    target_ulong old_value;
 +    target_ulong old_value = 0;
      /* execute combined read/write operation if it exists */
      if (csr_ops[csrno].op) {
          return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
      }
-     mstatus = env->mstatus;
+-    /* if no accessor exists then return failure */
-+    prev_priv = get_field(mstatus, MSTATUS_SPP);
+-    if (!csr_ops[csrno].read) {
-+    mstatus = set_field(mstatus, MSTATUS_SIE,
+-        return RISCV_EXCP_ILLEGAL_INST;
-+                        get_field(mstatus, MSTATUS_SPIE));
+-    }
-+    mstatus = set_field(mstatus, MSTATUS_SPIE, 1);
+-    /* read old value */
-+    mstatus = set_field(mstatus, MSTATUS_SPP, PRV_U);
+-    ret = csr_ops[csrno].read(env, csrno, &old_value);
-+    env->mstatus = mstatus;
+-    if (ret != RISCV_EXCP_NONE) {
+-        return ret;
-     if (riscv_has_ext(env, RVH) && !riscv_cpu_virt_enabled(env)) {
++    /*
-         /* We support Hypervisor extensions and virtulisation is disabled */
++     * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
-         target_ulong hstatus = env->hstatus;
++     * and we can't throw side effects caused by CSR reads.
++     */
--        prev_priv = get_field(mstatus, MSTATUS_SPP);
++    if (ret_value) {
-         prev_virt = get_field(hstatus, HSTATUS_SPV);
++        /* if no accessor exists then return failure */
++        if (!csr_ops[csrno].read) {
-         hstatus = set_field(hstatus, HSTATUS_SPV, 0);
++            return RISCV_EXCP_ILLEGAL_INST;
--        mstatus = set_field(mstatus, MSTATUS_SPP, 0);
++        }
--        mstatus = set_field(mstatus, SSTATUS_SIE,
++        /* read old value */
--                            get_field(mstatus, SSTATUS_SPIE));
++        ret = csr_ops[csrno].read(env, csrno, &old_value);
--        mstatus = set_field(mstatus, SSTATUS_SPIE, 1);
++        if (ret != RISCV_EXCP_NONE) {
++            return ret;
--        env->mstatus = mstatus;
++        }
          env->hstatus = hstatus;
          if (prev_virt) {
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
          }
          riscv_cpu_set_virt_enabled(env, prev_virt);
 -    } else {
 -        prev_priv = get_field(mstatus, MSTATUS_SPP);
 -
 -        mstatus = set_field(mstatus, MSTATUS_SIE,
 -                            get_field(mstatus, MSTATUS_SPIE));
 -        mstatus = set_field(mstatus, MSTATUS_SPIE, 1);
 -        mstatus = set_field(mstatus, MSTATUS_SPP, PRV_U);
 -        env->mstatus = mstatus;
      }
-     riscv_cpu_set_mode(env, prev_priv);
+     /* write value if writable and write mask set, otherwise drop writes */
 --
-.38.1
+.41.0

From: Alistair Francis <alistair.francis@wdc.com>

The following changes since commit 222059a0fccf4af3be776fe35a5ea2d6a68f9a0b:

Merge tag 'pull-ppc-20221221' of https://gitlab.com/danielhb/qemu into staging (2022-12-21 18:08:09 +0000)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20221222-1

for you to fetch changes up to 71a9bc59728a054036f3db7dd82dab8f8bd2baf9:

hw/intc: sifive_plic: Fix the pending register range check (2022-12-22 08:36:30 +1000)

----------------------------------------------------------------
First RISC-V PR for QEMU 8.0

* Fix PMP propagation for tlb
* Collection of bug fixes
* Add the `FIELDx_1CLEAR()` macro
* Bump the OpenTitan supported version
* Add smstateen support
* Support native debug icount trigger
* Remove the redundant ipi-id property in the virt machine
* Support cache-related PMU events in virtual mode
* Add some missing PolarFire SoC io regions
* Fix mret exception cause when no pmp rule is configured
* Fix bug where disabling compressed instructions would crash QEMU
* Add Zawrs ISA extension support
* A range of code refactoring and cleanups

----------------------------------------------------------------
Anup Patel (1):
      target/riscv: Typo fix in sstc() predicate

Atish Patra (1):
      hw/riscv: virt: Remove the redundant ipi-id property

Bin Meng (20):
      target/riscv: Add some comments for sstatus CSR in riscv_cpu_dump_state()
      target/riscv: Fix mret exception cause when no pmp rule is configured
      target/riscv: Simplify helper_sret() a little bit
      target/riscv: Clear mstatus.MPRV when leaving M-mode for priv spec 1.12+
      hw/riscv: Select MSI_NONBROKEN in SIFIVE_PLIC
      hw/intc: Select MSI_NONBROKEN in RISC-V AIA interrupt controllers
      hw/riscv: Fix opentitan dependency to SIFIVE_PLIC
      hw/riscv: Sort machines Kconfig options in alphabetical order
      hw/riscv: spike: Remove misleading comments
      hw/intc: sifive_plic: Drop PLICMode_H
      hw/intc: sifive_plic: Improve robustness of the PLIC config parser
      hw/intc: sifive_plic: Use error_setg() to propagate the error up via errp in sifive_plic_realize()
      hw/intc: sifive_plic: Update "num-sources" property default value
      hw/riscv: microchip_pfsoc: Fix the number of interrupt sources of PLIC
      hw/riscv: sifive_e: Fix the number of interrupt sources of PLIC
      hw/riscv: sifive_u: Avoid using magic number for "riscv, ndev"
      hw/riscv: virt: Fix the value of "riscv, ndev" in the dtb
      hw/intc: sifive_plic: Change "priority-base" to start from interrupt source 0
      hw/riscv: opentitan: Drop "hartid-base" and "priority-base" initialization
      hw/intc: sifive_plic: Fix the pending register range check

Christoph Muellner (1):
      RISC-V: Add Zawrs ISA extension support

Conor Dooley (3):
      hw/misc: pfsoc: add fabric clocks to ioscb
      hw/riscv: pfsoc: add missing FICs as unimplemented
      hw/{misc, riscv}: pfsoc: add system controller as unimplemented

Frédéric Pétrot (1):
      hw/intc: sifive_plic: Renumber the S irqs for numa support

Jim Shu (2):
      target/riscv: support cache-related PMU events in virtual mode
      hw/intc: sifive_plic: fix out-of-bound access of source_priority array

LIU Zhiwei (5):
      target/riscv: Fix PMP propagation for tlb
      target/riscv: Add itrigger support when icount is not enabled
      target/riscv: Add itrigger support when icount is enabled
      target/riscv: Enable native debug itrigger
      target/riscv: Add itrigger_enabled field to CPURISCVState

Mayuresh Chitale (3):
      target/riscv: Add smstateen support
      target/riscv: smstateen check for h/s/envcfg
      target/riscv: generate virtual instruction exception

Richard Henderson (4):
      tcg/riscv: Fix range matched by TCG_CT_CONST_M12
      tcg/riscv: Fix reg overlap case in tcg_out_addsub2
      tcg/riscv: Fix base register for user-only qemu_ld/st
      target/riscv: Set pc_succ_insn for !rvc illegal insn

Wilfred Mallawa (4):
      hw/registerfields: add `FIELDx_1CLEAR()` macro
      hw/ssi/ibex_spi: implement `FIELD32_1CLEAR` macro
      hw/riscv/opentitan: bump opentitan
      hw/riscv/opentitan: add aon_timer base unimpl

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Only the pmp index that be checked by pmp_hart_has_privs can be used
by pmp_get_tlb_size to avoid an error pmp index.

Before modification, we may use an error pmp index. For example,
we check address 0x4fc, and the size 0x4 in pmp_hart_has_privs. If there
is an pmp rule, valid range is [0x4fc, 0x500), then pmp_hart_has_privs
will return true;

However, this checked pmp index is discarded as pmp_hart_has_privs
return bool value. In pmp_is_range_in_tlb, it will traverse all pmp
rules. The tlb_sa will be 0x0, and tlb_ea will be 0xfff. If there is
a pmp rule [0x10, 0x14), it will be misused as it is legal in
pmp_get_tlb_size.

As we have already known the correct pmp index, just remove the
remove the pmp_is_range_in_tlb and get tlb size directly from
pmp_get_tlb_size.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221012060016.30856-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.h        |  6 +--
 target/riscv/cpu_helper.c | 16 ++++---
 target/riscv/pmp.c        | 90 +++++++++++++--------------------------
 3 files changed, 42 insertions(+), 70 deletions(-)

diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.h
+++ b/target/riscv/pmp.h
@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env);
 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
     target_ulong val);
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
-bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
     target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
     target_ulong mode);
-bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
-                         target_ulong *tlb_size);
+target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
+                              target_ulong tlb_sa, target_ulong tlb_ea);
 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index);
 void pmp_update_rule_nums(CPURISCVState *env);
 uint32_t pmp_get_num_rules(CPURISCVState *env);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address_pmp(CPURISCVState *env, int *prot,
                                     int mode)
 {
     pmp_priv_t pmp_priv;
-    target_ulong tlb_size_pmp = 0;
+    int pmp_index = -1;
 
     if (!riscv_feature(env, RISCV_FEATURE_PMP)) {
         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
         return TRANSLATE_SUCCESS;
     }
 
-    if (!pmp_hart_has_privs(env, addr, size, 1 << access_type, &pmp_priv,
-                            mode)) {
+    pmp_index = pmp_hart_has_privs(env, addr, size, 1 << access_type,
+                                   &pmp_priv, mode);
+    if (pmp_index < 0) {
         *prot = 0;
         return TRANSLATE_PMP_FAIL;
     }
 
     *prot = pmp_priv_to_page_prot(pmp_priv);
-    if (tlb_size != NULL) {
-        if (pmp_is_range_in_tlb(env, addr & ~(*tlb_size - 1), &tlb_size_pmp)) {
-            *tlb_size = tlb_size_pmp;
-        }
+    if ((tlb_size != NULL) && pmp_index != MAX_RISCV_PMPS) {
+        target_ulong tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
+        target_ulong tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
+
+        *tlb_size = pmp_get_tlb_size(env, pmp_index, tlb_sa, tlb_ea);
     }
 
     return TRANSLATE_SUCCESS;
diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
 
 /*
  * Check if the address has required RWX privs to complete desired operation
+ * Return PMP rule index if a pmp rule match
+ * Return MAX_RISCV_PMPS if default match
+ * Return negtive value if no match
  */
-bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
+int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
     target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
     target_ulong mode)
 {
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
 
     /* Short cut if no rules */
     if (0 == pmp_get_num_rules(env)) {
-        return pmp_hart_has_privs_default(env, addr, size, privs,
-                                          allowed_privs, mode);
+        if (pmp_hart_has_privs_default(env, addr, size, privs,
+                                       allowed_privs, mode)) {
+            ret = MAX_RISCV_PMPS;
+        }
     }
 
     if (size == 0) {
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
         if ((s + e) == 1) {
             qemu_log_mask(LOG_GUEST_ERROR,
                           "pmp violation - access is partially inside\n");
-            ret = 0;
+            ret = -1;
             break;
         }
 
@@ -XXX,XX +XXX,XX @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
                 }
             }
 
-            ret = ((privs & *allowed_privs) == privs);
+            if ((privs & *allowed_privs) == privs) {
+                ret = i;
+            }
             break;
         }
     }
 
     /* No rule matched */
     if (ret == -1) {
-        return pmp_hart_has_privs_default(env, addr, size, privs,
-                                          allowed_privs, mode);
+        if (pmp_hart_has_privs_default(env, addr, size, privs,
+                                       allowed_privs, mode)) {
+            ret = MAX_RISCV_PMPS;
+        }
     }
 
-    return ret == 1 ? true : false;
+    return ret;
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ target_ulong mseccfg_csr_read(CPURISCVState *env)
  * Calculate the TLB size if the start address or the end address of
  * PMP entry is presented in the TLB page.
  */
-static target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
-                                     target_ulong tlb_sa, target_ulong tlb_ea)
+target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
+                              target_ulong tlb_sa, target_ulong tlb_ea)
 {
     target_ulong pmp_sa = env->pmp_state.addr[pmp_index].sa;
     target_ulong pmp_ea = env->pmp_state.addr[pmp_index].ea;
 
-    if (pmp_sa >= tlb_sa && pmp_ea <= tlb_ea) {
-        return pmp_ea - pmp_sa + 1;
-    }
-
-    if (pmp_sa >= tlb_sa && pmp_sa <= tlb_ea && pmp_ea >= tlb_ea) {
-        return tlb_ea - pmp_sa + 1;
-    }
-
-    if (pmp_ea <= tlb_ea && pmp_ea >= tlb_sa && pmp_sa <= tlb_sa) {
-        return pmp_ea - tlb_sa + 1;
-    }
-
-    return 0;
-}
-
-/*
- * Check is there a PMP entry which range covers this page. If so,
- * try to find the minimum granularity for the TLB size.
- */
-bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
-                         target_ulong *tlb_size)
-{
-    int i;
-    target_ulong val;
-    target_ulong tlb_ea = (tlb_sa + TARGET_PAGE_SIZE - 1);
-
-    for (i = 0; i < MAX_RISCV_PMPS; i++) {
-        val = pmp_get_tlb_size(env, i, tlb_sa, tlb_ea);
-        if (val) {
-            if (*tlb_size == 0 || *tlb_size > val) {
-                *tlb_size = val;
-            }
-        }
-    }
-
-    if (*tlb_size != 0) {
+    if (pmp_sa <= tlb_sa && pmp_ea >= tlb_ea) {
+        return TARGET_PAGE_SIZE;
+    } else {
         /*
-         * At this point we have a tlb_size that is the smallest possible size
-         * That fits within a TARGET_PAGE_SIZE and the PMP region.
-         *
-         * If the size is less then TARGET_PAGE_SIZE we drop the size to 1.
-         * This means the result isn't cached in the TLB and is only used for
-         * a single translation.
-         */
-        if (*tlb_size < TARGET_PAGE_SIZE) {
-            *tlb_size = 1;
-        }
-
-        return true;
+        * At this point we have a tlb_size that is the smallest possible size
+        * That fits within a TARGET_PAGE_SIZE and the PMP region.
+        *
+        * If the size is less then TARGET_PAGE_SIZE we drop the size to 1.
+        * This means the result isn't cached in the TLB and is only used for
+        * a single translation.
+        */
+        return 1;
     }
-
-    return false;
 }
 
 /*
-- 
2.38.1

From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

Adds a helper macro that implements the register `w1c`
functionality.

Ex:
  uint32_t data = FIELD32_1CLEAR(val, REG, FIELD);

If ANY bits of the specified `FIELD` is set
then the respective field is cleared and returned to `data`.

If the field is cleared (0), then no change and
val is returned.

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221017054950.317584-2-wilfred.mallawa@opensource.wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/registerfields.h | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/include/hw/registerfields.h b/include/hw/registerfields.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/registerfields.h
+++ b/include/hw/registerfields.h
@@ -XXX,XX +XXX,XX @@
                   R_ ## reg ## _ ## field ## _LENGTH, _v.v);              \
     _d; })
 
+/*
+ * Clear the specified field in storage if
+ * any field bits are set, else no changes made. Implements
+ * single/multi-bit `w1c`
+ *
+ */
+#define FIELD8_1CLEAR(storage, reg, field)                                \
+    (FIELD_EX8(storage, reg, field) ?                                     \
+    FIELD_DP8(storage, reg, field, 0x00) : storage)
+
+#define FIELD16_1CLEAR(storage, reg, field)                               \
+    (FIELD_EX16(storage, reg, field) ?                                    \
+    FIELD_DP16(storage, reg, field, 0x00) : storage)
+
+#define FIELD32_1CLEAR(storage, reg, field)                               \
+    (FIELD_EX32(storage, reg, field) ?                                    \
+    FIELD_DP32(storage, reg, field, 0x00) : storage)
+
+#define FIELD64_1CLEAR(storage, reg, field)                               \
+    (FIELD_EX64(storage, reg, field) ?                                    \
+    FIELD_DP64(storage, reg, field, 0x00) : storage)
+
 #define FIELD_SDP8(storage, reg, field, val) ({                           \
     struct {                                                              \
         signed int v:R_ ## reg ## _ ## field ## _LENGTH;                  \
-- 
2.38.1

From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

use the `FIELD32_1CLEAR` macro to implement register
`rw1c` functionality to `ibex_spi`.

This change was tested by running the `SPI_HOST` from TockOS.

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221017054950.317584-3-wilfred.mallawa@opensource.wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/ssi/ibex_spi_host.c | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/hw/ssi/ibex_spi_host.c b/hw/ssi/ibex_spi_host.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/ibex_spi_host.c
+++ b/hw/ssi/ibex_spi_host.c
@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_write(void *opaque, hwaddr addr,
 {
     IbexSPIHostState *s = opaque;
     uint32_t val32 = val64;
-    uint32_t shift_mask = 0xff, status = 0, data = 0;
+    uint32_t shift_mask = 0xff, status = 0;
     uint8_t txqd_len;
 
     trace_ibex_spi_host_write(addr, size, val64);
@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_write(void *opaque, hwaddr addr,
     case IBEX_SPI_HOST_INTR_STATE:
         /* rw1c status register */
         if (FIELD_EX32(val32, INTR_STATE, ERROR)) {
-            data = FIELD_DP32(data, INTR_STATE, ERROR, 0);
+            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], INTR_STATE, ERROR);
         }
         if (FIELD_EX32(val32, INTR_STATE, SPI_EVENT)) {
-            data = FIELD_DP32(data, INTR_STATE, SPI_EVENT, 0);
+            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], INTR_STATE, SPI_EVENT);
         }
-        s->regs[addr] = data;
         break;
     case IBEX_SPI_HOST_INTR_ENABLE:
         s->regs[addr] = val32;
@@ -XXX,XX +XXX,XX @@ static void ibex_spi_host_write(void *opaque, hwaddr addr,
      *  When an error occurs, the corresponding bit must be cleared
      *  here before issuing any further commands
      */
-        status = s->regs[addr];
         /* rw1c status register */
         if (FIELD_EX32(val32, ERROR_STATUS, CMDBUSY)) {
-            status = FIELD_DP32(status, ERROR_STATUS, CMDBUSY, 0);
+            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, CMDBUSY);
         }
         if (FIELD_EX32(val32, ERROR_STATUS, OVERFLOW)) {
-            status = FIELD_DP32(status, ERROR_STATUS, OVERFLOW, 0);
+            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, OVERFLOW);
         }
         if (FIELD_EX32(val32, ERROR_STATUS, UNDERFLOW)) {
-            status = FIELD_DP32(status, ERROR_STATUS, UNDERFLOW, 0);
+            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, UNDERFLOW);
         }
         if (FIELD_EX32(val32, ERROR_STATUS, CMDINVAL)) {
-            status = FIELD_DP32(status, ERROR_STATUS, CMDINVAL, 0);
+            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, CMDINVAL);
         }
         if (FIELD_EX32(val32, ERROR_STATUS, CSIDINVAL)) {
-            status = FIELD_DP32(status, ERROR_STATUS, CSIDINVAL, 0);
+            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, CSIDINVAL);
         }
         if (FIELD_EX32(val32, ERROR_STATUS, ACCESSINVAL)) {
-            status = FIELD_DP32(status, ERROR_STATUS, ACCESSINVAL, 0);
+            s->regs[addr] = FIELD32_1CLEAR(s->regs[addr], ERROR_STATUS, ACCESSINVAL);
         }
-        s->regs[addr] = status;
         break;
     case IBEX_SPI_HOST_EVENT_ENABLE:
     /* Controls which classes of SPI events raise an interrupt. */
-- 
2.38.1

From: Richard Henderson <richard.henderson@linaro.org>

We were matching a signed 13-bit range, not a 12-bit range.
Expand the commentary within the function and be explicit
about all of the ranges.

Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221022095821.2441874-1-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tcg/riscv/tcg-target.c.inc | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static bool tcg_target_const_match(int64_t val, TCGType type, int ct)
     if ((ct & TCG_CT_CONST_ZERO) && val == 0) {
         return 1;
     }
-    if ((ct & TCG_CT_CONST_S12) && val == sextreg(val, 0, 12)) {
+    /*
+     * Sign extended from 12 bits: [-0x800, 0x7ff].
+     * Used for most arithmetic, as this is the isa field.
+     */
+    if ((ct & TCG_CT_CONST_S12) && val >= -0x800 && val <= 0x7ff) {
         return 1;
     }
-    if ((ct & TCG_CT_CONST_N12) && -val == sextreg(-val, 0, 12)) {
+    /*
+     * Sign extended from 12 bits, negated: [-0x7ff, 0x800].
+     * Used for subtraction, where a constant must be handled by ADDI.
+     */
+    if ((ct & TCG_CT_CONST_N12) && val >= -0x7ff && val <= 0x800) {
         return 1;
     }
-    if ((ct & TCG_CT_CONST_M12) && val >= -0xfff && val <= 0xfff) {
+    /*
+     * Sign extended from 12 bits, +/- matching: [-0x7ff, 0x7ff].
+     * Used by addsub2, which may need the negative operation,
+     * and requires the modified constant to be representable.
+     */
+    if ((ct & TCG_CT_CONST_M12) && val >= -0x7ff && val <= 0x7ff) {
         return 1;
     }
     return 0;
-- 
2.38.1

From: Richard Henderson <richard.henderson@linaro.org>

There was a typo using opc_addi instead of opc_add with the
two registers.  While we're at it, simplify the gating test
to al == bl to improve dynamic scheduling even when the
output register does not overlap the inputs.

Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221020233836.2341671-1-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tcg/riscv/tcg-target.c.inc | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_addsub2(TCGContext *s,
         if (cbl) {
             tcg_out_opc_imm(s, opc_addi, rl, al, bl);
             tcg_out_opc_imm(s, OPC_SLTIU, TCG_REG_TMP0, rl, bl);
-        } else if (rl == al && rl == bl) {
+        } else if (al == bl) {
+            /*
+             * If the input regs overlap, this is a simple doubling
+             * and carry-out is the input msb.  This special case is
+             * required when the output reg overlaps the input,
+             * but we might as well use it always.
+             */
             tcg_out_opc_imm(s, OPC_SLTI, TCG_REG_TMP0, al, 0);
-            tcg_out_opc_reg(s, opc_addi, rl, al, bl);
+            tcg_out_opc_reg(s, opc_add, rl, al, al);
         } else {
             tcg_out_opc_reg(s, opc_add, rl, al, bl);
             tcg_out_opc_reg(s, OPC_SLTU, TCG_REG_TMP0,
-- 
2.38.1

From: Richard Henderson <richard.henderson@linaro.org>

When guest_base != 0, we were not coordinating the usage of
TCG_REG_TMP0 as base properly, leading to a previous zero-extend
of the input address being discarded.

Shuffle the alignment check to the front, because that does not
depend on the zero-extend, and it keeps the register usage clear.
Set base after each step of the address arithmetic instead of before.

Return the base register used from tcg_out_tlb_load, so as to
keep that register choice localized to that function.

Reported-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221023233337.2846860-1-richard.henderson@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 tcg/riscv/tcg-target.c.inc | 39 +++++++++++++++++++++-----------------
 1 file changed, 22 insertions(+), 17 deletions(-)

diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -XXX,XX +XXX,XX @@ static void tcg_out_goto(TCGContext *s, const tcg_insn_unit *target)
     tcg_debug_assert(ok);
 }
 
-static void tcg_out_tlb_load(TCGContext *s, TCGReg addrl,
-                             TCGReg addrh, MemOpIdx oi,
-                             tcg_insn_unit **label_ptr, bool is_load)
+static TCGReg tcg_out_tlb_load(TCGContext *s, TCGReg addrl,
+                               TCGReg addrh, MemOpIdx oi,
+                               tcg_insn_unit **label_ptr, bool is_load)
 {
     MemOp opc = get_memop(oi);
     unsigned s_bits = opc & MO_SIZE;
@@ -XXX,XX +XXX,XX @@ static void tcg_out_tlb_load(TCGContext *s, TCGReg addrl,
         addrl = TCG_REG_TMP0;
     }
     tcg_out_opc_reg(s, OPC_ADD, TCG_REG_TMP0, TCG_REG_TMP2, addrl);
+    return TCG_REG_TMP0;
 }
 
 static void add_qemu_ldst_label(TCGContext *s, int is_ld, MemOpIdx oi,
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
 #else
     unsigned a_bits;
 #endif
-    TCGReg base = TCG_REG_TMP0;
+    TCGReg base;
 
     data_regl = *args++;
     data_regh = (TCG_TARGET_REG_BITS == 32 && is_64 ? *args++ : 0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, bool is_64)
     opc = get_memop(oi);
 
 #if defined(CONFIG_SOFTMMU)
-    tcg_out_tlb_load(s, addr_regl, addr_regh, oi, label_ptr, 1);
+    base = tcg_out_tlb_load(s, addr_regl, addr_regh, oi, label_ptr, 1);
     tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
     add_qemu_ldst_label(s, 1, oi,
                         (is_64 ? TCG_TYPE_I64 : TCG_TYPE_I32),
                         data_regl, data_regh, addr_regl, addr_regh,
                         s->code_ptr, label_ptr);
 #else
-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
-        tcg_out_ext32u(s, base, addr_regl);
-        addr_regl = base;
-    }
     a_bits = get_alignment_bits(opc);
     if (a_bits) {
         tcg_out_test_alignment(s, true, addr_regl, a_bits);
     }
+    base = addr_regl;
+    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+        tcg_out_ext32u(s, TCG_REG_TMP0, base);
+        base = TCG_REG_TMP0;
+    }
     if (guest_base != 0) {
-        tcg_out_opc_reg(s, OPC_ADD, base, TCG_GUEST_BASE_REG, addr_regl);
+        tcg_out_opc_reg(s, OPC_ADD, TCG_REG_TMP0, TCG_GUEST_BASE_REG, base);
+        base = TCG_REG_TMP0;
     }
     tcg_out_qemu_ld_direct(s, data_regl, data_regh, base, opc, is_64);
 #endif
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
 #else
     unsigned a_bits;
 #endif
-    TCGReg base = TCG_REG_TMP0;
+    TCGReg base;
 
     data_regl = *args++;
     data_regh = (TCG_TARGET_REG_BITS == 32 && is_64 ? *args++ : 0);
@@ -XXX,XX +XXX,XX @@ static void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, bool is_64)
     opc = get_memop(oi);
 
 #if defined(CONFIG_SOFTMMU)
-    tcg_out_tlb_load(s, addr_regl, addr_regh, oi, label_ptr, 0);
+    base = tcg_out_tlb_load(s, addr_regl, addr_regh, oi, label_ptr, 0);
     tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
     add_qemu_ldst_label(s, 0, oi,
                         (is_64 ? TCG_TYPE_I64 : TCG_TYPE_I32),
                         data_regl, data_regh, addr_regl, addr_regh,
                         s->code_ptr, label_ptr);
 #else
-    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
-        tcg_out_ext32u(s, base, addr_regl);
-        addr_regl = base;
-    }
     a_bits = get_alignment_bits(opc);
     if (a_bits) {
         tcg_out_test_alignment(s, false, addr_regl, a_bits);
     }
+    base = addr_regl;
+    if (TCG_TARGET_REG_BITS > TARGET_LONG_BITS) {
+        tcg_out_ext32u(s, TCG_REG_TMP0, base);
+        base = TCG_REG_TMP0;
+    }
     if (guest_base != 0) {
-        tcg_out_opc_reg(s, OPC_ADD, base, TCG_GUEST_BASE_REG, addr_regl);
+        tcg_out_opc_reg(s, OPC_ADD, TCG_REG_TMP0, TCG_GUEST_BASE_REG, base);
+        base = TCG_REG_TMP0;
     }
     tcg_out_qemu_st_direct(s, data_regl, data_regh, base, opc);
 #endif
-- 
2.38.1

From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

This patch updates the OpenTitan model to match
the specified register layout as per [1]. Which is also the latest
commit of OpenTitan supported by TockOS.

Note: Pinmux and Padctrl has been merged into Pinmux [2][3], this patch removes
any references to Padctrl. Note: OpenTitan doc [2] has not yet specified
much detail regarding this, except for a note that states `TODO: this
section needs to be updated to reflect the pinmux/padctrl merger`

[1] https://github.com/lowRISC/opentitan/blob/d072ac505f82152678d6e04be95c72b728a347b8/hw/top_earlgrey/sw/autogen/top_earlgrey_memory.h
[2] https://docs.opentitan.org/hw/top_earlgrey/doc/design/
[3] https://docs.opentitan.org/hw/ip/pinmux/doc/#overview

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20221025043335.339815-2-wilfred.mallawa@opensource.wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/opentitan.h |  9 ++++-----
 hw/riscv/opentitan.c         | 21 +++++++++++++--------
 2 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/include/hw/riscv/opentitan.h b/include/hw/riscv/opentitan.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/opentitan.h
+++ b/include/hw/riscv/opentitan.h
@@ -XXX,XX +XXX,XX @@ enum {
     IBEX_DEV_RSTMGR,
     IBEX_DEV_CLKMGR,
     IBEX_DEV_PINMUX,
-    IBEX_DEV_PADCTRL,
     IBEX_DEV_USBDEV,
     IBEX_DEV_FLASH_CTRL,
     IBEX_DEV_PLIC,
@@ -XXX,XX +XXX,XX @@ enum {
     IBEX_UART0_RX_TIMEOUT_IRQ     = 7,
     IBEX_UART0_RX_PARITY_ERR_IRQ  = 8,
     IBEX_TIMER_TIMEREXPIRED0_0    = 127,
-    IBEX_SPI_HOST0_ERR_IRQ        = 151,
-    IBEX_SPI_HOST0_SPI_EVENT_IRQ  = 152,
-    IBEX_SPI_HOST1_ERR_IRQ        = 153,
-    IBEX_SPI_HOST1_SPI_EVENT_IRQ  = 154,
+    IBEX_SPI_HOST0_ERR_IRQ        = 134,
+    IBEX_SPI_HOST0_SPI_EVENT_IRQ  = 135,
+    IBEX_SPI_HOST1_ERR_IRQ        = 136,
+    IBEX_SPI_HOST1_SPI_EVENT_IRQ  = 137,
 };
 
 #endif
diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/units.h"
 #include "sysemu/sysemu.h"
 
+/*
+ * This version of the OpenTitan machine currently supports
+ * OpenTitan RTL version:
+ * <lowRISC/opentitan@d072ac505f82152678d6e04be95c72b728a347b8>
+ *
+ * MMIO mapping as per (specified commit):
+ * lowRISC/opentitan: hw/top_earlgrey/sw/autogen/top_earlgrey_memory.h
+ */
 static const MemMapEntry ibex_memmap[] = {
-    [IBEX_DEV_ROM] =            {  0x00008000,   0x8000 },
+    [IBEX_DEV_ROM] =            {  0x00008000,  0x8000 },
     [IBEX_DEV_RAM] =            {  0x10000000,  0x20000 },
     [IBEX_DEV_FLASH] =          {  0x20000000,  0x100000 },
     [IBEX_DEV_UART] =           {  0x40000000,  0x1000  },
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry ibex_memmap[] = {
     [IBEX_DEV_I2C] =            {  0x40080000,  0x1000  },
     [IBEX_DEV_PATTGEN] =        {  0x400e0000,  0x1000  },
     [IBEX_DEV_TIMER] =          {  0x40100000,  0x1000  },
-    [IBEX_DEV_SENSOR_CTRL] =    {  0x40110000,  0x1000  },
     [IBEX_DEV_OTP_CTRL] =       {  0x40130000,  0x4000  },
     [IBEX_DEV_LC_CTRL] =        {  0x40140000,  0x1000  },
-    [IBEX_DEV_USBDEV] =         {  0x40150000,  0x1000  },
+    [IBEX_DEV_ALERT_HANDLER] =  {  0x40150000,  0x1000  },
     [IBEX_DEV_SPI_HOST0] =      {  0x40300000,  0x1000  },
     [IBEX_DEV_SPI_HOST1] =      {  0x40310000,  0x1000  },
+    [IBEX_DEV_USBDEV] =         {  0x40320000,  0x1000  },
     [IBEX_DEV_PWRMGR] =         {  0x40400000,  0x1000  },
     [IBEX_DEV_RSTMGR] =         {  0x40410000,  0x1000  },
     [IBEX_DEV_CLKMGR] =         {  0x40420000,  0x1000  },
     [IBEX_DEV_PINMUX] =         {  0x40460000,  0x1000  },
-    [IBEX_DEV_PADCTRL] =        {  0x40470000,  0x1000  },
+    [IBEX_DEV_SENSOR_CTRL] =    {  0x40490000,  0x1000  },
     [IBEX_DEV_FLASH_CTRL] =     {  0x41000000,  0x1000  },
     [IBEX_DEV_AES] =            {  0x41100000,  0x1000  },
     [IBEX_DEV_HMAC] =           {  0x41110000,  0x1000  },
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry ibex_memmap[] = {
     [IBEX_DEV_ENTROPY] =        {  0x41160000,  0x1000  },
     [IBEX_DEV_EDNO] =           {  0x41170000,  0x1000  },
     [IBEX_DEV_EDN1] =           {  0x41180000,  0x1000  },
-    [IBEX_DEV_ALERT_HANDLER] =  {  0x411b0000,  0x1000  },
     [IBEX_DEV_NMI_GEN] =        {  0x411c0000,  0x1000  },
     [IBEX_DEV_PERI] =           {  0x411f0000,  0x10000 },
-    [IBEX_DEV_PLIC] =           {  0x48000000,  0x4005000  },
+    [IBEX_DEV_PLIC] =           {  0x48000000,  0x4005000 },
     [IBEX_DEV_FLASH_VIRTUAL] =  {  0x80000000,  0x80000 },
 };
 
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
         memmap[IBEX_DEV_CLKMGR].base, memmap[IBEX_DEV_CLKMGR].size);
     create_unimplemented_device("riscv.lowrisc.ibex.pinmux",
         memmap[IBEX_DEV_PINMUX].base, memmap[IBEX_DEV_PINMUX].size);
-    create_unimplemented_device("riscv.lowrisc.ibex.padctrl",
-        memmap[IBEX_DEV_PADCTRL].base, memmap[IBEX_DEV_PADCTRL].size);
     create_unimplemented_device("riscv.lowrisc.ibex.usbdev",
         memmap[IBEX_DEV_USBDEV].base, memmap[IBEX_DEV_USBDEV].size);
     create_unimplemented_device("riscv.lowrisc.ibex.flash_ctrl",
-- 
2.38.1

From: Wilfred Mallawa <wilfred.mallawa@wdc.com>

Adds the updated `aon_timer` base as an unimplemented device. This is
used by TockOS, patch ensures the guest doesn't hit load faults.

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221025043335.339815-3-wilfred.mallawa@opensource.wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/opentitan.h | 1 +
 hw/riscv/opentitan.c         | 3 +++
 2 files changed, 4 insertions(+)

From: Mayuresh Chitale <mchitale@ventanamicro.com>

Smstateen extension specifies a mechanism to close
the potential covert channels that could cause security issues.

This patch adds the CSRs defined in the specification and
the corresponding predicates and read/write functions.

Signed-off-by: Mayuresh Chitale <mchitale@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221016124726.102129-2-mchitale@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h      |   4 +
 target/riscv/cpu_bits.h |  37 +++++
 target/riscv/csr.c      | 316 ++++++++++++++++++++++++++++++++++++++++
 target/riscv/machine.c  |  21 +++
 4 files changed, 378 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
 
     /* CSRs for execution enviornment configuration */
     uint64_t menvcfg;
+    uint64_t mstateen[SMSTATEEN_MAX_COUNT];
+    uint64_t hstateen[SMSTATEEN_MAX_COUNT];
+    uint64_t sstateen[SMSTATEEN_MAX_COUNT];
     target_ulong senvcfg;
     uint64_t henvcfg;
 #endif
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_ifencei;
     bool ext_icsr;
     bool ext_zihintpause;
+    bool ext_smstateen;
     bool ext_sstc;
     bool ext_svinval;
     bool ext_svnapot;
diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@
 /* Supervisor Configuration CSRs */
 #define CSR_SENVCFG         0x10A
 
+/* Supervisor state CSRs */
+#define CSR_SSTATEEN0       0x10C
+#define CSR_SSTATEEN1       0x10D
+#define CSR_SSTATEEN2       0x10E
+#define CSR_SSTATEEN3       0x10F
+
 /* Supervisor Trap Handling */
 #define CSR_SSCRATCH        0x140
 #define CSR_SEPC            0x141
@@ -XXX,XX +XXX,XX @@
 #define CSR_HENVCFG         0x60A
 #define CSR_HENVCFGH        0x61A
 
+/* Hypervisor state CSRs */
+#define CSR_HSTATEEN0       0x60C
+#define CSR_HSTATEEN0H      0x61C
+#define CSR_HSTATEEN1       0x60D
+#define CSR_HSTATEEN1H      0x61D
+#define CSR_HSTATEEN2       0x60E
+#define CSR_HSTATEEN2H      0x61E
+#define CSR_HSTATEEN3       0x60F
+#define CSR_HSTATEEN3H      0x61F
+
 /* Virtual CSRs */
 #define CSR_VSSTATUS        0x200
 #define CSR_VSIE            0x204
@@ -XXX,XX +XXX,XX @@
 #define CSR_MENVCFG         0x30A
 #define CSR_MENVCFGH        0x31A
 
+/* Machine state CSRs */
+#define CSR_MSTATEEN0       0x30C
+#define CSR_MSTATEEN0H      0x31C
+#define CSR_MSTATEEN1       0x30D
+#define CSR_MSTATEEN1H      0x31D
+#define CSR_MSTATEEN2       0x30E
+#define CSR_MSTATEEN2H      0x31E
+#define CSR_MSTATEEN3       0x30F
+#define CSR_MSTATEEN3H      0x31F
+
+/* Common defines for all smstateen */
+#define SMSTATEEN_MAX_COUNT 4
+#define SMSTATEEN0_CS       (1ULL << 0)
+#define SMSTATEEN0_FCSR     (1ULL << 1)
+#define SMSTATEEN0_HSCONTXT (1ULL << 57)
+#define SMSTATEEN0_IMSIC    (1ULL << 58)
+#define SMSTATEEN0_AIA      (1ULL << 59)
+#define SMSTATEEN0_SVSLCT   (1ULL << 60)
+#define SMSTATEEN0_HSENVCFG (1ULL << 62)
+#define SMSTATEEN_STATEEN   (1ULL << 63)
+
 /* Enhanced Physical Memory Protection (ePMP) */
 #define CSR_MSECCFG         0x747
 #define CSR_MSECCFGH        0x757
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException umode32(CPURISCVState *env, int csrno)
     return umode(env, csrno);
 }
 
+static RISCVException mstateen(CPURISCVState *env, int csrno)
+{
+    CPUState *cs = env_cpu(env);
+    RISCVCPU *cpu = RISCV_CPU(cs);
+
+    if (!cpu->cfg.ext_smstateen) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    return any(env, csrno);
+}
+
+static RISCVException hstateen_pred(CPURISCVState *env, int csrno, int base)
+{
+    CPUState *cs = env_cpu(env);
+    RISCVCPU *cpu = RISCV_CPU(cs);
+
+    if (!cpu->cfg.ext_smstateen) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    if (env->priv < PRV_M) {
+        if (!(env->mstateen[csrno - base] & SMSTATEEN_STATEEN)) {
+            return RISCV_EXCP_ILLEGAL_INST;
+        }
+    }
+
+    return hmode(env, csrno);
+}
+
+static RISCVException hstateen(CPURISCVState *env, int csrno)
+{
+    return hstateen_pred(env, csrno, CSR_HSTATEEN0);
+}
+
+static RISCVException hstateenh(CPURISCVState *env, int csrno)
+{
+    return hstateen_pred(env, csrno, CSR_HSTATEEN0H);
+}
+
+static RISCVException sstateen(CPURISCVState *env, int csrno)
+{
+    bool virt = riscv_cpu_virt_enabled(env);
+    int index = csrno - CSR_SSTATEEN0;
+    CPUState *cs = env_cpu(env);
+    RISCVCPU *cpu = RISCV_CPU(cs);
+
+    if (!cpu->cfg.ext_smstateen) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    if (env->priv < PRV_M) {
+        if (!(env->mstateen[index] & SMSTATEEN_STATEEN)) {
+            return RISCV_EXCP_ILLEGAL_INST;
+        }
+
+        if (virt) {
+            if (!(env->hstateen[index] & SMSTATEEN_STATEEN)) {
+                return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+            }
+        }
+    }
+
+    return smode(env, csrno);
+}
+
 /* Checks if PointerMasking registers could be accessed */
 static RISCVException pointer_masking(CPURISCVState *env, int csrno)
 {
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
+static RISCVException read_mstateen(CPURISCVState *env, int csrno,
+                                    target_ulong *val)
+{
+    *val = env->mstateen[csrno - CSR_MSTATEEN0];
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_mstateen(CPURISCVState *env, int csrno,
+                                     uint64_t wr_mask, target_ulong new_val)
+{
+    uint64_t *reg;
+
+    reg = &env->mstateen[csrno - CSR_MSTATEEN0];
+    *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
+                                      target_ulong new_val)
+{
+    uint64_t wr_mask = SMSTATEEN_STATEEN;
+
+    return write_mstateen(env, csrno, wr_mask, new_val);
+}
+
+static RISCVException write_mstateen_1_3(CPURISCVState *env, int csrno,
+                                      target_ulong new_val)
+{
+    return write_mstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
+}
+
+static RISCVException read_mstateenh(CPURISCVState *env, int csrno,
+                                      target_ulong *val)
+{
+    *val = env->mstateen[csrno - CSR_MSTATEEN0H] >> 32;
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
+                                      uint64_t wr_mask, target_ulong new_val)
+{
+    uint64_t *reg, val;
+
+    reg = &env->mstateen[csrno - CSR_MSTATEEN0H];
+    val = (uint64_t)new_val << 32;
+    val |= *reg & 0xFFFFFFFF;
+    *reg = (*reg & ~wr_mask) | (val & wr_mask);
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
+                                      target_ulong new_val)
+{
+    uint64_t wr_mask = SMSTATEEN_STATEEN;
+
+    return write_mstateenh(env, csrno, wr_mask, new_val);
+}
+
+static RISCVException write_mstateenh_1_3(CPURISCVState *env, int csrno,
+                                      target_ulong new_val)
+{
+    return write_mstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
+}
+
+static RISCVException read_hstateen(CPURISCVState *env, int csrno,
+                                    target_ulong *val)
+{
+    int index = csrno - CSR_HSTATEEN0;
+
+    *val = env->hstateen[index] & env->mstateen[index];
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_hstateen(CPURISCVState *env, int csrno,
+                                     uint64_t mask, target_ulong new_val)
+{
+    int index = csrno - CSR_HSTATEEN0;
+    uint64_t *reg, wr_mask;
+
+    reg = &env->hstateen[index];
+    wr_mask = env->mstateen[index] & mask;
+    *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
+                                      target_ulong new_val)
+{
+    uint64_t wr_mask = SMSTATEEN_STATEEN;
+
+    return write_hstateen(env, csrno, wr_mask, new_val);
+}
+
+static RISCVException write_hstateen_1_3(CPURISCVState *env, int csrno,
+                                      target_ulong new_val)
+{
+    return write_hstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
+}
+
+static RISCVException read_hstateenh(CPURISCVState *env, int csrno,
+                                     target_ulong *val)
+{
+    int index = csrno - CSR_HSTATEEN0H;
+
+    *val = (env->hstateen[index] >> 32) & (env->mstateen[index] >> 32);
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
+                                      uint64_t mask, target_ulong new_val)
+{
+    int index = csrno - CSR_HSTATEEN0H;
+    uint64_t *reg, wr_mask, val;
+
+    reg = &env->hstateen[index];
+    val = (uint64_t)new_val << 32;
+    val |= *reg & 0xFFFFFFFF;
+    wr_mask = env->mstateen[index] & mask;
+    *reg = (*reg & ~wr_mask) | (val & wr_mask);
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
+                                       target_ulong new_val)
+{
+    uint64_t wr_mask = SMSTATEEN_STATEEN;
+
+    return write_hstateenh(env, csrno, wr_mask, new_val);
+}
+
+static RISCVException write_hstateenh_1_3(CPURISCVState *env, int csrno,
+                                       target_ulong new_val)
+{
+    return write_hstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
+}
+
+static RISCVException read_sstateen(CPURISCVState *env, int csrno,
+                                    target_ulong *val)
+{
+    bool virt = riscv_cpu_virt_enabled(env);
+    int index = csrno - CSR_SSTATEEN0;
+
+    *val = env->sstateen[index] & env->mstateen[index];
+    if (virt) {
+        *val &= env->hstateen[index];
+    }
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_sstateen(CPURISCVState *env, int csrno,
+                                     uint64_t mask, target_ulong new_val)
+{
+    bool virt = riscv_cpu_virt_enabled(env);
+    int index = csrno - CSR_SSTATEEN0;
+    uint64_t wr_mask;
+    uint64_t *reg;
+
+    wr_mask = env->mstateen[index] & mask;
+    if (virt) {
+        wr_mask &= env->hstateen[index];
+    }
+
+    reg = &env->sstateen[index];
+    *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
+
+    return RISCV_EXCP_NONE;
+}
+
+static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
+                                      target_ulong new_val)
+{
+    uint64_t wr_mask = SMSTATEEN_STATEEN;
+
+    return write_sstateen(env, csrno, wr_mask, new_val);
+}
+
+static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno,
+                                      target_ulong new_val)
+{
+    return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
+}
+
 static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
                                 uint64_t *ret_val,
                                 uint64_t new_val, uint64_t wr_mask)
@@ -XXX,XX +XXX,XX @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
     [CSR_HENVCFGH] = { "henvcfgh", hmode32, read_henvcfgh, write_henvcfgh,
                        .min_priv_ver = PRIV_VERSION_1_12_0              },
 
+    /* Smstateen extension CSRs */
+    [CSR_MSTATEEN0] = { "mstateen0", mstateen, read_mstateen, write_mstateen0,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_MSTATEEN0H] = { "mstateen0h", mstateen, read_mstateenh,
+                          write_mstateen0h,
+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_MSTATEEN1] = { "mstateen1", mstateen, read_mstateen,
+                        write_mstateen_1_3,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_MSTATEEN1H] = { "mstateen1h", mstateen, read_mstateenh,
+                         write_mstateenh_1_3,
+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_MSTATEEN2] = { "mstateen2", mstateen, read_mstateen,
+                        write_mstateen_1_3,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_MSTATEEN2H] = { "mstateen2h", mstateen, read_mstateenh,
+                         write_mstateenh_1_3,
+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_MSTATEEN3] = { "mstateen3", mstateen, read_mstateen,
+                        write_mstateen_1_3,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_MSTATEEN3H] = { "mstateen3h", mstateen, read_mstateenh,
+                         write_mstateenh_1_3,
+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_HSTATEEN0] = { "hstateen0", hstateen, read_hstateen, write_hstateen0,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_HSTATEEN0H] = { "hstateen0h", hstateenh, read_hstateenh,
+                         write_hstateen0h,
+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_HSTATEEN1] = { "hstateen1", hstateen, read_hstateen,
+                        write_hstateen_1_3,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_HSTATEEN1H] = { "hstateen1h", hstateenh, read_hstateenh,
+                         write_hstateenh_1_3,
+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_HSTATEEN2] = { "hstateen2", hstateen, read_hstateen,
+                        write_hstateen_1_3,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_HSTATEEN2H] = { "hstateen2h", hstateenh, read_hstateenh,
+                         write_hstateenh_1_3,
+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_HSTATEEN3] = { "hstateen3", hstateen, read_hstateen,
+                        write_hstateen_1_3,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_HSTATEEN3H] = { "hstateen3h", hstateenh, read_hstateenh,
+                         write_hstateenh_1_3,
+                         .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_SSTATEEN0] = { "sstateen0", sstateen, read_sstateen, write_sstateen0,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_SSTATEEN1] = { "sstateen1", sstateen, read_sstateen,
+                        write_sstateen_1_3,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_SSTATEEN2] = { "sstateen2", sstateen, read_sstateen,
+                        write_sstateen_1_3,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+    [CSR_SSTATEEN3] = { "sstateen3", sstateen, read_sstateen,
+                        write_sstateen_1_3,
+                        .min_priv_ver = PRIV_VERSION_1_12_0 },
+
     /* Supervisor Trap Setup */
     [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
                          NULL,                read_sstatus_i128               },
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@ static int riscv_cpu_post_load(void *opaque, int version_id)
     return 0;
 }
 
+static bool smstateen_needed(void *opaque)
+{
+    RISCVCPU *cpu = opaque;
+
+    return cpu->cfg.ext_smstateen;
+}
+
+static const VMStateDescription vmstate_smstateen = {
+    .name = "cpu/smtateen",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = smstateen_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT64_ARRAY(env.mstateen, RISCVCPU, 4),
+        VMSTATE_UINT64_ARRAY(env.hstateen, RISCVCPU, 4),
+        VMSTATE_UINT64_ARRAY(env.sstateen, RISCVCPU, 4),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static bool envcfg_needed(void *opaque)
 {
     RISCVCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_riscv_cpu = {
         &vmstate_kvmtimer,
         &vmstate_envcfg,
         &vmstate_debug,
+        &vmstate_smstateen,
         NULL
     }
 };
-- 
2.38.1

From: Mayuresh Chitale <mchitale@ventanamicro.com>

Accesses to henvcfg, henvcfgh and senvcfg are allowed only if the corresponding
bit in mstateen0/hstateen0 is enabled. Otherwise an illegal instruction trap is
generated.

Signed-off-by: Mayuresh Chitale <mchitale@ventanamicro.com>
Reviewed-by: Weiwei Li<liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221016124726.102129-3-mchitale@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 87 ++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 80 insertions(+), 7 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
 }
 
 /* Predicates */
+#if !defined(CONFIG_USER_ONLY)
+static RISCVException smstateen_acc_ok(CPURISCVState *env, int index,
+                                       uint64_t bit)
+{
+    bool virt = riscv_cpu_virt_enabled(env);
+    CPUState *cs = env_cpu(env);
+    RISCVCPU *cpu = RISCV_CPU(cs);
+
+    if (env->priv == PRV_M || !cpu->cfg.ext_smstateen) {
+        return RISCV_EXCP_NONE;
+    }
+
+    if (!(env->mstateen[index] & bit)) {
+        return RISCV_EXCP_ILLEGAL_INST;
+    }
+
+    if (virt) {
+        if (!(env->hstateen[index] & bit)) {
+            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+        }
+
+        if (env->priv == PRV_U && !(env->sstateen[index] & bit)) {
+            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+        }
+    }
+
+    if (env->priv == PRV_U && riscv_has_ext(env, RVS)) {
+        if (!(env->sstateen[index] & bit)) {
+            return RISCV_EXCP_ILLEGAL_INST;
+        }
+    }
+
+    return RISCV_EXCP_NONE;
+}
+#endif
+
 static RISCVException fs(CPURISCVState *env, int csrno)
 {
 #if !defined(CONFIG_USER_ONLY)
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
 static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
                                  target_ulong *val)
 {
+    RISCVException ret;
+
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
     *val = env->senvcfg;
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
                                   target_ulong val)
 {
     uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
+    RISCVException ret;
 
-    env->senvcfg = (env->senvcfg & ~mask) | (val & mask);
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
 
+    env->senvcfg = (env->senvcfg & ~mask) | (val & mask);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
                                  target_ulong *val)
 {
+    RISCVException ret;
+
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
     *val = env->henvcfg;
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
                                   target_ulong val)
 {
     uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
+    RISCVException ret;
+
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
 
     if (riscv_cpu_mxl(env) == MXL_RV64) {
         mask |= HENVCFG_PBMTE | HENVCFG_STCE;
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
 static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
                                  target_ulong *val)
 {
+    RISCVException ret;
+
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
+
     *val = env->henvcfg >> 32;
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
 {
     uint64_t mask = HENVCFG_PBMTE | HENVCFG_STCE;
     uint64_t valh = (uint64_t)val << 32;
+    RISCVException ret;
 
-    env->henvcfg = (env->henvcfg & ~mask) | (valh & mask);
+    ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
+    if (ret != RISCV_EXCP_NONE) {
+        return ret;
+    }
 
+    env->henvcfg = (env->henvcfg & ~mask) | (valh & mask);
     return RISCV_EXCP_NONE;
 }
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateen(CPURISCVState *env, int csrno,
 static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
                                       target_ulong new_val)
 {
-    uint64_t wr_mask = SMSTATEEN_STATEEN;
+    uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
     return write_mstateen(env, csrno, wr_mask, new_val);
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
 static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
                                       target_ulong new_val)
 {
-    uint64_t wr_mask = SMSTATEEN_STATEEN;
+    uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
     return write_mstateenh(env, csrno, wr_mask, new_val);
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateen(CPURISCVState *env, int csrno,
 static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
                                       target_ulong new_val)
 {
-    uint64_t wr_mask = SMSTATEEN_STATEEN;
+    uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
     return write_hstateen(env, csrno, wr_mask, new_val);
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
 static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
                                        target_ulong new_val)
 {
-    uint64_t wr_mask = SMSTATEEN_STATEEN;
+    uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
     return write_hstateenh(env, csrno, wr_mask, new_val);
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_sstateen(CPURISCVState *env, int csrno,
 static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
                                       target_ulong new_val)
 {
-    uint64_t wr_mask = SMSTATEEN_STATEEN;
+    uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
     return write_sstateen(env, csrno, wr_mask, new_val);
 }
-- 
2.38.1

From: Mayuresh Chitale <mchitale@ventanamicro.com>

This patch adds a mechanism to generate a virtual instruction
instruction exception instead of an illegal instruction exception
during instruction decode when virt is enabled.

Signed-off-by: Mayuresh Chitale <mchitale@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221016124726.102129-4-mchitale@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
        to reset this known value.  */
     int frm;
     RISCVMXL ol;
+    bool virt_inst_excp;
     bool virt_enabled;
     const RISCVCPUConfig *cfg_ptr;
     bool hlsx;
@@ -XXX,XX +XXX,XX @@ static void gen_exception_illegal(DisasContext *ctx)
 {
     tcg_gen_st_i32(tcg_constant_i32(ctx->opcode), cpu_env,
                    offsetof(CPURISCVState, bins));
-    generate_exception(ctx, RISCV_EXCP_ILLEGAL_INST);
+    if (ctx->virt_inst_excp) {
+        generate_exception(ctx, RISCV_EXCP_VIRT_INSTRUCTION_FAULT);
+    } else {
+        generate_exception(ctx, RISCV_EXCP_ILLEGAL_INST);
+    }
 }
 
 static void gen_exception_inst_addr_mis(DisasContext *ctx)
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
         { has_XVentanaCondOps_p,  decode_XVentanaCodeOps },
     };
 
+    ctx->virt_inst_excp = false;
     /* Check for compressed insn */
     if (insn_len(opcode) == 2) {
         if (!has_ext(ctx, RVC)) {
-- 
2.38.1

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

When icount is not enabled, there is no API in QEMU that can get the
guest instruction number.

Translate the guest code in a way that each TB only has one instruction.
After executing the instruction, decrease the count by 1 until it reaches 0
where the itrigger fires.

Note that only when priviledge matches the itrigger configuration,
the count will decrease.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221013062946.7530-2-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                            |  2 +
 target/riscv/debug.h                          | 12 ++++
 target/riscv/helper.h                         |  2 +
 target/riscv/cpu_helper.c                     |  6 ++
 target/riscv/debug.c                          | 71 +++++++++++++++++++
 target/riscv/translate.c                      | 33 ++++++++-
 .../riscv/insn_trans/trans_privileged.c.inc   |  4 +-
 target/riscv/insn_trans/trans_rvi.c.inc       |  8 +--
 target/riscv/insn_trans/trans_rvv.c.inc       |  4 +-
 9 files changed, 131 insertions(+), 11 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TB_FLAGS, PM_MASK_ENABLED, 22, 1)
 FIELD(TB_FLAGS, PM_BASE_ENABLED, 23, 1)
 FIELD(TB_FLAGS, VTA, 24, 1)
 FIELD(TB_FLAGS, VMA, 25, 1)
+/* Native debug itrigger */
+FIELD(TB_FLAGS, ITRIGGER, 26, 1)
 
 #ifdef TARGET_RISCV32
 #define riscv_cpu_mxl(env)  ((void)(env), MXL_RV32)
diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ enum {
     SIZE_NUM = 16
 };
 
+/* itrigger filed masks */
+#define ITRIGGER_ACTION       0x3f
+#define ITRIGGER_U            BIT(6)
+#define ITRIGGER_S            BIT(7)
+#define ITRIGGER_PENDING      BIT(8)
+#define ITRIGGER_M            BIT(9)
+#define ITRIGGER_COUNT        (0x3fff << 10)
+#define ITRIGGER_HIT          BIT(24)
+#define ITRIGGER_VU           BIT(25)
+#define ITRIGGER_VS           BIT(26)
+
 bool tdata_available(CPURISCVState *env, int tdata_index);
 
 target_ulong tselect_csr_read(CPURISCVState *env);
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
 
 void riscv_trigger_init(CPURISCVState *env);
 
+bool riscv_itrigger_enabled(CPURISCVState *env);
 #endif /* RISCV_DEBUG_H */
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(sret, tl, env)
 DEF_HELPER_1(mret, tl, env)
 DEF_HELPER_1(wfi, void, env)
 DEF_HELPER_1(tlb_flush, void, env)
+/* Native Debug */
+DEF_HELPER_1(itrigger_match, void, env)
 #endif
 
 /* Hypervisor functions */
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "tcg/tcg-op.h"
 #include "trace.h"
 #include "semihosting/common-semi.h"
+#include "sysemu/cpu-timers.h"
 #include "cpu_bits.h"
+#include "debug.h"
 
 int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
 {
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
         flags = FIELD_DP32(flags, TB_FLAGS, MSTATUS_HS_VS,
                            get_field(env->mstatus_hs, MSTATUS_VS));
     }
+    if (riscv_feature(env, RISCV_FEATURE_DEBUG) && !icount_enabled()) {
+        flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER,
+                           riscv_itrigger_enabled(env));
+    }
 #endif
 
     flags = FIELD_DP32(flags, TB_FLAGS, XL, env->xl);
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "trace.h"
 #include "exec/exec-all.h"
+#include "exec/helper-proto.h"
 
 /*
  * The following M-mode trigger CSRs are implemented:
@@ -XXX,XX +XXX,XX @@ static void type6_reg_write(CPURISCVState *env, target_ulong index,
     return;
 }
 
+/* icount trigger type */
+static inline int
+itrigger_get_count(CPURISCVState *env, int index)
+{
+    return get_field(env->tdata1[index], ITRIGGER_COUNT);
+}
+
+static inline void
+itrigger_set_count(CPURISCVState *env, int index, int value)
+{
+    env->tdata1[index] = set_field(env->tdata1[index],
+                                   ITRIGGER_COUNT, value);
+}
+
+static bool check_itrigger_priv(CPURISCVState *env, int index)
+{
+    target_ulong tdata1 = env->tdata1[index];
+    if (riscv_cpu_virt_enabled(env)) {
+        /* check VU/VS bit against current privilege level */
+        return (get_field(tdata1, ITRIGGER_VS) == env->priv) ||
+               (get_field(tdata1, ITRIGGER_VU) == env->priv);
+    } else {
+        /* check U/S/M bit against current privilege level */
+        return (get_field(tdata1, ITRIGGER_M) == env->priv) ||
+               (get_field(tdata1, ITRIGGER_S) == env->priv) ||
+               (get_field(tdata1, ITRIGGER_U) == env->priv);
+    }
+}
+
+bool riscv_itrigger_enabled(CPURISCVState *env)
+{
+    int count;
+    for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
+        if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
+            continue;
+        }
+        if (check_itrigger_priv(env, i)) {
+            continue;
+        }
+        count = itrigger_get_count(env, i);
+        if (!count) {
+            continue;
+        }
+        return true;
+    }
+
+    return false;
+}
+
+void helper_itrigger_match(CPURISCVState *env)
+{
+    int count;
+    for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
+        if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
+            continue;
+        }
+        if (check_itrigger_priv(env, i)) {
+            continue;
+        }
+        count = itrigger_get_count(env, i);
+        if (!count) {
+            continue;
+        }
+        itrigger_set_count(env, i, count--);
+        if (!count) {
+            do_trigger_action(env, i);
+        }
+    }
+}
+
 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
 {
     switch (tdata_index) {
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     /* PointerMasking extension */
     bool pm_mask_enabled;
     bool pm_base_enabled;
+    /* Use icount trigger for native debug */
+    bool itrigger;
     /* TCG of the current insn_start */
     TCGOp *insn_start;
 } DisasContext;
@@ -XXX,XX +XXX,XX @@ static void gen_exception_inst_addr_mis(DisasContext *ctx)
     generate_exception(ctx, RISCV_EXCP_INST_ADDR_MIS);
 }
 
+static void lookup_and_goto_ptr(DisasContext *ctx)
+{
+#ifndef CONFIG_USER_ONLY
+    if (ctx->itrigger) {
+        gen_helper_itrigger_match(cpu_env);
+    }
+#endif
+    tcg_gen_lookup_and_goto_ptr();
+}
+
+static void exit_tb(DisasContext *ctx)
+{
+#ifndef CONFIG_USER_ONLY
+    if (ctx->itrigger) {
+        gen_helper_itrigger_match(cpu_env);
+    }
+#endif
+    tcg_gen_exit_tb(NULL, 0);
+}
+
 static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
 {
-    if (translator_use_goto_tb(&ctx->base, dest)) {
+     /*
+      * Under itrigger, instruction executes one by one like singlestep,
+      * direct block chain benefits will be small.
+      */
+    if (translator_use_goto_tb(&ctx->base, dest) && !ctx->itrigger) {
         tcg_gen_goto_tb(n);
         gen_set_pc_imm(ctx, dest);
         tcg_gen_exit_tb(ctx->base.tb, n);
     } else {
         gen_set_pc_imm(ctx, dest);
-        tcg_gen_lookup_and_goto_ptr();
+        lookup_and_goto_ptr(ctx);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
     memset(ctx->ftemp, 0, sizeof(ctx->ftemp));
     ctx->pm_mask_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_MASK_ENABLED);
     ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED);
+    ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER);
     ctx->zero = tcg_constant_tl(0);
 }
 
@@ -XXX,XX +XXX,XX @@ static void riscv_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 
     /* Only the first insn within a TB is allowed to cross a page boundary. */
     if (ctx->base.is_jmp == DISAS_NEXT) {
-        if (!is_same_page(&ctx->base, ctx->base.pc_next)) {
+        if (ctx->itrigger || !is_same_page(&ctx->base, ctx->base.pc_next)) {
             ctx->base.is_jmp = DISAS_TOO_MANY;
         } else {
             unsigned page_ofs = ctx->base.pc_next & ~TARGET_PAGE_MASK;
diff --git a/target/riscv/insn_trans/trans_privileged.c.inc b/target/riscv/insn_trans/trans_privileged.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_privileged.c.inc
+++ b/target/riscv/insn_trans/trans_privileged.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_sret(DisasContext *ctx, arg_sret *a)
     if (has_ext(ctx, RVS)) {
         decode_save_opc(ctx);
         gen_helper_sret(cpu_pc, cpu_env);
-        tcg_gen_exit_tb(NULL, 0); /* no chaining */
+        exit_tb(ctx); /* no chaining */
         ctx->base.is_jmp = DISAS_NORETURN;
     } else {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_mret(DisasContext *ctx, arg_mret *a)
 #ifndef CONFIG_USER_ONLY
     decode_save_opc(ctx);
     gen_helper_mret(cpu_pc, cpu_env);
-    tcg_gen_exit_tb(NULL, 0); /* no chaining */
+    exit_tb(ctx); /* no chaining */
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 #else
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a)
     }
 
     gen_set_gpri(ctx, a->rd, ctx->pc_succ_insn);
-    tcg_gen_lookup_and_goto_ptr();
+    lookup_and_goto_ptr(ctx);
 
     if (misaligned) {
         gen_set_label(misaligned);
@@ -XXX,XX +XXX,XX @@ static bool trans_pause(DisasContext *ctx, arg_pause *a)
      * end the TB and return to main loop
      */
     gen_set_pc_imm(ctx, ctx->pc_succ_insn);
-    tcg_gen_exit_tb(NULL, 0);
+    exit_tb(ctx);
     ctx->base.is_jmp = DISAS_NORETURN;
 
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_fence_i(DisasContext *ctx, arg_fence_i *a)
      * however we need to end the translation block
      */
     gen_set_pc_imm(ctx, ctx->pc_succ_insn);
-    tcg_gen_exit_tb(NULL, 0);
+    exit_tb(ctx);
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool do_csr_post(DisasContext *ctx)
     decode_save_opc(ctx);
     /* We may have changed important cpu state -- exit to main loop. */
     gen_set_pc_imm(ctx, ctx->pc_succ_insn);
-    tcg_gen_exit_tb(NULL, 0);
+    exit_tb(ctx);
     ctx->base.is_jmp = DISAS_NORETURN;
     return true;
 }
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool do_vsetvl(DisasContext *s, int rd, int rs1, TCGv s2)
     mark_vs_dirty(s);
 
     gen_set_pc_imm(s, s->pc_succ_insn);
-    tcg_gen_lookup_and_goto_ptr();
+    lookup_and_goto_ptr(s);
     s->base.is_jmp = DISAS_NORETURN;
 
     if (rd == 0 && rs1 == 0) {
@@ -XXX,XX +XXX,XX @@ static bool do_vsetivli(DisasContext *s, int rd, TCGv s1, TCGv s2)
     gen_set_gpr(s, rd, dst);
     mark_vs_dirty(s);
     gen_set_pc_imm(s, s->pc_succ_insn);
-    tcg_gen_lookup_and_goto_ptr();
+    lookup_and_goto_ptr(s);
     s->base.is_jmp = DISAS_NORETURN;
 
     return true;
-- 
2.38.1

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

The max count in itrigger can be 0x3FFF, which will cause a no trivial
translation and execution overload.

When icount is enabled, QEMU provides API that can fetch guest
instruction number. Thus, we can set an timer for itrigger with
the count as deadline.

Only when timer expires or priviledge mode changes, do lazy update
to count.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221013062946.7530-3-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  2 ++
 target/riscv/debug.h      |  1 +
 target/riscv/cpu_helper.c |  3 ++
 target/riscv/debug.c      | 59 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 65 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     target_ulong tdata3[RV_MAX_TRIGGERS];
     struct CPUBreakpoint *cpu_breakpoint[RV_MAX_TRIGGERS];
     struct CPUWatchpoint *cpu_watchpoint[RV_MAX_TRIGGERS];
+    QEMUTimer *itrigger_timer[RV_MAX_TRIGGERS];
+    int64_t last_icount;
 
     /* machine specific rdtime callback */
     uint64_t (*rdtime_fn)(void *);
diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
 void riscv_trigger_init(CPURISCVState *env);
 
 bool riscv_itrigger_enabled(CPURISCVState *env);
+void riscv_itrigger_update_priv(CPURISCVState *env);
 #endif /* RISCV_DEBUG_H */
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
     if (newpriv == PRV_H) {
         newpriv = PRV_U;
     }
+    if (icount_enabled() && newpriv != env->priv) {
+        riscv_itrigger_update_priv(env);
+    }
     /* tlb_flush is unnecessary as mode is contained in mmu_idx */
     env->priv = newpriv;
     env->xl = cpu_recompute_xl(env);
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@
 #include "trace.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
+#include "sysemu/cpu-timers.h"
 
 /*
  * The following M-mode trigger CSRs are implemented:
@@ -XXX,XX +XXX,XX @@ void helper_itrigger_match(CPURISCVState *env)
     }
 }
 
+static void riscv_itrigger_update_count(CPURISCVState *env)
+{
+    int count, executed;
+    /*
+     * Record last icount, so that we can evaluate the executed instructions
+     * since last priviledge mode change or timer expire.
+     */
+    int64_t last_icount = env->last_icount, current_icount;
+    current_icount = env->last_icount = icount_get_raw();
+
+    for (int i = 0; i < RV_MAX_TRIGGERS; i++) {
+        if (get_trigger_type(env, i) != TRIGGER_TYPE_INST_CNT) {
+            continue;
+        }
+        count = itrigger_get_count(env, i);
+        if (!count) {
+            continue;
+        }
+        /*
+         * Only when priviledge is changed or itrigger timer expires,
+         * the count field in itrigger tdata1 register is updated.
+         * And the count field in itrigger only contains remaining value.
+         */
+        if (check_itrigger_priv(env, i)) {
+            /*
+             * If itrigger enabled in this priviledge mode, the number of
+             * executed instructions since last priviledge change
+             * should be reduced from current itrigger count.
+             */
+            executed = current_icount - last_icount;
+            itrigger_set_count(env, i, count - executed);
+            if (count == executed) {
+                do_trigger_action(env, i);
+            }
+        } else {
+            /*
+             * If itrigger is not enabled in this priviledge mode,
+             * the number of executed instructions will be discard and
+             * the count field in itrigger will not change.
+             */
+            timer_mod(env->itrigger_timer[i],
+                      current_icount + count);
+        }
+    }
+}
+
+static void riscv_itrigger_timer_cb(void *opaque)
+{
+    riscv_itrigger_update_count((CPURISCVState *)opaque);
+}
+
+void riscv_itrigger_update_priv(CPURISCVState *env)
+{
+    riscv_itrigger_update_count(env);
+}
+
 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
 {
     switch (tdata_index) {
@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
         env->tdata3[i] = 0;
         env->cpu_breakpoint[i] = NULL;
         env->cpu_watchpoint[i] = NULL;
+        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                              riscv_itrigger_timer_cb, env);
     }
 }
-- 
2.38.1

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

When QEMU is not in icount mode, execute instruction one by one. The
tdata1 can be read directly.

When QEMU is in icount mode, use a timer to simulate the itrigger. The
tdata1 may be not right because of lazy update of count in tdata1. Thus,
We should pack the adjusted count into tdata1 before read it back.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221013062946.7530-4-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.c | 72 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ void riscv_itrigger_update_priv(CPURISCVState *env)
     riscv_itrigger_update_count(env);
 }
 
+static target_ulong itrigger_validate(CPURISCVState *env,
+                                      target_ulong ctrl)
+{
+    target_ulong val;
+
+    /* validate the generic part first */
+    val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT);
+
+    /* validate unimplemented (always zero) bits */
+    warn_always_zero_bit(ctrl, ITRIGGER_ACTION, "action");
+    warn_always_zero_bit(ctrl, ITRIGGER_HIT, "hit");
+    warn_always_zero_bit(ctrl, ITRIGGER_PENDING, "pending");
+
+    /* keep the mode and attribute bits */
+    val |= ctrl & (ITRIGGER_VU | ITRIGGER_VS | ITRIGGER_U | ITRIGGER_S |
+                   ITRIGGER_M | ITRIGGER_COUNT);
+
+    return val;
+}
+
+static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
+                               int tdata_index, target_ulong val)
+{
+    target_ulong new_val;
+
+    switch (tdata_index) {
+    case TDATA1:
+        /* set timer for icount */
+        new_val = itrigger_validate(env, val);
+        if (new_val != env->tdata1[index]) {
+            env->tdata1[index] = new_val;
+            if (icount_enabled()) {
+                env->last_icount = icount_get_raw();
+                /* set the count to timer */
+                timer_mod(env->itrigger_timer[index],
+                          env->last_icount + itrigger_get_count(env, index));
+            }
+        }
+        break;
+    case TDATA2:
+        qemu_log_mask(LOG_UNIMP,
+                      "tdata2 is not supported for icount trigger\n");
+        break;
+    case TDATA3:
+        qemu_log_mask(LOG_UNIMP,
+                      "tdata3 is not supported for icount trigger\n");
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    return;
+}
+
+static int itrigger_get_adjust_count(CPURISCVState *env)
+{
+    int count = itrigger_get_count(env, env->trigger_cur), executed;
+    if ((count != 0) && check_itrigger_priv(env, env->trigger_cur)) {
+        executed = icount_get_raw() - env->last_icount;
+        count += executed;
+    }
+    return count;
+}
+
 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
 {
+    int trigger_type;
     switch (tdata_index) {
     case TDATA1:
+        trigger_type = extract_trigger_type(env, env->tdata1[env->trigger_cur]);
+        if ((trigger_type == TRIGGER_TYPE_INST_CNT) && icount_enabled()) {
+            return deposit64(env->tdata1[env->trigger_cur], 10, 14,
+                             itrigger_get_adjust_count(env));
+        }
         return env->tdata1[env->trigger_cur];
     case TDATA2:
         return env->tdata2[env->trigger_cur];
@@ -XXX,XX +XXX,XX @@ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
         type6_reg_write(env, env->trigger_cur, tdata_index, val);
         break;
     case TRIGGER_TYPE_INST_CNT:
+        itrigger_reg_write(env, env->trigger_cur, tdata_index, val);
+        break;
     case TRIGGER_TYPE_INT:
     case TRIGGER_TYPE_EXCP:
     case TRIGGER_TYPE_EXT_SRC:
-- 
2.38.1

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Avoid calling riscv_itrigger_enabled() when calculate the tbflags.
As the itrigger enable status can only be changed when write
tdata1, migration load or itrigger fire, update env->itrigger_enabled
at these places.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221013062946.7530-5-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h        |  1 +
 target/riscv/cpu_helper.c |  3 +--
 target/riscv/debug.c      |  3 +++
 target/riscv/machine.c    | 15 +++++++++++++++
 4 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct CPUArchState {
     struct CPUWatchpoint *cpu_watchpoint[RV_MAX_TRIGGERS];
     QEMUTimer *itrigger_timer[RV_MAX_TRIGGERS];
     int64_t last_icount;
+    bool itrigger_enabled;
 
     /* machine specific rdtime callback */
     uint64_t (*rdtime_fn)(void *);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPURISCVState *env, target_ulong *pc,
                            get_field(env->mstatus_hs, MSTATUS_VS));
     }
     if (riscv_feature(env, RISCV_FEATURE_DEBUG) && !icount_enabled()) {
-        flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER,
-                           riscv_itrigger_enabled(env));
+        flags = FIELD_DP32(flags, TB_FLAGS, ITRIGGER, env->itrigger_enabled);
     }
 #endif
 
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ void helper_itrigger_match(CPURISCVState *env)
         }
         itrigger_set_count(env, i, count--);
         if (!count) {
+            env->itrigger_enabled = riscv_itrigger_enabled(env);
             do_trigger_action(env, i);
         }
     }
@@ -XXX,XX +XXX,XX @@ static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
                 /* set the count to timer */
                 timer_mod(env->itrigger_timer[index],
                           env->last_icount + itrigger_get_count(env, index));
+            } else {
+                env->itrigger_enabled = riscv_itrigger_enabled(env);
             }
         }
         break;
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "sysemu/kvm.h"
 #include "migration/cpu.h"
+#include "sysemu/cpu-timers.h"
+#include "debug.h"
 
 static bool pmp_needed(void *opaque)
 {
@@ -XXX,XX +XXX,XX @@ static bool debug_needed(void *opaque)
     return riscv_feature(env, RISCV_FEATURE_DEBUG);
 }
 
+static int debug_post_load(void *opaque, int version_id)
+{
+    RISCVCPU *cpu = opaque;
+    CPURISCVState *env = &cpu->env;
+
+    if (icount_enabled()) {
+        env->itrigger_enabled = riscv_itrigger_enabled(env);
+    }
+
+    return 0;
+}
+
 static const VMStateDescription vmstate_debug = {
     .name = "cpu/debug",
     .version_id = 2,
     .minimum_version_id = 2,
     .needed = debug_needed,
+    .post_load = debug_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINTTL(env.trigger_cur, RISCVCPU),
         VMSTATE_UINTTL_ARRAY(env.tdata1, RISCVCPU, RV_MAX_TRIGGERS),
-- 
2.38.1

From: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr>

Commit 40244040a7a changed the way the S irqs are numbered. This breaks when
using numa configuration, e.g.:
./qemu-system-riscv64 -nographic -machine virt,dumpdtb=numa-tree.dtb \
                      -m 2G -smp cpus=16 \
		      -object memory-backend-ram,id=mem0,size=512M \
		      -object memory-backend-ram,id=mem1,size=512M \
		      -object memory-backend-ram,id=mem2,size=512M \
		      -object memory-backend-ram,id=mem3,size=512M \
		      -numa node,cpus=0-3,memdev=mem0,nodeid=0 \
		      -numa node,cpus=4-7,memdev=mem1,nodeid=1 \
		      -numa node,cpus=8-11,memdev=mem2,nodeid=2 \
		      -numa node,cpus=12-15,memdev=mem3,nodeid=3
leads to:
Unexpected error in object_property_find_err() at ../qom/object.c:1304:
qemu-system-riscv64: Property 'riscv.sifive.plic.unnamed-gpio-out[8]' not
found

This patch makes the nubering of the S irqs identical to what it was before.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Frédéric Pétrot <frederic.petrot@univ-grenoble-alpes.fr>
Message-Id: <20221114135122.1668703-1-frederic.petrot@univ-grenoble-alpes.fr>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/sifive_plic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/sifive_plic.c
+++ b/hw/intc/sifive_plic.c
@@ -XXX,XX +XXX,XX @@ DeviceState *sifive_plic_create(hwaddr addr, char *hart_config,
         CPUState *cpu = qemu_get_cpu(cpu_num);
 
         if (plic->addr_config[i].mode == PLICMode_M) {
-            qdev_connect_gpio_out(dev, num_harts - plic->hartid_base + cpu_num,
+            qdev_connect_gpio_out(dev, cpu_num - hartid_base + num_harts,
                                   qdev_get_gpio_in(DEVICE(cpu), IRQ_M_EXT));
         }
         if (plic->addr_config[i].mode == PLICMode_S) {
-            qdev_connect_gpio_out(dev, cpu_num,
+            qdev_connect_gpio_out(dev, cpu_num - hartid_base,
                                   qdev_get_gpio_in(DEVICE(cpu), IRQ_S_EXT));
         }
     }
-- 
2.38.1

From: Anup Patel <apatel@ventanamicro.com>

We should use "&&" instead of "&" when checking hcounteren.TM and
henvcfg.STCE bits.

Fixes: 3ec0fe18a31f ("target/riscv: Add vstimecmp suppor")
Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221108125703.1463577-2-apatel@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException sstc(CPURISCVState *env, int csrno)
     }
 
     if (riscv_cpu_virt_enabled(env)) {
-        if (!(get_field(env->hcounteren, COUNTEREN_TM) &
+        if (!(get_field(env->hcounteren, COUNTEREN_TM) &&
               get_field(env->henvcfg, HENVCFG_STCE))) {
             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
-- 
2.38.1

From: Atish Patra <atishp@rivosinc.com>

The imsic DT binding[1] has changed and no longer require an ipi-id.
The latest IMSIC driver dynamically allocates ipi id if slow-ipi
is not defined.

Get rid of the unused dt property which may lead to confusion.

[1] https://lore.kernel.org/lkml/20221111044207.1478350-5-apatel@ventanamicro.com/

Signed-off-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221122080529.1692533-1-atishp@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h | 1 -
 hw/riscv/virt.c         | 4 ----
 2 files changed, 5 deletions(-)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ enum {
 
 #define VIRT_PLATFORM_BUS_NUM_IRQS 32
 
-#define VIRT_IRQCHIP_IPI_MSI 1
 #define VIRT_IRQCHIP_NUM_MSIS 255
 #define VIRT_IRQCHIP_NUM_SOURCES VIRTIO_NDEV
 #define VIRT_IRQCHIP_NUM_PRIO_BITS 3
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
         riscv_socket_count(mc) * sizeof(uint32_t) * 4);
     qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,num-ids",
         VIRT_IRQCHIP_NUM_MSIS);
-    qemu_fdt_setprop_cells(mc->fdt, imsic_name, "riscv,ipi-id",
-        VIRT_IRQCHIP_IPI_MSI);
     if (riscv_socket_count(mc) > 1) {
         qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,hart-index-bits",
             imsic_num_bits(imsic_max_hart_per_socket));
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
         riscv_socket_count(mc) * sizeof(uint32_t) * 4);
     qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,num-ids",
         VIRT_IRQCHIP_NUM_MSIS);
-    qemu_fdt_setprop_cells(mc->fdt, imsic_name, "riscv,ipi-id",
-        VIRT_IRQCHIP_IPI_MSI);
     if (imsic_guest_bits) {
         qemu_fdt_setprop_cell(mc->fdt, imsic_name, "riscv,guest-index-bits",
             imsic_guest_bits);
-- 
2.38.1

From: Jim Shu <jim.shu@sifive.com>

let tlb_fill() function also increments PMU counter when it is from
two-stage translation, so QEMU could also monitor these PMU events when
CPU runs in VS/VU mode (like running guest OS).

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221123090635.6574-1-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
         }
     }
 
+    pmu_tlb_fill_incr_ctr(cpu, access_type);
     if (riscv_cpu_virt_enabled(env) ||
         ((riscv_cpu_two_stage_lookup(mmu_idx) || two_stage_lookup) &&
          access_type != MMU_INST_FETCH)) {
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
             }
         }
     } else {
-        pmu_tlb_fill_incr_ctr(cpu, access_type);
         /* Single stage lookup */
         ret = get_physical_address(env, &pa, &prot, address, NULL,
                                    access_type, mmu_idx, true, false, false);
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

sstatus register dump is currently missing in riscv_cpu_dump_state().
As sstatus is a copy of mstatus, which is described in the priv spec,
it seems redundant to print the same information twice.

Add some comments for this to let people know this is intentional.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221125050354.3166023-1-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
             CSR_MHARTID,
             CSR_MSTATUS,
             CSR_MSTATUSH,
+            /*
+             * CSR_SSTATUS is intentionally omitted here as its value
+             * can be figured out by looking at CSR_MSTATUS
+             */
             CSR_HSTATUS,
             CSR_VSSTATUS,
             CSR_MIP,
-- 
2.38.1

From: Conor Dooley <conor.dooley@microchip.com>

On PolarFire SoC, some peripherals (eg the PCI root port) are clocked by
"Clock Conditioning Circuitry" in the FPGA. The specific clock depends
on the FPGA bitstream & can be locked to one particular {D,P}LL - in the
Icicle Kit Reference Design v2022.09 or later this is/will be the case.

Linux v6.1+ will have a driver for this peripheral and devicetrees that
previously relied on "fixed-frequency" clock nodes have been switched
over to clock-controller nodes. The IOSCB region is represented in QEMU,
but the specific region of it that the CCCs occupy has not so v6.1-rcN
kernels fail to boot in QEMU.

Add the regions as unimplemented so that the status-quo in terms of boot
is maintained.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Message-Id: <20221117225518.4102575-2-conor@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/misc/mchp_pfsoc_ioscb.h | 1 +
 hw/misc/mchp_pfsoc_ioscb.c         | 6 ++++++
 2 files changed, 7 insertions(+)

From: Conor Dooley <conor.dooley@microchip.com>

The Fabric Interconnect Controllers provide interfaces between the FPGA
fabric and the core complex. There are 5 FICs on PolarFire SoC, numbered
0 through 4. FIC2 is an AXI4 slave interface from the FPGA fabric and
does not show up on the MSS memory map. FIC4 is dedicated to the User
Crypto Processor and does not show up on the MSS memory map either.

FIC 0, 1 & 3 do show up in the MSS memory map and neither FICs 0 or 1
are represented in QEMU, leading to load access violations while booting
Linux for Icicle if PCIe is enabled as the root port is connected via
either FIC 0 or 1.

Acked-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Message-Id: <20221117225518.4102575-3-conor@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h |   2 +
 hw/riscv/microchip_pfsoc.c         | 115 ++++++++++++++++-------------
 2 files changed, 65 insertions(+), 52 deletions(-)

diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_USB,
     MICROCHIP_PFSOC_QSPI_XIP,
     MICROCHIP_PFSOC_IOSCB,
+    MICROCHIP_PFSOC_FABRIC_FIC0,
+    MICROCHIP_PFSOC_FABRIC_FIC1,
     MICROCHIP_PFSOC_FABRIC_FIC3,
     MICROCHIP_PFSOC_DRAM_LO,
     MICROCHIP_PFSOC_DRAM_LO_ALIAS,
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@
  *     describes the complete IOSCB modules memory maps
  */
 static const MemMapEntry microchip_pfsoc_memmap[] = {
-    [MICROCHIP_PFSOC_RSVD0] =           {        0x0,      0x100 },
-    [MICROCHIP_PFSOC_DEBUG] =           {      0x100,      0xf00 },
-    [MICROCHIP_PFSOC_E51_DTIM] =        {  0x1000000,     0x2000 },
-    [MICROCHIP_PFSOC_BUSERR_UNIT0] =    {  0x1700000,     0x1000 },
-    [MICROCHIP_PFSOC_BUSERR_UNIT1] =    {  0x1701000,     0x1000 },
-    [MICROCHIP_PFSOC_BUSERR_UNIT2] =    {  0x1702000,     0x1000 },
-    [MICROCHIP_PFSOC_BUSERR_UNIT3] =    {  0x1703000,     0x1000 },
-    [MICROCHIP_PFSOC_BUSERR_UNIT4] =    {  0x1704000,     0x1000 },
-    [MICROCHIP_PFSOC_CLINT] =           {  0x2000000,    0x10000 },
-    [MICROCHIP_PFSOC_L2CC] =            {  0x2010000,     0x1000 },
-    [MICROCHIP_PFSOC_DMA] =             {  0x3000000,   0x100000 },
-    [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,  0x2000000 },
-    [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,  0x4000000 },
-    [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,     0x1000 },
-    [MICROCHIP_PFSOC_WDOG0] =           { 0x20001000,     0x1000 },
-    [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,     0x2000 },
-    [MICROCHIP_PFSOC_AXISW] =           { 0x20004000,     0x1000 },
-    [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,     0x1000 },
-    [MICROCHIP_PFSOC_FMETER] =          { 0x20006000,     0x1000 },
-    [MICROCHIP_PFSOC_DDR_SGMII_PHY] =   { 0x20007000,     0x1000 },
-    [MICROCHIP_PFSOC_EMMC_SD] =         { 0x20008000,     0x1000 },
-    [MICROCHIP_PFSOC_DDR_CFG] =         { 0x20080000,    0x40000 },
-    [MICROCHIP_PFSOC_MMUART1] =         { 0x20100000,     0x1000 },
-    [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,     0x1000 },
-    [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,     0x1000 },
-    [MICROCHIP_PFSOC_MMUART4] =         { 0x20106000,     0x1000 },
-    [MICROCHIP_PFSOC_WDOG1] =           { 0x20101000,     0x1000 },
-    [MICROCHIP_PFSOC_WDOG2] =           { 0x20103000,     0x1000 },
-    [MICROCHIP_PFSOC_WDOG3] =           { 0x20105000,     0x1000 },
-    [MICROCHIP_PFSOC_WDOG4] =           { 0x20106000,     0x1000 },
-    [MICROCHIP_PFSOC_SPI0] =            { 0x20108000,     0x1000 },
-    [MICROCHIP_PFSOC_SPI1] =            { 0x20109000,     0x1000 },
-    [MICROCHIP_PFSOC_I2C0] =            { 0x2010a000,     0x1000 },
-    [MICROCHIP_PFSOC_I2C1] =            { 0x2010b000,     0x1000 },
-    [MICROCHIP_PFSOC_CAN0] =            { 0x2010c000,     0x1000 },
-    [MICROCHIP_PFSOC_CAN1] =            { 0x2010d000,     0x1000 },
-    [MICROCHIP_PFSOC_GEM0] =            { 0x20110000,     0x2000 },
-    [MICROCHIP_PFSOC_GEM1] =            { 0x20112000,     0x2000 },
-    [MICROCHIP_PFSOC_GPIO0] =           { 0x20120000,     0x1000 },
-    [MICROCHIP_PFSOC_GPIO1] =           { 0x20121000,     0x1000 },
-    [MICROCHIP_PFSOC_GPIO2] =           { 0x20122000,     0x1000 },
-    [MICROCHIP_PFSOC_RTC] =             { 0x20124000,     0x1000 },
-    [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,     0x1000 },
-    [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,    0x20000 },
-    [MICROCHIP_PFSOC_USB] =             { 0x20201000,     0x1000 },
-    [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,  0x1000000 },
-    [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000, 0x10000000 },
-    [MICROCHIP_PFSOC_FABRIC_FIC3] =     { 0x40000000, 0x20000000 },
-    [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000, 0x40000000 },
-    [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000, 0x40000000 },
-    [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,        0x0 },
-    [MICROCHIP_PFSOC_DRAM_HI_ALIAS] = { 0x1400000000,        0x0 },
+    [MICROCHIP_PFSOC_RSVD0] =           {        0x0,        0x100 },
+    [MICROCHIP_PFSOC_DEBUG] =           {      0x100,        0xf00 },
+    [MICROCHIP_PFSOC_E51_DTIM] =        {  0x1000000,       0x2000 },
+    [MICROCHIP_PFSOC_BUSERR_UNIT0] =    {  0x1700000,       0x1000 },
+    [MICROCHIP_PFSOC_BUSERR_UNIT1] =    {  0x1701000,       0x1000 },
+    [MICROCHIP_PFSOC_BUSERR_UNIT2] =    {  0x1702000,       0x1000 },
+    [MICROCHIP_PFSOC_BUSERR_UNIT3] =    {  0x1703000,       0x1000 },
+    [MICROCHIP_PFSOC_BUSERR_UNIT4] =    {  0x1704000,       0x1000 },
+    [MICROCHIP_PFSOC_CLINT] =           {  0x2000000,      0x10000 },
+    [MICROCHIP_PFSOC_L2CC] =            {  0x2010000,       0x1000 },
+    [MICROCHIP_PFSOC_DMA] =             {  0x3000000,     0x100000 },
+    [MICROCHIP_PFSOC_L2LIM] =           {  0x8000000,    0x2000000 },
+    [MICROCHIP_PFSOC_PLIC] =            {  0xc000000,    0x4000000 },
+    [MICROCHIP_PFSOC_MMUART0] =         { 0x20000000,       0x1000 },
+    [MICROCHIP_PFSOC_WDOG0] =           { 0x20001000,       0x1000 },
+    [MICROCHIP_PFSOC_SYSREG] =          { 0x20002000,       0x2000 },
+    [MICROCHIP_PFSOC_AXISW] =           { 0x20004000,       0x1000 },
+    [MICROCHIP_PFSOC_MPUCFG] =          { 0x20005000,       0x1000 },
+    [MICROCHIP_PFSOC_FMETER] =          { 0x20006000,       0x1000 },
+    [MICROCHIP_PFSOC_DDR_SGMII_PHY] =   { 0x20007000,       0x1000 },
+    [MICROCHIP_PFSOC_EMMC_SD] =         { 0x20008000,       0x1000 },
+    [MICROCHIP_PFSOC_DDR_CFG] =         { 0x20080000,      0x40000 },
+    [MICROCHIP_PFSOC_MMUART1] =         { 0x20100000,       0x1000 },
+    [MICROCHIP_PFSOC_MMUART2] =         { 0x20102000,       0x1000 },
+    [MICROCHIP_PFSOC_MMUART3] =         { 0x20104000,       0x1000 },
+    [MICROCHIP_PFSOC_MMUART4] =         { 0x20106000,       0x1000 },
+    [MICROCHIP_PFSOC_WDOG1] =           { 0x20101000,       0x1000 },
+    [MICROCHIP_PFSOC_WDOG2] =           { 0x20103000,       0x1000 },
+    [MICROCHIP_PFSOC_WDOG3] =           { 0x20105000,       0x1000 },
+    [MICROCHIP_PFSOC_WDOG4] =           { 0x20106000,       0x1000 },
+    [MICROCHIP_PFSOC_SPI0] =            { 0x20108000,       0x1000 },
+    [MICROCHIP_PFSOC_SPI1] =            { 0x20109000,       0x1000 },
+    [MICROCHIP_PFSOC_I2C0] =            { 0x2010a000,       0x1000 },
+    [MICROCHIP_PFSOC_I2C1] =            { 0x2010b000,       0x1000 },
+    [MICROCHIP_PFSOC_CAN0] =            { 0x2010c000,       0x1000 },
+    [MICROCHIP_PFSOC_CAN1] =            { 0x2010d000,       0x1000 },
+    [MICROCHIP_PFSOC_GEM0] =            { 0x20110000,       0x2000 },
+    [MICROCHIP_PFSOC_GEM1] =            { 0x20112000,       0x2000 },
+    [MICROCHIP_PFSOC_GPIO0] =           { 0x20120000,       0x1000 },
+    [MICROCHIP_PFSOC_GPIO1] =           { 0x20121000,       0x1000 },
+    [MICROCHIP_PFSOC_GPIO2] =           { 0x20122000,       0x1000 },
+    [MICROCHIP_PFSOC_RTC] =             { 0x20124000,       0x1000 },
+    [MICROCHIP_PFSOC_ENVM_CFG] =        { 0x20200000,       0x1000 },
+    [MICROCHIP_PFSOC_ENVM_DATA] =       { 0x20220000,      0x20000 },
+    [MICROCHIP_PFSOC_USB] =             { 0x20201000,       0x1000 },
+    [MICROCHIP_PFSOC_QSPI_XIP] =        { 0x21000000,    0x1000000 },
+    [MICROCHIP_PFSOC_IOSCB] =           { 0x30000000,   0x10000000 },
+    [MICROCHIP_PFSOC_FABRIC_FIC0] =   { 0x2000000000, 0x1000000000 },
+    [MICROCHIP_PFSOC_FABRIC_FIC1] =   { 0x3000000000, 0x1000000000 },
+    [MICROCHIP_PFSOC_FABRIC_FIC3] =     { 0x40000000,   0x20000000 },
+    [MICROCHIP_PFSOC_DRAM_LO] =         { 0x80000000,   0x40000000 },
+    [MICROCHIP_PFSOC_DRAM_LO_ALIAS] =   { 0xc0000000,   0x40000000 },
+    [MICROCHIP_PFSOC_DRAM_HI] =       { 0x1000000000,          0x0 },
+    [MICROCHIP_PFSOC_DRAM_HI_ALIAS] = { 0x1400000000,          0x0 },
+
 };
 
 static void microchip_pfsoc_soc_instance_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("microchip.pfsoc.fabricfic3",
         memmap[MICROCHIP_PFSOC_FABRIC_FIC3].base,
         memmap[MICROCHIP_PFSOC_FABRIC_FIC3].size);
+    /* FPGA Fabric */
+    create_unimplemented_device("microchip.pfsoc.fabricfic0",
+        memmap[MICROCHIP_PFSOC_FABRIC_FIC0].base,
+        memmap[MICROCHIP_PFSOC_FABRIC_FIC0].size);
+    /* FPGA Fabric */
+    create_unimplemented_device("microchip.pfsoc.fabricfic1",
+        memmap[MICROCHIP_PFSOC_FABRIC_FIC1].base,
+        memmap[MICROCHIP_PFSOC_FABRIC_FIC1].size);
 
     /* QSPI Flash */
     memory_region_init_rom(qspi_xip_mem, OBJECT(dev),
-- 
2.38.1

From: Conor Dooley <conor.dooley@microchip.com>

The system controller on PolarFire SoC is access via a mailbox. The
control registers for this mailbox lie in the "IOSCB" region & the
interrupt is cleared via write to the "SYSREG" region. It also has a
QSPI controller, usually connected to a flash chip, that is used for
storing FPGA bitstreams and used for In-Application Programming (IAP).

Linux has an implementation of the system controller, through which the
hwrng is accessed, leading to load/store access faults.

Add the QSPI as unimplemented and a very basic (effectively
unimplemented) version of the system controller's mailbox. Rather than
purely marking the regions as unimplemented, service the mailbox
requests by reporting failures and raising the interrupt so a guest can
better handle the lack of support.

Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221117225518.4102575-4-conor@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/misc/mchp_pfsoc_ioscb.h  |  3 ++
 include/hw/misc/mchp_pfsoc_sysreg.h |  1 +
 include/hw/riscv/microchip_pfsoc.h  |  1 +
 hw/misc/mchp_pfsoc_ioscb.c          | 72 ++++++++++++++++++++++++++++-
 hw/misc/mchp_pfsoc_sysreg.c         | 18 ++++++--
 hw/riscv/microchip_pfsoc.c          |  6 +++
 6 files changed, 95 insertions(+), 6 deletions(-)

diff --git a/include/hw/misc/mchp_pfsoc_ioscb.h b/include/hw/misc/mchp_pfsoc_ioscb.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/mchp_pfsoc_ioscb.h
+++ b/include/hw/misc/mchp_pfsoc_ioscb.h
@@ -XXX,XX +XXX,XX @@ typedef struct MchpPfSoCIoscbState {
     MemoryRegion lane01;
     MemoryRegion lane23;
     MemoryRegion ctrl;
+    MemoryRegion qspixip;
+    MemoryRegion mailbox;
     MemoryRegion cfg;
     MemoryRegion ccc;
     MemoryRegion pll_mss;
@@ -XXX,XX +XXX,XX @@ typedef struct MchpPfSoCIoscbState {
     MemoryRegion cfm_sgmii;
     MemoryRegion bc_sgmii;
     MemoryRegion io_calib_sgmii;
+    qemu_irq irq;
 } MchpPfSoCIoscbState;
 
 #define TYPE_MCHP_PFSOC_IOSCB "mchp.pfsoc.ioscb"
diff --git a/include/hw/misc/mchp_pfsoc_sysreg.h b/include/hw/misc/mchp_pfsoc_sysreg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/mchp_pfsoc_sysreg.h
+++ b/include/hw/misc/mchp_pfsoc_sysreg.h
@@ -XXX,XX +XXX,XX @@
 typedef struct MchpPfSoCSysregState {
     SysBusDevice parent;
     MemoryRegion sysreg;
+    qemu_irq irq;
 } MchpPfSoCSysregState;
 
 #define TYPE_MCHP_PFSOC_SYSREG "mchp.pfsoc.sysreg"
diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -XXX,XX +XXX,XX @@ enum {
     MICROCHIP_PFSOC_MMUART2_IRQ = 92,
     MICROCHIP_PFSOC_MMUART3_IRQ = 93,
     MICROCHIP_PFSOC_MMUART4_IRQ = 94,
+    MICROCHIP_PFSOC_MAILBOX_IRQ = 96,
 };
 
 #define MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT    1
diff --git a/hw/misc/mchp_pfsoc_ioscb.c b/hw/misc/mchp_pfsoc_ioscb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/mchp_pfsoc_ioscb.c
+++ b/hw/misc/mchp_pfsoc_ioscb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "qemu/log.h"
 #include "qapi/error.h"
+#include "hw/irq.h"
 #include "hw/sysbus.h"
 #include "hw/misc/mchp_pfsoc_ioscb.h"
 
@@ -XXX,XX +XXX,XX @@
 #define IOSCB_WHOLE_REG_SIZE        0x10000000
 #define IOSCB_SUBMOD_REG_SIZE       0x1000
 #define IOSCB_CCC_REG_SIZE          0x2000000
+#define IOSCB_CTRL_REG_SIZE         0x800
+#define IOSCB_QSPIXIP_REG_SIZE      0x200
+
 
 /*
  * There are many sub-modules in the IOSCB module.
@@ -XXX,XX +XXX,XX @@
 #define IOSCB_LANE01_BASE           0x06500000
 #define IOSCB_LANE23_BASE           0x06510000
 #define IOSCB_CTRL_BASE             0x07020000
+#define IOSCB_QSPIXIP_BASE          0x07020100
+#define IOSCB_MAILBOX_BASE          0x07020800
 #define IOSCB_CFG_BASE              0x07080000
 #define IOSCB_CCC_BASE              0x08000000
 #define IOSCB_PLL_MSS_BASE          0x0E001000
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
+#define SERVICES_CR             0x50
+#define SERVICES_SR             0x54
+#define SERVICES_STATUS_SHIFT   16
+
+static uint64_t mchp_pfsoc_ctrl_read(void *opaque, hwaddr offset,
+                                     unsigned size)
+{
+    uint32_t val = 0;
+
+    switch (offset) {
+    case SERVICES_SR:
+        /*
+         * Although some services have no error codes, most do. All services
+         * that do implement errors, begin their error codes at 1. Treat all
+         * service requests as failures & return 1.
+         * See the "PolarFire® FPGA and PolarFire SoC FPGA System Services"
+         * user guide for more information on service error codes.
+         */
+        val = 1u << SERVICES_STATUS_SHIFT;
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented device read "
+                      "(size %d, offset 0x%" HWADDR_PRIx ")\n",
+                      __func__, size, offset);
+    }
+
+    return val;
+}
+
+static void mchp_pfsoc_ctrl_write(void *opaque, hwaddr offset,
+                                  uint64_t value, unsigned size)
+{
+    MchpPfSoCIoscbState *s = opaque;
+
+    switch (offset) {
+    case SERVICES_CR:
+        qemu_irq_raise(s->irq);
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
+                      "(size %d, value 0x%" PRIx64
+                      ", offset 0x%" HWADDR_PRIx ")\n",
+                      __func__, size, value, offset);
+    }
+}
+
+static const MemoryRegionOps mchp_pfsoc_ctrl_ops = {
+    .read = mchp_pfsoc_ctrl_read,
+    .write = mchp_pfsoc_ctrl_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
 static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
 {
     MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
@@ -XXX,XX +XXX,XX @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
                           "mchp.pfsoc.ioscb.lane23", IOSCB_SUBMOD_REG_SIZE);
     memory_region_add_subregion(&s->container, IOSCB_LANE23_BASE, &s->lane23);
 
-    memory_region_init_io(&s->ctrl, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
-                          "mchp.pfsoc.ioscb.ctrl", IOSCB_SUBMOD_REG_SIZE);
+    memory_region_init_io(&s->ctrl, OBJECT(s), &mchp_pfsoc_ctrl_ops, s,
+                          "mchp.pfsoc.ioscb.ctrl", IOSCB_CTRL_REG_SIZE);
     memory_region_add_subregion(&s->container, IOSCB_CTRL_BASE, &s->ctrl);
 
+    memory_region_init_io(&s->qspixip, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
+                          "mchp.pfsoc.ioscb.qspixip", IOSCB_QSPIXIP_REG_SIZE);
+    memory_region_add_subregion(&s->container, IOSCB_QSPIXIP_BASE, &s->qspixip);
+
+    memory_region_init_io(&s->mailbox, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
+                          "mchp.pfsoc.ioscb.mailbox", IOSCB_SUBMOD_REG_SIZE);
+    memory_region_add_subregion(&s->container, IOSCB_MAILBOX_BASE, &s->mailbox);
+
     memory_region_init_io(&s->cfg, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
                           "mchp.pfsoc.ioscb.cfg", IOSCB_SUBMOD_REG_SIZE);
     memory_region_add_subregion(&s->container, IOSCB_CFG_BASE, &s->cfg);
@@ -XXX,XX +XXX,XX @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
                           IOSCB_SUBMOD_REG_SIZE);
     memory_region_add_subregion(&s->container, IOSCB_IO_CALIB_SGMII_BASE,
                                 &s->io_calib_sgmii);
+
+    sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
 }
 
 static void mchp_pfsoc_ioscb_class_init(ObjectClass *klass, void *data)
diff --git a/hw/misc/mchp_pfsoc_sysreg.c b/hw/misc/mchp_pfsoc_sysreg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/mchp_pfsoc_sysreg.c
+++ b/hw/misc/mchp_pfsoc_sysreg.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "qemu/log.h"
 #include "qapi/error.h"
+#include "hw/irq.h"
 #include "hw/sysbus.h"
 #include "hw/misc/mchp_pfsoc_sysreg.h"
 
 #define ENVM_CR         0xb8
+#define MESSAGE_INT     0x118c
 
 static uint64_t mchp_pfsoc_sysreg_read(void *opaque, hwaddr offset,
                                        unsigned size)
@@ -XXX,XX +XXX,XX @@ static uint64_t mchp_pfsoc_sysreg_read(void *opaque, hwaddr offset,
 static void mchp_pfsoc_sysreg_write(void *opaque, hwaddr offset,
                                     uint64_t value, unsigned size)
 {
-    qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
-                  "(size %d, value 0x%" PRIx64
-                  ", offset 0x%" HWADDR_PRIx ")\n",
-                  __func__, size, value, offset);
+    MchpPfSoCSysregState *s = opaque;
+    switch (offset) {
+    case MESSAGE_INT:
+        qemu_irq_lower(s->irq);
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
+                      "(size %d, value 0x%" PRIx64
+                      ", offset 0x%" HWADDR_PRIx ")\n",
+                      __func__, size, value, offset);
+    }
 }
 
 static const MemoryRegionOps mchp_pfsoc_sysreg_ops = {
@@ -XXX,XX +XXX,XX @@ static void mchp_pfsoc_sysreg_realize(DeviceState *dev, Error **errp)
                           "mchp.pfsoc.sysreg",
                           MCHP_PFSOC_SYSREG_REG_SIZE);
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->sysreg);
+    sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
 }
 
 static void mchp_pfsoc_sysreg_class_init(ObjectClass *klass, void *data)
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->sysreg), errp);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysreg), 0,
                     memmap[MICROCHIP_PFSOC_SYSREG].base);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sysreg), 0,
+                       qdev_get_gpio_in(DEVICE(s->plic),
+                       MICROCHIP_PFSOC_MAILBOX_IRQ));
 
     /* AXISW */
     create_unimplemented_device("microchip.pfsoc.axisw",
@@ -XXX,XX +XXX,XX @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->ioscb), errp);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ioscb), 0,
                     memmap[MICROCHIP_PFSOC_IOSCB].base);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->ioscb), 0,
+                       qdev_get_gpio_in(DEVICE(s->plic),
+                       MICROCHIP_PFSOC_MAILBOX_IRQ));
 
     /* FPGA Fabric */
     create_unimplemented_device("microchip.pfsoc.fabricfic3",
-- 
2.38.1

From: Jim Shu <jim.shu@sifive.com>

If the number of interrupt is not multiple of 32, PLIC will have
out-of-bound access to source_priority array. Compute the number of
interrupt in the last word to avoid this out-of-bound access of array.

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Message-Id: <20221127165753.30533-1-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/sifive_plic.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/sifive_plic.c
+++ b/hw/intc/sifive_plic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t sifive_plic_claimed(SiFivePLICState *plic, uint32_t addrid)
     uint32_t max_irq = 0;
     uint32_t max_prio = plic->target_priority[addrid];
     int i, j;
+    int num_irq_in_word = 32;
 
     for (i = 0; i < plic->bitfield_words; i++) {
         uint32_t pending_enabled_not_claimed =
@@ -XXX,XX +XXX,XX @@ static uint32_t sifive_plic_claimed(SiFivePLICState *plic, uint32_t addrid)
             continue;
         }
 
-        for (j = 0; j < 32; j++) {
+        if (i == (plic->bitfield_words - 1)) {
+            /*
+             * If plic->num_sources is not multiple of 32, num-of-irq in last
+             * word is not 32. Compute the num-of-irq of last word to avoid
+             * out-of-bound access of source_priority array.
+             */
+            num_irq_in_word = plic->num_sources - ((plic->bitfield_words - 1) << 5);
+        }
+
+        for (j = 0; j < num_irq_in_word; j++) {
             int irq = (i << 5) + j;
             uint32_t prio = plic->source_priority[irq];
             int enabled = pending_enabled_not_claimed & (1 << j);
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

The priv spec v1.12 says:

If no PMP entry matches an M-mode access, the access succeeds. If
  no PMP entry matches an S-mode or U-mode access, but at least one
  PMP entry is implemented, the access fails. Failed accesses generate
  an instruction, load, or store access-fault exception.

At present the exception cause is set to 'illegal instruction' but
should have been 'instruction access fault'.

Fixes: d102f19a2085 ("target/riscv/pmp: Raise exception if no PMP entry is configured")
Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221205065303.204095-1-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/op_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_mret(CPURISCVState *env)
 
     if (riscv_feature(env, RISCV_FEATURE_PMP) &&
         !pmp_get_num_rules(env) && (prev_priv != PRV_M)) {
-        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+        riscv_raise_exception(env, RISCV_EXCP_INST_ACCESS_FAULT, GETPC());
     }
 
     target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV);
-- 
2.38.1

From: Richard Henderson <richard.henderson@linaro.org>

Failure to set pc_succ_insn may result in a TB covering zero bytes,
which triggers an assert within the code generator.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1224
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221203175744.151365-1-richard.henderson@linaro.org>
[ Changes by AF:
 - Add missing run-plugin-test-noc-% line
]
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c          | 12 ++++--------
 tests/tcg/Makefile.target         |  2 ++
 tests/tcg/riscv64/Makefile.target |  6 ++++++
 tests/tcg/riscv64/test-noc.S      | 32 +++++++++++++++++++++++++++++++
 4 files changed, 44 insertions(+), 8 deletions(-)
 create mode 100644 tests/tcg/riscv64/test-noc.S

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void decode_opc(CPURISCVState *env, DisasContext *ctx, uint16_t opcode)
     ctx->virt_inst_excp = false;
     /* Check for compressed insn */
     if (insn_len(opcode) == 2) {
-        if (!has_ext(ctx, RVC)) {
-            gen_exception_illegal(ctx);
-        } else {
-            ctx->opcode = opcode;
-            ctx->pc_succ_insn = ctx->base.pc_next + 2;
-            if (decode_insn16(ctx, opcode)) {
-                return;
-            }
+        ctx->opcode = opcode;
+        ctx->pc_succ_insn = ctx->base.pc_next + 2;
+        if (has_ext(ctx, RVC) && decode_insn16(ctx, opcode)) {
+            return;
         }
     } else {
         uint32_t opcode32 = opcode;
diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
 
 %: %.c
 	$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $< -o $@ $(LDFLAGS)
+%: %.S
+	$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $< -o $@ $(LDFLAGS)
 else
 # For softmmu targets we include a different Makefile fragement as the
 # build options for bare programs are usually pretty different. They
diff --git a/tests/tcg/riscv64/Makefile.target b/tests/tcg/riscv64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/riscv64/Makefile.target
+++ b/tests/tcg/riscv64/Makefile.target
@@ -XXX,XX +XXX,XX @@
 VPATH += $(SRC_PATH)/tests/tcg/riscv64
 TESTS += test-div
 TESTS += noexec
+
+# Disable compressed instructions for test-noc
+TESTS += test-noc
+test-noc: LDFLAGS = -nostdlib -static
+run-test-noc: QEMU_OPTS += -cpu rv64,c=false
+run-plugin-test-noc-%: QEMU_OPTS += -cpu rv64,c=false
diff --git a/tests/tcg/riscv64/test-noc.S b/tests/tcg/riscv64/test-noc.S
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/riscv64/test-noc.S
@@ -XXX,XX +XXX,XX @@
+#include <asm/unistd.h>
+
+	.text
+	.globl _start
+_start:
+	.option	norvc
+	li	a0, 4		/* SIGILL */
+	la	a1, sa
+	li	a2, 0
+	li	a3, 8
+	li	a7, __NR_rt_sigaction
+	scall
+
+	.option	rvc
+	li	a0, 1
+	j	exit
+	.option	norvc
+
+pass:
+	li	a0, 0
+exit:
+	li	a7, __NR_exit
+	scall
+
+	.data
+	/* struct kernel_sigaction sa = { .sa_handler = pass }; */
+	.type	sa, @object
+	.size	sa, 32
+sa:
+	.dword	pass
+	.zero	24
+
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

There are 2 paths in helper_sret() and the same mstatus update codes
are replicated. Extract the common parts to simplify it a little bit.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221207090037.281452-1-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/op_helper.c | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
     }
 
     mstatus = env->mstatus;
+    prev_priv = get_field(mstatus, MSTATUS_SPP);
+    mstatus = set_field(mstatus, MSTATUS_SIE,
+                        get_field(mstatus, MSTATUS_SPIE));
+    mstatus = set_field(mstatus, MSTATUS_SPIE, 1);
+    mstatus = set_field(mstatus, MSTATUS_SPP, PRV_U);
+    env->mstatus = mstatus;
 
     if (riscv_has_ext(env, RVH) && !riscv_cpu_virt_enabled(env)) {
         /* We support Hypervisor extensions and virtulisation is disabled */
         target_ulong hstatus = env->hstatus;
 
-        prev_priv = get_field(mstatus, MSTATUS_SPP);
         prev_virt = get_field(hstatus, HSTATUS_SPV);
 
         hstatus = set_field(hstatus, HSTATUS_SPV, 0);
-        mstatus = set_field(mstatus, MSTATUS_SPP, 0);
-        mstatus = set_field(mstatus, SSTATUS_SIE,
-                            get_field(mstatus, SSTATUS_SPIE));
-        mstatus = set_field(mstatus, SSTATUS_SPIE, 1);
 
-        env->mstatus = mstatus;
         env->hstatus = hstatus;
 
         if (prev_virt) {
@@ -XXX,XX +XXX,XX @@ target_ulong helper_sret(CPURISCVState *env)
         }
 
         riscv_cpu_set_virt_enabled(env, prev_virt);
-    } else {
-        prev_priv = get_field(mstatus, MSTATUS_SPP);
-
-        mstatus = set_field(mstatus, MSTATUS_SIE,
-                            get_field(mstatus, MSTATUS_SPIE));
-        mstatus = set_field(mstatus, MSTATUS_SPIE, 1);
-        mstatus = set_field(mstatus, MSTATUS_SPP, PRV_U);
-        env->mstatus = mstatus;
     }
 
     riscv_cpu_set_mode(env, prev_priv);
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

Since priv spec v1.12, MRET and SRET now clear mstatus.MPRV when
leaving M-mode.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221207090037.281452-2-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/op_helper.c | 6 ++++++
 1 file changed, 6 insertions(+)

From: Christoph Muellner <christoph.muellner@vrull.eu>

This patch adds support for the Zawrs ISA extension.
Given the current (incomplete) implementation of reservation sets
there seems to be no way to provide a full emulation of the WRS
instruction (wake on reservation set invalidation or timeout or
interrupt). Therefore, we just exit the TB and return to the main loop.

The specification can be found here:
  https://github.com/riscv/riscv-zawrs/blob/main/zawrs.adoc

Note, that the Zawrs extension is frozen, but not ratified yet.

Changes since v3:
* Remove "RFC" since the extension is frozen
* Rebase on master and fix integration issues
* Fix entry ordering in extension list

Changes since v2:
* Rebase on master and resolve conflicts
* Adjustments according to a specification change
* Inline REQUIRE_ZAWRS() since it has only one user

Changes since v1:
* Adding zawrs to the ISA string that is passed to the kernel

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221005144948.3421504-1-christoph.muellner@vrull.eu>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h                          |  1 +
 target/riscv/insn32.decode                  |  4 ++
 target/riscv/cpu.c                          |  7 +++
 target/riscv/translate.c                    |  1 +
 target/riscv/insn_trans/trans_rvzawrs.c.inc | 51 +++++++++++++++++++++
 5 files changed, 64 insertions(+)
 create mode 100644 target/riscv/insn_trans/trans_rvzawrs.c.inc

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_svnapot;
     bool ext_svpbmt;
     bool ext_zdinx;
+    bool ext_zawrs;
     bool ext_zfh;
     bool ext_zfhmin;
     bool ext_zfinx;
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vsetvli         0 ........... ..... 111 ..... 1010111  @r2_zimm11
 vsetivli        11 .......... ..... 111 ..... 1010111  @r2_zimm10
 vsetvl          1000000 ..... ..... 111 ..... 1010111  @r
 
+# *** Zawrs Standard Extension ***
+wrs_nto    000000001101 00000 000 00000 1110011
+wrs_sto    000000011101 00000 000 00000 1110011
+
 # *** RV32 Zba Standard Extension ***
 sh1add     0010000 .......... 010 ..... 0110011 @r
 sh2add     0010000 .......... 100 ..... 0110011 @r
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zicsr, true, PRIV_VERSION_1_10_0, ext_icsr),
     ISA_EXT_DATA_ENTRY(zifencei, true, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, true, PRIV_VERSION_1_10_0, ext_zihintpause),
+    ISA_EXT_DATA_ENTRY(zawrs, true, PRIV_VERSION_1_12_0, ext_zawrs),
     ISA_EXT_DATA_ENTRY(zfh, true, PRIV_VERSION_1_12_0, ext_zfh),
     ISA_EXT_DATA_ENTRY(zfhmin, true, PRIV_VERSION_1_12_0, ext_zfhmin),
     ISA_EXT_DATA_ENTRY(zfinx, true, PRIV_VERSION_1_12_0, ext_zfinx),
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
             return;
         }
 
+        if ((cpu->cfg.ext_zawrs) && !cpu->cfg.ext_a) {
+            error_setg(errp, "Zawrs extension requires A extension");
+            return;
+        }
+
         if ((cpu->cfg.ext_zfh || cpu->cfg.ext_zfhmin) && !cpu->cfg.ext_f) {
             error_setg(errp, "Zfh/Zfhmin extensions require F extension");
             return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("Zifencei", RISCVCPU, cfg.ext_ifencei, true),
     DEFINE_PROP_BOOL("Zicsr", RISCVCPU, cfg.ext_icsr, true),
     DEFINE_PROP_BOOL("Zihintpause", RISCVCPU, cfg.ext_zihintpause, true),
+    DEFINE_PROP_BOOL("Zawrs", RISCVCPU, cfg.ext_zawrs, true),
     DEFINE_PROP_BOOL("Zfh", RISCVCPU, cfg.ext_zfh, false),
     DEFINE_PROP_BOOL("Zfhmin", RISCVCPU, cfg.ext_zfhmin, false),
     DEFINE_PROP_BOOL("Zve32f", RISCVCPU, cfg.ext_zve32f, false),
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
 #include "insn_trans/trans_rvh.c.inc"
 #include "insn_trans/trans_rvv.c.inc"
 #include "insn_trans/trans_rvb.c.inc"
+#include "insn_trans/trans_rvzawrs.c.inc"
 #include "insn_trans/trans_rvzfh.c.inc"
 #include "insn_trans/trans_rvk.c.inc"
 #include "insn_trans/trans_privileged.c.inc"
diff --git a/target/riscv/insn_trans/trans_rvzawrs.c.inc b/target/riscv/insn_trans/trans_rvzawrs.c.inc
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/insn_trans/trans_rvzawrs.c.inc
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V translation routines for the RISC-V Zawrs Extension.
+ *
+ * Copyright (c) 2022 Christoph Muellner, christoph.muellner@vrull.io
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+static bool trans_wrs(DisasContext *ctx)
+{
+    if (!ctx->cfg_ptr->ext_zawrs) {
+        return false;
+    }
+
+    /*
+     * The specification says:
+     * While stalled, an implementation is permitted to occasionally
+     * terminate the stall and complete execution for any reason.
+     *
+     * So let's just exit TB and return to the main loop.
+     */
+
+    /* Clear the load reservation  (if any).  */
+    tcg_gen_movi_tl(load_res, -1);
+
+    gen_set_pc_imm(ctx, ctx->pc_succ_insn);
+    tcg_gen_exit_tb(NULL, 0);
+    ctx->base.is_jmp = DISAS_NORETURN;
+
+    return true;
+}
+
+#define GEN_TRANS_WRS(insn)                                     \
+static bool trans_ ## insn(DisasContext *ctx, arg_ ## insn *a)  \
+{                                                               \
+    (void)a;                                                    \
+    return trans_wrs(ctx);                                      \
+}
+
+GEN_TRANS_WRS(wrs_nto)
+GEN_TRANS_WRS(wrs_sto)
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

hw/pci/Kconfig says MSI_NONBROKEN should be selected by interrupt
controllers regardless of how MSI is implemented. msi_nonbroken is
initialized to true in sifive_plic_realize().

Let SIFIVE_PLIC select MSI_NONBROKEN and drop the selection from
RISC-V machines.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Message-Id: <20221211030829.802437-1-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/Kconfig  | 1 +
 hw/riscv/Kconfig | 5 -----
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_IMSIC
 
 config SIFIVE_PLIC
     bool
+    select MSI_NONBROKEN
 
 config GOLDFISH_PIC
     bool
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config MICROCHIP_PFSOC
     select MCHP_PFSOC_IOSCB
     select MCHP_PFSOC_MMUART
     select MCHP_PFSOC_SYSREG
-    select MSI_NONBROKEN
     select RISCV_ACLINT
     select SIFIVE_PDMA
     select SIFIVE_PLIC
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     imply TPM_TIS_SYSBUS
     select RISCV_NUMA
     select GOLDFISH_RTC
-    select MSI_NONBROKEN
     select PCI
     select PCI_EXPRESS_GENERIC_BRIDGE
     select PFLASH_CFI01
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
 
 config SIFIVE_E
     bool
-    select MSI_NONBROKEN
     select RISCV_ACLINT
     select SIFIVE_GPIO
     select SIFIVE_PLIC
@@ -XXX,XX +XXX,XX @@ config SIFIVE_E
 config SIFIVE_U
     bool
     select CADENCE
-    select MSI_NONBROKEN
     select RISCV_ACLINT
     select SIFIVE_GPIO
     select SIFIVE_PDMA
@@ -XXX,XX +XXX,XX @@ config SPIKE
     bool
     select RISCV_NUMA
     select HTIF
-    select MSI_NONBROKEN
     select RISCV_ACLINT
     select SIFIVE_PLIC
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

SHAKTI_C machine Kconfig option was inserted in disorder. Fix it.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Message-Id: <20221211030829.802437-4-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/Kconfig | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -XXX,XX +XXX,XX @@ config RISCV_NUMA
 config IBEX
     bool
 
+# RISC-V machines in alphabetical order
+
 config MICROCHIP_PFSOC
     bool
     select CADENCE_SDHCI
@@ -XXX,XX +XXX,XX @@ config OPENTITAN
     select SIFIVE_PLIC
     select UNIMP
 
-config SHAKTI_C
-    bool
-    select UNIMP
-    select SHAKTI_UART
-    select RISCV_ACLINT
-    select SIFIVE_PLIC
-
 config RISCV_VIRT
     bool
     imply PCI_DEVICES
@@ -XXX,XX +XXX,XX @@ config RISCV_VIRT
     select FW_CFG_DMA
     select PLATFORM_BUS
 
+config SHAKTI_C
+    bool
+    select RISCV_ACLINT
+    select SHAKTI_UART
+    select SIFIVE_PLIC
+    select UNIMP
+
 config SIFIVE_E
     bool
     select RISCV_ACLINT
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

H-mode has been removed since priv spec 1.10. Drop it.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221211030829.802437-6-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/intc/sifive_plic.h | 1 -
 hw/intc/sifive_plic.c         | 1 -
 2 files changed, 2 deletions(-)

diff --git a/include/hw/intc/sifive_plic.h b/include/hw/intc/sifive_plic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/sifive_plic.h
+++ b/include/hw/intc/sifive_plic.h
@@ -XXX,XX +XXX,XX @@ DECLARE_INSTANCE_CHECKER(SiFivePLICState, SIFIVE_PLIC,
 typedef enum PLICMode {
     PLICMode_U,
     PLICMode_S,
-    PLICMode_H,
     PLICMode_M
 } PLICMode;
 
diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/sifive_plic.c
+++ b/hw/intc/sifive_plic.c
@@ -XXX,XX +XXX,XX @@ static PLICMode char_to_mode(char c)
     switch (c) {
     case 'U': return PLICMode_U;
     case 'S': return PLICMode_S;
-    case 'H': return PLICMode_H;
     case 'M': return PLICMode_M;
     default:
         error_report("plic: invalid mode '%c'", c);
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

At present the PLIC config parser can only handle legal config string
like "MS,MS". However if a config string like ",MS,MS,,MS,MS,," is
given the parser won't get the correct configuration.

This commit improves the config parser to make it more robust.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221211030829.802437-7-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/sifive_plic.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/sifive_plic.c
+++ b/hw/intc/sifive_plic.c
@@ -XXX,XX +XXX,XX @@ static void sifive_plic_reset(DeviceState *dev)
  */
 static void parse_hart_config(SiFivePLICState *plic)
 {
-    int addrid, hartid, modes;
+    int addrid, hartid, modes, m;
     const char *p;
     char c;
 
@@ -XXX,XX +XXX,XX @@ static void parse_hart_config(SiFivePLICState *plic)
     p = plic->hart_config;
     while ((c = *p++)) {
         if (c == ',') {
-            addrid += ctpop8(modes);
-            modes = 0;
-            hartid++;
+            if (modes) {
+                addrid += ctpop8(modes);
+                hartid++;
+                modes = 0;
+            }
         } else {
-            int m = 1 << char_to_mode(c);
+            m = 1 << char_to_mode(c);
             if (modes == (modes | m)) {
                 error_report("plic: duplicate mode '%c' in config: %s",
                              c, plic->hart_config);
@@ -XXX,XX +XXX,XX @@ static void parse_hart_config(SiFivePLICState *plic)
     }
     if (modes) {
         addrid += ctpop8(modes);
+        hartid++;
+        modes = 0;
     }
-    hartid++;
 
     plic->num_addrs = addrid;
     plic->num_harts = hartid;
@@ -XXX,XX +XXX,XX @@ static void parse_hart_config(SiFivePLICState *plic)
     p = plic->hart_config;
     while ((c = *p++)) {
         if (c == ',') {
-            hartid++;
+            if (modes) {
+                hartid++;
+                modes = 0;
+            }
         } else {
+            m = char_to_mode(c);
             plic->addr_config[addrid].addrid = addrid;
             plic->addr_config[addrid].hartid = hartid;
-            plic->addr_config[addrid].mode = char_to_mode(c);
+            plic->addr_config[addrid].mode = m;
+            modes |= (1 << m);
             addrid++;
         }
     }
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

The realize() callback has an errp for us to propagate the error up.
While we are here, correct the wrong multi-line comment format.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20221211030829.802437-8-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/sifive_plic.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/sifive_plic.c
+++ b/hw/intc/sifive_plic.c
@@ -XXX,XX +XXX,XX @@ static void sifive_plic_realize(DeviceState *dev, Error **errp)
     s->m_external_irqs = g_malloc(sizeof(qemu_irq) * s->num_harts);
     qdev_init_gpio_out(dev, s->m_external_irqs, s->num_harts);
 
-    /* We can't allow the supervisor to control SEIP as this would allow the
+    /*
+     * We can't allow the supervisor to control SEIP as this would allow the
      * supervisor to clear a pending external interrupt which will result in
      * lost a interrupt in the case a PLIC is attached. The SEIP bit must be
      * hardware controlled when a PLIC is attached.
@@ -XXX,XX +XXX,XX @@ static void sifive_plic_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < s->num_harts; i++) {
         RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(s->hartid_base + i));
         if (riscv_cpu_claim_interrupts(cpu, MIP_SEIP) < 0) {
-            error_report("SEIP already claimed");
-            exit(1);
+            error_setg(errp, "SEIP already claimed");
+            return;
         }
     }
 
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

At present the default value of "num-sources" property is zero,
which does not make a lot of sense, as in sifive_plic_realize()
we see s->bitfield_words is calculated by:

s->bitfield_words = (s->num_sources + 31) >> 5;

if the we don't configure "num-sources" property its default value
zero makes s->bitfield_words zero too, which isn't true because
interrupt source 0 still occupies one word.

Let's change the default value to 1 meaning that only interrupt
source 0 is supported by default and a sanity check in realize().

While we are here, add a comment to describe the exact meaning of
this property that the number should include interrupt source 0.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221211030829.802437-9-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/sifive_plic.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/sifive_plic.c
+++ b/hw/intc/sifive_plic.c
@@ -XXX,XX +XXX,XX @@ static void sifive_plic_realize(DeviceState *dev, Error **errp)
 
     parse_hart_config(s);
 
+    if (!s->num_sources) {
+        error_setg(errp, "plic: invalid number of interrupt sources");
+        return;
+    }
+
     s->bitfield_words = (s->num_sources + 31) >> 5;
     s->num_enables = s->bitfield_words * s->num_addrs;
     s->source_priority = g_new0(uint32_t, s->num_sources);
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sifive_plic = {
 static Property sifive_plic_properties[] = {
     DEFINE_PROP_STRING("hart-config", SiFivePLICState, hart_config),
     DEFINE_PROP_UINT32("hartid-base", SiFivePLICState, hartid_base, 0),
-    DEFINE_PROP_UINT32("num-sources", SiFivePLICState, num_sources, 0),
+    /* number of interrupt sources including interrupt source 0 */
+    DEFINE_PROP_UINT32("num-sources", SiFivePLICState, num_sources, 1),
     DEFINE_PROP_UINT32("num-priorities", SiFivePLICState, num_priorities, 0),
     DEFINE_PROP_UINT32("priority-base", SiFivePLICState, priority_base, 0),
     DEFINE_PROP_UINT32("pending-base", SiFivePLICState, pending_base, 0),
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

Per chapter 6.5.2 in [1], the number of interupt sources including
interrupt source 0 should be 187.

[1] PolarFire SoC MSS TRM:
https://ww1.microchip.com/downloads/aemDocuments/documents/FPGA/ProductDocuments/ReferenceManuals/PolarFire_SoC_FPGA_MSS_Technical_Reference_Manual_VC.pdf

Fixes: 56f6e31e7b7e ("hw/riscv: Initial support for Microchip PolarFire SoC Icicle Kit board")
Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Message-Id: <20221211030829.802437-10-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: Bin Meng <bmeng@tinylab.org>

Per chapter 10 in Freedom E310 manuals [1][2][3], E310 G002 and G003
supports 52 interrupt sources while G000 supports 51 interrupt sources.

We use the value of G002 and G003, so it is 53 (including source 0).

[1] G000 manual:
https://sifive.cdn.prismic.io/sifive/4faf3e34-4a42-4c2f-be9e-c77baa4928c7_fe310-g000-manual-v3p2.pdf

[2] G002 manual:
https://sifive.cdn.prismic.io/sifive/034760b5-ac6a-4b1c-911c-f4148bb2c4a5_fe310-g002-v1p5.pdf

[3] G003 manual:
https://sifive.cdn.prismic.io/sifive/3af39c59-6498-471e-9dab-5355a0d539eb_fe310-g003-manual.pdf

Fixes: eb637edb1241 ("SiFive Freedom E Series RISC-V Machine")
Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221211030829.802437-11-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/sifive_e.h | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/hw/riscv/sifive_e.h b/include/hw/riscv/sifive_e.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/sifive_e.h
+++ b/include/hw/riscv/sifive_e.h
@@ -XXX,XX +XXX,XX @@ enum {
 };
 
 #define SIFIVE_E_PLIC_HART_CONFIG "M"
-#define SIFIVE_E_PLIC_NUM_SOURCES 127
+/*
+ * Freedom E310 G002 and G003 supports 52 interrupt sources while
+ * Freedom E310 G000 supports 51 interrupt sources. We use the value
+ * of G002 and G003, so it is 53 (including interrupt source 0).
+ */
+#define SIFIVE_E_PLIC_NUM_SOURCES 53
 #define SIFIVE_E_PLIC_NUM_PRIORITIES 7
 #define SIFIVE_E_PLIC_PRIORITY_BASE 0x04
 #define SIFIVE_E_PLIC_PENDING_BASE 0x1000
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

At present magic number is used to create "riscv,ndev" property
in the dtb. Let's use the macro SIFIVE_U_PLIC_NUM_SOURCES that
is used to instantiate the PLIC model instead.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221211030829.802437-12-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/sifive_u.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
     qemu_fdt_setprop_cells(fdt, nodename, "reg",
         0x0, memmap[SIFIVE_U_DEV_PLIC].base,
         0x0, memmap[SIFIVE_U_DEV_PLIC].size);
-    qemu_fdt_setprop_cell(fdt, nodename, "riscv,ndev", 0x35);
+    qemu_fdt_setprop_cell(fdt, nodename, "riscv,ndev",
+                          SIFIVE_U_PLIC_NUM_SOURCES - 1);
     qemu_fdt_setprop_cell(fdt, nodename, "phandle", plic_phandle);
     plic_phandle = qemu_fdt_get_phandle(fdt, nodename);
     g_free(cells);
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

Commit 28d8c281200f ("hw/riscv: virt: Add optional AIA IMSIC support to virt machine")
changed the value of VIRT_IRQCHIP_NUM_SOURCES from 127 to 53, which
is VIRTIO_NDEV and also used as the value of "riscv,ndev" property
in the dtb. Unfortunately this is wrong as VIRT_IRQCHIP_NUM_SOURCES
should include interrupt source 0 but "riscv,ndev" does not.

While we are here, we also fix the comments of platform bus irq range
which is now "64 to 96", but should be "64 to 95", introduced since
commit 1832b7cb3f64 ("hw/riscv: virt: Create a platform bus").

Fixes: 28d8c281200f ("hw/riscv: virt: Add optional AIA IMSIC support to virt machine")
Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221211030829.802437-13-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/virt.h | 5 ++---
 hw/riscv/virt.c         | 3 ++-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/hw/riscv/virt.h b/include/hw/riscv/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/riscv/virt.h
+++ b/include/hw/riscv/virt.h
@@ -XXX,XX +XXX,XX @@ enum {
     VIRTIO_IRQ = 1, /* 1 to 8 */
     VIRTIO_COUNT = 8,
     PCIE_IRQ = 0x20, /* 32 to 35 */
-    VIRT_PLATFORM_BUS_IRQ = 64, /* 64 to 96 */
-    VIRTIO_NDEV = 96 /* Arbitrary maximum number of interrupts */
+    VIRT_PLATFORM_BUS_IRQ = 64, /* 64 to 95 */
 };
 
 #define VIRT_PLATFORM_BUS_NUM_IRQS 32
 
 #define VIRT_IRQCHIP_NUM_MSIS 255
-#define VIRT_IRQCHIP_NUM_SOURCES VIRTIO_NDEV
+#define VIRT_IRQCHIP_NUM_SOURCES 96
 #define VIRT_IRQCHIP_NUM_PRIO_BITS 3
 #define VIRT_IRQCHIP_MAX_GUESTS_BITS 3
 #define VIRT_IRQCHIP_MAX_GUESTS ((1U << VIRT_IRQCHIP_MAX_GUESTS_BITS) - 1U)
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_plic(RISCVVirtState *s,
         plic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 4);
     qemu_fdt_setprop_cells(mc->fdt, plic_name, "reg",
         0x0, plic_addr, 0x0, memmap[VIRT_PLIC].size);
-    qemu_fdt_setprop_cell(mc->fdt, plic_name, "riscv,ndev", VIRTIO_NDEV);
+    qemu_fdt_setprop_cell(mc->fdt, plic_name, "riscv,ndev",
+                          VIRT_IRQCHIP_NUM_SOURCES - 1);
     riscv_socket_fdt_write_id(mc, mc->fdt, plic_name, socket);
     qemu_fdt_setprop_cell(mc->fdt, plic_name, "phandle",
         plic_phandles[socket]);
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

At present the SiFive PLIC model "priority-base" expects interrupt
priority register base starting from source 1 instead source 0,
that's why on most platforms "priority-base" is set to 0x04 except
'opentitan' machine. 'opentitan' should have set "priority-base"
to 0x04 too.

Note the irq number calculation in sifive_plic_{read,write} is
correct as the codes make up for the irq number by adding 1.

Let's simply update "priority-base" to start from interrupt source
0 and add a comment to make it crystal clear.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Message-Id: <20221211030829.802437-14-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/hw/riscv/microchip_pfsoc.h | 2 +-
 include/hw/riscv/shakti_c.h        | 2 +-
 include/hw/riscv/sifive_e.h        | 2 +-
 include/hw/riscv/sifive_u.h        | 2 +-
 include/hw/riscv/virt.h            | 2 +-
 hw/intc/sifive_plic.c              | 5 +++--
 6 files changed, 8 insertions(+), 7 deletions(-)

From: Bin Meng <bmeng@tinylab.org>

"hartid-base" and "priority-base" are zero by default. There is no
need to initialize them to zero again.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221211030829.802437-15-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/opentitan.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/riscv/opentitan.c b/hw/riscv/opentitan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/opentitan.c
+++ b/hw/riscv/opentitan.c
@@ -XXX,XX +XXX,XX @@ static void lowrisc_ibex_soc_realize(DeviceState *dev_soc, Error **errp)
 
     /* PLIC */
     qdev_prop_set_string(DEVICE(&s->plic), "hart-config", "M");
-    qdev_prop_set_uint32(DEVICE(&s->plic), "hartid-base", 0);
     qdev_prop_set_uint32(DEVICE(&s->plic), "num-sources", 180);
     qdev_prop_set_uint32(DEVICE(&s->plic), "num-priorities", 3);
-    qdev_prop_set_uint32(DEVICE(&s->plic), "priority-base", 0x00);
     qdev_prop_set_uint32(DEVICE(&s->plic), "pending-base", 0x1000);
     qdev_prop_set_uint32(DEVICE(&s->plic), "enable-base", 0x2000);
     qdev_prop_set_uint32(DEVICE(&s->plic), "enable-stride", 32);
-- 
2.38.1

From: Bin Meng <bmeng@tinylab.org>

The pending register upper limit is currently set to
plic->num_sources >> 3, which is wrong, e.g.: considering
plic->num_sources is 7, the upper limit becomes 0 which fails
the range check if reading the pending register at pending_base.

Fixes: 1e24429e40df ("SiFive RISC-V PLIC Block")
Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20221211030829.802437-16-bmeng@tinylab.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/sifive_plic.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/intc/sifive_plic.c b/hw/intc/sifive_plic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/sifive_plic.c
+++ b/hw/intc/sifive_plic.c
@@ -XXX,XX +XXX,XX @@ static uint64_t sifive_plic_read(void *opaque, hwaddr addr, unsigned size)
         uint32_t irq = (addr - plic->priority_base) >> 2;
 
         return plic->source_priority[irq];
-    } else if (addr_between(addr, plic->pending_base, plic->num_sources >> 3)) {
+    } else if (addr_between(addr, plic->pending_base,
+                            (plic->num_sources + 31) >> 3)) {
         uint32_t word = (addr - plic->pending_base) >> 2;
 
         return plic->pending[word];
@@ -XXX,XX +XXX,XX @@ static void sifive_plic_write(void *opaque, hwaddr addr, uint64_t value,
             sifive_plic_update(plic);
         }
     } else if (addr_between(addr, plic->pending_base,
-                            plic->num_sources >> 3)) {
+                            (plic->num_sources + 31) >> 3)) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid pending write: 0x%" HWADDR_PRIx "",
                       __func__, addr);
-- 
2.38.1

The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:

Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)

are available in the Git repository at:

https://github.com/alistair23/qemu.git tags/pull-riscv-to-apply-20230911

for you to fetch changes up to e7a03409f29e2da59297d55afbaec98c96e43e3a:

target/riscv: don't read CSR in riscv_csrrw_do64 (2023-09-11 11:45:55 +1000)

----------------------------------------------------------------
First RISC-V PR for 8.2

* Remove 'host' CPU from TCG
 * riscv_htif Fixup printing on big endian hosts
 * Add zmmul isa string
 * Add smepmp isa string
 * Fix page_check_range use in fault-only-first
 * Use existing lookup tables for MixColumns
 * Add RISC-V vector cryptographic instruction set support
 * Implement WARL behaviour for mcountinhibit/mcounteren
 * Add Zihintntl extension ISA string to DTS
 * Fix zfa fleq.d and fltq.d
 * Fix upper/lower mtime write calculation
 * Make rtc variable names consistent
 * Use abi type for linux-user target_ucontext
 * Add RISC-V KVM AIA Support
 * Fix riscv,pmu DT node path in the virt machine
 * Update CSR bits name for svadu extension
 * Mark zicond non-experimental
 * Fix satp_mode_finalize() when satp_mode.supported = 0
 * Fix non-KVM --enable-debug build
 * Add new extensions to hwprobe
 * Use accelerated helper for AES64KS1I
 * Allocate itrigger timers only once
 * Respect mseccfg.RLB for pmpaddrX changes
 * Align the AIA model to v1.0 ratified spec
 * Don't read the CSR in riscv_csrrw_do64

----------------------------------------------------------------
Akihiko Odaki (1):
      target/riscv: Allocate itrigger timers only once

Ard Biesheuvel (2):
      target/riscv: Use existing lookup tables for MixColumns
      target/riscv: Use accelerated helper for AES64KS1I

Conor Dooley (1):
      hw/riscv: virt: Fix riscv,pmu DT node path

Daniel Henrique Barboza (6):
      target/riscv/cpu.c: do not run 'host' CPU with TCG
      target/riscv/cpu.c: add zmmul isa string
      target/riscv/cpu.c: add smepmp isa string
      target/riscv: fix satp_mode_finalize() when satp_mode.supported = 0
      hw/riscv/virt.c: fix non-KVM --enable-debug build
      hw/intc/riscv_aplic.c fix non-KVM --enable-debug build

Dickon Hood (2):
      target/riscv: Refactor translation of vector-widening instruction
      target/riscv: Add Zvbb ISA extension support

Jason Chien (3):
      target/riscv: Add Zihintntl extension ISA string to DTS
      hw/intc: Fix upper/lower mtime write calculation
      hw/intc: Make rtc variable names consistent

Kiran Ostrolenk (4):
      target/riscv: Refactor some of the generic vector functionality
      target/riscv: Refactor vector-vector translation macro
      target/riscv: Refactor some of the generic vector functionality
      target/riscv: Add Zvknh ISA extension support

LIU Zhiwei (3):
      target/riscv: Fix page_check_range use in fault-only-first
      target/riscv: Fix zfa fleq.d and fltq.d
      linux-user/riscv: Use abi type for target_ucontext

Lawrence Hunter (2):
      target/riscv: Add Zvbc ISA extension support
      target/riscv: Add Zvksh ISA extension support

Leon Schuermann (1):
      target/riscv/pmp.c: respect mseccfg.RLB for pmpaddrX changes

Max Chou (3):
      crypto: Create sm4_subword
      crypto: Add SM4 constant parameter CK
      target/riscv: Add Zvksed ISA extension support

Nazar Kazakov (4):
      target/riscv: Remove redundant "cpu_vl == 0" checks
      target/riscv: Move vector translation checks
      target/riscv: Add Zvkned ISA extension support
      target/riscv: Add Zvkg ISA extension support

Nikita Shubin (1):
      target/riscv: don't read CSR in riscv_csrrw_do64

Rob Bradford (1):
      target/riscv: Implement WARL behaviour for mcountinhibit/mcounteren

Robbin Ehn (1):
      linux-user/riscv: Add new extensions to hwprobe

Thomas Huth (2):
      hw/char/riscv_htif: Fix printing of console characters on big endian hosts
      hw/char/riscv_htif: Fix the console syscall on big endian hosts

Tommy Wu (1):
      target/riscv: Align the AIA model to v1.0 ratified spec

Vineet Gupta (1):
      riscv: zicond: make non-experimental

Weiwei Li (1):
      target/riscv: Update CSR bits name for svadu extension

Yong-Xuan Wang (5):
      target/riscv: support the AIA device emulation with KVM enabled
      target/riscv: check the in-kernel irqchip support
      target/riscv: Create an KVM AIA irqchip
      target/riscv: update APLIC and IMSIC to support KVM AIA
      target/riscv: select KVM AIA in riscv virt machine

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The 'host' CPU is available in a CONFIG_KVM build and it's currently
available for all accels, but is a KVM only CPU. This means that in a
RISC-V KVM capable host we can do things like this:

$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
qemu-system-riscv64: H extension requires priv spec 1.12.0

This CPU does not have a priv spec because we don't filter its extensions
via priv spec. We shouldn't be reaching riscv_cpu_realize_tcg() at all
with the 'host' CPU.

We don't have a way to filter the 'host' CPU out of the available CPU
options (-cpu help) if the build includes both KVM and TCG. What we can
do is to error out during riscv_cpu_realize_tcg() if the user chooses
the 'host' CPU with accel=tcg:

$ ./build/qemu-system-riscv64 -M virt,accel=tcg -cpu host --nographic
qemu-system-riscv64: 'host' CPU is not compatible with TCG acceleration

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230721133411.474105-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize_tcg(DeviceState *dev, Error **errp)
     CPURISCVState *env = &cpu->env;
     Error *local_err = NULL;
 
+    if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_CPU_HOST)) {
+        error_setg(errp, "'host' CPU is not compatible with TCG acceleration");
+        return;
+    }
+
     riscv_cpu_validate_misa_mxl(cpu, &local_err);
     if (local_err != NULL) {
         error_propagate(errp, local_err);
-- 
2.41.0

From: Thomas Huth <thuth@redhat.com>

The character that should be printed is stored in the 64 bit "payload"
variable. The code currently tries to print it by taking the address
of the variable and passing this pointer to qemu_chr_fe_write(). However,
this only works on little endian hosts where the least significant bits
are stored on the lowest address. To do this in a portable way, we have
to store the value in an uint8_t variable instead.

Fixes: 5033606780 ("RISC-V HTIF Console")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20230721094720.902454-2-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             s->tohost = 0; /* clear to indicate we read */
             return;
         } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
-            qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1);
+            uint8_t ch = (uint8_t)payload;
+            qemu_chr_fe_write(&s->chr, &ch, 1);
             resp = 0x100 | (uint8_t)payload;
         } else {
             qemu_log("HTIF device %d: unknown command\n", device);
-- 
2.41.0

From: Thomas Huth <thuth@redhat.com>

Values that have been read via cpu_physical_memory_read() from the
guest's memory have to be swapped in case the host endianess differs
from the guest.

Fixes: a6e13e31d5 ("riscv_htif: Support console output via proxy syscall")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-Id: <20230721094720.902454-3-thuth@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/riscv_htif.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
 #include "exec/address-spaces.h"
+#include "exec/tswap.h"
 #include "sysemu/dma.h"
 
 #define RISCV_DEBUG_HTIF 0
@@ -XXX,XX +XXX,XX @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
             } else {
                 uint64_t syscall[8];
                 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
-                if (syscall[0] == PK_SYS_WRITE &&
-                    syscall[1] == HTIF_DEV_CONSOLE &&
-                    syscall[3] == HTIF_CONSOLE_CMD_PUTC) {
+                if (tswap64(syscall[0]) == PK_SYS_WRITE &&
+                    tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
+                    tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
                     uint8_t ch;
-                    cpu_physical_memory_read(syscall[2], &ch, 1);
+                    cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
                     qemu_chr_fe_write(&s->chr, &ch, 1);
                     resp = 0x100 | (uint8_t)payload;
                 } else {
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

zmmul was promoted from experimental to ratified in commit 6d00ffad4e95.
Add a riscv,isa string for it.

Fixes: 6d00ffad4e95 ("target/riscv: move zmmul out of the experimental properties")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230720132424.371132-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_icsr),
     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_ifencei),
     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
+    ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

The cpu->cfg.epmp extension is still experimental, but it already has a
'smepmp' riscv,isa string. Add it.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20230720132424.371132-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
+    ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, epmp),
     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
-- 
2.41.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Commit bef6f008b98(accel/tcg: Return bool from page_check_range) converts
integer return value to bool type. However, it wrongly converted the use
of the API in riscv fault-only-first, where page_check_range < = 0, should
be converted to !page_check_range.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230729031618.821-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ vext_ldff(void *vd, void *v0, target_ulong base,
                                          cpu_mmu_index(env, false));
                 if (host) {
 #ifdef CONFIG_USER_ONLY
-                    if (page_check_range(addr, offset, PAGE_READ)) {
+                    if (!page_check_range(addr, offset, PAGE_READ)) {
                         vl = i;
                         goto ProbeSuccess;
                     }
-- 
2.41.0

From: Ard Biesheuvel <ardb@kernel.org>

The AES MixColumns and InvMixColumns operations are relatively
expensive 4x4 matrix multiplications in GF(2^8), which is why C
implementations usually rely on precomputed lookup tables rather than
performing the calculations on demand.

Given that we already carry those tables in QEMU, we can just grab the
right value in the implementation of the RISC-V AES32 instructions. Note
that the tables in question are permuted according to the respective
Sbox, so we can omit the Sbox lookup as well in this case.

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Zewen Ye <lustrew@foxmail.com>
Cc: Weiwei Li <liweiwei@iscas.ac.cn>
Cc: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230731084043.1791984-1-ardb@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/aes.h         |  7 +++++++
 crypto/aes.c                 |  4 ++--
 target/riscv/crypto_helper.c | 34 ++++------------------------------
 3 files changed, 13 insertions(+), 32 deletions(-)

diff --git a/include/crypto/aes.h b/include/crypto/aes.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/aes.h
+++ b/include/crypto/aes.h
@@ -XXX,XX +XXX,XX @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
 extern const uint8_t AES_sbox[256];
 extern const uint8_t AES_isbox[256];
 
+/*
+AES_Te0[x] = S [x].[02, 01, 01, 03];
+AES_Td0[x] = Si[x].[0e, 09, 0d, 0b];
+*/
+
+extern const uint32_t AES_Te0[256], AES_Td0[256];
+
 #endif
diff --git a/crypto/aes.c b/crypto/aes.c
index XXXXXXX..XXXXXXX 100644
--- a/crypto/aes.c
+++ b/crypto/aes.c
@@ -XXX,XX +XXX,XX @@ AES_Td3[x] = Si[x].[09, 0d, 0b, 0e];
 AES_Td4[x] = Si[x].[01, 01, 01, 01];
 */
 
-static const uint32_t AES_Te0[256] = {
+const uint32_t AES_Te0[256] = {
     0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
     0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
     0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
@@ -XXX,XX +XXX,XX @@ static const uint32_t AES_Te4[256] = {
     0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
 };
 
-static const uint32_t AES_Td0[256] = {
+const uint32_t AES_Td0[256] = {
     0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
     0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
     0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "crypto/aes-round.h"
 #include "crypto/sm4.h"
 
-#define AES_XTIME(a) \
-    ((a << 1) ^ ((a & 0x80) ? 0x1b : 0))
-
-#define AES_GFMUL(a, b) (( \
-    (((b) & 0x1) ? (a) : 0) ^ \
-    (((b) & 0x2) ? AES_XTIME(a) : 0) ^ \
-    (((b) & 0x4) ? AES_XTIME(AES_XTIME(a)) : 0) ^ \
-    (((b) & 0x8) ? AES_XTIME(AES_XTIME(AES_XTIME(a))) : 0)) & 0xFF)
-
-static inline uint32_t aes_mixcolumn_byte(uint8_t x, bool fwd)
-{
-    uint32_t u;
-
-    if (fwd) {
-        u = (AES_GFMUL(x, 3) << 24) | (x << 16) | (x << 8) |
-            (AES_GFMUL(x, 2) << 0);
-    } else {
-        u = (AES_GFMUL(x, 0xb) << 24) | (AES_GFMUL(x, 0xd) << 16) |
-            (AES_GFMUL(x, 0x9) << 8) | (AES_GFMUL(x, 0xe) << 0);
-    }
-    return u;
-}
-
 #define sext32_xlen(x) (target_ulong)(int32_t)(x)
 
 static inline target_ulong aes32_operation(target_ulong shamt,
@@ -XXX,XX +XXX,XX @@ static inline target_ulong aes32_operation(target_ulong shamt,
                                            bool enc, bool mix)
 {
     uint8_t si = rs2 >> shamt;
-    uint8_t so;
     uint32_t mixed;
     target_ulong res;
 
     if (enc) {
-        so = AES_sbox[si];
         if (mix) {
-            mixed = aes_mixcolumn_byte(so, true);
+            mixed = be32_to_cpu(AES_Te0[si]);
         } else {
-            mixed = so;
+            mixed = AES_sbox[si];
         }
     } else {
-        so = AES_isbox[si];
         if (mix) {
-            mixed = aes_mixcolumn_byte(so, false);
+            mixed = be32_to_cpu(AES_Td0[si]);
         } else {
-            mixed = so;
+            mixed = AES_isbox[si];
         }
     }
     mixed = rol32(mixed, shamt);
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Take some functions/macros out of `vector_helper` and put them in a new
module called `vector_internals`. This ensures they can be used by both
vector and vector-crypto helpers (latter implemented in proceeding
commits).

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230711165917.2629866-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 182 +++++++++++++++++++++++++++++
 target/riscv/vector_helper.c    | 201 +-------------------------------
 target/riscv/vector_internals.c |  81 +++++++++++++
 target/riscv/meson.build        |   1 +
 4 files changed, 265 insertions(+), 200 deletions(-)
 create mode 100644 target/riscv/vector_internals.h
 create mode 100644 target/riscv/vector_internals.c

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Vector Extension Internals
+ *
+ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef TARGET_RISCV_VECTOR_INTERNALS_H
+#define TARGET_RISCV_VECTOR_INTERNALS_H
+
+#include "qemu/osdep.h"
+#include "qemu/bitops.h"
+#include "cpu.h"
+#include "tcg/tcg-gvec-desc.h"
+#include "internals.h"
+
+static inline uint32_t vext_nf(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, NF);
+}
+
+/*
+ * Note that vector data is stored in host-endian 64-bit chunks,
+ * so addressing units smaller than that needs a host-endian fixup.
+ */
+#if HOST_BIG_ENDIAN
+#define H1(x)   ((x) ^ 7)
+#define H1_2(x) ((x) ^ 6)
+#define H1_4(x) ((x) ^ 4)
+#define H2(x)   ((x) ^ 3)
+#define H4(x)   ((x) ^ 1)
+#define H8(x)   ((x))
+#else
+#define H1(x)   (x)
+#define H1_2(x) (x)
+#define H1_4(x) (x)
+#define H2(x)   (x)
+#define H4(x)   (x)
+#define H8(x)   (x)
+#endif
+
+/*
+ * Encode LMUL to lmul as following:
+ *     LMUL    vlmul    lmul
+ *      1       000       0
+ *      2       001       1
+ *      4       010       2
+ *      8       011       3
+ *      -       100       -
+ *     1/8      101      -3
+ *     1/4      110      -2
+ *     1/2      111      -1
+ */
+static inline int32_t vext_lmul(uint32_t desc)
+{
+    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
+}
+
+static inline uint32_t vext_vm(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VM);
+}
+
+static inline uint32_t vext_vma(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VMA);
+}
+
+static inline uint32_t vext_vta(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VTA);
+}
+
+static inline uint32_t vext_vta_all_1s(uint32_t desc)
+{
+    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
+}
+
+/*
+ * Earlier designs (pre-0.9) had a varying number of bits
+ * per mask value (MLEN). In the 0.9 design, MLEN=1.
+ * (Section 4.5)
+ */
+static inline int vext_elem_mask(void *v0, int index)
+{
+    int idx = index / 64;
+    int pos = index  % 64;
+    return (((uint64_t *)v0)[idx] >> pos) & 1;
+}
+
+/*
+ * Get number of total elements, including prestart, body and tail elements.
+ * Note that when LMUL < 1, the tail includes the elements past VLMAX that
+ * are held in the same vector register.
+ */
+static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
+                                            uint32_t esz)
+{
+    uint32_t vlenb = simd_maxsz(desc);
+    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
+    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
+                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
+    return (vlenb << emul) / esz;
+}
+
+/* set agnostic elements to 1s */
+void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+                       uint32_t tot);
+
+/* expand macro args before macro */
+#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
+
+/* (TD, T1, T2, TX1, TX2) */
+#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
+#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
+#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
+#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
+
+/* operation of two vector elements */
+typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
+
+#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
+static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
+{                                                               \
+    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
+    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
+}
+
+void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivv2_fn *fn, uint32_t esz);
+
+/* generate the helpers for OPIVV */
+#define GEN_VEXT_VV(NAME, ESZ)                            \
+void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
+{                                                         \
+    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
+               do_##NAME, ESZ);                           \
+}
+
+typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
+
+/*
+ * (T1)s1 gives the real operator type.
+ * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
+ */
+#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
+static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
+{                                                                   \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
+    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
+}
+
+void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivx2_fn fn, uint32_t esz);
+
+/* generate the helpers for OPIVX */
+#define GEN_VEXT_VX(NAME, ESZ)                            \
+void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
+                  void *vs2, CPURISCVState *env,          \
+                  uint32_t desc)                          \
+{                                                         \
+    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
+               do_##NAME, ESZ);                           \
+}
+
+#endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "fpu/softfloat.h"
 #include "tcg/tcg-gvec-desc.h"
 #include "internals.h"
+#include "vector_internals.h"
 #include <math.h>
 
 target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(vsetvl)(CPURISCVState *env, target_ulong s1,
     return vl;
 }
 
-/*
- * Note that vector data is stored in host-endian 64-bit chunks,
- * so addressing units smaller than that needs a host-endian fixup.
- */
-#if HOST_BIG_ENDIAN
-#define H1(x)   ((x) ^ 7)
-#define H1_2(x) ((x) ^ 6)
-#define H1_4(x) ((x) ^ 4)
-#define H2(x)   ((x) ^ 3)
-#define H4(x)   ((x) ^ 1)
-#define H8(x)   ((x))
-#else
-#define H1(x)   (x)
-#define H1_2(x) (x)
-#define H1_4(x) (x)
-#define H2(x)   (x)
-#define H4(x)   (x)
-#define H8(x)   (x)
-#endif
-
-static inline uint32_t vext_nf(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, NF);
-}
-
-static inline uint32_t vext_vm(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VM);
-}
-
-/*
- * Encode LMUL to lmul as following:
- *     LMUL    vlmul    lmul
- *      1       000       0
- *      2       001       1
- *      4       010       2
- *      8       011       3
- *      -       100       -
- *     1/8      101      -3
- *     1/4      110      -2
- *     1/2      111      -1
- */
-static inline int32_t vext_lmul(uint32_t desc)
-{
-    return sextract32(FIELD_EX32(simd_data(desc), VDATA, LMUL), 0, 3);
-}
-
-static inline uint32_t vext_vta(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VTA);
-}
-
-static inline uint32_t vext_vma(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VMA);
-}
-
-static inline uint32_t vext_vta_all_1s(uint32_t desc)
-{
-    return FIELD_EX32(simd_data(desc), VDATA, VTA_ALL_1S);
-}
-
 /*
  * Get the maximum number of elements can be operated.
  *
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vext_max_elems(uint32_t desc, uint32_t log2_esz)
     return scale < 0 ? vlenb >> -scale : vlenb << scale;
 }
 
-/*
- * Get number of total elements, including prestart, body and tail elements.
- * Note that when LMUL < 1, the tail includes the elements past VLMAX that
- * are held in the same vector register.
- */
-static inline uint32_t vext_get_total_elems(CPURISCVState *env, uint32_t desc,
-                                            uint32_t esz)
-{
-    uint32_t vlenb = simd_maxsz(desc);
-    uint32_t sew = 1 << FIELD_EX64(env->vtype, VTYPE, VSEW);
-    int8_t emul = ctzl(esz) - ctzl(sew) + vext_lmul(desc) < 0 ? 0 :
-                  ctzl(esz) - ctzl(sew) + vext_lmul(desc);
-    return (vlenb << emul) / esz;
-}
-
 static inline target_ulong adjust_addr(CPURISCVState *env, target_ulong addr)
 {
     return (addr & ~env->cur_pmmask) | env->cur_pmbase;
@@ -XXX,XX +XXX,XX @@ static void probe_pages(CPURISCVState *env, target_ulong addr,
     }
 }
 
-/* set agnostic elements to 1s */
-static void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
-                              uint32_t tot)
-{
-    if (is_agnostic == 0) {
-        /* policy undisturbed */
-        return;
-    }
-    if (tot - cnt == 0) {
-        return;
-    }
-    memset(base + cnt, -1, tot - cnt);
-}
-
 static inline void vext_set_elem_mask(void *v0, int index,
                                       uint8_t value)
 {
@@ -XXX,XX +XXX,XX @@ static inline void vext_set_elem_mask(void *v0, int index,
     ((uint64_t *)v0)[idx] = deposit64(old, pos, 1, value);
 }
 
-/*
- * Earlier designs (pre-0.9) had a varying number of bits
- * per mask value (MLEN). In the 0.9 design, MLEN=1.
- * (Section 4.5)
- */
-static inline int vext_elem_mask(void *v0, int index)
-{
-    int idx = index / 64;
-    int pos = index  % 64;
-    return (((uint64_t *)v0)[idx] >> pos) & 1;
-}
-
 /* elements operations for load and store */
 typedef void vext_ldst_elem_fn(CPURISCVState *env, abi_ptr addr,
                                uint32_t idx, void *vd, uintptr_t retaddr);
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
  * Vector Integer Arithmetic Instructions
  */
 
-/* expand macro args before macro */
-#define RVVCALL(macro, ...)  macro(__VA_ARGS__)
-
 /* (TD, T1, T2, TX1, TX2) */
 #define OP_SSS_B int8_t, int8_t, int8_t, int8_t, int8_t
 #define OP_SSS_H int16_t, int16_t, int16_t, int16_t, int16_t
 #define OP_SSS_W int32_t, int32_t, int32_t, int32_t, int32_t
 #define OP_SSS_D int64_t, int64_t, int64_t, int64_t, int64_t
-#define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
-#define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
-#define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
-#define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 #define OP_SUS_B int8_t, uint8_t, int8_t, uint8_t, int8_t
 #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
 #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
 #define NOP_UUU_H uint16_t, uint16_t, uint32_t, uint16_t, uint32_t
 #define NOP_UUU_W uint32_t, uint32_t, uint64_t, uint32_t, uint64_t
 
-/* operation of two vector elements */
-typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
-
-#define OPIVV2(NAME, TD, T1, T2, TX1, TX2, HD, HS1, HS2, OP)    \
-static void do_##NAME(void *vd, void *vs1, void *vs2, int i)    \
-{                                                               \
-    TX1 s1 = *((T1 *)vs1 + HS1(i));                             \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                             \
-    *((TD *)vd + HD(i)) = OP(s2, s1);                           \
-}
 #define DO_SUB(N, M) (N - M)
 #define DO_RSUB(N, M) (M - N)
 
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vsub_vv_h, OP_SSS_H, H2, H2, H2, DO_SUB)
 RVVCALL(OPIVV2, vsub_vv_w, OP_SSS_W, H4, H4, H4, DO_SUB)
 RVVCALL(OPIVV2, vsub_vv_d, OP_SSS_D, H8, H8, H8, DO_SUB)
 
-static void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
-                       CPURISCVState *env, uint32_t desc,
-                       opivv2_fn *fn, uint32_t esz)
-{
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-    uint32_t vta = vext_vta(desc);
-    uint32_t vma = vext_vma(desc);
-    uint32_t i;
-
-    for (i = env->vstart; i < vl; i++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            /* set masked-off elements to 1s */
-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-            continue;
-        }
-        fn(vd, vs1, vs2, i);
-    }
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-}
-
-/* generate the helpers for OPIVV */
-#define GEN_VEXT_VV(NAME, ESZ)                            \
-void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
-                  void *vs2, CPURISCVState *env,          \
-                  uint32_t desc)                          \
-{                                                         \
-    do_vext_vv(vd, v0, vs1, vs2, env, desc,               \
-               do_##NAME, ESZ);                           \
-}
-
 GEN_VEXT_VV(vadd_vv_b, 1)
 GEN_VEXT_VV(vadd_vv_h, 2)
 GEN_VEXT_VV(vadd_vv_w, 4)
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VV(vsub_vv_h, 2)
 GEN_VEXT_VV(vsub_vv_w, 4)
 GEN_VEXT_VV(vsub_vv_d, 8)
 
-typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
-
-/*
- * (T1)s1 gives the real operator type.
- * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
- */
-#define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
-static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
-{                                                                   \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
-    *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
-}
 
 RVVCALL(OPIVX2, vadd_vx_b, OP_SSS_B, H1, H1, DO_ADD)
 RVVCALL(OPIVX2, vadd_vx_h, OP_SSS_H, H2, H2, DO_ADD)
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vrsub_vx_h, OP_SSS_H, H2, H2, DO_RSUB)
 RVVCALL(OPIVX2, vrsub_vx_w, OP_SSS_W, H4, H4, DO_RSUB)
 RVVCALL(OPIVX2, vrsub_vx_d, OP_SSS_D, H8, H8, DO_RSUB)
 
-static void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
-                       CPURISCVState *env, uint32_t desc,
-                       opivx2_fn fn, uint32_t esz)
-{
-    uint32_t vm = vext_vm(desc);
-    uint32_t vl = env->vl;
-    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
-    uint32_t vta = vext_vta(desc);
-    uint32_t vma = vext_vma(desc);
-    uint32_t i;
-
-    for (i = env->vstart; i < vl; i++) {
-        if (!vm && !vext_elem_mask(v0, i)) {
-            /* set masked-off elements to 1s */
-            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
-            continue;
-        }
-        fn(vd, s1, vs2, i);
-    }
-    env->vstart = 0;
-    /* set tail elements to 1s */
-    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
-}
-
-/* generate the helpers for OPIVX */
-#define GEN_VEXT_VX(NAME, ESZ)                            \
-void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
-                  void *vs2, CPURISCVState *env,          \
-                  uint32_t desc)                          \
-{                                                         \
-    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
-               do_##NAME, ESZ);                           \
-}
-
 GEN_VEXT_VX(vadd_vx_b, 1)
 GEN_VEXT_VX(vadd_vx_h, 2)
 GEN_VEXT_VX(vadd_vx_w, 4)
diff --git a/target/riscv/vector_internals.c b/target/riscv/vector_internals.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/riscv/vector_internals.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * RISC-V Vector Extension Internals
+ *
+ * Copyright (c) 2020 T-Head Semiconductor Co., Ltd. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "vector_internals.h"
+
+/* set agnostic elements to 1s */
+void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
+                       uint32_t tot)
+{
+    if (is_agnostic == 0) {
+        /* policy undisturbed */
+        return;
+    }
+    if (tot - cnt == 0) {
+        return ;
+    }
+    memset(base + cnt, -1, tot - cnt);
+}
+
+void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivv2_fn *fn, uint32_t esz)
+{
+    uint32_t vm = vext_vm(desc);
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+    uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
+    uint32_t i;
+
+    for (i = env->vstart; i < vl; i++) {
+        if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+            continue;
+        }
+        fn(vd, vs1, vs2, i);
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+}
+
+void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+                CPURISCVState *env, uint32_t desc,
+                opivx2_fn fn, uint32_t esz)
+{
+    uint32_t vm = vext_vm(desc);
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, esz);
+    uint32_t vta = vext_vta(desc);
+    uint32_t vma = vext_vma(desc);
+    uint32_t i;
+
+    for (i = env->vstart; i < vl; i++) {
+        if (!vm && !vext_elem_mask(v0, i)) {
+            /* set masked-off elements to 1s */
+            vext_set_elems_1s(vd, vma, i * esz, (i + 1) * esz);
+            continue;
+        }
+        fn(vd, s1, vs2, i);
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
+}
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -XXX,XX +XXX,XX @@ riscv_ss.add(files(
   'gdbstub.c',
   'op_helper.c',
   'vector_helper.c',
+  'vector_internals.c',
   'bitmanip_helper.c',
   'translate.c',
   'm128_helper.c',
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Refactor the non SEW-specific stuff out of `GEN_OPIVV_TRANS` into
function `opivv_trans` (similar to `opivi_trans`). `opivv_trans` will be
used in proceeding vector-crypto commits.

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 62 +++++++++++++------------
 1 file changed, 32 insertions(+), 30 deletions(-)

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

Remove the redundant "vl == 0" check which is already included within the  vstart >= vl check, when vl == 0.

Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230711165917.2629866-4-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 31 +------------------------
 1 file changed, 1 insertion(+), 30 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -XXX,XX +XXX,XX @@ static bool ldst_us_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_stride_trans(uint32_t vd, uint32_t rs1, uint32_t rs2,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldst_index_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool ldff_trans(uint32_t vd, uint32_t rs1, uint32_t data,
     TCGv_i32 desc;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ do_opivv_gvec(DisasContext *s, arg_rmrr *a, GVecGen3Fn *gvec_fn,
         return false;
     }
 
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     if (a->vm && s->vl_eq_vlmax && !(s->vta && s->lmul < 0)) {
@@ -XXX,XX +XXX,XX @@ static bool opivx_trans(uint32_t vd, uint32_t rs1, uint32_t vs2, uint32_t vm,
     uint32_t data = 0;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool opivi_trans(uint32_t vd, uint32_t imm, uint32_t vs2, uint32_t vm,
     uint32_t data = 0;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool do_opivv_widen(DisasContext *s, arg_rmrr *a,
     if (checkfn(s, a)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool do_opiwv_widen(DisasContext *s, arg_rmrr *a,
     if (opiwv_widen_check(s, a)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool opivv_trans(uint32_t vd, uint32_t vs1, uint32_t vs2, uint32_t vm,
 {
     uint32_t data = 0;
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     data = FIELD_DP32(data, VDATA, VM, vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
             gen_helper_##NAME##_w,                                 \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_v(DisasContext *s, arg_vmv_v_v *a)
                 gen_helper_vmv_v_v_w, gen_helper_vmv_v_v_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             tcg_gen_gvec_2_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_x(DisasContext *s, arg_vmv_v_x *a)
         vext_check_ss(s, a->rd, 0, 1)) {
         TCGv s1;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         s1 = get_gpr(s, a->rs1, EXT_SIGN);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_v_i(DisasContext *s, arg_vmv_v_i *a)
                 gen_helper_vmv_v_x_w, gen_helper_vmv_v_x_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             s1 = tcg_constant_i64(simm);
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool opfvf_trans(uint32_t vd, uint32_t rs1, uint32_t vs2,
     TCGv_i64 t1;
 
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     dest = tcg_temp_new_ptr();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)           \
         };                                                       \
         TCGLabel *over = gen_new_label();                        \
         gen_set_rm(s, RISCV_FRM_DYN);                            \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);        \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);\
                                                                  \
         data = FIELD_DP32(data, VDATA, VM, a->vm);               \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmrr *a)             \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool do_opfv(DisasContext *s, arg_rmr *a,
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
         gen_set_rm_chkfrm(s, rm);
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_v_f(DisasContext *s, arg_vfmv_v_f *a)
                 gen_helper_vmv_v_x_d,
             };
             TCGLabel *over = gen_new_label();
-            tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
             tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
             t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm(s, RISCV_FRM_DYN);                              \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_rmr *a)              \
         };                                                         \
         TCGLabel *over = gen_new_label();                          \
         gen_set_rm_chkfrm(s, FRM);                                 \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, VM, a->vm);                 \
@@ -XXX,XX +XXX,XX @@ static bool trans_##NAME(DisasContext *s, arg_r *a)                \
         uint32_t data = 0;                                         \
         gen_helper_gvec_4_ptr *fn = gen_helper_##NAME;             \
         TCGLabel *over = gen_new_label();                          \
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);          \
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over); \
                                                                    \
         data = FIELD_DP32(data, VDATA, LMUL, s->lmul);             \
@@ -XXX,XX +XXX,XX @@ static bool trans_vid_v(DisasContext *s, arg_vid_v *a)
         require_vm(a->vm, a->rd)) {
         uint32_t data = 0;
         TCGLabel *over = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         data = FIELD_DP32(data, VDATA, VM, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_vmv_s_x(DisasContext *s, arg_vmv_s_x *a)
         TCGv s1;
         TCGLabel *over = gen_new_label();
 
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         t1 = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_vfmv_s_f(DisasContext *s, arg_vfmv_s_f *a)
         TCGv_i64 t1;
         TCGLabel *over = gen_new_label();
 
-        /* if vl == 0 or vstart >= vl, skip vector register write back */
-        tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
+        /* if vstart >= vl, skip vector register write back */
         tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
         /* NaN-box f[rs1] */
@@ -XXX,XX +XXX,XX @@ static bool int_ext_op(DisasContext *s, arg_rmr *a, uint8_t seq)
     uint32_t data = 0;
     gen_helper_gvec_3_ptr *fn;
     TCGLabel *over = gen_new_label();
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_vl, 0, over);
     tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
 
     static gen_helper_gvec_3_ptr * const fns[6][4] = {
-- 
2.41.0

From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>

This commit adds support for the Zvbc vector-crypto extension, which
consists of the following instructions:

* vclmulh.[vx,vv]
* vclmul.[vx,vv]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: Max Chou <max.chou@sifive.com>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
[max.chou@sifive.com: Exposed x-zvbc property]
Message-ID: <20230711165917.2629866-5-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |  1 +
 target/riscv/helper.h                    |  6 +++
 target/riscv/insn32.decode               |  6 +++
 target/riscv/cpu.c                       |  9 ++++
 target/riscv/translate.c                 |  1 +
 target/riscv/vcrypto_helper.c            | 59 ++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 62 ++++++++++++++++++++++++
 target/riscv/meson.build                 |  3 +-
 8 files changed, 146 insertions(+), 1 deletion(-)
 create mode 100644 target/riscv/vcrypto_helper.c
 create mode 100644 target/riscv/insn_trans/trans_rvvk.c.inc

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

Move the checks out of `do_opiv{v,x,i}_gvec{,_shift}` functions
and into the corresponding macros. This enables the functions to be
reused in proceeding commits without check duplication.

Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-6-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 28 +++++++++++--------------
 1 file changed, 12 insertions(+), 16 deletions(-)

From: Dickon Hood <dickon.hood@codethink.co.uk>

Zvbb (implemented in later commit) has a widening instruction, which
requires an extra check on the enabled extensions.  Refactor
GEN_OPIVX_WIDEN_TRANS() to take a check function to avoid reimplementing
it.

Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-7-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 52 +++++++++++--------------
 1 file changed, 23 insertions(+), 29 deletions(-)

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

Move some macros out of `vector_helper` and into `vector_internals`.
This ensures they can be used by both vector and vector-crypto helpers
(latter implemented in proceeding commits).

Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-8-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/vector_internals.h | 46 +++++++++++++++++++++++++++++++++
 target/riscv/vector_helper.c    | 42 ------------------------------
 2 files changed, 46 insertions(+), 42 deletions(-)

diff --git a/target/riscv/vector_internals.h b/target/riscv/vector_internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_internals.h
+++ b/target/riscv/vector_internals.h
@@ -XXX,XX +XXX,XX @@ void vext_set_elems_1s(void *base, uint32_t is_agnostic, uint32_t cnt,
 /* expand macro args before macro */
 #define RVVCALL(macro, ...)  macro(__VA_ARGS__)
 
+/* (TD, T2, TX2) */
+#define OP_UU_B uint8_t, uint8_t, uint8_t
+#define OP_UU_H uint16_t, uint16_t, uint16_t
+#define OP_UU_W uint32_t, uint32_t, uint32_t
+#define OP_UU_D uint64_t, uint64_t, uint64_t
+
 /* (TD, T1, T2, TX1, TX2) */
 #define OP_UUU_B uint8_t, uint8_t, uint8_t, uint8_t, uint8_t
 #define OP_UUU_H uint16_t, uint16_t, uint16_t, uint16_t, uint16_t
 #define OP_UUU_W uint32_t, uint32_t, uint32_t, uint32_t, uint32_t
 #define OP_UUU_D uint64_t, uint64_t, uint64_t, uint64_t, uint64_t
 
+#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
+static void do_##NAME(void *vd, void *vs2, int i)      \
+{                                                      \
+    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
+    *((TD *)vd + HD(i)) = OP(s2);                      \
+}
+
+#define GEN_VEXT_V(NAME, ESZ)                          \
+void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
+                  CPURISCVState *env, uint32_t desc)   \
+{                                                      \
+    uint32_t vm = vext_vm(desc);                       \
+    uint32_t vl = env->vl;                             \
+    uint32_t total_elems =                             \
+        vext_get_total_elems(env, desc, ESZ);          \
+    uint32_t vta = vext_vta(desc);                     \
+    uint32_t vma = vext_vma(desc);                     \
+    uint32_t i;                                        \
+                                                       \
+    for (i = env->vstart; i < vl; i++) {               \
+        if (!vm && !vext_elem_mask(v0, i)) {           \
+            /* set masked-off elements to 1s */        \
+            vext_set_elems_1s(vd, vma, i * ESZ,        \
+                              (i + 1) * ESZ);          \
+            continue;                                  \
+        }                                              \
+        do_##NAME(vd, vs2, i);                         \
+    }                                                  \
+    env->vstart = 0;                                   \
+    /* set tail elements to 1s */                      \
+    vext_set_elems_1s(vd, vta, vl * ESZ,               \
+                      total_elems * ESZ);              \
+}
+
 /* operation of two vector elements */
 typedef void opivv2_fn(void *vd, void *vs1, void *vs2, int i);
 
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
                do_##NAME, ESZ);                           \
 }
 
+/* Three of the widening shortening macros: */
+/* (TD, T1, T2, TX1, TX2) */
+#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
+#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
+#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
+
 #endif /* TARGET_RISCV_VECTOR_INTERNALS_H */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_ST_WHOLE(vs8r_v, int8_t, ste_b)
 #define OP_SUS_H int16_t, uint16_t, int16_t, uint16_t, int16_t
 #define OP_SUS_W int32_t, uint32_t, int32_t, uint32_t, int32_t
 #define OP_SUS_D int64_t, uint64_t, int64_t, uint64_t, int64_t
-#define WOP_UUU_B uint16_t, uint8_t, uint8_t, uint16_t, uint16_t
-#define WOP_UUU_H uint32_t, uint16_t, uint16_t, uint32_t, uint32_t
-#define WOP_UUU_W uint64_t, uint32_t, uint32_t, uint64_t, uint64_t
 #define WOP_SSS_B int16_t, int8_t, int8_t, int16_t, int16_t
 #define WOP_SSS_H int32_t, int16_t, int16_t, int32_t, int32_t
 #define WOP_SSS_W int64_t, int32_t, int32_t, int64_t, int64_t
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_VF(vfwnmsac_vf_h, 4)
 GEN_VEXT_VF(vfwnmsac_vf_w, 8)
 
 /* Vector Floating-Point Square-Root Instruction */
-/* (TD, T2, TX2) */
-#define OP_UU_H uint16_t, uint16_t, uint16_t
-#define OP_UU_W uint32_t, uint32_t, uint32_t
-#define OP_UU_D uint64_t, uint64_t, uint64_t
-
 #define OPFVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
 static void do_##NAME(void *vd, void *vs2, int i,      \
                       CPURISCVState *env)              \
@@ -XXX,XX +XXX,XX @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
 GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
 
 /* Vector Floating-Point Classify Instruction */
-#define OPIVV1(NAME, TD, T2, TX2, HD, HS2, OP)         \
-static void do_##NAME(void *vd, void *vs2, int i)      \
-{                                                      \
-    TX2 s2 = *((T2 *)vs2 + HS2(i));                    \
-    *((TD *)vd + HD(i)) = OP(s2);                      \
-}
-
-#define GEN_VEXT_V(NAME, ESZ)                          \
-void HELPER(NAME)(void *vd, void *v0, void *vs2,       \
-                  CPURISCVState *env, uint32_t desc)   \
-{                                                      \
-    uint32_t vm = vext_vm(desc);                       \
-    uint32_t vl = env->vl;                             \
-    uint32_t total_elems =                             \
-        vext_get_total_elems(env, desc, ESZ);          \
-    uint32_t vta = vext_vta(desc);                     \
-    uint32_t vma = vext_vma(desc);                     \
-    uint32_t i;                                        \
-                                                       \
-    for (i = env->vstart; i < vl; i++) {               \
-        if (!vm && !vext_elem_mask(v0, i)) {           \
-            /* set masked-off elements to 1s */        \
-            vext_set_elems_1s(vd, vma, i * ESZ,        \
-                              (i + 1) * ESZ);          \
-            continue;                                  \
-        }                                              \
-        do_##NAME(vd, vs2, i);                         \
-    }                                                  \
-    env->vstart = 0;                                   \
-    /* set tail elements to 1s */                      \
-    vext_set_elems_1s(vd, vta, vl * ESZ,               \
-                      total_elems * ESZ);              \
-}
-
 target_ulong fclass_h(uint64_t frs1)
 {
     float16 f = frs1;
-- 
2.41.0

From: Dickon Hood <dickon.hood@codethink.co.uk>

This commit adds support for the Zvbb vector-crypto extension, which
consists of the following instructions:

* vrol.[vv,vx]
* vror.[vv,vx,vi]
* vbrev8.v
* vrev8.v
* vandn.[vv,vx]
* vbrev.v
* vclz.v
* vctz.v
* vcpop.v
* vwsll.[vv,vx,vi]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
[max.chou@sifive.com: Fix imm mode of vror.vi]
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Dickon Hood <dickon.hood@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvbb property]
Message-ID: <20230711165917.2629866-9-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |  62 +++++++++
 target/riscv/insn32.decode               |  20 +++
 target/riscv/cpu.c                       |  12 ++
 target/riscv/vcrypto_helper.c            | 138 +++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 164 +++++++++++++++++++++++
 6 files changed, 397 insertions(+)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve32f;
     bool ext_zve64f;
     bool ext_zve64d;
+    bool ext_zvbb;
     bool ext_zvbc;
     bool ext_zmmul;
     bool ext_zvfbfmin;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vclmul_vv, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vclmul_vx, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vclmulh_vv, void, ptr, ptr, ptr, ptr, env, i32)
 DEF_HELPER_6(vclmulh_vx, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vror_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vror_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vror_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vror_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vrol_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vrol_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vrol_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vrol_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_5(vrev8_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vrev8_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev8_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vbrev_v_d, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_5(vclz_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vclz_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vctz_v_d, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_b, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_h, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_w, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vcpop_v_d, void, ptr, ptr, ptr, env, i32)
+
+DEF_HELPER_6(vwsll_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vwsll_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_6(vandn_vv_b, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_h, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_w, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vv_d, void, ptr, ptr, ptr, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 %imm_u    12:s20                 !function=ex_shift_12
 %imm_bs   30:2                   !function=ex_shift_3
 %imm_rnum 20:4
+%imm_z6   26:1 15:5
 
 # Argument sets:
 &empty
@@ -XXX,XX +XXX,XX @@
 @r_vm    ...... vm:1 ..... ..... ... ..... ....... &rmrr %rs2 %rs1 %rd
 @r_vm_1  ...... . ..... ..... ... ..... .......    &rmrr vm=1 %rs2 %rs1 %rd
 @r_vm_0  ...... . ..... ..... ... ..... .......    &rmrr vm=0 %rs2 %rs1 %rd
+@r2_zimm6  ..... . vm:1 ..... ..... ... ..... .......  &rmrr %rs2 rs1=%imm_z6 %rd
 @r2_zimm11 . zimm:11  ..... ... ..... ....... %rs1 %rd
 @r2_zimm10 .. zimm:10  ..... ... ..... ....... %rs1 %rd
 @r2_s    .......   ..... ..... ... ..... ....... %rs2 %rs1
@@ -XXX,XX +XXX,XX @@ vclmul_vv   001100 . ..... ..... 010 ..... 1010111 @r_vm
 vclmul_vx   001100 . ..... ..... 110 ..... 1010111 @r_vm
 vclmulh_vv  001101 . ..... ..... 010 ..... 1010111 @r_vm
 vclmulh_vx  001101 . ..... ..... 110 ..... 1010111 @r_vm
+
+# *** Zvbb vector crypto extension ***
+vrol_vv     010101 . ..... ..... 000 ..... 1010111 @r_vm
+vrol_vx     010101 . ..... ..... 100 ..... 1010111 @r_vm
+vror_vv     010100 . ..... ..... 000 ..... 1010111 @r_vm
+vror_vx     010100 . ..... ..... 100 ..... 1010111 @r_vm
+vror_vi     01010. . ..... ..... 011 ..... 1010111 @r2_zimm6
+vbrev8_v    010010 . ..... 01000 010 ..... 1010111 @r2_vm
+vrev8_v     010010 . ..... 01001 010 ..... 1010111 @r2_vm
+vandn_vv    000001 . ..... ..... 000 ..... 1010111 @r_vm
+vandn_vx    000001 . ..... ..... 100 ..... 1010111 @r_vm
+vbrev_v     010010 . ..... 01010 010 ..... 1010111 @r2_vm
+vclz_v      010010 . ..... 01100 010 ..... 1010111 @r2_vm
+vctz_v      010010 . ..... 01101 010 ..... 1010111 @r2_vm
+vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
+vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
+vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
+vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
     ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
     ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
+    ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
+    /*
+     * In principle Zve*x would also suffice here, were they supported
+     * in qemu
+     */
+    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
+        error_setg(errp,
+                   "Vector crypto extensions require V or Zve* extensions");
+        return;
+    }
+
     if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
         error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
         return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvfbfwma", RISCVCPU, cfg.ext_zvfbfwma, false),
 
     /* Vector cryptography extensions */
+    DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
 
     DEFINE_PROP_END_OF_LIST(),
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
 #include "qemu/bitops.h"
+#include "qemu/bswap.h"
 #include "cpu.h"
 #include "exec/memop.h"
 #include "exec/exec-all.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVV2, vclmulh_vv, OP_UUU_D, H8, H8, H8, clmulh64)
 GEN_VEXT_VV(vclmulh_vv, 8)
 RVVCALL(OPIVX2, vclmulh_vx, OP_UUU_D, H8, H8, clmulh64)
 GEN_VEXT_VX(vclmulh_vx, 8)
+
+RVVCALL(OPIVV2, vror_vv_b, OP_UUU_B, H1, H1, H1, ror8)
+RVVCALL(OPIVV2, vror_vv_h, OP_UUU_H, H2, H2, H2, ror16)
+RVVCALL(OPIVV2, vror_vv_w, OP_UUU_W, H4, H4, H4, ror32)
+RVVCALL(OPIVV2, vror_vv_d, OP_UUU_D, H8, H8, H8, ror64)
+GEN_VEXT_VV(vror_vv_b, 1)
+GEN_VEXT_VV(vror_vv_h, 2)
+GEN_VEXT_VV(vror_vv_w, 4)
+GEN_VEXT_VV(vror_vv_d, 8)
+
+RVVCALL(OPIVX2, vror_vx_b, OP_UUU_B, H1, H1, ror8)
+RVVCALL(OPIVX2, vror_vx_h, OP_UUU_H, H2, H2, ror16)
+RVVCALL(OPIVX2, vror_vx_w, OP_UUU_W, H4, H4, ror32)
+RVVCALL(OPIVX2, vror_vx_d, OP_UUU_D, H8, H8, ror64)
+GEN_VEXT_VX(vror_vx_b, 1)
+GEN_VEXT_VX(vror_vx_h, 2)
+GEN_VEXT_VX(vror_vx_w, 4)
+GEN_VEXT_VX(vror_vx_d, 8)
+
+RVVCALL(OPIVV2, vrol_vv_b, OP_UUU_B, H1, H1, H1, rol8)
+RVVCALL(OPIVV2, vrol_vv_h, OP_UUU_H, H2, H2, H2, rol16)
+RVVCALL(OPIVV2, vrol_vv_w, OP_UUU_W, H4, H4, H4, rol32)
+RVVCALL(OPIVV2, vrol_vv_d, OP_UUU_D, H8, H8, H8, rol64)
+GEN_VEXT_VV(vrol_vv_b, 1)
+GEN_VEXT_VV(vrol_vv_h, 2)
+GEN_VEXT_VV(vrol_vv_w, 4)
+GEN_VEXT_VV(vrol_vv_d, 8)
+
+RVVCALL(OPIVX2, vrol_vx_b, OP_UUU_B, H1, H1, rol8)
+RVVCALL(OPIVX2, vrol_vx_h, OP_UUU_H, H2, H2, rol16)
+RVVCALL(OPIVX2, vrol_vx_w, OP_UUU_W, H4, H4, rol32)
+RVVCALL(OPIVX2, vrol_vx_d, OP_UUU_D, H8, H8, rol64)
+GEN_VEXT_VX(vrol_vx_b, 1)
+GEN_VEXT_VX(vrol_vx_h, 2)
+GEN_VEXT_VX(vrol_vx_w, 4)
+GEN_VEXT_VX(vrol_vx_d, 8)
+
+static uint64_t brev8(uint64_t val)
+{
+    val = ((val & 0x5555555555555555ull) << 1) |
+          ((val & 0xAAAAAAAAAAAAAAAAull) >> 1);
+    val = ((val & 0x3333333333333333ull) << 2) |
+          ((val & 0xCCCCCCCCCCCCCCCCull) >> 2);
+    val = ((val & 0x0F0F0F0F0F0F0F0Full) << 4) |
+          ((val & 0xF0F0F0F0F0F0F0F0ull) >> 4);
+
+    return val;
+}
+
+RVVCALL(OPIVV1, vbrev8_v_b, OP_UU_B, H1, H1, brev8)
+RVVCALL(OPIVV1, vbrev8_v_h, OP_UU_H, H2, H2, brev8)
+RVVCALL(OPIVV1, vbrev8_v_w, OP_UU_W, H4, H4, brev8)
+RVVCALL(OPIVV1, vbrev8_v_d, OP_UU_D, H8, H8, brev8)
+GEN_VEXT_V(vbrev8_v_b, 1)
+GEN_VEXT_V(vbrev8_v_h, 2)
+GEN_VEXT_V(vbrev8_v_w, 4)
+GEN_VEXT_V(vbrev8_v_d, 8)
+
+#define DO_IDENTITY(a) (a)
+RVVCALL(OPIVV1, vrev8_v_b, OP_UU_B, H1, H1, DO_IDENTITY)
+RVVCALL(OPIVV1, vrev8_v_h, OP_UU_H, H2, H2, bswap16)
+RVVCALL(OPIVV1, vrev8_v_w, OP_UU_W, H4, H4, bswap32)
+RVVCALL(OPIVV1, vrev8_v_d, OP_UU_D, H8, H8, bswap64)
+GEN_VEXT_V(vrev8_v_b, 1)
+GEN_VEXT_V(vrev8_v_h, 2)
+GEN_VEXT_V(vrev8_v_w, 4)
+GEN_VEXT_V(vrev8_v_d, 8)
+
+#define DO_ANDN(a, b) ((a) & ~(b))
+RVVCALL(OPIVV2, vandn_vv_b, OP_UUU_B, H1, H1, H1, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_h, OP_UUU_H, H2, H2, H2, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_w, OP_UUU_W, H4, H4, H4, DO_ANDN)
+RVVCALL(OPIVV2, vandn_vv_d, OP_UUU_D, H8, H8, H8, DO_ANDN)
+GEN_VEXT_VV(vandn_vv_b, 1)
+GEN_VEXT_VV(vandn_vv_h, 2)
+GEN_VEXT_VV(vandn_vv_w, 4)
+GEN_VEXT_VV(vandn_vv_d, 8)
+
+RVVCALL(OPIVX2, vandn_vx_b, OP_UUU_B, H1, H1, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_h, OP_UUU_H, H2, H2, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_w, OP_UUU_W, H4, H4, DO_ANDN)
+RVVCALL(OPIVX2, vandn_vx_d, OP_UUU_D, H8, H8, DO_ANDN)
+GEN_VEXT_VX(vandn_vx_b, 1)
+GEN_VEXT_VX(vandn_vx_h, 2)
+GEN_VEXT_VX(vandn_vx_w, 4)
+GEN_VEXT_VX(vandn_vx_d, 8)
+
+RVVCALL(OPIVV1, vbrev_v_b, OP_UU_B, H1, H1, revbit8)
+RVVCALL(OPIVV1, vbrev_v_h, OP_UU_H, H2, H2, revbit16)
+RVVCALL(OPIVV1, vbrev_v_w, OP_UU_W, H4, H4, revbit32)
+RVVCALL(OPIVV1, vbrev_v_d, OP_UU_D, H8, H8, revbit64)
+GEN_VEXT_V(vbrev_v_b, 1)
+GEN_VEXT_V(vbrev_v_h, 2)
+GEN_VEXT_V(vbrev_v_w, 4)
+GEN_VEXT_V(vbrev_v_d, 8)
+
+RVVCALL(OPIVV1, vclz_v_b, OP_UU_B, H1, H1, clz8)
+RVVCALL(OPIVV1, vclz_v_h, OP_UU_H, H2, H2, clz16)
+RVVCALL(OPIVV1, vclz_v_w, OP_UU_W, H4, H4, clz32)
+RVVCALL(OPIVV1, vclz_v_d, OP_UU_D, H8, H8, clz64)
+GEN_VEXT_V(vclz_v_b, 1)
+GEN_VEXT_V(vclz_v_h, 2)
+GEN_VEXT_V(vclz_v_w, 4)
+GEN_VEXT_V(vclz_v_d, 8)
+
+RVVCALL(OPIVV1, vctz_v_b, OP_UU_B, H1, H1, ctz8)
+RVVCALL(OPIVV1, vctz_v_h, OP_UU_H, H2, H2, ctz16)
+RVVCALL(OPIVV1, vctz_v_w, OP_UU_W, H4, H4, ctz32)
+RVVCALL(OPIVV1, vctz_v_d, OP_UU_D, H8, H8, ctz64)
+GEN_VEXT_V(vctz_v_b, 1)
+GEN_VEXT_V(vctz_v_h, 2)
+GEN_VEXT_V(vctz_v_w, 4)
+GEN_VEXT_V(vctz_v_d, 8)
+
+RVVCALL(OPIVV1, vcpop_v_b, OP_UU_B, H1, H1, ctpop8)
+RVVCALL(OPIVV1, vcpop_v_h, OP_UU_H, H2, H2, ctpop16)
+RVVCALL(OPIVV1, vcpop_v_w, OP_UU_W, H4, H4, ctpop32)
+RVVCALL(OPIVV1, vcpop_v_d, OP_UU_D, H8, H8, ctpop64)
+GEN_VEXT_V(vcpop_v_b, 1)
+GEN_VEXT_V(vcpop_v_h, 2)
+GEN_VEXT_V(vcpop_v_w, 4)
+GEN_VEXT_V(vcpop_v_d, 8)
+
+#define DO_SLL(N, M) (N << (M & (sizeof(N) * 8 - 1)))
+RVVCALL(OPIVV2, vwsll_vv_b, WOP_UUU_B, H2, H1, H1, DO_SLL)
+RVVCALL(OPIVV2, vwsll_vv_h, WOP_UUU_H, H4, H2, H2, DO_SLL)
+RVVCALL(OPIVV2, vwsll_vv_w, WOP_UUU_W, H8, H4, H4, DO_SLL)
+GEN_VEXT_VV(vwsll_vv_b, 2)
+GEN_VEXT_VV(vwsll_vv_h, 4)
+GEN_VEXT_VV(vwsll_vv_w, 8)
+
+RVVCALL(OPIVX2, vwsll_vx_b, WOP_UUU_B, H2, H1, DO_SLL)
+RVVCALL(OPIVX2, vwsll_vx_h, WOP_UUU_H, H4, H2, DO_SLL)
+RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
+GEN_VEXT_VX(vwsll_vx_b, 2)
+GEN_VEXT_VX(vwsll_vx_h, 4)
+GEN_VEXT_VX(vwsll_vx_w, 8)
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vclmul_vx_check(DisasContext *s, arg_rmrr *a)
 
 GEN_VX_MASKED_TRANS(vclmul_vx, vclmul_vx_check)
 GEN_VX_MASKED_TRANS(vclmulh_vx, vclmul_vx_check)
+
+/*
+ * Zvbb
+ */
+
+#define GEN_OPIVI_GVEC_TRANS_CHECK(NAME, IMM_MODE, OPIVX, SUF, CHECK)   \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)              \
+    {                                                                   \
+        if (CHECK(s, a)) {                                              \
+            static gen_helper_opivx *const fns[4] = {                   \
+                gen_helper_##OPIVX##_b,                                 \
+                gen_helper_##OPIVX##_h,                                 \
+                gen_helper_##OPIVX##_w,                                 \
+                gen_helper_##OPIVX##_d,                                 \
+            };                                                          \
+            return do_opivi_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew], \
+                                 IMM_MODE);                             \
+        }                                                               \
+        return false;                                                   \
+    }
+
+#define GEN_OPIVV_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
+    {                                                                    \
+        if (CHECK(s, a)) {                                               \
+            static gen_helper_gvec_4_ptr *const fns[4] = {               \
+                gen_helper_##NAME##_b,                                   \
+                gen_helper_##NAME##_h,                                   \
+                gen_helper_##NAME##_w,                                   \
+                gen_helper_##NAME##_d,                                   \
+            };                                                           \
+            return do_opivv_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
+        }                                                                \
+        return false;                                                    \
+    }
+
+#define GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(NAME, SUF, CHECK)       \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)       \
+    {                                                            \
+        if (CHECK(s, a)) {                                       \
+            static gen_helper_opivx *const fns[4] = {            \
+                gen_helper_##NAME##_b,                           \
+                gen_helper_##NAME##_h,                           \
+                gen_helper_##NAME##_w,                           \
+                gen_helper_##NAME##_d,                           \
+            };                                                   \
+            return do_opivx_gvec_shift(s, a, tcg_gen_gvec_##SUF, \
+                                       fns[s->sew]);             \
+        }                                                        \
+        return false;                                            \
+    }
+
+static bool zvbb_vv_check(DisasContext *s, arg_rmrr *a)
+{
+    return opivv_check(s, a) && s->cfg_ptr->ext_zvbb == true;
+}
+
+static bool zvbb_vx_check(DisasContext *s, arg_rmrr *a)
+{
+    return opivx_check(s, a) && s->cfg_ptr->ext_zvbb == true;
+}
+
+/* vrol.v[vx] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vrol_vv, rotlv, zvbb_vv_check)
+GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vrol_vx, rotls, zvbb_vx_check)
+
+/* vror.v[vxi] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vror_vv, rotrv, zvbb_vv_check)
+GEN_OPIVX_GVEC_SHIFT_TRANS_CHECK(vror_vx, rotrs, zvbb_vx_check)
+GEN_OPIVI_GVEC_TRANS_CHECK(vror_vi, IMM_TRUNC_SEW, vror_vx, rotri, zvbb_vx_check)
+
+#define GEN_OPIVX_GVEC_TRANS_CHECK(NAME, SUF, CHECK)                     \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)               \
+    {                                                                    \
+        if (CHECK(s, a)) {                                               \
+            static gen_helper_opivx *const fns[4] = {                    \
+                gen_helper_##NAME##_b,                                   \
+                gen_helper_##NAME##_h,                                   \
+                gen_helper_##NAME##_w,                                   \
+                gen_helper_##NAME##_d,                                   \
+            };                                                           \
+            return do_opivx_gvec(s, a, tcg_gen_gvec_##SUF, fns[s->sew]); \
+        }                                                                \
+        return false;                                                    \
+    }
+
+/* vandn.v[vx] */
+GEN_OPIVV_GVEC_TRANS_CHECK(vandn_vv, andc, zvbb_vv_check)
+GEN_OPIVX_GVEC_TRANS_CHECK(vandn_vx, andcs, zvbb_vx_check)
+
+#define GEN_OPIV_TRANS(NAME, CHECK)                                        \
+    static bool trans_##NAME(DisasContext *s, arg_rmr *a)                  \
+    {                                                                      \
+        if (CHECK(s, a)) {                                                 \
+            uint32_t data = 0;                                             \
+            static gen_helper_gvec_3_ptr *const fns[4] = {                 \
+                gen_helper_##NAME##_b,                                     \
+                gen_helper_##NAME##_h,                                     \
+                gen_helper_##NAME##_w,                                     \
+                gen_helper_##NAME##_d,                                     \
+            };                                                             \
+            TCGLabel *over = gen_new_label();                              \
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);     \
+                                                                           \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                     \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                 \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                   \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s); \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                   \
+            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, 0),         \
+                               vreg_ofs(s, a->rs2), cpu_env,               \
+                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, \
+                               data, fns[s->sew]);                         \
+            mark_vs_dirty(s);                                              \
+            gen_set_label(over);                                           \
+            return true;                                                   \
+        }                                                                  \
+        return false;                                                      \
+    }
+
+static bool zvbb_opiv_check(DisasContext *s, arg_rmr *a)
+{
+    return s->cfg_ptr->ext_zvbb == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           vext_check_ss(s, a->rd, a->rs2, a->vm);
+}
+
+GEN_OPIV_TRANS(vbrev8_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vrev8_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vbrev_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vclz_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vctz_v, zvbb_opiv_check)
+GEN_OPIV_TRANS(vcpop_v, zvbb_opiv_check)
+
+static bool vwsll_vv_check(DisasContext *s, arg_rmrr *a)
+{
+    return s->cfg_ptr->ext_zvbb && opivv_widen_check(s, a);
+}
+
+static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
+{
+    return s->cfg_ptr->ext_zvbb && opivx_widen_check(s, a);
+}
+
+/* OPIVI without GVEC IR */
+#define GEN_OPIVI_WIDEN_TRANS(NAME, IMM_MODE, OPIVX, CHECK)                  \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                   \
+    {                                                                        \
+        if (CHECK(s, a)) {                                                   \
+            static gen_helper_opivx *const fns[3] = {                        \
+                gen_helper_##OPIVX##_b,                                      \
+                gen_helper_##OPIVX##_h,                                      \
+                gen_helper_##OPIVX##_w,                                      \
+            };                                                               \
+            return opivi_trans(a->rd, a->rs1, a->rs2, a->vm, fns[s->sew], s, \
+                               IMM_MODE);                                    \
+        }                                                                    \
+        return false;                                                        \
+    }
+
+GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
+GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
+GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
-- 
2.41.0

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

This commit adds support for the Zvkned vector-crypto extension, which
consists of the following instructions:

* vaesef.[vv,vs]
* vaesdf.[vv,vs]
* vaesdm.[vv,vs]
* vaesz.vs
* vaesem.[vv,vs]
* vaeskf1.vi
* vaeskf2.vi

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Co-authored-by: William Salmon <will.salmon@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: William Salmon <will.salmon@codethink.co.uk>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Imported aes-round.h and exposed x-zvkned
property]
[max.chou@sifive.com: Fixed endian issues and replaced the vstart & vl
egs checking by helper function]
[max.chou@sifive.com: Replaced bswap32 calls in aes key expanding]
Message-ID: <20230711165917.2629866-10-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |  14 ++
 target/riscv/insn32.decode               |  14 ++
 target/riscv/cpu.c                       |   4 +-
 target/riscv/vcrypto_helper.c            | 202 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 147 +++++++++++++++++
 6 files changed, 381 insertions(+), 1 deletion(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zve64d;
     bool ext_zvbb;
     bool ext_zvbc;
+    bool ext_zvkned;
     bool ext_zmmul;
     bool ext_zvfbfmin;
     bool ext_zvfbfwma;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_6(vandn_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vandn_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+
+DEF_HELPER_2(egs_check, void, i32, env)
+
+DEF_HELPER_4(vaesef_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesef_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdf_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdf_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesem_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesem_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdm_vv, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
+DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
+DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@
 @r_rm    .......   ..... ..... ... ..... ....... %rs2 %rs1 %rm %rd
 @r2_rm   .......   ..... ..... ... ..... ....... %rs1 %rm %rd
 @r2      .......   ..... ..... ... ..... ....... &r2 %rs1 %rd
+@r2_vm_1 ...... . ..... ..... ... ..... ....... &rmr vm=1 %rs2 %rd
 @r2_nfvm ... ... vm:1 ..... ..... ... ..... ....... &r2nfvm %nf %rs1 %rd
 @r2_vm   ...... vm:1 ..... ..... ... ..... ....... &rmr %rs2 %rd
 @r1_vm   ...... vm:1 ..... ..... ... ..... ....... %rd
@@ -XXX,XX +XXX,XX @@ vcpop_v     010010 . ..... 01110 010 ..... 1010111 @r2_vm
 vwsll_vv    110101 . ..... ..... 000 ..... 1010111 @r_vm
 vwsll_vx    110101 . ..... ..... 100 ..... 1010111 @r_vm
 vwsll_vi    110101 . ..... ..... 011 ..... 1010111 @r_vm
+
+# *** Zvkned vector crypto extension ***
+vaesef_vv   101000 1 ..... 00011 010 ..... 1110111 @r2_vm_1
+vaesef_vs   101001 1 ..... 00011 010 ..... 1110111 @r2_vm_1
+vaesdf_vv   101000 1 ..... 00001 010 ..... 1110111 @r2_vm_1
+vaesdf_vs   101001 1 ..... 00001 010 ..... 1110111 @r2_vm_1
+vaesem_vv   101000 1 ..... 00010 010 ..... 1110111 @r2_vm_1
+vaesem_vs   101001 1 ..... 00010 010 ..... 1110111 @r2_vm_1
+vaesdm_vv   101000 1 ..... 00000 010 ..... 1110111 @r2_vm_1
+vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
+vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
+vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
+    ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      * In principle Zve*x would also suffice here, were they supported
      * in qemu
      */
-    if (cpu->cfg.ext_zvbb && !cpu->cfg.ext_zve32f) {
+    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     /* Vector cryptography extensions */
     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
+    DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
 
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "qemu/bswap.h"
 #include "cpu.h"
+#include "crypto/aes.h"
+#include "crypto/aes-round.h"
 #include "exec/memop.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ RVVCALL(OPIVX2, vwsll_vx_w, WOP_UUU_W, H8, H4, DO_SLL)
 GEN_VEXT_VX(vwsll_vx_b, 2)
 GEN_VEXT_VX(vwsll_vx_h, 4)
 GEN_VEXT_VX(vwsll_vx_w, 8)
+
+void HELPER(egs_check)(uint32_t egs, CPURISCVState *env)
+{
+    uint32_t vl = env->vl;
+    uint32_t vstart = env->vstart;
+
+    if (vl % egs != 0 || vstart % egs != 0) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+    }
+}
+
+static inline void xor_round_key(AESState *round_state, AESState *round_key)
+{
+    round_state->v = round_state->v ^ round_key->v;
+}
+
+#define GEN_ZVKNED_HELPER_VV(NAME, ...)                                   \
+    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
+                      uint32_t desc)                                      \
+    {                                                                     \
+        uint32_t vl = env->vl;                                            \
+        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
+        uint32_t vta = vext_vta(desc);                                    \
+                                                                          \
+        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
+            AESState round_key;                                           \
+            round_key.d[0] = *((uint64_t *)vs2 + H8(i * 2 + 0));          \
+            round_key.d[1] = *((uint64_t *)vs2 + H8(i * 2 + 1));          \
+            AESState round_state;                                         \
+            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
+            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
+            __VA_ARGS__;                                                  \
+            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
+            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
+        }                                                                 \
+        env->vstart = 0;                                                  \
+        /* set tail elements to 1s */                                     \
+        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
+    }
+
+#define GEN_ZVKNED_HELPER_VS(NAME, ...)                                   \
+    void HELPER(NAME)(void *vd, void *vs2, CPURISCVState *env,            \
+                      uint32_t desc)                                      \
+    {                                                                     \
+        uint32_t vl = env->vl;                                            \
+        uint32_t total_elems = vext_get_total_elems(env, desc, 4);        \
+        uint32_t vta = vext_vta(desc);                                    \
+                                                                          \
+        for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {        \
+            AESState round_key;                                           \
+            round_key.d[0] = *((uint64_t *)vs2 + H8(0));                  \
+            round_key.d[1] = *((uint64_t *)vs2 + H8(1));                  \
+            AESState round_state;                                         \
+            round_state.d[0] = *((uint64_t *)vd + H8(i * 2 + 0));         \
+            round_state.d[1] = *((uint64_t *)vd + H8(i * 2 + 1));         \
+            __VA_ARGS__;                                                  \
+            *((uint64_t *)vd + H8(i * 2 + 0)) = round_state.d[0];         \
+            *((uint64_t *)vd + H8(i * 2 + 1)) = round_state.d[1];         \
+        }                                                                 \
+        env->vstart = 0;                                                  \
+        /* set tail elements to 1s */                                     \
+        vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);              \
+    }
+
+GEN_ZVKNED_HELPER_VV(vaesef_vv, aesenc_SB_SR_AK(&round_state,
+                                                &round_state,
+                                                &round_key,
+                                                false);)
+GEN_ZVKNED_HELPER_VS(vaesef_vs, aesenc_SB_SR_AK(&round_state,
+                                                &round_state,
+                                                &round_key,
+                                                false);)
+GEN_ZVKNED_HELPER_VV(vaesdf_vv, aesdec_ISB_ISR_AK(&round_state,
+                                                  &round_state,
+                                                  &round_key,
+                                                  false);)
+GEN_ZVKNED_HELPER_VS(vaesdf_vs, aesdec_ISB_ISR_AK(&round_state,
+                                                  &round_state,
+                                                  &round_key,
+                                                  false);)
+GEN_ZVKNED_HELPER_VV(vaesem_vv, aesenc_SB_SR_MC_AK(&round_state,
+                                                   &round_state,
+                                                   &round_key,
+                                                   false);)
+GEN_ZVKNED_HELPER_VS(vaesem_vs, aesenc_SB_SR_MC_AK(&round_state,
+                                                   &round_state,
+                                                   &round_key,
+                                                   false);)
+GEN_ZVKNED_HELPER_VV(vaesdm_vv, aesdec_ISB_ISR_AK_IMC(&round_state,
+                                                      &round_state,
+                                                      &round_key,
+                                                      false);)
+GEN_ZVKNED_HELPER_VS(vaesdm_vs, aesdec_ISB_ISR_AK_IMC(&round_state,
+                                                      &round_state,
+                                                      &round_key,
+                                                      false);)
+GEN_ZVKNED_HELPER_VS(vaesz_vs, xor_round_key(&round_state, &round_key);)
+
+void HELPER(vaeskf1_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
+                        CPURISCVState *env, uint32_t desc)
+{
+    uint32_t *vd = vd_vptr;
+    uint32_t *vs2 = vs2_vptr;
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
+    uint32_t vta = vext_vta(desc);
+
+    uimm &= 0b1111;
+    if (uimm > 10 || uimm == 0) {
+        uimm ^= 0b1000;
+    }
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        uint32_t rk[8], tmp;
+        static const uint32_t rcon[] = {
+            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
+            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
+        };
+
+        rk[0] = vs2[i * 4 + H4(0)];
+        rk[1] = vs2[i * 4 + H4(1)];
+        rk[2] = vs2[i * 4 + H4(2)];
+        rk[3] = vs2[i * 4 + H4(3)];
+        tmp = ror32(rk[3], 8);
+
+        rk[4] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
+                         ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
+                         ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
+                         ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
+                      ^ rcon[uimm - 1];
+        rk[5] = rk[1] ^ rk[4];
+        rk[6] = rk[2] ^ rk[5];
+        rk[7] = rk[3] ^ rk[6];
+
+        vd[i * 4 + H4(0)] = rk[4];
+        vd[i * 4 + H4(1)] = rk[5];
+        vd[i * 4 + H4(2)] = rk[6];
+        vd[i * 4 + H4(3)] = rk[7];
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
+}
+
+void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
+                        CPURISCVState *env, uint32_t desc)
+{
+    uint32_t *vd = vd_vptr;
+    uint32_t *vs2 = vs2_vptr;
+    uint32_t vl = env->vl;
+    uint32_t total_elems = vext_get_total_elems(env, desc, 4);
+    uint32_t vta = vext_vta(desc);
+
+    uimm &= 0b1111;
+    if (uimm > 14 || uimm < 2) {
+        uimm ^= 0b1000;
+    }
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        uint32_t rk[12], tmp;
+        static const uint32_t rcon[] = {
+            0x00000001, 0x00000002, 0x00000004, 0x00000008, 0x00000010,
+            0x00000020, 0x00000040, 0x00000080, 0x0000001B, 0x00000036,
+        };
+
+        rk[0] = vd[i * 4 + H4(0)];
+        rk[1] = vd[i * 4 + H4(1)];
+        rk[2] = vd[i * 4 + H4(2)];
+        rk[3] = vd[i * 4 + H4(3)];
+        rk[4] = vs2[i * 4 + H4(0)];
+        rk[5] = vs2[i * 4 + H4(1)];
+        rk[6] = vs2[i * 4 + H4(2)];
+        rk[7] = vs2[i * 4 + H4(3)];
+
+        if (uimm % 2 == 0) {
+            tmp = ror32(rk[7], 8);
+            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(tmp >> 24) & 0xff] << 24) |
+                             ((uint32_t)AES_sbox[(tmp >> 16) & 0xff] << 16) |
+                             ((uint32_t)AES_sbox[(tmp >> 8) & 0xff] << 8) |
+                             ((uint32_t)AES_sbox[(tmp >> 0) & 0xff] << 0))
+                          ^ rcon[(uimm - 1) / 2];
+        } else {
+            rk[8] = rk[0] ^ (((uint32_t)AES_sbox[(rk[7] >> 24) & 0xff] << 24) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 16) & 0xff] << 16) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 8) & 0xff] << 8) |
+                             ((uint32_t)AES_sbox[(rk[7] >> 0) & 0xff] << 0));
+        }
+        rk[9] = rk[1] ^ rk[8];
+        rk[10] = rk[2] ^ rk[9];
+        rk[11] = rk[3] ^ rk[10];
+
+        vd[i * 4 + H4(0)] = rk[8];
+        vd[i * 4 + H4(1)] = rk[9];
+        vd[i * 4 + H4(2)] = rk[10];
+        vd[i * 4 + H4(3)] = rk[11];
+    }
+    env->vstart = 0;
+    /* set tail elements to 1s */
+    vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
+}
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vwsll_vx_check(DisasContext *s, arg_rmrr *a)
 GEN_OPIVV_WIDEN_TRANS(vwsll_vv, vwsll_vv_check)
 GEN_OPIVX_WIDEN_TRANS(vwsll_vx, vwsll_vx_check)
 GEN_OPIVI_WIDEN_TRANS(vwsll_vi, IMM_ZX, vwsll_vx, vwsll_vx_check)
+
+/*
+ * Zvkned
+ */
+
+#define ZVKNED_EGS 4
+
+#define GEN_V_UNMASKED_TRANS(NAME, CHECK, EGS)                                \
+    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            TCGv_ptr rd_v, rs2_v;                                             \
+            TCGv_i32 desc, egs;                                               \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+            rd_v = tcg_temp_new_ptr();                                        \
+            rs2_v = tcg_temp_new_ptr();                                       \
+            desc = tcg_constant_i32(                                          \
+                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
+            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
+            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
+            gen_helper_##NAME(rd_v, rs2_v, cpu_env, desc);                    \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vaes_check_vv(DisasContext *s, arg_rmr *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul) &&
+           s->sew == MO_32;
+}
+
+static bool vaes_check_overlap(DisasContext *s, int vd, int vs2)
+{
+    int8_t op_size = s->lmul <= 0 ? 1 : 1 << s->lmul;
+    return !is_overlapped(vd, op_size, vs2, 1);
+}
+
+static bool vaes_check_vs(DisasContext *s, arg_rmr *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return vaes_check_overlap(s, a->rd, a->rs2) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           require_align(a->rd, s->lmul) &&
+           s->sew == MO_32;
+}
+
+GEN_V_UNMASKED_TRANS(vaesef_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesef_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdf_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdf_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdm_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesdm_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesz_vs, vaes_check_vs, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesem_vv, vaes_check_vv, ZVKNED_EGS)
+GEN_V_UNMASKED_TRANS(vaesem_vs, vaes_check_vs, ZVKNED_EGS)
+
+#define GEN_VI_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
+    static bool trans_##NAME(DisasContext *s, arg_##NAME *a)                  \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            TCGv_ptr rd_v, rs2_v;                                             \
+            TCGv_i32 uimm_v, desc, egs;                                       \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+                                                                              \
+            rd_v = tcg_temp_new_ptr();                                        \
+            rs2_v = tcg_temp_new_ptr();                                       \
+            uimm_v = tcg_constant_i32(a->rs1);                                \
+            desc = tcg_constant_i32(                                          \
+                simd_desc(s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8, data)); \
+            tcg_gen_addi_ptr(rd_v, cpu_env, vreg_ofs(s, a->rd));              \
+            tcg_gen_addi_ptr(rs2_v, cpu_env, vreg_ofs(s, a->rs2));            \
+            gen_helper_##NAME(rd_v, rs2_v, uimm_v, cpu_env, desc);            \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vaeskf1_check(DisasContext *s, arg_vaeskf1_vi *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->sew == MO_32 &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul);
+}
+
+static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
+{
+    int egw_bytes = ZVKNED_EGS << s->sew;
+    return s->cfg_ptr->ext_zvkned == true &&
+           require_rvv(s) &&
+           vext_check_isa_ill(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           s->sew == MO_32 &&
+           require_align(a->rd, s->lmul) &&
+           require_align(a->rs2, s->lmul);
+}
+
+GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
+GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
-- 
2.41.0

From: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>

This commit adds support for the Zvknh vector-crypto extension, which
consists of the following instructions:

* vsha2ms.vv
* vsha2c[hl].vv

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvknha & x-zvknhb properties]
[max.chou@sifive.com: Replaced SEW selection to happened during
translation]
Message-ID: <20230711165917.2629866-11-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   2 +
 target/riscv/helper.h                    |   6 +
 target/riscv/insn32.decode               |   5 +
 target/riscv/cpu.c                       |  13 +-
 target/riscv/vcrypto_helper.c            | 238 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 129 ++++++++++++
 6 files changed, 390 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_cfg.h
+++ b/target/riscv/cpu_cfg.h
@@ -XXX,XX +XXX,XX @@ struct RISCVCPUConfig {
     bool ext_zvbb;
     bool ext_zvbc;
     bool ext_zvkned;
+    bool ext_zvknha;
+    bool ext_zvknhb;
     bool ext_zmmul;
     bool ext_zvfbfmin;
     bool ext_zvfbfwma;
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vaesdm_vs, void, ptr, ptr, env, i32)
 DEF_HELPER_4(vaesz_vs, void, ptr, ptr, env, i32)
 DEF_HELPER_5(vaeskf1_vi, void, ptr, ptr, i32, env, i32)
 DEF_HELPER_5(vaeskf2_vi, void, ptr, ptr, i32, env, i32)
+
+DEF_HELPER_5(vsha2ms_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2ch32_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2ch64_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2cl32_vv, void, ptr, ptr, ptr, env, i32)
+DEF_HELPER_5(vsha2cl64_vv, void, ptr, ptr, ptr, env, i32)
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -XXX,XX +XXX,XX @@ vaesdm_vs   101001 1 ..... 00000 010 ..... 1110111 @r2_vm_1
 vaesz_vs    101001 1 ..... 00111 010 ..... 1110111 @r2_vm_1
 vaeskf1_vi  100010 1 ..... ..... 010 ..... 1110111 @r_vm_1
 vaeskf2_vi  101010 1 ..... ..... 010 ..... 1110111 @r_vm_1
+
+# *** Zvknh vector crypto extension ***
+vsha2ms_vv  101101 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vsha2ch_vv  101110 1 ..... ..... 010 ..... 1110111 @r_vm_1
+vsha2cl_vv  101111 1 ..... ..... 010 ..... 1110111 @r_vm_1
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static const struct isa_ext_data isa_edata_arr[] = {
     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
+    ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
+    ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
      * In principle Zve*x would also suffice here, were they supported
      * in qemu
      */
-    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned) && !cpu->cfg.ext_zve32f) {
+    if ((cpu->cfg.ext_zvbb || cpu->cfg.ext_zvkned || cpu->cfg.ext_zvknha) &&
+        !cpu->cfg.ext_zve32f) {
         error_setg(errp,
                    "Vector crypto extensions require V or Zve* extensions");
         return;
     }
 
-    if (cpu->cfg.ext_zvbc && !cpu->cfg.ext_zve64f) {
-        error_setg(errp, "Zvbc extension requires V or Zve64{f,d} extensions");
+    if ((cpu->cfg.ext_zvbc || cpu->cfg.ext_zvknhb) && !cpu->cfg.ext_zve64f) {
+        error_setg(
+            errp,
+            "Zvbc and Zvknhb extensions require V or Zve64{f,d} extensions");
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("x-zvbb", RISCVCPU, cfg.ext_zvbb, false),
     DEFINE_PROP_BOOL("x-zvbc", RISCVCPU, cfg.ext_zvbc, false),
     DEFINE_PROP_BOOL("x-zvkned", RISCVCPU, cfg.ext_zvkned, false),
+    DEFINE_PROP_BOOL("x-zvknha", RISCVCPU, cfg.ext_zvknha, false),
+    DEFINE_PROP_BOOL("x-zvknhb", RISCVCPU, cfg.ext_zvknhb, false),
 
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/target/riscv/vcrypto_helper.c b/target/riscv/vcrypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/vcrypto_helper.c
+++ b/target/riscv/vcrypto_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(vaeskf2_vi)(void *vd_vptr, void *vs2_vptr, uint32_t uimm,
     /* set tail elements to 1s */
     vext_set_elems_1s(vd, vta, vl * 4, total_elems * 4);
 }
+
+static inline uint32_t sig0_sha256(uint32_t x)
+{
+    return ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3);
+}
+
+static inline uint32_t sig1_sha256(uint32_t x)
+{
+    return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
+}
+
+static inline uint64_t sig0_sha512(uint64_t x)
+{
+    return ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7);
+}
+
+static inline uint64_t sig1_sha512(uint64_t x)
+{
+    return ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6);
+}
+
+static inline void vsha2ms_e32(uint32_t *vd, uint32_t *vs1, uint32_t *vs2)
+{
+    uint32_t res[4];
+    res[0] = sig1_sha256(vs1[H4(2)]) + vs2[H4(1)] + sig0_sha256(vd[H4(1)]) +
+             vd[H4(0)];
+    res[1] = sig1_sha256(vs1[H4(3)]) + vs2[H4(2)] + sig0_sha256(vd[H4(2)]) +
+             vd[H4(1)];
+    res[2] =
+        sig1_sha256(res[0]) + vs2[H4(3)] + sig0_sha256(vd[H4(3)]) + vd[H4(2)];
+    res[3] =
+        sig1_sha256(res[1]) + vs1[H4(0)] + sig0_sha256(vs2[H4(0)]) + vd[H4(3)];
+    vd[H4(3)] = res[3];
+    vd[H4(2)] = res[2];
+    vd[H4(1)] = res[1];
+    vd[H4(0)] = res[0];
+}
+
+static inline void vsha2ms_e64(uint64_t *vd, uint64_t *vs1, uint64_t *vs2)
+{
+    uint64_t res[4];
+    res[0] = sig1_sha512(vs1[2]) + vs2[1] + sig0_sha512(vd[1]) + vd[0];
+    res[1] = sig1_sha512(vs1[3]) + vs2[2] + sig0_sha512(vd[2]) + vd[1];
+    res[2] = sig1_sha512(res[0]) + vs2[3] + sig0_sha512(vd[3]) + vd[2];
+    res[3] = sig1_sha512(res[1]) + vs1[0] + sig0_sha512(vs2[0]) + vd[3];
+    vd[3] = res[3];
+    vd[2] = res[2];
+    vd[1] = res[1];
+    vd[0] = res[0];
+}
+
+void HELPER(vsha2ms_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                        uint32_t desc)
+{
+    uint32_t sew = FIELD_EX64(env->vtype, VTYPE, VSEW);
+    uint32_t esz = sew == MO_32 ? 4 : 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        if (sew == MO_32) {
+            vsha2ms_e32(((uint32_t *)vd) + i * 4, ((uint32_t *)vs1) + i * 4,
+                        ((uint32_t *)vs2) + i * 4);
+        } else {
+            /* If not 32 then SEW should be 64 */
+            vsha2ms_e64(((uint64_t *)vd) + i * 4, ((uint64_t *)vs1) + i * 4,
+                        ((uint64_t *)vs2) + i * 4);
+        }
+    }
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+static inline uint64_t sum0_64(uint64_t x)
+{
+    return ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39);
+}
+
+static inline uint32_t sum0_32(uint32_t x)
+{
+    return ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22);
+}
+
+static inline uint64_t sum1_64(uint64_t x)
+{
+    return ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41);
+}
+
+static inline uint32_t sum1_32(uint32_t x)
+{
+    return ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25);
+}
+
+#define ch(x, y, z) ((x & y) ^ ((~x) & z))
+
+#define maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
+
+static void vsha2c_64(uint64_t *vs2, uint64_t *vd, uint64_t *vs1)
+{
+    uint64_t a = vs2[3], b = vs2[2], e = vs2[1], f = vs2[0];
+    uint64_t c = vd[3], d = vd[2], g = vd[1], h = vd[0];
+    uint64_t W0 = vs1[0], W1 = vs1[1];
+    uint64_t T1 = h + sum1_64(e) + ch(e, f, g) + W0;
+    uint64_t T2 = sum0_64(a) + maj(a, b, c);
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    T1 = h + sum1_64(e) + ch(e, f, g) + W1;
+    T2 = sum0_64(a) + maj(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    vd[0] = f;
+    vd[1] = e;
+    vd[2] = b;
+    vd[3] = a;
+}
+
+static void vsha2c_32(uint32_t *vs2, uint32_t *vd, uint32_t *vs1)
+{
+    uint32_t a = vs2[H4(3)], b = vs2[H4(2)], e = vs2[H4(1)], f = vs2[H4(0)];
+    uint32_t c = vd[H4(3)], d = vd[H4(2)], g = vd[H4(1)], h = vd[H4(0)];
+    uint32_t W0 = vs1[H4(0)], W1 = vs1[H4(1)];
+    uint32_t T1 = h + sum1_32(e) + ch(e, f, g) + W0;
+    uint32_t T2 = sum0_32(a) + maj(a, b, c);
+
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    T1 = h + sum1_32(e) + ch(e, f, g) + W1;
+    T2 = sum0_32(a) + maj(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    e = d + T1;
+    d = c;
+    c = b;
+    b = a;
+    a = T1 + T2;
+
+    vd[H4(0)] = f;
+    vd[H4(1)] = e;
+    vd[H4(2)] = b;
+    vd[H4(3)] = a;
+}
+
+void HELPER(vsha2ch32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 4;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
+                  ((uint32_t *)vs1) + 4 * i + 2);
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2ch64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
+                  ((uint64_t *)vs1) + 4 * i + 2);
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2cl32_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    const uint32_t esz = 4;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_32(((uint32_t *)vs2) + 4 * i, ((uint32_t *)vd) + 4 * i,
+                  (((uint32_t *)vs1) + 4 * i));
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
+
+void HELPER(vsha2cl64_vv)(void *vd, void *vs1, void *vs2, CPURISCVState *env,
+                          uint32_t desc)
+{
+    uint32_t esz = 8;
+    uint32_t total_elems;
+    uint32_t vta = vext_vta(desc);
+
+    for (uint32_t i = env->vstart / 4; i < env->vl / 4; i++) {
+        vsha2c_64(((uint64_t *)vs2) + 4 * i, ((uint64_t *)vd) + 4 * i,
+                  (((uint64_t *)vs1) + 4 * i));
+    }
+
+    /* set tail elements to 1s */
+    total_elems = vext_get_total_elems(env, desc, esz);
+    vext_set_elems_1s(vd, vta, env->vl * esz, total_elems * esz);
+    env->vstart = 0;
+}
diff --git a/target/riscv/insn_trans/trans_rvvk.c.inc b/target/riscv/insn_trans/trans_rvvk.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvvk.c.inc
+++ b/target/riscv/insn_trans/trans_rvvk.c.inc
@@ -XXX,XX +XXX,XX @@ static bool vaeskf2_check(DisasContext *s, arg_vaeskf2_vi *a)
 
 GEN_VI_UNMASKED_TRANS(vaeskf1_vi, vaeskf1_check, ZVKNED_EGS)
 GEN_VI_UNMASKED_TRANS(vaeskf2_vi, vaeskf2_check, ZVKNED_EGS)
+
+/*
+ * Zvknh
+ */
+
+#define ZVKNH_EGS 4
+
+#define GEN_VV_UNMASKED_TRANS(NAME, CHECK, EGS)                               \
+    static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                    \
+    {                                                                         \
+        if (CHECK(s, a)) {                                                    \
+            uint32_t data = 0;                                                \
+            TCGLabel *over = gen_new_label();                                 \
+            TCGv_i32 egs;                                                     \
+                                                                              \
+            if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {                      \
+                /* save opcode for unwinding in case we throw an exception */ \
+                decode_save_opc(s);                                           \
+                egs = tcg_constant_i32(EGS);                                  \
+                gen_helper_egs_check(egs, cpu_env);                           \
+                tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);    \
+            }                                                                 \
+                                                                              \
+            data = FIELD_DP32(data, VDATA, VM, a->vm);                        \
+            data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                    \
+            data = FIELD_DP32(data, VDATA, VTA, s->vta);                      \
+            data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);    \
+            data = FIELD_DP32(data, VDATA, VMA, s->vma);                      \
+                                                                              \
+            tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),       \
+                               vreg_ofs(s, a->rs2), cpu_env,                  \
+                               s->cfg_ptr->vlen / 8, s->cfg_ptr->vlen / 8,    \
+                               data, gen_helper_##NAME);                      \
+                                                                              \
+            mark_vs_dirty(s);                                                 \
+            gen_set_label(over);                                              \
+            return true;                                                      \
+        }                                                                     \
+        return false;                                                         \
+    }
+
+static bool vsha_check_sew(DisasContext *s)
+{
+    return (s->cfg_ptr->ext_zvknha == true && s->sew == MO_32) ||
+           (s->cfg_ptr->ext_zvknhb == true &&
+            (s->sew == MO_32 || s->sew == MO_64));
+}
+
+static bool vsha_check(DisasContext *s, arg_rmrr *a)
+{
+    int egw_bytes = ZVKNH_EGS << s->sew;
+    int mult = 1 << MAX(s->lmul, 0);
+    return opivv_check(s, a) &&
+           vsha_check_sew(s) &&
+           MAXSZ(s) >= egw_bytes &&
+           !is_overlapped(a->rd, mult, a->rs1, mult) &&
+           !is_overlapped(a->rd, mult, a->rs2, mult) &&
+           s->lmul >= 0;
+}
+
+GEN_VV_UNMASKED_TRANS(vsha2ms_vv, vsha_check, ZVKNH_EGS)
+
+static bool trans_vsha2cl_vv(DisasContext *s, arg_rmrr *a)
+{
+    if (vsha_check(s, a)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+        TCGv_i32 egs;
+
+        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
+            /* save opcode for unwinding in case we throw an exception */
+            decode_save_opc(s);
+            egs = tcg_constant_i32(ZVKNH_EGS);
+            gen_helper_egs_check(egs, cpu_env);
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+        }
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
+
+        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
+            s->cfg_ptr->vlen / 8, data,
+            s->sew == MO_32 ?
+                gen_helper_vsha2cl32_vv : gen_helper_vsha2cl64_vv);
+
+        mark_vs_dirty(s);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
+
+static bool trans_vsha2ch_vv(DisasContext *s, arg_rmrr *a)
+{
+    if (vsha_check(s, a)) {
+        uint32_t data = 0;
+        TCGLabel *over = gen_new_label();
+        TCGv_i32 egs;
+
+        if (!s->vstart_eq_zero || !s->vl_eq_vlmax) {
+            /* save opcode for unwinding in case we throw an exception */
+            decode_save_opc(s);
+            egs = tcg_constant_i32(ZVKNH_EGS);
+            gen_helper_egs_check(egs, cpu_env);
+            tcg_gen_brcond_tl(TCG_COND_GEU, cpu_vstart, cpu_vl, over);
+        }
+
+        data = FIELD_DP32(data, VDATA, VM, a->vm);
+        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);
+        data = FIELD_DP32(data, VDATA, VTA, s->vta);
+        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);
+
+        tcg_gen_gvec_3_ptr(vreg_ofs(s, a->rd), vreg_ofs(s, a->rs1),
+            vreg_ofs(s, a->rs2), cpu_env, s->cfg_ptr->vlen / 8,
+            s->cfg_ptr->vlen / 8, data,
+            s->sew == MO_32 ?
+                gen_helper_vsha2ch32_vv : gen_helper_vsha2ch64_vv);
+
+        mark_vs_dirty(s);
+        gen_set_label(over);
+        return true;
+    }
+    return false;
+}
-- 
2.41.0

From: Lawrence Hunter <lawrence.hunter@codethink.co.uk>

This commit adds support for the Zvksh vector-crypto extension, which
consists of the following instructions:

* vsm3me.vv
* vsm3c.vi

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Kiran Ostrolenk <kiran.ostrolenk@codethink.co.uk>
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvksh property]
Message-ID: <20230711165917.2629866-12-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |   3 +
 target/riscv/insn32.decode               |   4 +
 target/riscv/cpu.c                       |   6 +-
 target/riscv/vcrypto_helper.c            | 134 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc |  31 ++++++
 6 files changed, 177 insertions(+), 2 deletions(-)

From: Nazar Kazakov <nazar.kazakov@codethink.co.uk>

This commit adds support for the Zvkg vector-crypto extension, which
consists of the following instructions:

* vgmul.vv
* vghsh.vv

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Co-authored-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
[max.chou@sifive.com: Replaced vstart checking by TCG op]
Signed-off-by: Lawrence Hunter <lawrence.hunter@codethink.co.uk>
Signed-off-by: Nazar Kazakov <nazar.kazakov@codethink.co.uk>
Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
[max.chou@sifive.com: Exposed x-zvkg property]
[max.chou@sifive.com: Replaced uint by int for cross win32 build]
Message-ID: <20230711165917.2629866-13-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |  1 +
 target/riscv/helper.h                    |  3 +
 target/riscv/insn32.decode               |  4 ++
 target/riscv/cpu.c                       |  6 +-
 target/riscv/vcrypto_helper.c            | 72 ++++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc | 30 ++++++++++
 6 files changed, 114 insertions(+), 2 deletions(-)

From: Max Chou <max.chou@sifive.com>

Allows sharing of sm4_subword between different targets.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-14-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/sm4.h           |  8 ++++++++
 target/arm/tcg/crypto_helper.c | 10 ++--------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/sm4.h
+++ b/include/crypto/sm4.h
@@ -XXX,XX +XXX,XX @@
 
 extern const uint8_t sm4_sbox[256];
 
+static inline uint32_t sm4_subword(uint32_t word)
+{
+    return sm4_sbox[word & 0xff] |
+           sm4_sbox[(word >> 8) & 0xff] << 8 |
+           sm4_sbox[(word >> 16) & 0xff] << 16 |
+           sm4_sbox[(word >> 24) & 0xff] << 24;
+}
+
 #endif
diff --git a/target/arm/tcg/crypto_helper.c b/target/arm/tcg/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/crypto_helper.c
+++ b/target/arm/tcg/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4e(uint64_t *rd, uint64_t *rn, uint64_t *rm)
             CR_ST_WORD(d, (i + 3) % 4) ^
             CR_ST_WORD(n, i);
 
-        t = sm4_sbox[t & 0xff] |
-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-            sm4_sbox[(t >> 24) & 0xff] << 24;
+        t = sm4_subword(t);
 
         CR_ST_WORD(d, i) ^= t ^ rol32(t, 2) ^ rol32(t, 10) ^ rol32(t, 18) ^
                             rol32(t, 24);
@@ -XXX,XX +XXX,XX @@ static void do_crypto_sm4ekey(uint64_t *rd, uint64_t *rn, uint64_t *rm)
             CR_ST_WORD(d, (i + 3) % 4) ^
             CR_ST_WORD(m, i);
 
-        t = sm4_sbox[t & 0xff] |
-            sm4_sbox[(t >> 8) & 0xff] << 8 |
-            sm4_sbox[(t >> 16) & 0xff] << 16 |
-            sm4_sbox[(t >> 24) & 0xff] << 24;
+        t = sm4_subword(t);
 
         CR_ST_WORD(d, i) ^= t ^ rol32(t, 13) ^ rol32(t, 23);
     }
-- 
2.41.0

From: Max Chou <max.chou@sifive.com>

Adds sm4_ck constant for use in sm4 cryptography across different targets.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-15-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/crypto/sm4.h |  1 +
 crypto/sm4.c         | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/include/crypto/sm4.h b/include/crypto/sm4.h
index XXXXXXX..XXXXXXX 100644
--- a/include/crypto/sm4.h
+++ b/include/crypto/sm4.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_SM4_H
 
 extern const uint8_t sm4_sbox[256];
+extern const uint32_t sm4_ck[32];
 
 static inline uint32_t sm4_subword(uint32_t word)
 {
diff --git a/crypto/sm4.c b/crypto/sm4.c
index XXXXXXX..XXXXXXX 100644
--- a/crypto/sm4.c
+++ b/crypto/sm4.c
@@ -XXX,XX +XXX,XX @@ uint8_t const sm4_sbox[] = {
     0x79, 0xee, 0x5f, 0x3e, 0xd7, 0xcb, 0x39, 0x48,
 };
 
+uint32_t const sm4_ck[] = {
+    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
+    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
+    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
+    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
+    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
+    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
+    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
+    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
+};
-- 
2.41.0

From: Max Chou <max.chou@sifive.com>

This commit adds support for the Zvksed vector-crypto extension, which
consists of the following instructions:

* vsm4k.vi
* vsm4r.[vv,vs]

Translation functions are defined in
`target/riscv/insn_trans/trans_rvvk.c.inc` and helpers are defined in
`target/riscv/vcrypto_helper.c`.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
[lawrence.hunter@codethink.co.uk: Moved SM4 functions from
crypto_helper.c to vcrypto_helper.c]
[nazar.kazakov@codethink.co.uk: Added alignment checks, refactored code to
use macros, and minor style changes]
Signed-off-by: Max Chou <max.chou@sifive.com>
Message-ID: <20230711165917.2629866-16-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h                   |   1 +
 target/riscv/helper.h                    |   4 +
 target/riscv/insn32.decode               |   5 +
 target/riscv/cpu.c                       |   5 +-
 target/riscv/vcrypto_helper.c            | 127 +++++++++++++++++++++++
 target/riscv/insn_trans/trans_rvvk.c.inc |  43 ++++++++
 6 files changed, 184 insertions(+), 1 deletion(-)

From: Rob Bradford <rbradford@rivosinc.com>

These are WARL fields - zero out the bits for unavailable counters and
special case the TM bit in mcountinhibit which is hardwired to zero.
This patch achieves this by modifying the value written so that any use
of the field will see the correctly masked bits.

Tested by modifying OpenSBI to write max value to these CSRs and upon
subsequent read the appropriate number of bits for number of PMUs is
enabled and the TM bit is zero in mcountinhibit.

Signed-off-by: Rob Bradford <rbradford@rivosinc.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Message-ID: <20230802124906.24197-1-rbradford@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
 {
     int cidx;
     PMUCTRState *counter;
+    RISCVCPU *cpu = env_archcpu(env);
 
-    env->mcountinhibit = val;
+    /* WARL register - disable unavailable counters; TM bit is always 0 */
+    env->mcountinhibit =
+        val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR);
 
     /* Check if any other counter is also monitoring cycles/instructions */
     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
@@ -XXX,XX +XXX,XX @@ static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
                                        target_ulong val)
 {
-    env->mcounteren = val;
+    RISCVCPU *cpu = env_archcpu(env);
+
+    /* WARL register - disable unavailable counters */
+    env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
+                             COUNTEREN_IR);
     return RISCV_EXCP_NONE;
 }
 
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

RVA23 Profiles states:
The RVA23 profiles are intended to be used for 64-bit application
processors that will run rich OS stacks from standard binary OS
distributions and with a substantial number of third-party binary user
applications that will be supported over a considerable length of time
in the field.

The chapter 4 of the unprivileged spec introduces the Zihintntl extension
and Zihintntl is a mandatory extension presented in RVA23 Profiles, whose
purpose is to enable application and operating system portability across
different implementations. Thus the DTS should contain the Zihintntl ISA
string in order to pass to software.

The unprivileged spec states:
Like any HINTs, these instructions may be freely ignored. Hence, although
they are described in terms of cache-based memory hierarchies, they do not
mandate the provision of caches.

These instructions are encoded with non-used opcode, e.g. ADD x0, x0, x2,
which QEMU already supports, and QEMU does not emulate cache. Therefore
these instructions can be considered as a no-op, and we only need to add
a new property for the Zihintntl extension.

Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Jason Chien <jason.chien@sifive.com>
Message-ID: <20230726074049.19505-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_cfg.h | 1 +
 target/riscv/cpu.c     | 2 ++
 2 files changed, 3 insertions(+)

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

Commit a47842d ("riscv: Add support for the Zfa extension") implemented the zfa extension.
However, it has some typos for fleq.d and fltq.d. Both of them misused the fltq.s
helper function.

Fixes: a47842d ("riscv: Add support for the Zfa extension")
Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Weiwei Li <liweiwei@iscas.ac.cn>
Message-ID: <20230728003906.768-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzfa.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvzfa.c.inc b/target/riscv/insn_trans/trans_rvzfa.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/insn_trans/trans_rvzfa.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfa.c.inc
@@ -XXX,XX +XXX,XX @@ bool trans_fleq_d(DisasContext *ctx, arg_fleq_d *a)
     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_helper_fleq_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ bool trans_fltq_d(DisasContext *ctx, arg_fltq_d *a)
     TCGv_i64 src1 = get_fpr_hs(ctx, a->rs1);
     TCGv_i64 src2 = get_fpr_hs(ctx, a->rs2);
 
-    gen_helper_fltq_s(dest, cpu_env, src1, src2);
+    gen_helper_fltq_d(dest, cpu_env, src1, src2);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

When writing the upper mtime, we should keep the original lower mtime
whose value is given by cpu_riscv_read_rtc() instead of
cpu_riscv_read_rtc_raw(). The same logic applies to writes to lower mtime.

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230728082502.26439-1-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         return;
     } else if (addr == mtimer->time_base || addr == mtimer->time_base + 4) {
         uint64_t rtc_r = cpu_riscv_read_rtc_raw(mtimer->timebase_freq);
+        uint64_t rtc = cpu_riscv_read_rtc(mtimer);
 
         if (addr == mtimer->time_base) {
             if (size == 4) {
                 /* time_lo for RV32/RV64 */
-                mtimer->time_delta = ((rtc_r & ~0xFFFFFFFFULL) | value) - rtc_r;
+                mtimer->time_delta = ((rtc & ~0xFFFFFFFFULL) | value) - rtc_r;
             } else {
                 /* time for RV64 */
                 mtimer->time_delta = value - rtc_r;
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write(void *opaque, hwaddr addr,
         } else {
             if (size == 4) {
                 /* time_hi for RV32/RV64 */
-                mtimer->time_delta = (value << 32 | (rtc_r & 0xFFFFFFFF)) - rtc_r;
+                mtimer->time_delta = (value << 32 | (rtc & 0xFFFFFFFF)) - rtc_r;
             } else {
                 qemu_log_mask(LOG_GUEST_ERROR,
                               "aclint-mtimer: invalid time_hi write: %08x",
-- 
2.41.0

From: Jason Chien <jason.chien@sifive.com>

The variables whose values are given by cpu_riscv_read_rtc() should be named
"rtc". The variables whose value are given by cpu_riscv_read_rtc_raw()
should be named "rtc_r".

Signed-off-by: Jason Chien <jason.chien@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230728082502.26439-2-jason.chien@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
     uint64_t next;
     uint64_t diff;
 
-    uint64_t rtc_r = cpu_riscv_read_rtc(mtimer);
+    uint64_t rtc = cpu_riscv_read_rtc(mtimer);
 
     /* Compute the relative hartid w.r.t the socket */
     hartid = hartid - mtimer->hartid_base;
 
     mtimer->timecmp[hartid] = value;
-    if (mtimer->timecmp[hartid] <= rtc_r) {
+    if (mtimer->timecmp[hartid] <= rtc) {
         /*
          * If we're setting an MTIMECMP value in the "past",
          * immediately raise the timer interrupt
@@ -XXX,XX +XXX,XX @@ static void riscv_aclint_mtimer_write_timecmp(RISCVAclintMTimerState *mtimer,
 
     /* otherwise, set up the future timer interrupt */
     qemu_irq_lower(mtimer->timer_irqs[hartid]);
-    diff = mtimer->timecmp[hartid] - rtc_r;
+    diff = mtimer->timecmp[hartid] - rtc;
     /* back to ns (note args switched in muldiv64) */
     uint64_t ns_diff = muldiv64(diff, NANOSECONDS_PER_SECOND, timebase_freq);
 
-- 
2.41.0

From: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>

We should not use types dependend on host arch for target_ucontext.
This bug is found when run rv32 applications.

Signed-off-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20230811055438.1945-1-zhiwei_liu@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/riscv/signal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/riscv/signal.c b/linux-user/riscv/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/riscv/signal.c
+++ b/linux-user/riscv/signal.c
@@ -XXX,XX +XXX,XX @@ struct target_sigcontext {
 }; /* cf. riscv-linux:arch/riscv/include/uapi/asm/ptrace.h */
 
 struct target_ucontext {
-    unsigned long uc_flags;
-    struct target_ucontext *uc_link;
+    abi_ulong uc_flags;
+    abi_ptr uc_link;
     target_stack_t uc_stack;
     target_sigset_t uc_sigmask;
     uint8_t   __unused[1024 / 8 - sizeof(target_sigset_t)];
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

In this patch, we create the APLIC and IMSIC FDT helper functions and
remove M mode AIA devices when using KVM acceleration.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-2-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 290 +++++++++++++++++++++++-------------------------
 1 file changed, 137 insertions(+), 153 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static uint32_t imsic_num_bits(uint32_t count)
     return ret;
 }
 
-static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
-                             uint32_t *phandle, uint32_t *intc_phandles,
-                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
+static void create_fdt_one_imsic(RISCVVirtState *s, hwaddr base_addr,
+                                 uint32_t *intc_phandles, uint32_t msi_phandle,
+                                 bool m_mode, uint32_t imsic_guest_bits)
 {
     int cpu, socket;
     char *imsic_name;
     MachineState *ms = MACHINE(s);
     int socket_count = riscv_socket_count(ms);
-    uint32_t imsic_max_hart_per_socket, imsic_guest_bits;
+    uint32_t imsic_max_hart_per_socket;
     uint32_t *imsic_cells, *imsic_regs, imsic_addr, imsic_size;
 
-    *msi_m_phandle = (*phandle)++;
-    *msi_s_phandle = (*phandle)++;
     imsic_cells = g_new0(uint32_t, ms->smp.cpus * 2);
     imsic_regs = g_new0(uint32_t, socket_count * 4);
 
-    /* M-level IMSIC node */
     for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
         imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+        imsic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
-    imsic_max_hart_per_socket = 0;
-    for (socket = 0; socket < socket_count; socket++) {
-        imsic_addr = memmap[VIRT_IMSIC_M].base +
-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-        imsic_size = IMSIC_HART_SIZE(0) * s->soc[socket].num_harts;
-        imsic_regs[socket * 4 + 0] = 0;
-        imsic_regs[socket * 4 + 1] = cpu_to_be32(imsic_addr);
-        imsic_regs[socket * 4 + 2] = 0;
-        imsic_regs[socket * 4 + 3] = cpu_to_be32(imsic_size);
-        if (imsic_max_hart_per_socket < s->soc[socket].num_harts) {
-            imsic_max_hart_per_socket = s->soc[socket].num_harts;
-        }
-    }
-    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-        (unsigned long)memmap[VIRT_IMSIC_M].base);
-    qemu_fdt_add_subnode(ms->fdt, imsic_name);
-    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
-        "riscv,imsics");
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
-        FDT_IMSIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
-        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
-        socket_count * sizeof(uint32_t) * 4);
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
-        VIRT_IRQCHIP_NUM_MSIS);
-    if (socket_count > 1) {
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
-            imsic_num_bits(imsic_max_hart_per_socket));
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
-            imsic_num_bits(socket_count));
-        qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
-            IMSIC_MMIO_GROUP_MIN_SHIFT);
-    }
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_m_phandle);
-
-    g_free(imsic_name);
 
-    /* S-level IMSIC node */
-    for (cpu = 0; cpu < ms->smp.cpus; cpu++) {
-        imsic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        imsic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
-    }
-    imsic_guest_bits = imsic_num_bits(s->aia_guests + 1);
     imsic_max_hart_per_socket = 0;
     for (socket = 0; socket < socket_count; socket++) {
-        imsic_addr = memmap[VIRT_IMSIC_S].base +
-                     socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+        imsic_addr = base_addr + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
         imsic_size = IMSIC_HART_SIZE(imsic_guest_bits) *
                      s->soc[socket].num_harts;
         imsic_regs[socket * 4 + 0] = 0;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
             imsic_max_hart_per_socket = s->soc[socket].num_harts;
         }
     }
-    imsic_name = g_strdup_printf("/soc/imsics@%lx",
-        (unsigned long)memmap[VIRT_IMSIC_S].base);
+
+    imsic_name = g_strdup_printf("/soc/imsics@%lx", (unsigned long)base_addr);
     qemu_fdt_add_subnode(ms->fdt, imsic_name);
-    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible",
-        "riscv,imsics");
+    qemu_fdt_setprop_string(ms->fdt, imsic_name, "compatible", "riscv,imsics");
     qemu_fdt_setprop_cell(ms->fdt, imsic_name, "#interrupt-cells",
-        FDT_IMSIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller",
-        NULL, 0);
-    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller",
-        NULL, 0);
+                          FDT_IMSIC_INT_CELLS);
+    qemu_fdt_setprop(ms->fdt, imsic_name, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop(ms->fdt, imsic_name, "msi-controller", NULL, 0);
     qemu_fdt_setprop(ms->fdt, imsic_name, "interrupts-extended",
-        imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
+                     imsic_cells, ms->smp.cpus * sizeof(uint32_t) * 2);
     qemu_fdt_setprop(ms->fdt, imsic_name, "reg", imsic_regs,
-        socket_count * sizeof(uint32_t) * 4);
+                     socket_count * sizeof(uint32_t) * 4);
     qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,num-ids",
-        VIRT_IRQCHIP_NUM_MSIS);
+                     VIRT_IRQCHIP_NUM_MSIS);
+
     if (imsic_guest_bits) {
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,guest-index-bits",
-            imsic_guest_bits);
+                              imsic_guest_bits);
     }
+
     if (socket_count > 1) {
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,hart-index-bits",
-            imsic_num_bits(imsic_max_hart_per_socket));
+                              imsic_num_bits(imsic_max_hart_per_socket));
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-bits",
-            imsic_num_bits(socket_count));
+                              imsic_num_bits(socket_count));
         qemu_fdt_setprop_cell(ms->fdt, imsic_name, "riscv,group-index-shift",
-            IMSIC_MMIO_GROUP_MIN_SHIFT);
+                              IMSIC_MMIO_GROUP_MIN_SHIFT);
     }
-    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", *msi_s_phandle);
-    g_free(imsic_name);
+    qemu_fdt_setprop_cell(ms->fdt, imsic_name, "phandle", msi_phandle);
 
+    g_free(imsic_name);
     g_free(imsic_regs);
     g_free(imsic_cells);
 }
 
-static void create_fdt_socket_aplic(RISCVVirtState *s,
-                                    const MemMapEntry *memmap, int socket,
-                                    uint32_t msi_m_phandle,
-                                    uint32_t msi_s_phandle,
-                                    uint32_t *phandle,
-                                    uint32_t *intc_phandles,
-                                    uint32_t *aplic_phandles)
+static void create_fdt_imsic(RISCVVirtState *s, const MemMapEntry *memmap,
+                             uint32_t *phandle, uint32_t *intc_phandles,
+                             uint32_t *msi_m_phandle, uint32_t *msi_s_phandle)
+{
+    *msi_m_phandle = (*phandle)++;
+    *msi_s_phandle = (*phandle)++;
+
+    if (!kvm_enabled()) {
+        /* M-level IMSIC node */
+        create_fdt_one_imsic(s, memmap[VIRT_IMSIC_M].base, intc_phandles,
+                             *msi_m_phandle, true, 0);
+    }
+
+    /* S-level IMSIC node */
+    create_fdt_one_imsic(s, memmap[VIRT_IMSIC_S].base, intc_phandles,
+                         *msi_s_phandle, false,
+                         imsic_num_bits(s->aia_guests + 1));
+
+}
+
+static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
+                                 unsigned long aplic_addr, uint32_t aplic_size,
+                                 uint32_t msi_phandle,
+                                 uint32_t *intc_phandles,
+                                 uint32_t aplic_phandle,
+                                 uint32_t aplic_child_phandle,
+                                 bool m_mode)
 {
     int cpu;
     char *aplic_name;
     uint32_t *aplic_cells;
-    unsigned long aplic_addr;
     MachineState *ms = MACHINE(s);
-    uint32_t aplic_m_phandle, aplic_s_phandle;
 
-    aplic_m_phandle = (*phandle)++;
-    aplic_s_phandle = (*phandle)++;
     aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
 
-    /* M-level APLIC node */
     for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_M_EXT);
+        aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
-    aplic_addr = memmap[VIRT_APLIC_M].base +
-                 (memmap[VIRT_APLIC_M].size * socket);
+
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
     qemu_fdt_add_subnode(ms->fdt, aplic_name);
     qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
     qemu_fdt_setprop_cell(ms->fdt, aplic_name,
-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
+                          "#interrupt-cells", FDT_APLIC_INT_CELLS);
     qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
+
     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+                         aplic_cells,
+                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
     } else {
-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
-            msi_m_phandle);
+        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
     }
+
     qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_M].size);
+                           0x0, aplic_addr, 0x0, aplic_size);
     qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
-        VIRT_IRQCHIP_NUM_SOURCES);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
-        aplic_s_phandle);
-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
-        aplic_s_phandle, 0x1, VIRT_IRQCHIP_NUM_SOURCES);
+                          VIRT_IRQCHIP_NUM_SOURCES);
+
+    if (aplic_child_phandle) {
+        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,children",
+                              aplic_child_phandle);
+        qemu_fdt_setprop_cells(ms->fdt, aplic_name, "riscv,delegate",
+                               aplic_child_phandle, 0x1,
+                               VIRT_IRQCHIP_NUM_SOURCES);
+    }
+
     riscv_socket_fdt_write_id(ms, aplic_name, socket);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_m_phandle);
+    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_phandle);
+
     g_free(aplic_name);
+    g_free(aplic_cells);
+}
 
-    /* S-level APLIC node */
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
-        aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
-        aplic_cells[cpu * 2 + 1] = cpu_to_be32(IRQ_S_EXT);
+static void create_fdt_socket_aplic(RISCVVirtState *s,
+                                    const MemMapEntry *memmap, int socket,
+                                    uint32_t msi_m_phandle,
+                                    uint32_t msi_s_phandle,
+                                    uint32_t *phandle,
+                                    uint32_t *intc_phandles,
+                                    uint32_t *aplic_phandles)
+{
+    char *aplic_name;
+    unsigned long aplic_addr;
+    MachineState *ms = MACHINE(s);
+    uint32_t aplic_m_phandle, aplic_s_phandle;
+
+    aplic_m_phandle = (*phandle)++;
+    aplic_s_phandle = (*phandle)++;
+
+    if (!kvm_enabled()) {
+        /* M-level APLIC node */
+        aplic_addr = memmap[VIRT_APLIC_M].base +
+                     (memmap[VIRT_APLIC_M].size * socket);
+        create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
+                             msi_m_phandle, intc_phandles,
+                             aplic_m_phandle, aplic_s_phandle,
+                             true);
     }
+
+    /* S-level APLIC node */
     aplic_addr = memmap[VIRT_APLIC_S].base +
                  (memmap[VIRT_APLIC_S].size * socket);
+    create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
+                         msi_s_phandle, intc_phandles,
+                         aplic_s_phandle, 0,
+                         false);
+
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
-    qemu_fdt_add_subnode(ms->fdt, aplic_name);
-    qemu_fdt_setprop_string(ms->fdt, aplic_name, "compatible", "riscv,aplic");
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name,
-        "#interrupt-cells", FDT_APLIC_INT_CELLS);
-    qemu_fdt_setprop(ms->fdt, aplic_name, "interrupt-controller", NULL, 0);
-    if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
-        qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-            aplic_cells, s->soc[socket].num_harts * sizeof(uint32_t) * 2);
-    } else {
-        qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent",
-            msi_s_phandle);
-    }
-    qemu_fdt_setprop_cells(ms->fdt, aplic_name, "reg",
-        0x0, aplic_addr, 0x0, memmap[VIRT_APLIC_S].size);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "riscv,num-sources",
-        VIRT_IRQCHIP_NUM_SOURCES);
-    riscv_socket_fdt_write_id(ms, aplic_name, socket);
-    qemu_fdt_setprop_cell(ms->fdt, aplic_name, "phandle", aplic_s_phandle);
 
     if (!socket) {
         platform_bus_add_all_fdt_nodes(ms->fdt, aplic_name,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
 
     g_free(aplic_name);
 
-    g_free(aplic_cells);
     aplic_phandles[socket] = aplic_s_phandle;
 }
 
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
     int i;
     hwaddr addr;
     uint32_t guest_bits;
-    DeviceState *aplic_m;
-    bool msimode = (aia_type == VIRT_AIA_TYPE_APLIC_IMSIC) ? true : false;
+    DeviceState *aplic_s = NULL;
+    DeviceState *aplic_m = NULL;
+    bool msimode = aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
 
     if (msimode) {
-        /* Per-socket M-level IMSICs */
-        addr = memmap[VIRT_IMSIC_M].base + socket * VIRT_IMSIC_GROUP_MAX_SIZE;
-        for (i = 0; i < hart_count; i++) {
-            riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
-                               base_hartid + i, true, 1,
-                               VIRT_IRQCHIP_NUM_MSIS);
+        if (!kvm_enabled()) {
+            /* Per-socket M-level IMSICs */
+            addr = memmap[VIRT_IMSIC_M].base +
+                   socket * VIRT_IMSIC_GROUP_MAX_SIZE;
+            for (i = 0; i < hart_count; i++) {
+                riscv_imsic_create(addr + i * IMSIC_HART_SIZE(0),
+                                   base_hartid + i, true, 1,
+                                   VIRT_IRQCHIP_NUM_MSIS);
+            }
         }
 
         /* Per-socket S-level IMSICs */
@@ -XXX,XX +XXX,XX @@ static DeviceState *virt_create_aia(RISCVVirtAIAType aia_type, int aia_guests,
         }
     }
 
-    /* Per-socket M-level APLIC */
-    aplic_m = riscv_aplic_create(
-        memmap[VIRT_APLIC_M].base + socket * memmap[VIRT_APLIC_M].size,
-        memmap[VIRT_APLIC_M].size,
-        (msimode) ? 0 : base_hartid,
-        (msimode) ? 0 : hart_count,
-        VIRT_IRQCHIP_NUM_SOURCES,
-        VIRT_IRQCHIP_NUM_PRIO_BITS,
-        msimode, true, NULL);
-
-    if (aplic_m) {
-        /* Per-socket S-level APLIC */
-        riscv_aplic_create(
-            memmap[VIRT_APLIC_S].base + socket * memmap[VIRT_APLIC_S].size,
-            memmap[VIRT_APLIC_S].size,
-            (msimode) ? 0 : base_hartid,
-            (msimode) ? 0 : hart_count,
-            VIRT_IRQCHIP_NUM_SOURCES,
-            VIRT_IRQCHIP_NUM_PRIO_BITS,
-            msimode, false, aplic_m);
+    if (!kvm_enabled()) {
+        /* Per-socket M-level APLIC */
+        aplic_m = riscv_aplic_create(memmap[VIRT_APLIC_M].base +
+                                     socket * memmap[VIRT_APLIC_M].size,
+                                     memmap[VIRT_APLIC_M].size,
+                                     (msimode) ? 0 : base_hartid,
+                                     (msimode) ? 0 : hart_count,
+                                     VIRT_IRQCHIP_NUM_SOURCES,
+                                     VIRT_IRQCHIP_NUM_PRIO_BITS,
+                                     msimode, true, NULL);
     }
 
-    return aplic_m;
+    /* Per-socket S-level APLIC */
+    aplic_s = riscv_aplic_create(memmap[VIRT_APLIC_S].base +
+                                 socket * memmap[VIRT_APLIC_S].size,
+                                 memmap[VIRT_APLIC_S].size,
+                                 (msimode) ? 0 : base_hartid,
+                                 (msimode) ? 0 : hart_count,
+                                 VIRT_IRQCHIP_NUM_SOURCES,
+                                 VIRT_IRQCHIP_NUM_PRIO_BITS,
+                                 msimode, false, aplic_m);
+
+    return kvm_enabled() ? aplic_s : aplic_m;
 }
 
 static void create_platform_bus(RISCVVirtState *s, DeviceState *irqchip)
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

We check the in-kernel irqchip support when using KVM acceleration.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-3-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
 
 int kvm_arch_irqchip_create(KVMState *s)
 {
-    return 0;
+    if (kvm_kernel_irqchip_split()) {
+        error_report("-machine kernel_irqchip=split is not supported on RISC-V.");
+        exit(1);
+    }
+
+    /*
+     * We can create the VAIA using the newer device control API.
+     */
+    return kvm_check_extension(s, KVM_CAP_DEVICE_CTRL);
 }
 
 int kvm_arch_process_async_events(CPUState *cs)
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

We create a vAIA chip by using the KVM_DEV_TYPE_RISCV_AIA and then set up
the chip with the KVM_DEV_RISCV_AIA_GRP_* APIs.
We also extend KVM accelerator to specify the KVM AIA mode. The "riscv-aia"
parameter is passed along with --accel in QEMU command-line.
1) "riscv-aia=emul": IMSIC is emulated by hypervisor
2) "riscv-aia=hwaccel": use hardware guest IMSIC
3) "riscv-aia=auto": use the hardware guest IMSICs whenever available
                     otherwise we fallback to software emulation.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-4-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h |   4 +
 target/riscv/kvm.c       | 186 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 190 insertions(+)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@
 void kvm_riscv_init_user_properties(Object *cpu_obj);
 void kvm_riscv_reset_vcpu(RISCVCPU *cpu);
 void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level);
+void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                          uint64_t aia_irq_num, uint64_t aia_msi_num,
+                          uint64_t aplic_base, uint64_t imsic_base,
+                          uint64_t guest_num);
 
 #endif
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "hw/boards.h"
 #include "hw/irq.h"
+#include "hw/intc/riscv_imsic.h"
 #include "qemu/log.h"
 #include "hw/loader.h"
 #include "kvm_riscv.h"
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "migration/migration.h"
 #include "sysemu/runstate.h"
+#include "hw/riscv/numa.h"
 
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
@@ -XXX,XX +XXX,XX @@ bool kvm_arch_cpu_check_are_resettable(void)
     return true;
 }
 
+static int aia_mode;
+
+static const char *kvm_aia_mode_str(uint64_t mode)
+{
+    switch (mode) {
+    case KVM_DEV_RISCV_AIA_MODE_EMUL:
+        return "emul";
+    case KVM_DEV_RISCV_AIA_MODE_HWACCEL:
+        return "hwaccel";
+    case KVM_DEV_RISCV_AIA_MODE_AUTO:
+    default:
+        return "auto";
+    };
+}
+
+static char *riscv_get_kvm_aia(Object *obj, Error **errp)
+{
+    return g_strdup(kvm_aia_mode_str(aia_mode));
+}
+
+static void riscv_set_kvm_aia(Object *obj, const char *val, Error **errp)
+{
+    if (!strcmp(val, "emul")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_EMUL;
+    } else if (!strcmp(val, "hwaccel")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_HWACCEL;
+    } else if (!strcmp(val, "auto")) {
+        aia_mode = KVM_DEV_RISCV_AIA_MODE_AUTO;
+    } else {
+        error_setg(errp, "Invalid KVM AIA mode");
+        error_append_hint(errp, "Valid values are emul, hwaccel, and auto.\n");
+    }
+}
+
 void kvm_arch_accel_class_init(ObjectClass *oc)
 {
+    object_class_property_add_str(oc, "riscv-aia", riscv_get_kvm_aia,
+                                  riscv_set_kvm_aia);
+    object_class_property_set_description(oc, "riscv-aia",
+                                          "Set KVM AIA mode. Valid values are "
+                                          "emul, hwaccel, and auto. Default "
+                                          "is auto.");
+    object_property_set_default_str(object_class_property_find(oc, "riscv-aia"),
+                                    "auto");
+}
+
+void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
+                          uint64_t aia_irq_num, uint64_t aia_msi_num,
+                          uint64_t aplic_base, uint64_t imsic_base,
+                          uint64_t guest_num)
+{
+    int ret, i;
+    int aia_fd = -1;
+    uint64_t default_aia_mode;
+    uint64_t socket_count = riscv_socket_count(machine);
+    uint64_t max_hart_per_socket = 0;
+    uint64_t socket, base_hart, hart_count, socket_imsic_base, imsic_addr;
+    uint64_t socket_bits, hart_bits, guest_bits;
+
+    aia_fd = kvm_create_device(kvm_state, KVM_DEV_TYPE_RISCV_AIA, false);
+
+    if (aia_fd < 0) {
+        error_report("Unable to create in-kernel irqchip");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_MODE,
+                            &default_aia_mode, false, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to get current KVM AIA mode");
+        exit(1);
+    }
+    qemu_log("KVM AIA: default mode is %s\n",
+             kvm_aia_mode_str(default_aia_mode));
+
+    if (default_aia_mode != aia_mode) {
+        ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                                KVM_DEV_RISCV_AIA_CONFIG_MODE,
+                                &aia_mode, true, NULL);
+        if (ret < 0)
+            warn_report("KVM AIA: failed to set KVM AIA mode");
+        else
+            qemu_log("KVM AIA: set current mode to %s\n",
+                     kvm_aia_mode_str(aia_mode));
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_SRCS,
+                            &aia_irq_num, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set number of input irq lines");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_IDS,
+                            &aia_msi_num, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set number of msi");
+        exit(1);
+    }
+
+    socket_bits = find_last_bit(&socket_count, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_BITS,
+                            &socket_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set group_bits");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GROUP_SHIFT,
+                            &group_shift, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set group_shift");
+        exit(1);
+    }
+
+    guest_bits = guest_num == 0 ? 0 :
+                 find_last_bit(&guest_num, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_GUEST_BITS,
+                            &guest_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set guest_bits");
+        exit(1);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
+                            KVM_DEV_RISCV_AIA_ADDR_APLIC,
+                            &aplic_base, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set the base address of APLIC");
+        exit(1);
+    }
+
+    for (socket = 0; socket < socket_count; socket++) {
+        socket_imsic_base = imsic_base + socket * (1U << group_shift);
+        hart_count = riscv_socket_hart_count(machine, socket);
+        base_hart = riscv_socket_first_hartid(machine, socket);
+
+        if (max_hart_per_socket < hart_count) {
+            max_hart_per_socket = hart_count;
+        }
+
+        for (i = 0; i < hart_count; i++) {
+            imsic_addr = socket_imsic_base + i * IMSIC_HART_SIZE(guest_bits);
+            ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_ADDR,
+                                    KVM_DEV_RISCV_AIA_ADDR_IMSIC(i + base_hart),
+                                    &imsic_addr, true, NULL);
+            if (ret < 0) {
+                error_report("KVM AIA: failed to set the IMSIC address for hart %d", i);
+                exit(1);
+            }
+        }
+    }
+
+    hart_bits = find_last_bit(&max_hart_per_socket, BITS_PER_LONG) + 1;
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CONFIG,
+                            KVM_DEV_RISCV_AIA_CONFIG_HART_BITS,
+                            &hart_bits, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: failed to set hart_bits");
+        exit(1);
+    }
+
+    if (kvm_has_gsi_routing()) {
+        for (uint64_t idx = 0; idx < aia_irq_num + 1; ++idx) {
+            /* KVM AIA only has one APLIC instance */
+            kvm_irqchip_add_irq_route(kvm_state, idx, 0, idx);
+        }
+        kvm_gsi_routing_allowed = true;
+        kvm_irqchip_commit_routes(kvm_state);
+    }
+
+    ret = kvm_device_access(aia_fd, KVM_DEV_RISCV_AIA_GRP_CTRL,
+                            KVM_DEV_RISCV_AIA_CTRL_INIT,
+                            NULL, true, NULL);
+    if (ret < 0) {
+        error_report("KVM AIA: initialized fail");
+        exit(1);
+    }
+
+    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
 }
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

KVM AIA can't emulate APLIC only. When "aia=aplic" parameter is passed,
APLIC devices is emulated by QEMU. For "aia=aplic-imsic", remove the
mmio operations of APLIC when using KVM AIA and send wired interrupt
signal via KVM_IRQ_LINE API.
After KVM AIA enabled, MSI messages are delivered by KVM_SIGNAL_MSI API
when the IMSICs receive mmio write requests.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-5-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aplic.c | 56 ++++++++++++++++++++++++++++++-------------
 hw/intc/riscv_imsic.c | 25 +++++++++++++++----
 2 files changed, 61 insertions(+), 20 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "migration/vmstate.h"
 
 #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@
 
 #define APLIC_IDC_CLAIMI               0x1c
 
+/*
+ * KVM AIA only supports APLIC MSI, fallback to QEMU emulation if we want to use
+ * APLIC Wired.
+ */
+static bool is_kvm_aia(bool msimode)
+{
+    return kvm_irqchip_in_kernel() && msimode;
+}
+
 static uint32_t riscv_aplic_read_input_word(RISCVAPLICState *aplic,
                                             uint32_t word)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
     return topi;
 }
 
+static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
+{
+    kvm_set_irq(kvm_state, irq, !!level);
+}
+
 static void riscv_aplic_request(void *opaque, int irq, int level)
 {
     bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
     uint32_t i;
     RISCVAPLICState *aplic = RISCV_APLIC(dev);
 
-    aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
-    aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
-    aplic->state = g_new0(uint32_t, aplic->num_irqs);
-    aplic->target = g_new0(uint32_t, aplic->num_irqs);
-    if (!aplic->msimode) {
-        for (i = 0; i < aplic->num_irqs; i++) {
-            aplic->target[i] = 1;
+    if (!is_kvm_aia(aplic->msimode)) {
+        aplic->bitfield_words = (aplic->num_irqs + 31) >> 5;
+        aplic->sourcecfg = g_new0(uint32_t, aplic->num_irqs);
+        aplic->state = g_new0(uint32_t, aplic->num_irqs);
+        aplic->target = g_new0(uint32_t, aplic->num_irqs);
+        if (!aplic->msimode) {
+            for (i = 0; i < aplic->num_irqs; i++) {
+                aplic->target[i] = 1;
+            }
         }
-    }
-    aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
-    aplic->iforce = g_new0(uint32_t, aplic->num_harts);
-    aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
+        aplic->idelivery = g_new0(uint32_t, aplic->num_harts);
+        aplic->iforce = g_new0(uint32_t, aplic->num_harts);
+        aplic->ithreshold = g_new0(uint32_t, aplic->num_harts);
 
-    memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops, aplic,
-                          TYPE_RISCV_APLIC, aplic->aperture_size);
-    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
+        memory_region_init_io(&aplic->mmio, OBJECT(dev), &riscv_aplic_ops,
+                              aplic, TYPE_RISCV_APLIC, aplic->aperture_size);
+        sysbus_init_mmio(SYS_BUS_DEVICE(dev), &aplic->mmio);
+    }
 
     /*
      * Only root APLICs have hardware IRQ lines. All non-root APLICs
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
+        if (is_kvm_aia(aplic->msimode)) {
+            qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
+        } else {
+            qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
+        }
     }
 
     /* Create output IRQ lines for non-MSI mode */
@@ -XXX,XX +XXX,XX @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
     qdev_prop_set_bit(dev, "mmode", mmode);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+
+    if (!is_kvm_aia(msimode)) {
+        sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, addr);
+    }
 
     if (parent) {
         riscv_aplic_add_child(parent, dev);
diff --git a/hw/intc/riscv_imsic.c b/hw/intc/riscv_imsic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_imsic.c
+++ b/hw/intc/riscv_imsic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "target/riscv/cpu_bits.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
 #include "migration/vmstate.h"
 
 #define IMSIC_MMIO_PAGE_LE             0x00
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_write(void *opaque, hwaddr addr, uint64_t value,
         goto err;
     }
 
+#if defined(CONFIG_KVM)
+    if (kvm_irqchip_in_kernel()) {
+        struct kvm_msi msi;
+
+        msi.address_lo = extract64(imsic->mmio.addr + addr, 0, 32);
+        msi.address_hi = extract64(imsic->mmio.addr + addr, 32, 32);
+        msi.data = le32_to_cpu(value);
+
+        kvm_vm_ioctl(kvm_state, KVM_SIGNAL_MSI, &msi);
+
+        return;
+    }
+#endif
+
     /* Writes only supported for MSI little-endian registers */
     page = addr >> IMSIC_MMIO_PAGE_SHIFT;
     if ((addr & (IMSIC_MMIO_PAGE_SZ - 1)) == IMSIC_MMIO_PAGE_LE) {
@@ -XXX,XX +XXX,XX @@ static void riscv_imsic_realize(DeviceState *dev, Error **errp)
     CPUState *cpu = cpu_by_arch_id(imsic->hartid);
     CPURISCVState *env = cpu ? cpu->env_ptr : NULL;
 
-    imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
-    imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
-    imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
-    imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
+    if (!kvm_irqchip_in_kernel()) {
+        imsic->num_eistate = imsic->num_pages * imsic->num_irqs;
+        imsic->eidelivery = g_new0(uint32_t, imsic->num_pages);
+        imsic->eithreshold = g_new0(uint32_t, imsic->num_pages);
+        imsic->eistate = g_new0(uint32_t, imsic->num_eistate);
+    }
 
     memory_region_init_io(&imsic->mmio, OBJECT(dev), &riscv_imsic_ops,
                           imsic, TYPE_RISCV_IMSIC,
-- 
2.41.0

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

Select KVM AIA when the host kernel has in-kernel AIA chip support.
Since KVM AIA only has one APLIC instance, we map the QEMU APLIC
devices to KVM APLIC.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230727102439.22554-6-yongxuan.wang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 94 +++++++++++++++++++++++++++++++++----------------
 1 file changed, 63 insertions(+), 31 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/riscv/virt.h"
 #include "hw/riscv/boot.h"
 #include "hw/riscv/numa.h"
+#include "kvm_riscv.h"
 #include "hw/intc/riscv_aclint.h"
 #include "hw/intc/riscv_aplic.h"
 #include "hw/intc/riscv_imsic.h"
@@ -XXX,XX +XXX,XX @@
 #error "Can't accommodate all IMSIC groups in address space"
 #endif
 
+/* KVM AIA only supports APLIC MSI. APLIC Wired is always emulated by QEMU. */
+static bool virt_use_kvm_aia(RISCVVirtState *s)
+{
+    return kvm_irqchip_in_kernel() && s->aia_type == VIRT_AIA_TYPE_APLIC_IMSIC;
+}
+
 static const MemMapEntry virt_memmap[] = {
     [VIRT_DEBUG] =        {        0x0,         0x100 },
     [VIRT_MROM] =         {     0x1000,        0xf000 },
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
                                  uint32_t *intc_phandles,
                                  uint32_t aplic_phandle,
                                  uint32_t aplic_child_phandle,
-                                 bool m_mode)
+                                 bool m_mode, int num_harts)
 {
     int cpu;
     char *aplic_name;
     uint32_t *aplic_cells;
     MachineState *ms = MACHINE(s);
 
-    aplic_cells = g_new0(uint32_t, s->soc[socket].num_harts * 2);
+    aplic_cells = g_new0(uint32_t, num_harts * 2);
 
-    for (cpu = 0; cpu < s->soc[socket].num_harts; cpu++) {
+    for (cpu = 0; cpu < num_harts; cpu++) {
         aplic_cells[cpu * 2 + 0] = cpu_to_be32(intc_phandles[cpu]);
         aplic_cells[cpu * 2 + 1] = cpu_to_be32(m_mode ? IRQ_M_EXT : IRQ_S_EXT);
     }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_one_aplic(RISCVVirtState *s, int socket,
 
     if (s->aia_type == VIRT_AIA_TYPE_APLIC) {
         qemu_fdt_setprop(ms->fdt, aplic_name, "interrupts-extended",
-                         aplic_cells,
-                         s->soc[socket].num_harts * sizeof(uint32_t) * 2);
+                         aplic_cells, num_harts * sizeof(uint32_t) * 2);
     } else {
         qemu_fdt_setprop_cell(ms->fdt, aplic_name, "msi-parent", msi_phandle);
     }
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
                                     uint32_t msi_s_phandle,
                                     uint32_t *phandle,
                                     uint32_t *intc_phandles,
-                                    uint32_t *aplic_phandles)
+                                    uint32_t *aplic_phandles,
+                                    int num_harts)
 {
     char *aplic_name;
     unsigned long aplic_addr;
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
         create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_M].size,
                              msi_m_phandle, intc_phandles,
                              aplic_m_phandle, aplic_s_phandle,
-                             true);
+                             true, num_harts);
     }
 
     /* S-level APLIC node */
@@ -XXX,XX +XXX,XX @@ static void create_fdt_socket_aplic(RISCVVirtState *s,
     create_fdt_one_aplic(s, socket, aplic_addr, memmap[VIRT_APLIC_S].size,
                          msi_s_phandle, intc_phandles,
                          aplic_s_phandle, 0,
-                         false);
+                         false, num_harts);
 
     aplic_name = g_strdup_printf("/soc/aplic@%lx", aplic_addr);
 
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
         *msi_pcie_phandle = msi_s_phandle;
     }
 
-    phandle_pos = ms->smp.cpus;
-    for (socket = (socket_count - 1); socket >= 0; socket--) {
-        phandle_pos -= s->soc[socket].num_harts;
-
-        if (s->aia_type == VIRT_AIA_TYPE_NONE) {
-            create_fdt_socket_plic(s, memmap, socket, phandle,
-                &intc_phandles[phandle_pos], xplic_phandles);
-        } else {
-            create_fdt_socket_aplic(s, memmap, socket,
-                msi_m_phandle, msi_s_phandle, phandle,
-                &intc_phandles[phandle_pos], xplic_phandles);
+    /* KVM AIA only has one APLIC instance */
+    if (virt_use_kvm_aia(s)) {
+        create_fdt_socket_aplic(s, memmap, 0,
+                                msi_m_phandle, msi_s_phandle, phandle,
+                                &intc_phandles[0], xplic_phandles,
+                                ms->smp.cpus);
+    } else {
+        phandle_pos = ms->smp.cpus;
+        for (socket = (socket_count - 1); socket >= 0; socket--) {
+            phandle_pos -= s->soc[socket].num_harts;
+
+            if (s->aia_type == VIRT_AIA_TYPE_NONE) {
+                create_fdt_socket_plic(s, memmap, socket, phandle,
+                                       &intc_phandles[phandle_pos],
+                                       xplic_phandles);
+            } else {
+                create_fdt_socket_aplic(s, memmap, socket,
+                                        msi_m_phandle, msi_s_phandle, phandle,
+                                        &intc_phandles[phandle_pos],
+                                        xplic_phandles,
+                                        s->soc[socket].num_harts);
+            }
         }
     }
 
     g_free(intc_phandles);
 
-    for (socket = 0; socket < socket_count; socket++) {
-        if (socket == 0) {
-            *irq_mmio_phandle = xplic_phandles[socket];
-            *irq_virtio_phandle = xplic_phandles[socket];
-            *irq_pcie_phandle = xplic_phandles[socket];
-        }
-        if (socket == 1) {
-            *irq_virtio_phandle = xplic_phandles[socket];
-            *irq_pcie_phandle = xplic_phandles[socket];
-        }
-        if (socket == 2) {
-            *irq_pcie_phandle = xplic_phandles[socket];
+    if (virt_use_kvm_aia(s)) {
+        *irq_mmio_phandle = xplic_phandles[0];
+        *irq_virtio_phandle = xplic_phandles[0];
+        *irq_pcie_phandle = xplic_phandles[0];
+    } else {
+        for (socket = 0; socket < socket_count; socket++) {
+            if (socket == 0) {
+                *irq_mmio_phandle = xplic_phandles[socket];
+                *irq_virtio_phandle = xplic_phandles[socket];
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
+            if (socket == 1) {
+                *irq_virtio_phandle = xplic_phandles[socket];
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
+            if (socket == 2) {
+                *irq_pcie_phandle = xplic_phandles[socket];
+            }
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         }
     }
 
+    if (virt_use_kvm_aia(s)) {
+        kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
+                             VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
+                             memmap[VIRT_APLIC_S].base,
+                             memmap[VIRT_IMSIC_S].base,
+                             s->aia_guests);
+    }
+
     if (riscv_is_32bit(&s->soc[0])) {
 #if HOST_LONG_BITS == 64
         /* limit RAM size in a 32-bit system */
-- 
2.41.0

From: Conor Dooley <conor.dooley@microchip.com>

On a dtb dumped from the virt machine, dt-validate complains:
soc: pmu: {'riscv,event-to-mhpmcounters': [[1, 1, 524281], [2, 2, 524284], [65561, 65561, 524280], [65563, 65563, 524280], [65569, 65569, 524280]], 'compatible': ['riscv,pmu']} should not be valid under {'type': 'object'}
        from schema $id: http://devicetree.org/schemas/simple-bus.yaml#
That's pretty cryptic, but running the dtb back through dtc produces
something a lot more reasonable:
Warning (simple_bus_reg): /soc/pmu: missing or empty reg/ranges property

Moving the riscv,pmu node out of the soc bus solves the problem.

Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20230727-groom-decline-2c57ce42841c@spud>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_pmu(RISCVVirtState *s)
     MachineState *ms = MACHINE(s);
     RISCVCPU hart = s->soc[0].harts[0];
 
-    pmu_name = g_strdup_printf("/soc/pmu");
+    pmu_name = g_strdup_printf("/pmu");
     qemu_fdt_add_subnode(ms->fdt, pmu_name);
     qemu_fdt_setprop_string(ms->fdt, pmu_name, "compatible", "riscv,pmu");
     riscv_pmu_generate_fdt_node(ms->fdt, hart.cfg.pmu_num, pmu_name);
-- 
2.41.0

From: Weiwei Li <liweiwei@iscas.ac.cn>

The Svadu specification updated the name of the *envcfg bit from
HADE to ADUE.

Signed-off-by: Weiwei Li <liweiwei@iscas.ac.cn>
Signed-off-by: Junqiang Wang <wangjunqiang@iscas.ac.cn>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20230816141916.66898-1-liweiwei@iscas.ac.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu_bits.h   |  8 ++++----
 target/riscv/cpu.c        |  4 ++--
 target/riscv/cpu_helper.c |  6 +++---
 target/riscv/csr.c        | 12 ++++++------
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define MENVCFG_CBIE                       (3UL << 4)
 #define MENVCFG_CBCFE                      BIT(6)
 #define MENVCFG_CBZE                       BIT(7)
-#define MENVCFG_HADE                       (1ULL << 61)
+#define MENVCFG_ADUE                       (1ULL << 61)
 #define MENVCFG_PBMTE                      (1ULL << 62)
 #define MENVCFG_STCE                       (1ULL << 63)
 
 /* For RV32 */
-#define MENVCFGH_HADE                      BIT(29)
+#define MENVCFGH_ADUE                      BIT(29)
 #define MENVCFGH_PBMTE                     BIT(30)
 #define MENVCFGH_STCE                      BIT(31)
 
@@ -XXX,XX +XXX,XX @@ typedef enum RISCVException {
 #define HENVCFG_CBIE                       MENVCFG_CBIE
 #define HENVCFG_CBCFE                      MENVCFG_CBCFE
 #define HENVCFG_CBZE                       MENVCFG_CBZE
-#define HENVCFG_HADE                       MENVCFG_HADE
+#define HENVCFG_ADUE                       MENVCFG_ADUE
 #define HENVCFG_PBMTE                      MENVCFG_PBMTE
 #define HENVCFG_STCE                       MENVCFG_STCE
 
 /* For RV32 */
-#define HENVCFGH_HADE                       MENVCFGH_HADE
+#define HENVCFGH_ADUE                       MENVCFGH_ADUE
 #define HENVCFGH_PBMTE                      MENVCFGH_PBMTE
 #define HENVCFGH_STCE                       MENVCFGH_STCE
 
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
     env->two_stage_lookup = false;
 
     env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
-                   (cpu->cfg.ext_svadu ? MENVCFG_HADE : 0);
+                   (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
     env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
-                   (cpu->cfg.ext_svadu ? HENVCFG_HADE : 0);
+                   (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
 
     /* Initialized default priorities of local interrupts. */
     for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     bool pbmte = env->menvcfg & MENVCFG_PBMTE;
-    bool hade = env->menvcfg & MENVCFG_HADE;
+    bool adue = env->menvcfg & MENVCFG_ADUE;
 
     if (first_stage && two_stage && env->virt_enabled) {
         pbmte = pbmte && (env->henvcfg & HENVCFG_PBMTE);
-        hade = hade && (env->henvcfg & HENVCFG_HADE);
+        adue = adue && (env->henvcfg & HENVCFG_ADUE);
     }
 
     int ptshift = (levels - 1) * ptidxbits;
@@ -XXX,XX +XXX,XX @@ restart:
 
     /* Page table updates need to be atomic with MTTCG enabled */
     if (updated_pte != pte && !is_debug) {
-        if (!hade) {
+        if (!adue) {
             return TRANSLATE_FAIL;
         }
 
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
     if (riscv_cpu_mxl(env) == MXL_RV64) {
         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                (cfg->ext_svadu ? MENVCFG_HADE : 0);
+                (cfg->ext_svadu ? MENVCFG_ADUE : 0);
     }
     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
 
@@ -XXX,XX +XXX,XX @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
-                    (cfg->ext_svadu ? MENVCFG_HADE : 0);
+                    (cfg->ext_svadu ? MENVCFG_ADUE : 0);
     uint64_t valh = (uint64_t)val << 32;
 
     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
      * henvcfg.hade is read_only 0 when menvcfg.hade = 0
      */
-    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
+    *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                            env->menvcfg);
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
     }
 
     if (riscv_cpu_mxl(env) == MXL_RV64) {
-        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE);
+        mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
     }
 
     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
@@ -XXX,XX +XXX,XX @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
         return ret;
     }
 
-    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
+    *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
                             env->menvcfg)) >> 32;
     return RISCV_EXCP_NONE;
 }
@@ -XXX,XX +XXX,XX @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
                                      target_ulong val)
 {
     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
-                                    HENVCFG_HADE);
+                                    HENVCFG_ADUE);
     uint64_t valh = (uint64_t)val << 32;
     RISCVException ret;
 
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

In the same emulated RISC-V host, the 'host' KVM CPU takes 4 times
longer to boot than the 'rv64' KVM CPU.

The reason is an unintended behavior of riscv_cpu_satp_mode_finalize()
when satp_mode.supported = 0, i.e. when cpu_init() does not set
satp_mode_max_supported(). satp_mode_max_from_map(map) does:

31 - __builtin_clz(map)

This means that, if satp_mode.supported = 0, satp_mode_supported_max
wil be '31 - 32'. But this is C, so satp_mode_supported_max will gladly
set it to UINT_MAX (4294967295). After that, if the user didn't set a
satp_mode, set_satp_mode_default_map(cpu) will make

cfg.satp_mode.map = cfg.satp_mode.supported

So satp_mode.map = 0. And then satp_mode_map_max will be set to
satp_mode_max_from_map(cpu->cfg.satp_mode.map), i.e. also UINT_MAX. The
guard "satp_mode_map_max > satp_mode_supported_max" doesn't protect us
here since both are UINT_MAX.

And finally we have 2 loops:

for (int i = satp_mode_map_max - 1; i >= 0; --i) {

Which are, in fact, 2 loops from UINT_MAX -1 to -1. This is where the
extra delay when booting the 'host' CPU is coming from.

Commit 43d1de32f8 already set a precedence for satp_mode.supported = 0
in a different manner. We're doing the same here. If supported == 0,
interpret as 'the CPU wants the OS to handle satp mode alone' and skip
satp_mode_finalize().

We'll also put a guard in satp_mode_max_from_map() to assert out if map
is 0 since the function is not ready to deal with it.

Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
Fixes: 6f23aaeb9b ("riscv: Allow user to set the satp mode")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20230817152903.694926-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static uint8_t satp_mode_from_str(const char *satp_mode_str)
 
 uint8_t satp_mode_max_from_map(uint32_t map)
 {
+    /*
+     * 'map = 0' will make us return (31 - 32), which C will
+     * happily overflow to UINT_MAX. There's no good result to
+     * return if 'map = 0' (e.g. returning 0 will be ambiguous
+     * with the result for 'map = 1').
+     *
+     * Assert out if map = 0. Callers will have to deal with
+     * it outside of this function.
+     */
+    g_assert(map > 0);
+
     /* map here has at least one bit set, so no problem with clz */
     return 31 - __builtin_clz(map);
 }
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
 static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
 {
     bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
-    uint8_t satp_mode_map_max;
-    uint8_t satp_mode_supported_max =
-                        satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
+    uint8_t satp_mode_map_max, satp_mode_supported_max;
+
+    /* The CPU wants the OS to decide which satp mode to use */
+    if (cpu->cfg.satp_mode.supported == 0) {
+        return;
+    }
+
+    satp_mode_supported_max =
+                    satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
 
     if (cpu->cfg.satp_mode.map == 0) {
         if (cpu->cfg.satp_mode.init == 0) {
-- 
2.41.0

From: Vineet Gupta <vineetg@rivosinc.com>

zicond is now codegen supported in both llvm and gcc.

This change allows seamless enabling/testing of zicond in downstream
projects. e.g. currently riscv-gnu-toolchain parses elf attributes
to create a cmdline for qemu but fails short of enabling it because of
the "x-" prefix.

Signed-off-by: Vineet Gupta <vineetg@rivosinc.com>
Message-ID: <20230808181715.436395-1-vineetg@rivosinc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("zcf", RISCVCPU, cfg.ext_zcf, false),
     DEFINE_PROP_BOOL("zcmp", RISCVCPU, cfg.ext_zcmp, false),
     DEFINE_PROP_BOOL("zcmt", RISCVCPU, cfg.ext_zcmt, false),
+    DEFINE_PROP_BOOL("zicond", RISCVCPU, cfg.ext_zicond, false),
 
     /* Vendor-specific custom extensions */
     DEFINE_PROP_BOOL("xtheadba", RISCVCPU, cfg.ext_xtheadba, false),
@@ -XXX,XX +XXX,XX @@ static Property riscv_cpu_extensions[] = {
     DEFINE_PROP_BOOL("xventanacondops", RISCVCPU, cfg.ext_XVentanaCondOps, false),
 
     /* These are experimental so mark with 'x-' */
-    DEFINE_PROP_BOOL("x-zicond", RISCVCPU, cfg.ext_zicond, false),
 
     /* ePMP 0.9.3 */
     DEFINE_PROP_BOOL("x-epmp", RISCVCPU, cfg.epmp, false),
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

A build with --enable-debug and without KVM will fail as follows:

/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_riscv_virt.c.o: in function `virt_machine_init':
./qemu/build/../hw/riscv/virt.c:1465: undefined reference to `kvm_riscv_aia_create'

This happens because the code block with "if virt_use_kvm_aia(s)" isn't
being ignored by the debug build, resulting in an undefined reference to
a KVM only function.

Add a 'kvm_enabled()' conditional together with virt_use_kvm_aia() will
make the compiler crop the kvm_riscv_aia_create() call entirely from a
non-KVM build. Note that adding the 'kvm_enabled()' conditional inside
virt_use_kvm_aia() won't fix the build because this function would need
to be inlined multiple times to make the compiler zero out the entire
block.

While we're at it, use kvm_enabled() in all instances where
virt_use_kvm_aia() is checked to allow the compiler to elide these other
kvm-only instances as well.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Fixes: dbdb99948e ("target/riscv: select KVM AIA in riscv virt machine")
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230830133503.711138-2-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/virt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
     }
 
     /* KVM AIA only has one APLIC instance */
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         create_fdt_socket_aplic(s, memmap, 0,
                                 msi_m_phandle, msi_s_phandle, phandle,
                                 &intc_phandles[0], xplic_phandles,
@@ -XXX,XX +XXX,XX @@ static void create_fdt_sockets(RISCVVirtState *s, const MemMapEntry *memmap,
 
     g_free(intc_phandles);
 
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         *irq_mmio_phandle = xplic_phandles[0];
         *irq_virtio_phandle = xplic_phandles[0];
         *irq_pcie_phandle = xplic_phandles[0];
@@ -XXX,XX +XXX,XX @@ static void virt_machine_init(MachineState *machine)
         }
     }
 
-    if (virt_use_kvm_aia(s)) {
+    if (kvm_enabled() && virt_use_kvm_aia(s)) {
         kvm_riscv_aia_create(machine, IMSIC_MMIO_GROUP_MIN_SHIFT,
                              VIRT_IRQCHIP_NUM_SOURCES, VIRT_IRQCHIP_NUM_MSIS,
                              memmap[VIRT_APLIC_S].base,
-- 
2.41.0

From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

Commit 6df0b37e2ab breaks a --enable-debug build in a non-KVM
environment with the following error:

/usr/bin/ld: libqemu-riscv64-softmmu.fa.p/hw_intc_riscv_aplic.c.o: in function `riscv_kvm_aplic_request':
./qemu/build/../hw/intc/riscv_aplic.c:486: undefined reference to `kvm_set_irq'
collect2: error: ld returned 1 exit status

This happens because the debug build will poke into the
'if (is_kvm_aia(aplic->msimode))' block and fail to find a reference to
the KVM only function riscv_kvm_aplic_request().

There are multiple solutions to fix this. We'll go with the same
solution from the previous patch, i.e. add a kvm_enabled() conditional
to filter out the block. But there's a catch: riscv_kvm_aplic_request()
is a local function that would end up being used if the compiler crops
the block, and this won't work. Quoting Richard Henderson's explanation
in [1]:

"(...) the compiler won't eliminate entire unused functions with -O0"

We'll solve it by moving riscv_kvm_aplic_request() to kvm.c and add its
declaration in kvm_riscv.h, where all other KVM specific public
functions are already declared. Other archs handles KVM specific code in
this manner and we expect to do the same from now on.

[1] https://lore.kernel.org/qemu-riscv/d2f1ad02-eb03-138f-9d08-db676deeed05@linaro.org/

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230830133503.711138-3-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm_riscv.h | 1 +
 hw/intc/riscv_aplic.c    | 8 ++------
 target/riscv/kvm.c       | 5 +++++
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/riscv/kvm_riscv.h b/target/riscv/kvm_riscv.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm_riscv.h
+++ b/target/riscv/kvm_riscv.h
@@ -XXX,XX +XXX,XX @@ void kvm_riscv_aia_create(MachineState *machine, uint64_t group_shift,
                           uint64_t aia_irq_num, uint64_t aia_msi_num,
                           uint64_t aplic_base, uint64_t imsic_base,
                           uint64_t guest_num);
+void riscv_kvm_aplic_request(void *opaque, int irq, int level);
 
 #endif
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -XXX,XX +XXX,XX @@
 #include "target/riscv/cpu.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
+#include "kvm_riscv.h"
 #include "migration/vmstate.h"
 
 #define APLIC_MAX_IDC                  (1UL << 14)
@@ -XXX,XX +XXX,XX @@ static uint32_t riscv_aplic_idc_claimi(RISCVAPLICState *aplic, uint32_t idc)
     return topi;
 }
 
-static void riscv_kvm_aplic_request(void *opaque, int irq, int level)
-{
-    kvm_set_irq(kvm_state, irq, !!level);
-}
-
 static void riscv_aplic_request(void *opaque, int irq, int level)
 {
     bool update = false;
@@ -XXX,XX +XXX,XX @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
      * have IRQ lines delegated by their parent APLIC.
      */
     if (!aplic->parent) {
-        if (is_kvm_aia(aplic->msimode)) {
+        if (kvm_enabled() && is_kvm_aia(aplic->msimode)) {
             qdev_init_gpio_in(dev, riscv_kvm_aplic_request, aplic->num_irqs);
         } else {
             qdev_init_gpio_in(dev, riscv_aplic_request, aplic->num_irqs);
diff --git a/target/riscv/kvm.c b/target/riscv/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/kvm.c
+++ b/target/riscv/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/runstate.h"
 #include "hw/riscv/numa.h"
 
+void riscv_kvm_aplic_request(void *opaque, int irq, int level)
+{
+    kvm_set_irq(kvm_state, irq, !!level);
+}
+
 static uint64_t kvm_riscv_reg_id(CPURISCVState *env, uint64_t type,
                                  uint64_t idx)
 {
-- 
2.41.0

From: Robbin Ehn <rehn@rivosinc.com>

This patch adds the new extensions in
linux 6.5 to the hwprobe syscall.

And fixes RVC check to OR with correct value.
The previous variable contains 0 therefore it
did work.

Signed-off-by: Robbin Ehn <rehn@rivosinc.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <bc82203b72d7efb30f1b4a8f9eb3d94699799dc8.camel@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/syscall.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
 #define RISCV_HWPROBE_KEY_IMA_EXT_0     4
 #define     RISCV_HWPROBE_IMA_FD       (1 << 0)
 #define     RISCV_HWPROBE_IMA_C        (1 << 1)
+#define     RISCV_HWPROBE_IMA_V        (1 << 2)
+#define     RISCV_HWPROBE_EXT_ZBA      (1 << 3)
+#define     RISCV_HWPROBE_EXT_ZBB      (1 << 4)
+#define     RISCV_HWPROBE_EXT_ZBS      (1 << 5)
 
 #define RISCV_HWPROBE_KEY_CPUPERF_0     5
 #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
@@ -XXX,XX +XXX,XX @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
                     riscv_has_ext(env, RVD) ?
                     RISCV_HWPROBE_IMA_FD : 0;
             value |= riscv_has_ext(env, RVC) ?
-                     RISCV_HWPROBE_IMA_C : pair->value;
+                     RISCV_HWPROBE_IMA_C : 0;
+            value |= riscv_has_ext(env, RVV) ?
+                     RISCV_HWPROBE_IMA_V : 0;
+            value |= cfg->ext_zba ?
+                     RISCV_HWPROBE_EXT_ZBA : 0;
+            value |= cfg->ext_zbb ?
+                     RISCV_HWPROBE_EXT_ZBB : 0;
+            value |= cfg->ext_zbs ?
+                     RISCV_HWPROBE_EXT_ZBS : 0;
             __put_user(value, &pair->value);
             break;
         case RISCV_HWPROBE_KEY_CPUPERF_0:
-- 
2.41.0

From: Ard Biesheuvel <ardb@kernel.org>

Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
implement the first half of the key schedule derivation. This does not
actually involve shifting rows, so clone the same value into all four
columns of the AES vector to counter that operation.

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20230831154118.138727-1-ardb@kernel.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/crypto_helper.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
 
     uint8_t enc_rnum = rnum;
     uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
-    uint8_t rcon_ = 0;
-    target_ulong result;
+    AESState t, rc = {};
 
     if (enc_rnum != 0xA) {
         temp = ror32(temp, 8); /* Rotate right by 8 */
-        rcon_ = round_consts[enc_rnum];
+        rc.w[0] = rc.w[1] = round_consts[enc_rnum];
     }
 
-    temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
-           ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
-           ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
-           ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
+    t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
+    aesenc_SB_SR_AK(&t, &t, &rc, false);
 
-    temp ^= rcon_;
-
-    result = ((uint64_t)temp << 32) | temp;
-
-    return result;
+    return t.d[0];
 }
 
 target_ulong HELPER(aes64im)(target_ulong rs1)
-- 
2.41.0

From: Akihiko Odaki <akihiko.odaki@daynix.com>

riscv_trigger_init() had been called on reset events that can happen
several times for a CPU and it allocated timers for itrigger. If old
timers were present, they were simply overwritten by the new timers,
resulting in a memory leak.

Divide riscv_trigger_init() into two functions, namely
riscv_trigger_realize() and riscv_trigger_reset() and call them in
appropriate timing. The timer allocation will happen only once for a
CPU in riscv_trigger_realize().

Fixes: 5a4ae64cac ("target/riscv: Add itrigger support when icount is enabled")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230818034059.9146-1-akihiko.odaki@daynix.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/debug.h |  3 ++-
 target/riscv/cpu.c   |  8 +++++++-
 target/riscv/debug.c | 15 ++++++++++++---
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/target/riscv/debug.h b/target/riscv/debug.h
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.h
+++ b/target/riscv/debug.h
@@ -XXX,XX +XXX,XX @@ void riscv_cpu_debug_excp_handler(CPUState *cs);
 bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp);
 
-void riscv_trigger_init(CPURISCVState *env);
+void riscv_trigger_realize(CPURISCVState *env);
+void riscv_trigger_reset_hold(CPURISCVState *env);
 
 bool riscv_itrigger_enabled(CPURISCVState *env);
 void riscv_itrigger_update_priv(CPURISCVState *env);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj)
 
 #ifndef CONFIG_USER_ONLY
     if (cpu->cfg.debug) {
-        riscv_trigger_init(env);
+        riscv_trigger_reset_hold(env);
     }
 
     if (kvm_enabled()) {
@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_realize(DeviceState *dev, Error **errp)
 
     riscv_cpu_register_gdb_regs_for_features(cs);
 
+#ifndef CONFIG_USER_ONLY
+    if (cpu->cfg.debug) {
+        riscv_trigger_realize(&cpu->env);
+    }
+#endif
+
     qemu_init_vcpu(cs);
     cpu_reset(cs);
 
diff --git a/target/riscv/debug.c b/target/riscv/debug.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/debug.c
+++ b/target/riscv/debug.c
@@ -XXX,XX +XXX,XX @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
     return false;
 }
 
-void riscv_trigger_init(CPURISCVState *env)
+void riscv_trigger_realize(CPURISCVState *env)
+{
+    int i;
+
+    for (i = 0; i < RV_MAX_TRIGGERS; i++) {
+        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                              riscv_itrigger_timer_cb, env);
+    }
+}
+
+void riscv_trigger_reset_hold(CPURISCVState *env)
 {
     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
     int i;
@@ -XXX,XX +XXX,XX @@ void riscv_trigger_init(CPURISCVState *env)
         env->tdata3[i] = 0;
         env->cpu_breakpoint[i] = NULL;
         env->cpu_watchpoint[i] = NULL;
-        env->itrigger_timer[i] = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                              riscv_itrigger_timer_cb, env);
+        timer_del(env->itrigger_timer[i]);
     }
 }
-- 
2.41.0

From: Leon Schuermann <leons@opentitan.org>

When the rule-lock bypass (RLB) bit is set in the mseccfg CSR, the PMP
configuration lock bits must not apply. While this behavior is
implemented for the pmpcfgX CSRs, this bit is not respected for
changes to the pmpaddrX CSRs. This patch ensures that pmpaddrX CSR
writes work even on locked regions when the global rule-lock bypass is
enabled.

Signed-off-by: Leon Schuermann <leons@opentitan.org>
Reviewed-by: Mayuresh Chitale <mchitale@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230829215046.1430463-1-leon@is.currently.online>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t pmp_get_a_field(uint8_t cfg)
  */
 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
 {
+    /* mseccfg.RLB is set */
+    if (MSECCFG_RLB_ISSET(env)) {
+        return 0;
+    }
 
     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
         return 1;
-- 
2.41.0

From: Tommy Wu <tommy.wu@sifive.com>

According to the new spec, when vsiselect has a reserved value, attempts
from M-mode or HS-mode to access vsireg, or from VS-mode to access
sireg, should preferably raise an illegal instruction exception.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-ID: <20230816061647.600672-1-tommy.wu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static int rmw_iprio(target_ulong xlen,
 static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                      target_ulong new_val, target_ulong wr_mask)
 {
-    bool virt;
+    bool virt, isel_reserved;
     uint8_t *iprio;
     int ret = -EINVAL;
     target_ulong priv, isel, vgein;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
 
     /* Decode register details from CSR number */
     virt = false;
+    isel_reserved = false;
     switch (csrno) {
     case CSR_MIREG:
         iprio = env->miprio;
@@ -XXX,XX +XXX,XX @@ static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
                                                   riscv_cpu_mxl_bits(env)),
                                     val, new_val, wr_mask);
         }
+    } else {
+        isel_reserved = true;
     }
 
 done:
     if (ret) {
-        return (env->virt_enabled && virt) ?
+        return (env->virt_enabled && virt && !isel_reserved) ?
                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
     }
     return RISCV_EXCP_NONE;
-- 
2.41.0

From: Nikita Shubin <n.shubin@yadro.com>

As per ISA:

"For CSRRWI, if rd=x0, then the instruction shall not read the CSR and
shall not cause any of the side effects that might occur on a CSR read."

trans_csrrwi() and trans_csrrw() call do_csrw() if rd=x0, do_csrw() calls
riscv_csrrw_do64(), via helper_csrw() passing NULL as *ret_value.

Signed-off-by: Nikita Shubin <n.shubin@yadro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20230808090914.17634-1-nikita.shubin@maquefel.me>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -XXX,XX +XXX,XX @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
                                        target_ulong write_mask)
 {
     RISCVException ret;
-    target_ulong old_value;
+    target_ulong old_value = 0;
 
     /* execute combined read/write operation if it exists */
     if (csr_ops[csrno].op) {
         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
     }
 
-    /* if no accessor exists then return failure */
-    if (!csr_ops[csrno].read) {
-        return RISCV_EXCP_ILLEGAL_INST;
-    }
-    /* read old value */
-    ret = csr_ops[csrno].read(env, csrno, &old_value);
-    if (ret != RISCV_EXCP_NONE) {
-        return ret;
+    /*
+     * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
+     * and we can't throw side effects caused by CSR reads.
+     */
+    if (ret_value) {
+        /* if no accessor exists then return failure */
+        if (!csr_ops[csrno].read) {
+            return RISCV_EXCP_ILLEGAL_INST;
+        }
+        /* read old value */
+        ret = csr_ops[csrno].read(env, csrno, &old_value);
+        if (ret != RISCV_EXCP_NONE) {
+            return ret;
+        }
     }
 
     /* write value if writable and write mask set, otherwise drop writes */
-- 
2.41.0